fix postfix hopefully

bin/backup_browse_old.sh

@@ -1,203 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# --- SUDO CHECK ---
-if [ "$EUID" -ne 0 ]; then
-    echo "This script requires root privileges. Re-running with sudo..."
-    exec sudo "$0" "$@"
-fi
-
-# --- HANDLE OPTIONS ---
-BORG_PASSPHRASE=""
-SHOW_FOLDERS_ONLY=false
-SHOW_FILES=false  # Default to showing files and directories
-
-while getopts "k:fp" opt; do
-    case "$opt" in
-        k)
-            BORG_PASSPHRASE=$(<"$OPTARG")
-            if [ -z "$BORG_PASSPHRASE" ]; then
-                echo "Error: The key file is empty."
-                exit 1
-            fi
-            echo "Using passphrase from key file: $OPTARG"
-            ;;
-        f)
-            SHOW_FOLDERS_ONLY=true
-            echo "Only directories will be shown in fzf by default."
-            SHOW_FILES=false
-            ;;
-        p)
-            SHOW_FILES=true
-            echo "Both files and directories will be shown in fzf."
-            ;;
-        *)
-            echo "Usage: $0 [-k passphrase_file] [-f] [-p] <repo>"
-            exit 1
-            ;;
-    esac
-done
-shift $((OPTIND - 1))
-
-# --- FALLBACK TO /run/secrets/borg_passwd IF NO KEY FILE ---
-if [ -z "$BORG_PASSPHRASE" ]; then
-    if [ $# -eq 0 ]; then
-        BORG_PASSPHRASE=$(<"/run/secrets/borg_passwd")
-        echo "Using passphrase from /run/secrets/borg_passwd"
-    else
-        # Prompt user for passphrase if neither -k nor /run/secrets/borg_passwd is available
-        read -s -p "Enter Borg repository passphrase: " BORG_PASSPHRASE
-        echo
-    fi
-fi
-
-export BORG_PASSPHRASE
-
-# --- DEFAULT REPO ---
-REPO="${1:-/holocron/archives/servers/snowbelle}"
-
-# --- CHECK REQUIRED COMMANDS ---
-for cmd in borg fzf find tree cp mkdir; do
-    command -v "$cmd" >/dev/null || { echo "Error: '$cmd' is required but not installed."; exit 1; }
-done
-
-# --- LIST ARCHIVES (sorted, newest last) ---
-mapfile -t archives < <(borg list --format="{archive}{NL}" "$REPO" | sort -r)
-if [ ${#archives[@]} -eq 0 ]; then
-    echo "No archives found in $REPO"
-    exit 1
-fi
-
-# --- FZF ARCHIVE SELECT ---
-selected=$(printf '%s\n' "${archives[@]}" | fzf --prompt="Select archive: " --height=40% --border)
-if [ -z "$selected" ]; then
-    echo "No archive selected."
-    exit 1
-fi
-echo "Selected archive: $selected"
-
-# --- GENERATE A UNIQUE, SHORTER MOUNT POINT ---
-MOUNT_POINT="/tmp/$(uuidgen | sha256sum | head -c 2)-restore-${selected}"
-mkdir -p "$MOUNT_POINT"
-
-# --- MOUNT ARCHIVE ---
-echo "Mounting '$selected' to $MOUNT_POINT..."
-borg mount "$REPO::$selected" "$MOUNT_POINT"
-
-if [ ! -d "$MOUNT_POINT" ]; then
-    echo "Error: mount failed."
-    exit 1
-fi
-
-# --- LIST FILES AND DIRECTORIES ---
-echo "Scanning files and directories..."
-if command -v fd >/dev/null 2>&1; then
-    # List both files and directories with fd
-    if [ "$SHOW_FILES" = true ]; then
-        files=$(fd . "$MOUNT_POINT" | sort)  # Show both files and directories
-    else
-        files=$(fd --type d . "$MOUNT_POINT" | sort)  # Only directories
-    fi
-else
-    # Fall back to find if fd is not available
-    if [ "$SHOW_FILES" = true ]; then
-        files=$(find "$MOUNT_POINT" | sort)  # Show both files and directories
-    else
-        files=$(find "$MOUNT_POINT" -type d | sort)  # Only directories
-    fi
-fi
-
-if [ -z "$files" ]; then
-    echo "No files or directories found in archive."
-    borg umount "$MOUNT_POINT"
-    rm -rf "$MOUNT_POINT"
-    exit 1
-fi
-
-# --- FZF FILE/DIRECTORY SELECTION ---
-if [ "$SHOW_FILES" = true ]; then
-    # If showing files and directories, we pass everything to fzf
-    selected_items=$(printf '%s\n' "$files" | sed "s|$MOUNT_POINT/||" | tac | fzf \
-        --multi \
-        --height=50% \
-        --border \
-        --prompt="Select files or directories to restore: " \
-        --preview "tree -C -L 5 $MOUNT_POINT/$(dirname {})" \
-        --preview-window=right:50% \
-        --delimiter='/' \
-        --with-nth=1..)
-else
-    # If only showing directories, pass directories to fzf
-    selected_items=$(printf '%s\n' "$files" | sed "s|$MOUNT_POINT/||" | tac | fzf \
-        --multi \
-        --height=50% \
-        --border \
-        --prompt="Select directories to restore: " \
-        --preview "tree -C -d -L 3 $MOUNT_POINT/$(dirname {})" \
-        --preview-window=right:50% \
-        --delimiter='/' \
-        --with-nth=1..)
-fi
-
-if [ -z "$selected_items" ]; then
-    echo "No items selected. Exiting."
-    borg umount "$MOUNT_POINT"
-    rm -rf "$MOUNT_POINT"
-    exit 0
-fi
-
-# --- SUMMARY OF SELECTED ITEMS ---
-echo "Selected items:"
-for item in $selected_items; do
-    echo "  $item"
-done
-
-# --- OPTIONS MENU (concise) ---
-# Default to option 1 if no input is given
-echo "Select restore destination: 1) Restore to ./${selected}_restore  2) Restore to original dirs  3) Quit"
-read -p "Enter your choice (1/2/3) [default: 1]: " choice
-# Default to option 1 if user presses Enter without providing input
-choice="${choice:-1}"
-
-# --- SET RESTORE DESTINATION BASED ON USER CHOICE ---
-case "$choice" in
-    1)
-        DEST="./${selected}_restore"
-        ;;
-    2)
-        DEST="$MOUNT_POINT"
-        ;;
-    3)
-        echo "Quitting. No items restored."
-        borg umount "$MOUNT_POINT"
-        rm -rf "$MOUNT_POINT"
-        exit 0
-        ;;
-    *)
-        echo "Invalid choice. Exiting."
-        borg umount "$MOUNT_POINT"
-        rm -rf "$MOUNT_POINT"
-        exit 1
-        ;;
-esac
-
-mkdir -p "$DEST"
-
-# --- RESTORE SELECTED ITEMS (FILES OR DIRECTORIES) ---
-echo "Restoring selected items..."
-while IFS= read -r item; do
-    dest_path="$DEST/$item"
-    mkdir -p "$(dirname "$dest_path")"
-    if [ -d "$MOUNT_POINT/$item" ]; then
-        cp -r "$MOUNT_POINT/$item" "$dest_path"
-    else
-        cp -a "$MOUNT_POINT/$item" "$dest_path"
-    fi
-    echo "Restored: $item"
-done <<< "$selected_items"
-
-# --- CLEANUP ---
-borg umount "$MOUNT_POINT"
-rm -rf "$MOUNT_POINT"
-echo "Restore complete."
-

bin/borg_lf.sh

@@ -1,99 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# --- SUDO CHECK ---
-if [ "$EUID" -ne 0 ]; then
-    echo "This script requires root privileges. Re-running with sudo..."
-    exec sudo "$0" "$@"
-fi
-
-# --- HANDLE OPTIONS ---
-BORG_PASSPHRASE=""
-SHOW_FOLDERS_ONLY=false
-SHOW_FILES=false  # Default to showing files and directories
-
-while getopts "k:fp" opt; do
-    case "$opt" in
-        k)
-            BORG_PASSPHRASE=$(<"$OPTARG")
-            if [ -z "$BORG_PASSPHRASE" ]; then
-                echo "Error: The key file is empty."
-                exit 1
-            fi
-            echo "Using passphrase from key file: $OPTARG"
-            ;;
-        f)
-            SHOW_FOLDERS_ONLY=true
-            echo "Only directories will be shown in fzf by default."
-            SHOW_FILES=false
-            ;;
-        p)
-            SHOW_FILES=true
-            echo "Both files and directories will be shown in fzf."
-            ;;
-        *)
-            echo "Usage: $0 [-k passphrase_file] [-f] [-p] <repo>"
-            exit 1
-            ;;
-    esac
-done
-shift $((OPTIND - 1))
-
-# --- FALLBACK TO /run/secrets/borg_passwd IF NO KEY FILE ---
-if [ -z "$BORG_PASSPHRASE" ]; then
-    if [ $# -eq 0 ]; then
-        BORG_PASSPHRASE=$(<"/run/secrets/borg_passwd")
-        echo "Using passphrase from /run/secrets/borg_passwd"
-    else
-        # Prompt user for passphrase if neither -k nor /run/secrets/borg_passwd is available
-        read -s -p "Enter Borg repository passphrase: " BORG_PASSPHRASE
-        echo
-    fi
-fi
-
-export BORG_PASSPHRASE
-
-# --- DEFAULT REPO ---
-REPO="${1:-/holocron/archives/servers/snowbelle}"
-
-# --- CHECK REQUIRED COMMANDS ---
-for cmd in borg fzf find tree cp mkdir; do
-    command -v "$cmd" >/dev/null || { echo "Error: '$cmd' is required but not installed."; exit 1; }
-done
-
-# --- LIST ARCHIVES (sorted, newest last) ---
-mapfile -t archives < <(borg list --format="{archive}{NL}" "$REPO" | sort -r)
-if [ ${#archives[@]} -eq 0 ]; then
-    echo "No archives found in $REPO"
-    exit 1
-fi
-
-# --- FZF ARCHIVE SELECT ---
-selected=$(printf '%s\n' "${archives[@]}" | fzf --prompt="Select archive: " --height=40% --border)
-if [ -z "$selected" ]; then
-    echo "No archive selected."
-    exit 1
-fi
-echo "Selected archive: $selected"
-
-# --- GENERATE A UNIQUE, SHORTER MOUNT POINT ---
-MOUNT_POINT="/tmp/$(uuidgen | sha256sum | head -c 2)-restore-${selected}"
-mkdir -p "$MOUNT_POINT"
-
-# --- MOUNT ARCHIVE ---
-echo "Mounting '$selected' to $MOUNT_POINT..."
-borg mount "$REPO::$selected" "$MOUNT_POINT"
-
-cleanup() {
-  echo "Unmounting archive..."
-  borg umount "$MOUNT_POINT" >/dev/null 2>&1 || true
-  rmdir "$MOUNT_POINT" >/dev/null 2>&1 || true
-}
-trap cleanup EXIT INT TERM
-
-if [ ! -d "$MOUNT_POINT" ]; then
-    echo "Error: mount failed."
-    exit 1
-fi
-
-lf $MOUNT_POINT

