test: setting up nas structure

modules/nixos/homelab/acme/default.nix

@@ -0,0 +1,56 @@
+{
+  flake,
+  ...
+}:
+let
+  inherit (flake.config.people) user0;
+  inherit (flake.config.people.users.${user0}) email;
+  inherit (flake.config.services) instances;
+  service = instances.acme;
+  dns0 = instances.web.dns.provider0;
+  dns1 = instances.web.dns.provider1;
+in
+{
+  security.acme = {
+    acceptTerms = true;
+    defaults = {
+      email = email.address0;
+      server = "https://acme-v02.api.letsencrypt.org/directory";
+    };
+  };
+
+  sops =
+    let
+      dnsList = [
+        dns0
+        dns1
+      ];
+      secretList = [
+        "pass"
+      ];
+      sopsPath = secret: dns: {
+        path = "/var/lib/secrets/${instances.acme.name}/${dns}-${secret}";
+        owner = "root";
+        mode = "600";
+      };
+    in
+    {
+      secrets = builtins.listToAttrs (
+        builtins.concatLists (
+          map (
+            dns:
+            map (secret: {
+              name = "dns/${dns}";
+              value = sopsPath secret dns;
+            }) secretList
+          ) dnsList
+        )
+      );
+    };
+
+  systemd = {
+    tmpfiles.rules = [
+      "Z ${service.sops.path0} 755 ${service.name} ${service.name} -"
+    ];
+  };
+}

modules/nixos/homelab/caddy/config/firefly-iii/default.nix

@@ -0,0 +1,34 @@
+{
+  flake,
+  config,
+  ...
+}:
+let
+
+  inherit (flake.config.services) instances;
+  serviceCfg = instances.firefly-iii;
+  interfaceCfg = serviceCfg.intefaces.interface0;
+  host = interfaceCfg.domain;
+  dns0 = instances.web.dns.provider0;
+  dns0Path = "dns/${dns0}";
+in
+{
+  security.acme.certs."${host}" = {
+    dnsProvider = dns0;
+    environmentFile = config.sops.secrets.${dns0Path}.path;
+    group = "caddy";
+  };
+
+  services.caddy.virtualHosts."${host}" = {
+    extraConfig = ''
+      reverse_proxy http://${interfaceCfg.microvm.ip}:80 {
+        header_up X-Forwarded-Proto https
+        header_up X-Forwarded-Host {host}
+      }
+
+      tls ${interfaceCfg.ssl.cert} ${interfaceCfg.ssl.key}
+
+      encode zstd gzip
+    '';
+  };
+}

modules/nixos/homelab/caddy/config/forgejo/default.nix

@@ -0,0 +1,26 @@
+{ flake, config, ... }:
+let
+  inherit (flake.config.services) instances;
+  serviceCfg = instances.forgejo;
+  dns0 = instances.web.dns.provider0;
+  dns0Path = "dns/${dns0}";
+  interface0Cfg = serviceCfg.interfaces.interface0;
+  host0 = interface0Cfg.domain;
+in
+{
+  security.acme.certs."${host0}" = {
+    dnsProvider = dns0;
+    environmentFile = config.sops.secrets.${dns0Path}.path;
+    group = "caddy";
+  };
+
+  services.caddy.virtualHosts."${host0}" = {
+    extraConfig = ''
+      reverse_proxy ${interface0Cfg.microvm.ip}:${toString serviceCfg.ports.port0} {
+        header_up X-Real-IP {remote_host}
+      }
+      tls ${interface0Cfg.ssl.cert} ${interface0Cfg.ssl.key}
+      encode zstd gzip
+    '';
+  };
+}

modules/nixos/homelab/caddy/config/jellyfin/default.nix

@@ -0,0 +1,37 @@
+{
+  config,
+  flake,
+  ...
+}:
+let
+  inherit (flake.config.services) instances;
+  serviceCfg = instances.jellyfin;
+  interface0Cfg = serviceCfg.interfaces.interface0;
+  host0 = interface0Cfg.domain;
+  dns0 = instances.web.dns.provider0;
+  dns0Path = "dns/${dns0}";
+
+in
+{
+  security.acme.certs."${host0}" = {
+    dnsProvider = dns0;
+    environmentFile = config.sops.secrets.${dns0Path}.path;
+    group = "caddy";
+  };
+
+  services = {
+    caddy = {
+      virtualHosts = {
+        "${host0}" = {
+          extraConfig = ''
+            reverse_proxy ${interface0Cfg.interface.ip}:${toString serviceCfg.ports.port0} {
+              header_up X-Real-IP {remote_host}
+            }
+            tls ${interface0Cfg.ssl.cert} ${interface0Cfg.ssl.key}
+            encode zstd gzip
+          '';
+        };
+      };
+    };
+  };
+}

modules/nixos/homelab/caddy/config/mastodon/default.nix

@@ -0,0 +1,31 @@
+{ flake, config, ... }:
+let
+  inherit (flake.config.services) instances;
+  serviceCfg = instances.mastodon;
+  interface0Cfg = serviceCfg.interfaces.interface0;
+  host0 = interface0Cfg.domain;
+  dns0 = instances.web.dns.provider0;
+  dns0Path = "dns/${dns0}";
+in
+{
+  security.acme.certs."${host0}" = {
+    dnsProvider = dns0;
+    environmentFile = config.sops.secrets.${dns0Path}.path;
+    group = "caddy";
+  };
+
+  services.caddy.virtualHosts."${host0}" = {
+    extraConfig = ''
+      reverse_proxy http://${interface0Cfg.microvm.ip}:80 {
+        header_up X-Forwarded-Proto {scheme}
+        header_up X-Real-IP {remote_host}
+        header_up X-Forwarded-For {remote_host}
+      }
+
+      tls ${interface0Cfg.ssl.cert} ${interface0Cfg.ssl.key}
+
+      encode zstd gzip
+    '';