bin/rebuild

@@ -26,6 +26,8 @@ echo "files:"
 git status --short
 read -rp "commit message: " commit_msg
 echo "rebuilding nixos with flake.nix..."
+#if ! sudo nixos-rebuild switch --flake .#"$hostname" 2>&1 | tee "$logfile"; then
+#if ! nh os switch 2>&1 | tee "$logfile"; then
 if ! sudo nixos-rebuild switch --flake .#"$hostname" 2>&1 | tee "$logfile"; then
     echo "rebuild failed; exited with no commit"
     exit 1

bin/rebuild_legacy.sh

@@ -1,26 +0,0 @@
-#!/usr/bin/env bash
-set -e
-pushd ~/.nix
-# nvim flake.nix
-# alejandra . &>/dev/null
-# git diff -U0 *.nix
-
-# add generation comment to flake.nix
-gen=$(nixos-rebuild list-generations | grep current)
-if sed -n '3p' flake.nix | grep -q '^# generation:'; then
-    # replace the comment on line 3
-    sed -i "3s/^# generation:.*/# generation: $gen/" flake.nix
-else
-    # insert comment on line 3
-    sed -i "3i# generation: $gen" flake.nix
-fi
-
-git diff -U0 $(find . -name '*.nix')
-
-echo "nixos rebuilding..."
-#sudo nixos-rebuild switch --flake ~/.nix#snowbelle &>.nixos-switch-log || (
-# cat .nixos-switch-log | grep --color error && false)
-sudo nixos-rebuild switch --flake ~/.nix#snowbelle 2>&1 | tee .nixos-switch-log | grep --color=always -E "error|$" && true
-
-git commit -am "$gen"
-popd

flake.nix

@@ -4,14 +4,14 @@
 {
   description = "blakes nix config";
   inputs = {
-    nixpkgs.url = "nixpkgs/nixos-25.05";
+    nixpkgs.url = "nixpkgs/nixos-25.11";
     nixpkgs-unstable.url = "nixpkgs/nixos-unstable";
     nix-darwin = {
-      url = "github:LnL7/nix-darwin";
-      inputs.nixpkgs.follows = "nixpkgs";
+      url = "github:nix-darwin/nix-darwin/master";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
     };
     home-manager = {
-      url = "github:nix-community/home-manager/release-25.05";
+      url = "github:nix-community/home-manager/release-25.11";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     home-manager-unstable = {
@@ -19,6 +19,7 @@
       inputs.nixpkgs.follows = "nixpkgs-unstable";
     };
     nix-homebrew.url = "github:zhaofengli/nix-homebrew";
+    nix-flatpak.url = "github:gmodena/nix-flatpak/?ref=latest";
     sops-nix = {
       url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -27,6 +28,14 @@
       url = "github:nix-community/disko/latest";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    lanzaboote = {
+      url = "github:nix-community/lanzaboote/v0.4.3";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    watershot = {
+      url = "github:Kirottu/watershot";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     vpn-confinement = {
       url = "github:Maroka-chan/VPN-Confinement";
     };
@@ -35,7 +44,7 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     autoaspm = {
-      url = "github:notthebee/AutoASPM";
+      url = "git+https://git.notthebe.ee/notthebee/AutoASPM.git";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     stylix = {
@@ -43,6 +52,10 @@
       inputs.nixpkgs.follows = "nixpkgs-unstable";
     };
     copyparty.url = "github:9001/copyparty";
+    slippi = {
+      url = "github:lytedev/slippi-nix";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
+    };
   };
   outputs = {
     self,
@@ -74,9 +87,19 @@
         specialArgs = {inherit inputs stable_pkgs unstable_pkgs;};
         modules = [
           ./hosts/nixos/yveltal/configuration.nix
+          ./hosts/nixos/yveltal/disko.nix
+          inputs.home-manager-unstable.nixosModules.default
+          inputs.disko.nixosModules.disko
+        ];
+      };
+      mew = nixpkgs-unstable.lib.nixosSystem {
+        system = systems.x86_64;
+        specialArgs = {inherit inputs stable_pkgs unstable_pkgs;};
+        modules = [
+          ./hosts/nixos/mew/configuration.nix
+          ./hosts/nixos/mew/disko.nix
           inputs.home-manager-unstable.nixosModules.default
           inputs.disko.nixosModules.disko
-          ./hosts/nixos/yveltal/disko.nix
         ];
       };
       vaniville = nixpkgs.lib.nixosSystem {
@@ -93,14 +116,15 @@
         system = systems.darwin;
         specialArgs = {inherit inputs stable_pkgs unstable_pkgs nix-homebrew;};
         modules = [
-          ./hosts/darwin/cen-it-07/configuration.nix
+          #./hosts/darwin/cen-it-07/configuration.nix
           inputs.home-manager.darwinModules.default
           nix-homebrew.darwinModules.nix-homebrew
           {
             nix-homebrew = {
               enable = true;  # install homebrew
               enableRosetta = true;   # install homebrew for rosetta as well
-              user = "blake";  # user owning homebrew prefix
+              autoMigrate = true;
+              user = "bhelderman";  # user owning homebrew prefix
             };
           }
         ];

hosts/nixos/default.nix

@@ -5,47 +5,78 @@
   inputs,
   ...
 }: {
-
   imports = [
     inputs.autoaspm.nixosModules.default
   ];
 
+  # set timezone
+  time.timeZone = "America/Chicago";
+
+  nix = {
+    # garbage collect & remove builds older then 14 days
+    gc = {
+      automatic = true;
+      dates = "daily";
+      options = "--delete-older-than 14d";
+      persistent = true;
+    };
+    # optimise nix store, dedupe and such
+    optimise = {
+      automatic = true;
+      dates = [ "daily" ];
+    };
+    # the goats
+    settings = {
+      substituters = [
+        "https://cache.nixos.org"
+      ];
+      trusted-public-keys = [
+      ];
+      experimental-features = lib.mkDefault [
+        "nix-command"
+        "flakes"
+      ];
+    };
+  };
+
+  # allow proprietary packages
+  nixpkgs = {
+    config = {
+      allowUnfree = true;
+      allowUnfreePredicate = _: true;
+    };
+  };
+
+  # power management
+  services.autoaspm.enable = true;
+  powerManagement.powertop.enable = true;
+
+  # things are better this way
+  users.defaultUserShell = pkgs.zsh;
+
   # base system package install list
   environment.systemPackages = with pkgs; [
     wget
     curl
     dig
+    nmap
     rsync
+    iperf3
+    jq
     git
     age
-    fzf
-    cifs-utils
-    neofetch
-    usbutils
-    pciutils
-    python3
     vim
-    lf
+    ncdu
     btop
     powertop
-    dig
+    iotop
+    cifs-utils
+    usbutils
+    pciutils
+    lm_sensors
   ];
 
-  # set timezone
-  time.timeZone = "America/Chicago";
-
-  # allow proprietary packages
-  nixpkgs.config.allowUnfree = true;
-
-  # power management
-  services.autoaspm.enable = true;
-  powerManagement.powertop.enable = true;
-
-  # enable flakes
-  nix.settings.experimental-features = ["nix-command" "flakes"];
-  users.defaultUserShell = pkgs.zsh;
-
-  # passwordless rebuild
+  # nice to have passwordless sudo
   security.sudo = {
     extraRules = [
       {
@@ -67,6 +98,18 @@
             command = "/run/current-system/sw/bin/tailscale";
             options = ["NOPASSWD"];
           }
+          {
+            command = "/etc/profiles/per-user/blake/bin/nom";
+            options = ["NOPASSWD"];
+          }
+          {
+            command = "/etc/profiles/per-user/blake/bin/nom-build";
+            options = ["NOPASSWD"];
+          }
+          {
+            command = "/etc/profiles/per-user/blake/bin/nom-shell";
+            options = ["NOPASSWD"];
+          }
         ];
       }
     ];

hosts/nixos/froakie/disko.nix

@@ -0,0 +1,70 @@
+{
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = ""; # disk id here
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            luks = {
+              size = "100%";
+              content = {
+                type = "luks";
+                name = "crypted";
+                # disable settings.keyFile if you want to use interactive password entry
+                #passwordFile = "/tmp/secret.key"; # Interactive
+                settings = {
+                  allowDiscards = true;
+                  #keyFile = "/tmp/secret.key";
+                };
+                #additionalKeyFiles = [ "/tmp/additionalSecret.key" ];
+                content = {
+                  type = "btrfs";
+                  extraArgs = [ "-f" ];
+                  subvolumes = {
+                    "@root" = {
+                      mountpoint = "/";
+                      mountOptions = [
+                        "compress=zstd"
+                        "noatime"
+                      ];
+                    };
+                    "@home" = {
+                      mountpoint = "/home";
+                      mountOptions = [
+                        "compress=zstd"
+                        "noatime"
+                      ];
+                    };
+                    "@nix" = {
+                      mountpoint = "/nix";
+                      mountOptions = [
+                        "compress=zstd"
+                        "noatime"
+                      ];
+                    };
+                    "@swap" = {
+                      mountpoint = "/.swapvol";
+                      swap.swapfile.size = "32G";
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/nixos/mew/configuration.nix

@@ -0,0 +1,113 @@
+{
+  pkgs,
+  config,
+  lib,
+  modulesPath,
+  inputs,
+  stable_pkgs,
+  unstable_pkgs,
+  ...
+}: {
+  imports = [
+    # Include the results of the hardware scan.
+    (modulesPath + "/installer/scan/not-detected.nix")
+    #./hardware-configuration.nix
+    ../../nixos
+    ../../../users/blake
+    ../../../modules/desktop
+    ../../../modules/system
+  ];
+
+  # home grown nixos modules
+  system = {
+    secure_boot.enable = false;
+    cifs_mounts.enable = true;
+    udiskie.enable = true;
+    ssh.enable = true;
+    sops.enable = true;
+    japanese.enable = true;
+    yubikey.enable = true;
+    yubikey.lock_on_remove = false;
+    tailscale.enable = true;
+    syncthing.enable = true;
+    flatpak.enable = true;
+    graphics = {
+      enable = true;
+      vendor = "amd";
+    };
+  };
+  desktop = {
+    pipewire.enable = true;
+    hypr.enable = true;
+    greetd.enable = true;
+  };
+  gaming = {
+    steam.enable = true;
+    lutris.enable = true;
+    proton_ge.enable = true;
+    gamemode.enable = true;
+    mangohud.enable = true;
+  };
+
+  # import home grown host specific home-manager modules
+  home-manager.users.blake.imports = [
+    ../../../users/blake/hosts/yveltal.nix
+  ];
+
+  # fix power buttons
+  # move this to a laptops file at some point
+  services.logind.settings.Login = {
+    HandlePowerKey = "suspend-then-hibernate";
+    HandleLidSwitch = "suspend-then-hibernate";
+  };
+  # sets the delay before hibernation for ^
+  systemd.sleep.extraConfig = ''
+    HibernateDelaySec=1800
+  '';
+
+  # boot (systemd is growing on me)
+  boot = {
+    kernelModules = [ "kvm-amd" ];
+    extraModulePackages = [];
+    loader = {
+      systemd-boot.enable = true; # systemd your pretty cool ya know
+      efi.canTouchEfiVariables = true;
+    };
+    initrd = {
+      systemd.enable = true; # better logging
+      availableKernelModules = ["xhci_pci" "thunderbolt" "vmd" "nvme" "usb_storage" "sd_mod" "ahci"];
+      kernelModules = [];
+    };
+  };
+
+  # setup hostname and networking stack
+  networking = {
+    hostName = "mew"; # hostname
+    useDHCP = lib.mkDefault true;
+    interfaces = {
+      wlp7s0.useDHCP = lib.mkDefault true;
+    };
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [22];
+      allowedUDPPorts = [51820]; # wireguard
+    };
+    networkmanager = {
+      enable = true; # the goat
+      dns = "systemd-resolved"; # the backup dancer!
+    };
+  };
+  services.resolved = {
+    enable = true;
+    fallbackDns = ["1.1.1.1" "9.9.9.9"];
+    dnsovertls = "opportunistic";
+  };
+
+  hardware.bluetooth.enable = true;
+
+  system.stateVersion = "25.05"; # stays here :   )
+
+  # hardware shit
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/nixos/mew/disko.nix

@@ -0,0 +1,70 @@
+{
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/disk/by-id/nvme-MTFDHBA512TDV-1AZ1AABHA_UJUND0170FW7O0"; # disk id here
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            luks = {
+              size = "100%";
+              content = {
+                type = "luks";
+                name = "crypted";
+                # disable settings.keyFile if you want to use interactive password entry
+                #passwordFile = "/tmp/secret.key"; # Interactive
+                settings = {
+                  allowDiscards = true;
+                  #keyFile = "/tmp/secret.key";
+                };
+                #additionalKeyFiles = [ "/tmp/additionalSecret.key" ];
+                content = {
+                  type = "btrfs";
+                  extraArgs = [ "-f" ];
+                  subvolumes = {
+                    "@root" = {
+                      mountpoint = "/";
+                      mountOptions = [
+                        "compress=zstd"
+                        "noatime"
+                      ];
+                    };
+                    "@home" = {
+                      mountpoint = "/home";
+                      mountOptions = [
+                        "compress=zstd"
+                        "noatime"
+                      ];
+                    };
+                    "@nix" = {
+                      mountpoint = "/nix";
+                      mountOptions = [
+                        "compress=zstd"
+                        "noatime"
+                      ];
+                    };
+                    "@swap" = {
+                      mountpoint = "/.swapvol";
+                      swap.swapfile.size = "32G";
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/nixos/snowbelle/configuration.nix

@@ -14,11 +14,12 @@ in
       ../../../modules/holocron
       ../../../modules/homelab
       ../../../modules/gameservers/minecraft_recpro
+      ../../../modules/gameservers/minecraft_modded
     ];
 
-#      home-manager.users.blake.imports = [
-#      ../../../users/blake/hosts/snowbelle.nix
-#      ];
+  home-manager.users.blake.imports = [
+  ../../../users/blake/hosts/snowbelle.nix
+  ];
 
   system = {
     ssh.enable = true;
@@ -66,6 +67,7 @@ in
   };
   gameservers = {
     minecraft_recpro.enable = true;
+    minecraft_modded.enable = true;
   };
 
   # boot (systemd is going on me)

hosts/nixos/yveltal/configuration.nix

@@ -1,8 +1,15 @@
-{ config, lib, modulesPath, inputs, stable_pkgs, unstable_pkgs, ... }:
-
 {
-  imports =
-    [ # Include the results of the hardware scan.
+  pkgs,
+  config,
+  lib,
+  modulesPath,
+  inputs,
+  stable_pkgs,
+  unstable_pkgs,
+  ...
+}: {
+  imports = [
+    # Include the results of the hardware scan.
     (modulesPath + "/installer/scan/not-detected.nix")
     #./hardware-configuration.nix
     ../../nixos
@@ -11,28 +18,28 @@
     ../../../modules/system
   ];
 
-  home-manager.users.blake.imports = [
-  ../../../users/blake/hosts/yveltal.nix
-  ];
-
+  # home grown nixos modules
   system = {
+    secure_boot.enable = true;
+    cifs_mounts.enable = true;
+    udiskie.enable = true;
     ssh.enable = true;
     sops.enable = true;
     yubikey.enable = true;
+    yubikey.lock_on_remove = true;
     tailscale.enable = true;
     syncthing.enable = true;
+    flatpak.enable = true;
     graphics = {
       enable = true;
       vendor = "intel";
     };
   };
-
   desktop = {
     pipewire.enable = true;
     hypr.enable = true;
     greetd.enable = true;
   };
-
   gaming = {
     steam.enable = true;
     lutris.enable = true;
@@ -41,7 +48,13 @@
     mangohud.enable = true;
   };
 
+  # import home grown host specific home-manager modules
+  home-manager.users.blake.imports = [
+    ../../../users/blake/hosts/yveltal.nix
+  ];
+
   # fix power buttons
+  # move this to a laptops file at some point
   services.logind.settings.Login = {
     HandlePowerKey = "suspend-then-hibernate";
     HandleLidSwitch = "suspend-then-hibernate";
@@ -67,39 +80,33 @@
   };
 
   # setup hostname and networking stack
-  services.resolved = {
-    enable = true;
-    fallbackDns = [ "1.1.1.1" "9.9.9.9" ];
-    dnsovertls = "opportunistic";
-  };
   networking = {
     hostName = "yveltal"; # hostname
     useDHCP = lib.mkDefault true;
     interfaces = {
       wlp0s20f3.useDHCP = lib.mkDefault true;
     };
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [22];
+      allowedUDPPorts = [51820]; # wireguard
+    };
     networkmanager = {
       enable = true; # the goat
       dns = "systemd-resolved"; # the backup dancer!
     };
   };
+  services.resolved = {
+    enable = true;
+    fallbackDns = ["1.1.1.1" "9.9.9.9"];
+    dnsovertls = "opportunistic";
+  };
 
   hardware.bluetooth.enable = true;
 
-  # Open ports in the firewall.
-  networking.firewall.allowedTCPPorts = [
-    22
-  ];
-
-  networking.firewall.allowedUDPPorts = [ 51820 ];
-  # Or disable the firewall altogether.
-  networking.firewall.enable = true;
-
   system.stateVersion = "25.05"; # stays here :   )
 
-
   # hardware shit
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
-

modules/desktop/gaming/default.nix

@@ -1,10 +1,12 @@
 {
   pkgs,
   config,
+  inputs,
   lib,
   ...
 }: {
   imports = [
+    inputs.slippi.nixosModules.default # gcc drivers
     ./steam
     ./lutris
     ./proton_ge

modules/desktop/gaming/lutris/default.nix

@@ -13,6 +13,7 @@ in {
   config = lib.mkIf cfg.enable {
     environment.systemPackages = with pkgs; [
       lutris
+      wine
     ];
   };
 }

modules/desktop/gaming/steam/default.nix

@@ -13,9 +13,10 @@ in {
   config = lib.mkIf cfg.enable {
     programs.steam = {
       enable = true;
-      gamescopeSession.enable = true; # requires setting launch option `gamescope %command%`
+      gamescopeSession.enable = true; # requires setting launch option `gamescope <options> -- %command%`
       remotePlay.openFirewall = true; # open ports for remote play
       #dedicatedServer.openFirewall = true; # open ports for source dedicated server
+      protontricks.enable = true;
     };
   };
 }

modules/desktop/hypr/default.nix

@@ -15,6 +15,8 @@ in {
     programs.hyprland.enable = true;
 
     # give hyprlock perms to unlock
-    security.pam.services.hyprlock = {};
+    security.pam.services.hyprlock = {
+      enable = true;
+    };
   };
 }

modules/gameservers/minecraft_modded/default.nix

@@ -0,0 +1,156 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "minecraft_modded";
+  cfg = config.gameservers.${service};
+  sec = config.sops.secrets;
+  servers = {
+    cobblemon = {
+      data_dir = "/var/lib/gameservers/minecraft_modded/cobblemon";
+      start_file = "start.sh";
+    };
+  };
+in {
+  options.gameservers.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+    url = lib.mkOption {
+      type = lib.types.str;
+      default = "mc.recoil.pro";
+      description = "set domain for ${service}";
+    };
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/gameservers/${service}";
+      description = "set data directory for ${service}";
+    };
+    ids = lib.mkOption {
+      type = lib.types.int;
+      default = 25565;
+      description = "set uid and pid of ${service} user (matches port by default)";
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "enable backups for ${service}";
+    };
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = "velocity";
+    };
+    backup_repo = lib.mkOption {
+      type = lib.types.path;
+      default = "/holocron/archives/gameservers/minecraft/modded";
+      description = "path to take hourly backups to with borg!";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    # declare ${service} user
+    users.users.minecraft = lib.mkDefault {
+      description = "minecraft server user";
+      uid = lib.mkForce cfg.ids;
+      isSystemUser = true;
+      shell = pkgs.bash;
+      group = "minecraft";
+      extraGroups = [];
+    };
+
+    systemd.tmpfiles.rules =
+      lib.attrsets.mapAttrsToList (
+        name: cfg: "d ${cfg.data_dir} 0770 minecraft minecraft -"
+      )
+      servers;
+
+    # Create a systemd service per server running in tmux
+    systemd.services =
+      lib.attrsets.mapAttrs (name: srv: {
+        description = "minecraft_recpro: ${name}";
+        after = ["network.target"];
+        wants = ["network.target"];
+        serviceConfig = {
+          User = "minecraft";
+          Group = "minecraft";
+          WorkingDirectory = srv.data_dir;
+          UMask = "0007";
+          ExecStart = "${pkgs.openjdk21}/bin/java -Xms4G -Xmx12G -XX:+UseG1GC -XX:+ParallelRefProcEnabled -XX:MaxGCPauseMillis=200 -XX:+UnlockExperimentalVMOptions -XX:+AlwaysPreTouch -XX:G1NewSizePercent=30 -XX:G1MaxNewSizePercent=40 -XX:G1HeapRegionSize=8M -XX:G1ReservePercent=20 -XX:G1HeapWastePercent=5 -XX:G1MixedGCCountTarget=4 -XX:InitiatingHeapOccupancyPercent=15 -XX:G1MixedGCLiveThresholdPercent=90 -XX:G1RSetUpdatingPauseTimePercent=5 -XX:SurvivorRatio=32 -XX:+PerfDisableSharedMem -XX:MaxTenuringThreshold=1 -Dusing.aikars.flags=https://mcflags.emc.gs -Daikars.new.flags=true @libraries/net/neoforged/neoforge/21.1.211/unix_args.txt";
+          #ExecStart = "${srv.data_dir}/${srv.start_file}";
+          Restart = "on-failure";
+          KillMode = "process";
+        };
+        wantedBy = ["multi-user.target"];
+      })
+      servers;
+
+    environment.systemPackages = with pkgs; [openjdk21 mcrcon];
+
+    #    services.mysql = {
+    #      enable = true;
+    #      package = pkgs.mariadb;
+    #      ensureDatabases = ["minecraft_recpro_db"];
+    #      ensureUsers = [
+    #        {
+    #          name = "minecraft";
+    #          ensurePermissions = {"minecraft_recpro_db.*" = "ALL PRIVILEGES";};
+    #        }
+    #      ];
+    #      initialScript = pkgs.writeText "minecraft_recpro-init.sql" ''
+    #        CREATE USER IF NOT EXISTS 'minecraft_recpro'@'localhost' IDENTIFIED BY 'IKNOWTHISISBADIJUSTNEEDTHISTOWORKRNPLS';
+    #        GRANT ALL PRIVILEGES ON minecraft_recpro_db.* TO 'minecraft_recpro'@'localhost';
+    #        FLUSH PRIVILEGES;
+    #      '';
+    #    };
+
+    # open firewall
+    networking.firewall.allowedTCPPorts = [25778];
+
+    #    sops.secrets = {
+    #      "velocity_forwarding" = {
+    #        owner = "minecraft";
+    #        group = "minecraft";
+    #        path = "/var/lib/gameservers/minecraft_recpro/velocity/forwarding.secret";
+    #        mode = "0400";
+    #      };
+    #      "minecraft_recpro_db_passwd" = {
+    #        owner = "mysql";
+    #        group = "mysql";
+    #      };
+    #    };
+
+    # backups minecraft_recpro with borg!
+    services.borgbackup.jobs.${service} = {
+      archiveBaseName = service;
+      repo = cfg.backup_repo;
+      paths = lib.flatten (
+        lib.attrValues (
+          lib.mapAttrs (_: srv:
+            [srv.data_dir]
+            ++ (
+              if builtins.hasAttr "db_dump" srv
+              then [srv.db_dump]
+              else []
+            ))
+          servers
+        )
+      );
+      compression = "auto,zstd";
+      #preHook = "systemctl start mysql-backup.service";
+      startAt = "*-*-* *:00:00";
+      group = "archives";
+      encryption.mode = "repokey-blake2";
+      encryption.passCommand = "cat ${config.sops.secrets."borg_passwd".path}";
+      extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
+      extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
+      prune.keep = {
+        within = "1d"; # Keep all archives from the last day
+        hourly = 24;
+        daily = 7;
+        weekly = 12;
+        monthly = -1; # Keep at least one archive for each month
+      };
+    };
+  };
+}

modules/holocron/syncthing/default.nix

@@ -22,7 +22,7 @@ in {
       dataDir = "/var/lib/syncthing";
       guiAddress = "0.0.0.0:2222";
       openDefaultPorts = true;
-      extraFlags = ["--no-default-folder"];
+      #extraFlags = ["--no-default-folder"];
       key = sec."${service}/snowbelle/key".path;
       cert = sec."${service}/snowbelle/cert".path;
       settings = {
@@ -31,11 +31,12 @@ in {
           "zygarde" = {id = "UYLTF52-VVKUR7F-JN33HQZ-RFNWGL3-JER52LA-GZD2LPJ-QIFEE7K-MNMZRQ5";};
           "yveltal" = {id = "ZVSQ4WJ-7OICYOZ-3ECES4X-KH37IPB-TKHKUJG-BSEGXVM-AHYY5C3-VKG44AX";};
           "CEN-IT-07" = {id = "DPYKA4Z-3PX7JB2-FBEOXXX-SC7TLT2-QC5P2IR-SXOPJGX-QO3DMII-5B7UCA4";};
+          "CEN-IT-00007" = {id = "XBPXGYU-DUJSLDH-6BDNF4D-CO2COC3-N3FM6W5-IHZOJBM-Z2N77RI-IVAV5AH";};
         };
         folders = {
           "holocron" = {
             path = "/holocron/users/blake/holocron";
-            devices = ["lugia" "zygarde" "CEN-IT-07" "yveltal"];
+            devices = ["lugia" "zygarde" "CEN-IT-07" "CEN-IT-00007"  "yveltal"];
             id = "5voxg-c3he2";
             versioning = {
               type = "staggered";

modules/homelab/arr/bazarr/default.nix

@@ -78,7 +78,7 @@ in
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       extraConfig = ''
-        tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
+        tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}
       '';
     };

modules/homelab/arr/flaresolverr/default.nix

@@ -74,7 +74,7 @@ in
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       extraConfig = ''
-        tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
+        tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}
       '';
     };

modules/homelab/arr/prowlarr/default.nix

@@ -80,7 +80,7 @@ in
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       extraConfig = ''
-        tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
+        tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}
       '';
     };

modules/homelab/arr/radarr/default.nix

@@ -86,7 +86,7 @@ in
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       extraConfig = ''
-        tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
+        tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}
       '';
     };

modules/homelab/arr/sonarr/default.nix

@@ -83,8 +83,9 @@ in
 
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
+      # tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
       extraConfig = ''
-        tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
+        tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}
       '';
     };

modules/homelab/dnsmasq/default.nix

@@ -24,6 +24,7 @@ in {
       enable = true;
       settings = {
         listen-address = "10.10.0.10";  # your LAN IP
+        #interface = "enp89s0";
         bind-interfaces = true;
         address = "/snowbelle.lan/10.10.0.10";
         server = [ # upstream dns

modules/homelab/gitea/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, config, lib, ... }:
+{ pkgs, nixpkgs-unstable, config, lib, ... }:
 
 let
   service = "gitea";
@@ -62,6 +62,10 @@ in
       createHome = true;
       group = service;
       extraGroups = [];
+      # if you wanna attempt system ssh again
+      #openssh.authorizedKeys.keyFiles = [
+      #  "${cfg.data_dir}/.ssh/authorized_keys"
+      #];
     };
 
     # declare the gitea service
@@ -73,16 +77,26 @@ in
       appName =  "gitea";
       settings = {
         server = {
+          # http config
           ROOT_URL = "https://git.blakedheld.xyz";
           DOMAIN = "git.blakedheld.xyz";
           HTTP_PORT = cfg.port;
-          SSH_PORT = cfg.ssh_port;
-          START_SSH_SERVER = true;
-          ENABLE_PUSH_CREATE_USER = true;
+          # local network config
+          #LOCAL_ROOT_URL = "https://git.snowbelle.lan";
           ALLOW_LOCALNETWORKS = true;
           ALLOWED_DOMAINS = "10.10.0.10";
           SKIP_TLS_VERIFY = true;
-
+          # configure for system ssh (trying to use the systms on nix sucks)
+          SSH_PORT = cfg.ssh_port;
+          START_SSH_SERVER = true;
+          #          SSH_PORT = 22;
+          #          START_SSH_SERVER = false;
+          #          SSH_ROOT_PATH = "${cfg.data_dir}/.ssh";
+          #          SSH_CREATE_AUTHORIZED_KEYS_FILE = true;
+          # actual git config
+          DEFAULT_BRANCH = "trunk";
+          ENABLE_PUSH_CREATE_USER = true;
+          DEFAULT_PUSH_CREATE_PRIVATE = true;
         };
       };
       database = {
@@ -99,8 +113,13 @@ in
     networking.firewall.allowedTCPPorts = [ cfg.port cfg.ssh_port ];
 
     # add to caddy for reverse proxy
+    services.caddy.virtualHosts."git.${homelab.public_domain}" = {
+      extraConfig = ''
+        reverse_proxy localhost:${toString cfg.port} {
+        }
+      '';
+    };
     services.caddy.virtualHosts."${cfg.url}" = {
-      serverAliases = [ "git.${homelab.public_domain}" ];
       extraConfig = ''
         tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
         reverse_proxy localhost:${toString cfg.port} {
@@ -108,6 +127,7 @@ in
       '';
     };
 
+
     # add to glance
     homelab.glance.links.services = [{
       title = service;

modules/homelab/glance/default.nix

@@ -242,6 +242,13 @@ in
                     cache = "5s";
                     template = "<div style=\"display:flex; align-items:center; gap:12px;\">\n  <div style=\"width:40px; height:40px; flex-shrink:0;  border-radius:4px; display:flex; justify-content:center; align-items:center; overflow:hidden;\">\n    {{ if .JSON.Bool \"online\" }}\n      <img src=\"{{ .JSON.String \"icon\" | safeURL }}\" width=\"64\" height=\"64\" style=\"object-fit:contain;\">\n    {{ else }}\n      <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 20 20\" fill=\"currentColor\" style=\"width:32px; height:32px; opacity:0.5;\">\n        <path fill-rule=\"evenodd\" d=\"M1 5.25A2.25 2.25 0 0 1 3.25 3h13.5A2.25 2.25 0 0 1 19 5.25v9.5A2.25 2.25 0 0 1 16.75 17H3.25A2.25 2.25 0 0 1 1 14.75v-9.5Zm1.5 5.81v3.69c0 .414.336.75.75.75h13.5a.75.75 0 0 0 .75-.75v-2.69l-2.22-2.219a.75.75 0 0 0-1.06 0l-1.91 1.909.47.47a.75.75 0 1 1-1.06 1.06L6.53 8.091a.75.75 0 0 0-1.06 0l-2.97 2.97ZM12 7a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\" clip-rule=\"evenodd\" />\n      </svg>\n    {{ end }}\n  </div>\n\n  <div style=\"flex-grow:1; min-width:0;\">\n    <a class=\"size-h4 block text-truncate color-highlight\">\n      {{ .JSON.String \"host\" }}\n      {{ if .JSON.Bool \"online\" }}\n      <span\n        style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-positive); display: inline-block; vertical-align: middle;\"\n        data-popover-type=\"text\"\n        data-popover-text=\"Online\"\n      ></span>\n      {{ else }}\n      <span\n        style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-negative); display: inline-block; vertical-align: middle;\"\n        data-popover-type=\"text\"\n        data-popover-text=\"Offline\"\n      ></span>\n      {{ end }}\n    </a>\n\n    <ul class=\"list-horizontal-text\">\n      <li>\n        {{ if .JSON.Bool \"online\" }}\n        <span>{{ .JSON.String \"version.name_clean\" }}</span>\n        {{ else }}\n        <span>Offline</span>\n        {{ end }}\n      </li>\n      {{ if .JSON.Bool \"online\" }}\n      <li data-popover-type=\"html\">\n        <div data-popover-html>\n          {{ range .JSON.Array \"players.list\" }}{{ .String \"name_clean\" }}<br>{{ end }}\n        </div>\n        <p style=\"display:inline-flex;align-items:center;\">\n          <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;\">\n            <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n          </svg>\n          {{ .JSON.Int \"players.online\" | formatNumber }}/{{ .JSON.Int \"players.max\" | formatNumber }} players\n        </p>\n      </li>\n      {{ else }}\n      <li>\n        <p style=\"display:inline-flex;align-items:center;\">\n          <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;opacity:0.5;\">\n            <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n          </svg>\n          0 players\n        </p>\n      </li>\n      {{ end }}\n    </ul>\n  </div>\n</div>";
                   }
+                  {
+                    type = "custom-api";
+                    title = "cobblemon";
+                    url = "https://api.mcstatus.io/v2/status/java/cobblemon.recoil.pro";
+                    cache = "5s";
+                    template = "<div style=\"display:flex; align-items:center; gap:12px;\">\n  <div style=\"width:40px; height:40px; flex-shrink:0;  border-radius:4px; display:flex; justify-content:center; align-items:center; overflow:hidden;\">\n    {{ if .JSON.Bool \"online\" }}\n      <img src=\"{{ .JSON.String \"icon\" | safeURL }}\" width=\"64\" height=\"64\" style=\"object-fit:contain;\">\n    {{ else }}\n      <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 20 20\" fill=\"currentColor\" style=\"width:32px; height:32px; opacity:0.5;\">\n        <path fill-rule=\"evenodd\" d=\"M1 5.25A2.25 2.25 0 0 1 3.25 3h13.5A2.25 2.25 0 0 1 19 5.25v9.5A2.25 2.25 0 0 1 16.75 17H3.25A2.25 2.25 0 0 1 1 14.75v-9.5Zm1.5 5.81v3.69c0 .414.336.75.75.75h13.5a.75.75 0 0 0 .75-.75v-2.69l-2.22-2.219a.75.75 0 0 0-1.06 0l-1.91 1.909.47.47a.75.75 0 1 1-1.06 1.06L6.53 8.091a.75.75 0 0 0-1.06 0l-2.97 2.97ZM12 7a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\" clip-rule=\"evenodd\" />\n      </svg>\n    {{ end }}\n  </div>\n\n  <div style=\"flex-grow:1; min-width:0;\">\n    <a class=\"size-h4 block text-truncate color-highlight\">\n      {{ .JSON.String \"host\" }}\n      {{ if .JSON.Bool \"online\" }}\n      <span\n        style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-positive); display: inline-block; vertical-align: middle;\"\n        data-popover-type=\"text\"\n        data-popover-text=\"Online\"\n      ></span>\n      {{ else }}\n      <span\n        style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-negative); display: inline-block; vertical-align: middle;\"\n        data-popover-type=\"text\"\n        data-popover-text=\"Offline\"\n      ></span>\n      {{ end }}\n    </a>\n\n    <ul class=\"list-horizontal-text\">\n      <li>\n        {{ if .JSON.Bool \"online\" }}\n        <span>{{ .JSON.String \"version.name_clean\" }}</span>\n        {{ else }}\n        <span>Offline</span>\n        {{ end }}\n      </li>\n      {{ if .JSON.Bool \"online\" }}\n      <li data-popover-type=\"html\">\n        <div data-popover-html>\n          {{ range .JSON.Array \"players.list\" }}{{ .String \"name_clean\" }}<br>{{ end }}\n        </div>\n        <p style=\"display:inline-flex;align-items:center;\">\n          <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;\">\n            <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n          </svg>\n          {{ .JSON.Int \"players.online\" | formatNumber }}/{{ .JSON.Int \"players.max\" | formatNumber }} players\n        </p>\n      </li>\n      {{ else }}\n      <li>\n        <p style=\"display:inline-flex;align-items:center;\">\n          <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;opacity:0.5;\">\n            <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n          </svg>\n          0 players\n        </p>\n      </li>\n      {{ end }}\n    </ul>\n  </div>\n</div>";
+                  }
                 ];
               }
               {

modules/homelab/motd/default.nix

@@ -78,7 +78,7 @@ in {
 
       # --- gameservers ---
       echo -e "''${headings}gameservers:''${reset}"
-        for service in velocity smp superflat bento; do
+        for service in velocity smp superflat bento cobblemon; do
           status=$(systemctl is-active $service 2>/dev/null)
           if [ "$status" = "active" ]; then
               printf "%-32s%s\n" "  ''${active}[$service]''${reset}" "running"

modules/homelab/postfix/default.nix

@@ -60,13 +60,11 @@ in {
     # enable the ${service} service
     services.postfix = {
       enable = true;
-      relayHost = "smtp.gmail.com";
-      relayPort = cfg.port;
-      config = {
-        #smtp_use_tls = "yes";
+      settings.main = {
+        relayhost = ["smtp.gmail.com:${toString cfg.port}"];
         smtp_tls_security_level = "may";
         smtp_sasl_auth_enable = "yes";
-        smtp_sasl_security_options = "";
+        smtp_sasl_security_options = "noanonymous";
         smtp_sasl_password_maps = "texthash:${config.sops.secrets."postfix_passwd".path}";
         # optional: Forward mails to root (e.g. from cron jobs, smartd)
         # to me privately and to my work email:

modules/homelab/qbittorrent/default.nix

@@ -117,7 +117,7 @@ in
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       extraConfig = ''
-        tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
+        tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}
       '';
     };

modules/system/cifs_mounts/default.nix

@@ -0,0 +1,72 @@
+{
+  pkgs,
+  inputs,
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.system.cifs_mounts;
+  sec = config.sops.secrets;
+in {
+  options.system.cifs_mounts = {
+    enable = lib.mkEnableOption "enables mounting holocron fileshare on the client side";
+  };
+
+
+  config = lib.mkIf cfg.enable {
+
+    environment.systemPackages = with pkgs; [
+      cifs-utils
+    ];
+
+    fileSystems."/media/holocron/blake" = {
+      device = "//10.10.0.10/users/blake";
+      fsType = "cifs";
+      options = [
+        "x-systemd.automount"
+        "noauto"
+        "_netdev"
+        "credentials=${sec."holocron_creds".path}"
+        "uid=1000"
+        "gid=1000"
+        "file_mode=0664"
+        "dir_mode=0775"
+      ];
+    };
+    fileSystems."/media/holocron/archives" = {
+      device = "//10.10.0.10/archives";
+      fsType = "cifs";
+      options = [
+        "x-systemd.automount"
+        "noauto"
+        "_netdev"
+        "credentials=${sec."holocron_creds".path}"
+        "uid=1000"
+        "gid=1000"
+        "file_mode=0664"
+        "dir_mode=0775"
+      ];
+    };
+    fileSystems."/media/holocron/media" = {
+      device = "//10.10.0.10/media";
+      fsType = "cifs";
+      options = [
+        "x-systemd.automount"
+        "noauto"
+        "_netdev"
+        "credentials=${sec."holocron_creds".path}"
+        "uid=1000"
+        "gid=1000"
+        "file_mode=0664"
+        "dir_mode=0775"
+      ];
+    };
+    # manage secrets with sops
+    sops.secrets = {
+      "holocron_creds" = {
+        owner = "blake";
+        group = "blake";
+      };
+    };
+  };
+}

modules/system/default.nix

@@ -11,10 +11,15 @@
     ./podman
     ./yubikey
     ./tailscale
+    ./japanese
     ./vpns
     ./vpn-confinement
     ./syncthing
     ./graphics
+    ./flatpak
+    ./secure_boot
+    ./cifs_mounts
+    ./udiskie
   ];
 
   system.ssh.enable = lib.mkDefault true;

modules/system/flatpak/default.nix

@@ -0,0 +1,19 @@
+{
+  pkgs,
+  inputs,
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.system.flatpak;
+in {
+  options.system.flatpak = {
+    enable = lib.mkEnableOption "enables nix-flatpak on nixos side";
+  };
+
+  imports = [inputs.nix-flatpak.nixosModules.nix-flatpak];
+
+  config = lib.mkIf cfg.enable {
+    services.flatpak.enable = true;
+  };
+}

modules/system/graphics/default.nix

@@ -57,12 +57,10 @@ in {
 
       # enable amd vulkan (program will choose this or regular)
       hardware.graphics.extraPackages = with pkgs; [
-        amdvlk
         rocmPackages.clr.icd # enable open cl (compute framework like cuda)
       ];
       # ^ but 32 bit
       hardware.graphics.extraPackages32 = with pkgs; [
-        driversi686Linux.amdvlk
       ];
 
       # make hip work (extension on cli.icd ^)

modules/system/japanese/default.nix

@@ -0,0 +1,52 @@
+{
+  pkgs,
+  inputs,
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.system.japanese;
+in {
+  options.system.japanese = {
+    enable = lib.mkEnableOption "enables japanese tools";
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    # japanese input
+    i18n.inputMethod = {
+      enabled = "fcitx5";
+  
+      fcitx5.addons = with pkgs; [
+        fcitx5-mozc
+        fcitx5-gtk
+        fcitx5-qt
+      ];
+    };
+  
+    environment.systemPackages = with pkgs; [
+      fcitx5
+      fcitx5-configtool
+    ];
+
+    # fonts for japanese
+    fonts = {
+      enableDefaultPackages = true;
+      packages = with pkgs; [
+        noto-fonts
+        noto-fonts-cjk
+        noto-fonts-emoji
+        source-han-sans
+        source-han-serif
+      ];
+  
+      fontconfig = {
+        defaultFonts = {
+          serif = [ "Noto Serif CJK JP" ];
+          sansSerif = [ "Noto Sans CJK JP" ];
+          monospace = [ "Noto Sans Mono CJK JP" ];
+        };
+      };
+    };
+  };
+}

modules/system/secure_boot/default.nix

@@ -0,0 +1,43 @@
+{
+  pkgs,
+  inputs,
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.system.secure_boot;
+in {
+  options.system.secure_boot = {
+    enable = lib.mkEnableOption "enables secureboot with lanzaboote";
+  };
+
+  imports = [inputs.lanzaboote.nixosModules.lanzaboote];
+
+  config = lib.mkIf cfg.enable {
+    # install userspace secureboot tools
+    environment.systemPackages = with pkgs; [
+      sbctl
+      e2fsprogs
+    ];
+
+    # force disable systemd-boot so lanzaboote can be used
+    boot.loader.systemd-boot.enable = lib.mkForce false;
+
+    /*
+    this uses the project lanzaboote for secureboot (extension on systemd)
+    setup guide can be found here: https://github.com/nix-community/lanzaboote/blob/master/docs/QUICK_START.md
+    tldr:
+    while currently using systemd-boot
+    generate keys with `nix-shell -p --run "sudo sbctl create-keys"`
+    rebuild with this module enabled then check `sudo sbctl verify`
+    reboot and enable secureboot setup mode in bios
+    check that setup mode is enabled with `sudo sbctl status`
+    enroll keys with `sudo sbctl enroll-keys` use the `--microsoft` flag to incude their keys for compatibality
+    reboot (disable secureboot setup mode if not done automatically) then check secure boot status with `sudo bootctl status`
+    */
+    boot.lanzaboote = {
+      enable = true;
+      pkiBundle = "/var/lib/sbctl";
+    };
+  };
+}

modules/system/ssh/default.nix

@@ -13,7 +13,7 @@ in
     services.openssh = {
       enable = true;
       settings = {
-        PasswordAuthentication = true;
+        PasswordAuthentication = false;
         PermitRootLogin = "no";
         X11Forwarding = false;
       };

modules/system/syncthing/default.nix

@@ -34,13 +34,15 @@ in {
           "snowbelle" = {id = "6WQ6ATA-5AT4RUM-NW67PAL-N62CPNV-ALRFG3P-5BDRO22-HWFC2Q4-5S5BDA5";};
           "lugia" = {id = "BKKSFPH-YEOVVAB-DTT7KK3-UDKAEJ2-PC6ECG7-Y76ZIVP-JRYMMXS-RTZYVQ3";};
           "zygarde" = {id = "UYLTF52-VVKUR7F-JN33HQZ-RFNWGL3-JER52LA-GZD2LPJ-QIFEE7K-MNMZRQ5";};
+          "mew" = {id = "7ZC2NAS-QONQKAL-Z54NPMB-7TRXM6M-K7Z6PZD-FG4AI4H-V7SMFJN-JOYBHQO";};
           "yveltal" = {id = "ZVSQ4WJ-7OICYOZ-3ECES4X-KH37IPB-TKHKUJG-BSEGXVM-AHYY5C3-VKG44AX";};
           "CEN-IT-07" = {id = "DPYKA4Z-3PX7JB2-FBEOXXX-SC7TLT2-QC5P2IR-SXOPJGX-QO3DMII-5B7UCA4";};
+          "CEN-IT-00007" = {id = "XBPXGYU-DUJSLDH-6BDNF4D-CO2COC3-N3FM6W5-IHZOJBM-Z2N77RI-IVAV5AH";};
         };
         folders = {
           "holocron" = {
             path = "/home/blake/holocron";
-            devices = ["lugia" "zygarde" "CEN-IT-07" "snowbelle"];
+            devices = ["lugia" "zygarde" "mew" "yveltal" "CEN-IT-07" "CEN-IT-00007" "snowbelle"];
             id = "5voxg-c3he2";
             versioning = {
               type = "staggered";

modules/system/tailscale/default.nix

@@ -21,6 +21,9 @@ in {
         "--accept-dns=true" # explicitly allow resolved
       ];
     };
+    systemd.services.tailscaled = {
+      after = [ "remote-fs.target" ];   # keep tailscale up until remote mounts are unmounted
+    };
 
     # network config
     networking.firewall.trustedInterfaces = ["tailscale0"];

modules/system/udiskie/default.nix

@@ -0,0 +1,16 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: let
+  cfg = config.system.udiskie;
+in {
+  options.system.udiskie = {
+    enable = lib.mkEnableOption "enable udiskie for automount on nixos side";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.udisks2.enable = true;
+  };
+}

modules/system/yubikey/default.nix

@@ -5,7 +5,7 @@
   ...
 }:
 /*
-# to enroll a yubikey (works like .ssh/known_hosts)
+# to enroll a yubikey with pam (works like .ssh/known_hosts)
 nix-shell -p pam_u2f
 mkdir -p ~/.config/Yubico
 pamu2fcfg > ~/.config/Yubico/u2f_keys
@@ -15,6 +15,9 @@ pamu2fcfg -n >> ~/.config/Yubico/u2f_keys (to add additional yubikeys)
 nix-shell -p pamtester
 pamtester login <username> authenticate
 pamtester sudo <username> authenticate
+
+# to enroll yubikey with luks
+`sudo systemd-cryptenroll --fido2-device=auto /dev/<disk>`
 */
 let
   service = "yubikey";
@@ -43,9 +46,18 @@ in {
       yubikey-manager
     ];
 
+    # enable smartcard
+    services.pcscd.enable = true;
+
+    # enables it for everything
+    security.pam.u2f = lib.mkIf (cfg.mode == "u2f") {
+      enable = true;
+    };
+
+    # selectivlt edit what u2f is enabled for
     security.pam.services = lib.mkIf (cfg.mode == "u2f") {
-      login.u2fAuth = true;
-      sudo.u2fAuth = true;
+      #login.u2fAuth = true;
+      #sudo.u2fAuth = true;
     };
 
     security.pam.yubico = lib.mkIf (cfg.mode == "challenge-response") {

secrets/secrets.yaml

@@ -6,6 +6,8 @@ klefki_auth_map: ENC[AES256_GCM,data:u8OBLtT/,iv:THW21BDyhyFIjcwixsAnaAODofxbuQZ
 tailscale_authkey: ENC[AES256_GCM,data:SU0k3asrJd+WZ86VbC4w8TDJp+MqsbyagrzCfDcgTzO5yvBjpWAKbJ7A+VxgQvdu4+S2jMYbdrONPp3YbQ==,iv:VMYmGVk5GpUQApKKQYhdOw/cYCXrXxEZJJwHfQL4MjQ=,tag:7ruaoCDxuFQ7tE/JLJ37Xw==,type:str]
 #ENC[AES256_GCM,data:bEbCic+ZDAA5ieNedCbiVbJrse17,iv:UwRYlis6NPB/RUcv+YnPxrGdbIcF4hrNiZt19YvWZNQ=,tag:m6PVlzPNnahX7X7KzMUj7A==,type:comment]
 borg_passwd: ENC[AES256_GCM,data:XOMJtr+DRs7xn5Iclc49iTzK9cFJyc/fSXJjhdKa9jdN,iv:YB8z7zNYjh6NpSxQb1TfPxAYUdzThdVfNZIe6tO5grA=,tag:bO6kZ3cLJDL4IQoWmGvRdg==,type:str]
+#ENC[AES256_GCM,data:ztRwuY0mTMDmwV5HqVR7Dmc+dCWcrVRtWZGEL1abE/WUcA==,iv:mmaWfHRiENJUGNhyUBFo1z7PdzVPH1OUZrVhkce6KV0=,tag:GKEvT0qkzTtimQXDueKPdw==,type:comment]
+holocron_creds: ENC[AES256_GCM,data:2QXtXrN5w0UFn70GZOsYFPdtPwjLcuUdtkEam5aZ83N6LEDqPWJi,iv:kUS9pq5CX19vqHumc6QjY+Xpd4N+Ge7oCcQYtMFh+WM=,tag:IUA1ZVThF91EdHrwmS624g==,type:str]
 #ENC[AES256_GCM,data:VdbMrwGKUKNJHw==,iv:OLwBh6KQXR/H8eRgp/hH8k3QfIkK/ydL735kx/dpc8E=,tag:N+v+ym6RMbvW4IckbiLK8Q==,type:comment]
 syncthing:
     gui_passwd: ENC[AES256_GCM,data:CicGIe5dT8lJVchCcE4wg3E8va3RYR8d53MISkE=,iv:8ziDDyQvU8ABaKKwYlcHmvm8Qybk4G+q5F0Ghqluu9w=,tag:YlyNPE04KD3detL1QUTrgQ==,type:str]
@@ -15,6 +17,9 @@ syncthing:
     yveltal:
         key: ENC[AES256_GCM,data:unUnEeDhCqHUZCJtGCbj5rmrLx+9GiUTl75K3HdkI94YfCLNYCBACYu2v/7FbNIEsjVoQEA5/gKEcUHzVq6LaHM2w9GSo6tjkegdzTUgbHBJf4ssJ38z5rQkMc7tbzsA0NUHBPklz1eyjkW96HQPD0REcwA3CIc=,iv:PZ7vfhIpwPpMz4P04bewNhRuahmpukasgYb8fL/EJBE=,tag:G1HDyPAVSdm/fwqTXTT3PQ==,type:str]
         cert: ENC[AES256_GCM,data:yLq2dNjdMiRj4reyZWsSqZ+1rw4DTwKBZoQHzeKb8YBn63ub4TZPlnOjSTt2DwOQwrJDNhsaeGscZ6J7rLxF/rtH6YnR8XxQuOu/NNIcZ4m9EqhsXyznSx4Q+0gamUXujRgGRVH5FNrfiFoqP3VuNghoX+NLxfX0BcVruEjbmLUWVVzY0yS0ufzxegM8WFAxuKhcr1NlhBU65TxKUtbj4vcByzWHkfLGIb5ICnGeF/p9/FvpFSavw3nLdybDLJ6EKEeaxy6t984fkuotAvk54kLbF4yt0q5mjDxy0U6xtn1hg3x03IRAPjKDRdpDmzYf4XxykEb74JX9q2zjUhb2l1ORWcZu/uKvEiuZWDJRmJ4ypOiyZOCqTvY6s2iDhEjmMKxlNr2mhuz9Hn6b3KoQjePIEd1eS/VEmo09pEuUlhlAEziVcdnpeRyWlN2xpv4ps90gLxJ1Mj9nAZwRqFOQl0V4N5OBHEqMBE1nQv4afMpGX5QF2UotTpNfka+LdKwc1iHHtpHZYmG1/LVwz3jDv4XnVLdDWojFA/8eJIWVq1BsUTYSy+Q27bsoTX4iL0Y/OAHRzXZTqYc4aiAWJoaNTNgmagZ9C03SA6qePlGe/5azI3f54rC2m1/JDUtYW3IABHSFUaVnTdWnD4GDNSYRJIknyUwXR4sE3pRD979prmgtepOyETOAVgEeUVKz1leJZ2HyyhjFU41TL0IN/sl+YPD9bC3Nmw7OsxMFGPC4l5vn64DVp7HHRSKyJvZ5fG8s4nSzyZAKomkocOpKHEuQPyyerZpL1lne/m2B/y7/W2ouAGxcawZOSU6f74mn5wM=,iv:Ggag5SNUFkhMWS0u1kwkD5tGjiMv4i041bCESl5XOdc=,tag:pPISz0eBWzHcPHsC8dVG3g==,type:str]
+    mew:
+        key: ENC[AES256_GCM,data:8i2thp667lKEXR0cIaEOLHPXWlhFS38FvbtHgni3i0dTBx9DYtJbGogNaWMlA8r2HzBHkG3Jg0nJs7IOrJWugnGLNLbvhdsxBswEndOBaed4vq+SSN6ssxdjjyFd38wlIZNZsytjPFhyRgDLJ+0rftcIQXPjBhU=,iv:IZ3zWD/ZpalOzSAJQubo/y4LcEzHMEcl+C4GB3Q/nac=,tag:IKEwIkuvHE6qrUoCEqI2Ug==,type:str]
+        cert: ENC[AES256_GCM,data:uvNZYmQnexXTr/Sz7vLQIJK93MmsoiJfCAL8/rLVQH0D+1nVaM472lqR5pP0qhLKuYhFUESxhAotVtqLpOWK1MfAxuk2RHv8mvbtIJkheRmsIWw7dAAABIkmgnelI03P2Tk2129I95vMM1lybu4W6m9VslwJF8X/4rCxshdbuz9mcjwxBpUEDr1V76DO3bgQUuPwizx17ON8gNd+NtRqPPaXlGrfLCFv1Fib3YFd7+WRkERki9ZO7Q0quY75G4Jseb28QaiM2BT7jfECJo4x7rMePMV303sIrF9paaUKTuSiCUsamLsi5Hwr907y2lHB9Gocwio7tnSRSRhHHcWLI8dQktzW7Flqs8+MZGZ1oJBQO7kQDefF1q4mddADimoqD9F1NsOiOmqqZRRB37alLGmRjeYBIlA6q/FgN9BAj9h0cG3oN1MUXPRGzDfggg5TLjBM2FbG/N3xgncZ2AzTPOcLtrtc0I2PYk3FFxgzpHWnjS2t7CQo/JxqdXbdy9nTHIqbrnKIQ/FtS7/p+cgQcU815UMsJm3qP+hPLCyNuziYq3Vt/X7C3eTnrqemXjEeJ/SJxb+Oul5GS1OL14dNsJllFNuj33Zep/hyQvHnf/HW7kXAfDqIP9zn85EFriAZEuaKwbHB2pkvbWKFxrpXJFhjnPFDKxGOjAmsLmil4paFKdt5hK7rp0mmoIMN+mMFbYx333llik0qk27yYTQwOR3eeCGqHODUU+izUT8NuQBezyxsEmEYu/YBcpatcYylwKgIFcC058oltsxlbxRg5Rrdk5FOqj7Uui0qwFXvYesz6Tiq/rGmcOPlcE5xw14=,iv:LePpzWGDTV1ONwt1uHUptMW1dO1SwwUKrtCEerc/DEc=,tag:a5B/7hmIxvLXU90Stcq7zA==,type:str]
 #ENC[AES256_GCM,data:A0ITyGOGMIoyVOcn5JOi1RAtqUM=,iv:+wWpmFbeLiX/Ae53pj0QmnYY3MEzOMib4cqbePUKtGI=,tag:JHXvrN4bOH+oD3Q70pUuew==,type:comment]
 pia_auth: ENC[AES256_GCM,data:rwAu4f5XVS4v4FCLj2zXAegIZeRPLIzUVv6TCrdfg9RGSDJYHgVAX0aFXCBQsDQju9RDycXmc9Id8IuyYN8=,iv:kEA4ADQyUI+zlQoZOKi81dw5BLE1oesqhVf6bfiLgB4=,tag:VHT2uPNW27F3KRM7ZhWdCw==,type:str]
 #ENC[AES256_GCM,data:mbIgMJBhL8nWJzl8q2dFL8XtO1Xa1Q==,iv:caYHYp1boK9wRgCcQe40HTWT/HxAIvYe+HyaruI53Vc=,tag:S6wowhAHObEcs7z8FimZ1g==,type:comment]
@@ -30,6 +35,7 @@ minecraft_recpro_db_passwd: ENC[AES256_GCM,data:dPAkdEX0hBigo/lND2r3ShxnS4Jc5wTI
 mosquitto_hashed_passwd: ENC[AES256_GCM,data:k1Lnr8ZTDpzXMoRmRH61X41boX/D8Rm1KPh7x3/IHFo+XKIOUQns53iA+7e7Ohp8uWSthDlOk4SlRvTXdUNiEz7Zmw9LYwy7BHbwpNo2pFApAye1ORPrMrhMUkUfgBgc8oqPPyRXmmrOAFp6GBbRhg==,iv:D8wQL9iF0rqOte5X24kDTVjYUJXbZSLz0Ykbp0HqmYo=,tag:RUCgO1uKPIdumSo563cg1Q==,type:str]
 mosquitto_passwd.yaml: ENC[AES256_GCM,data:9xwHiUaQ6zG/4rkRemXtbRJ/KEV4yajqyYlcXRR1eAQ2XijYOzitPjt53h3FPqp5rxl6dJerXNH5CiZZK3t1l339NxNseJFGVmIHitWJxNmGJMlG3M8r8Q==,iv:C6WWZuVkYaasB2pol3uf4Mc3d/lDEgt2pKX+dHl/Cr4=,tag:jYTC6RKF2TzDSwSUh6D8zQ==,type:str]
 #ENC[AES256_GCM,data:zmSByl0De3a39qLbS99oce7ORe2BBoPa+3I05/YYxL7iBeWCP3ZK,iv:6nUTBUFpNK7Mttckqu6Wk/QJ5cP4+iL+EH4ldaIuu9s=,tag:pc5UtjbNPsVOEMCdLKgGMA==,type:comment]
+#ENC[AES256_GCM,data:ZWlAWAthigdTlfHrQl1x8eSj+gv4Gj1poZfPViu1mVz/ZmUJFZyCSkdIg0CPdNNF38TE0iabBk+o7aHkFmIFz18hjVYAk4M2E034qg==,iv:jU+2E+XAILgFNyMkGZ1CMJ83q7V/yyEJwHXWw05RlHo=,tag:n8w0/ktmum5P31vMWJVxgA==,type:comment]
 postfix_passwd: ENC[AES256_GCM,data:3ndIsTGPyAQELM8lptBK241a3p77fNijXma4souFKnyrkLBpZ4OP6KWuldFlWySpSG7Yme0by5gOzg==,iv:nYuJKeY4H3OfQleLo7gvheT5JHgXW3hGQvjHeEEN260=,tag:q952E/0QLC49O5Rwua0RWQ==,type:str]
 #ENC[AES256_GCM,data:UcpnHZj5xr8P64PzhWVKbFy8pvFM9GCz2mDoW/6iRVqgLTL0FSn6KXep/kfLEnYiqv5ZpsVZjjXsbI5VRJfBo7w4kzX661oDU8323DfQHDkbo2g=,iv:nEApgutl5kjfZkwi9WTOwatraM3+TQqFgk5gEMw0rwA=,tag:Q4gndL+6q7jHN02QCpJDjw==,type:comment]
 #ENC[AES256_GCM,data:3oMbbBSrbjrqsdiON1ENB8JeKW0=,iv:+/eL/51OA+VHbkWWSNzQId5BlxnMm+5NBA0uKw010Tk=,tag:vBJpCYmvFivBYIKatDWgHw==,type:comment]
@@ -60,7 +66,7 @@ sops:
             U0tmdFBuZnJES3piOTZNV0VKQmQ0eVUKCWRQ/flLzmpC64WyLoipklZBmrkpYiUg
             PRu+itNolpPTHm96pe+P93g2iP0wgekG0cX21wkiU2xaLF3dY2FEIA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-11-05T05:51:29Z"
-    mac: ENC[AES256_GCM,data:y4KF/ImqWzga34UIjn8ohvR4Ktu785vNgyxLDxJZOvqZNsShlgSBQ+EnJ6TgG3Ghyo6n3frcMBaZJLP4QJVqsoigUMqqOdhp3xxLRQSV5c5GbmKscW2q/xdkKqnqbANDWxQ4FWd7n/CfH+FDxtRoWgkptRzhpqYEdXxFRjzR5jo=,iv:KJYp8BmuXyuDkpRH/ZjahT8tG4NoG7Y4XFJ9Q4GntLg=,tag:sr9HQCuynFXwYT7Ulbyerg==,type:str]
+    lastmodified: "2026-01-28T21:02:05Z"
+    mac: ENC[AES256_GCM,data:b9aX43ViObNX29DkVNHtwkQRm26PRe2rZYhDnL1ZYLLWyaO3OGP9+rM4vHT0lyuowQ6+Ur3IMPVpUSziXYLh3mtxr0hyYy5Y1miBuIxXYLBi3oLRTW1TgZdklzFDVL3c1GT4lXEh4q9KG3dP64r9/8dvjO2iRIosZ93/l0pIi3A=,iv:/gdNfVy8UiQsIRAHh2jiha5fL+wmfgp0srxt17Ry4Xs=,tag:YdVbvpBnQSaIarGIfiTzKQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0

users/blake/assets/icons/cursors/posy_dark/cursors/00000000000000020006000e7e9ffc3f

@@ -0,0 +1 @@
+background

users/blake/assets/icons/cursors/posy_dark/cursors/00008160000006810000408080010102

@@ -0,0 +1 @@
+size_NS

users/blake/assets/icons/cursors/posy_dark/cursors/028006030e0e7ebffc7f7070c0600140

@@ -0,0 +1 @@
+size_EW

users/blake/assets/icons/cursors/posy_dark/cursors/03b6e0fcb3499374a867c041f52298f0

@@ -0,0 +1 @@
+forbidden

users/blake/assets/icons/cursors/posy_dark/cursors/08e8e1c95fe2fc01f976f1e063a24ccd

@@ -0,0 +1 @@
+background

users/blake/assets/icons/cursors/posy_dark/cursors/1081e37283d90000800003c07f3ef6bf

@@ -0,0 +1 @@
+default

users/blake/assets/icons/cursors/posy_dark/cursors/14fef782d02440884392942c11205230

@@ -0,0 +1 @@
+size_EW

users/blake/assets/icons/cursors/posy_dark/cursors/2870a09082c103050810ffdffffe0204

@@ -0,0 +1 @@
+size_NS

users/blake/assets/icons/cursors/posy_dark/cursors/3085a0e285430894940527032f8b26df

@@ -0,0 +1 @@
+link

users/blake/assets/icons/cursors/posy_dark/cursors/3ecb610c1bf2410f44200f48c40d3599

@@ -0,0 +1 @@
+background

users/blake/assets/icons/cursors/posy_dark/cursors/4498f0e0c1937ffe01fd06f973665830

@@ -0,0 +1 @@
+hand

users/blake/assets/icons/cursors/posy_dark/cursors/5c6cd98b3f3ebcb1f9c7f1c204630408

@@ -0,0 +1 @@
+help

users/blake/assets/icons/cursors/posy_dark/cursors/6407b0e94181790501fd1e167b474872

@@ -0,0 +1 @@
+default

users/blake/assets/icons/cursors/posy_dark/cursors/640fb0e74195791501fd1ed57b41487f

@@ -0,0 +1 @@
+link

users/blake/assets/icons/cursors/posy_dark/cursors/9081237383d90e509aa00f00170e968f

@@ -0,0 +1 @@
+hand

users/blake/assets/icons/cursors/posy_dark/cursors/9d800788f1b08800ae810202380a0822

@@ -0,0 +1 @@
+hand

users/blake/assets/icons/cursors/posy_dark/cursors/X_cursor

@@ -0,0 +1 @@
+forbidden

users/blake/assets/icons/cursors/posy_dark/cursors/aero_busy

@@ -0,0 +1 @@
+wait

users/blake/assets/icons/cursors/posy_dark/cursors/aero_working

@@ -0,0 +1 @@
+background

users/blake/assets/icons/cursors/posy_dark/cursors/alias

@@ -0,0 +1 @@
+link

users/blake/assets/icons/cursors/posy_dark/cursors/all-scroll

@@ -0,0 +1 @@
+move

users/blake/assets/icons/cursors/posy_dark/cursors/arrow

@@ -0,0 +1 @@
+default

users/blake/assets/icons/cursors/posy_dark/cursors/bd_double_arrow

@@ -0,0 +1 @@
+size_NeSw

users/blake/assets/icons/cursors/posy_dark/cursors/bottom_left_corner

@@ -0,0 +1 @@
+size_NeSw

users/blake/assets/icons/cursors/posy_dark/cursors/bottom_right_corner

@@ -0,0 +1 @@
+size_NwSe

users/blake/assets/icons/cursors/posy_dark/cursors/bottom_side

@@ -0,0 +1 @@
+size_NS

users/blake/assets/icons/cursors/posy_dark/cursors/bottom_tee

@@ -0,0 +1 @@
+size_NS

users/blake/assets/icons/cursors/posy_dark/cursors/c7088f0f3e6c8088236ef8e1e3e70000

@@ -0,0 +1 @@
+size_NeSw

users/blake/assets/icons/cursors/posy_dark/cursors/cell

@@ -0,0 +1 @@
+precise

users/blake/assets/icons/cursors/posy_dark/cursors/center_ptr

@@ -0,0 +1 @@
+alt

users/blake/assets/icons/cursors/posy_dark/cursors/circle

@@ -0,0 +1 @@
+forbidden

users/blake/assets/icons/cursors/posy_dark/cursors/closedhand

@@ -0,0 +1 @@
+link

users/blake/assets/icons/cursors/posy_dark/cursors/col-resize

@@ -0,0 +1 @@
+size_EW

users/blake/assets/icons/cursors/posy_dark/cursors/color-picker

@@ -0,0 +1 @@
+precise

users/blake/assets/icons/cursors/posy_dark/cursors/context-menu

@@ -0,0 +1 @@
+default

users/blake/assets/icons/cursors/posy_dark/cursors/copy

@@ -0,0 +1 @@
+default

users/blake/assets/icons/cursors/posy_dark/cursors/cross

@@ -0,0 +1 @@
+precise

users/blake/assets/icons/cursors/posy_dark/cursors/cross_reverse

@@ -0,0 +1 @@
+precise

users/blake/assets/icons/cursors/posy_dark/cursors/crossed_circle

@@ -0,0 +1 @@
+forbidden

users/blake/assets/icons/cursors/posy_dark/cursors/crosshair

@@ -0,0 +1 @@
+precise

users/blake/assets/icons/cursors/posy_dark/cursors/cursor

@@ -0,0 +1 @@
+default

users/blake/assets/icons/cursors/posy_dark/cursors/d9ce0ab605698f320427677b458ad60b

@@ -0,0 +1 @@
+help

users/blake/assets/icons/cursors/posy_dark/cursors/diamond_cross

@@ -0,0 +1 @@
+precise

users/blake/assets/icons/cursors/posy_dark/cursors/dnd-ask

@@ -0,0 +1 @@
+help

users/blake/assets/icons/cursors/posy_dark/cursors/dnd-link

@@ -0,0 +1 @@
+link

users/blake/assets/icons/cursors/posy_dark/cursors/dnd-move

@@ -0,0 +1 @@
+move

users/blake/assets/icons/cursors/posy_dark/cursors/dnd-none

@@ -0,0 +1 @@
+link

users/blake/assets/icons/cursors/posy_dark/cursors/dnd_no_drop

@@ -0,0 +1 @@
+forbidden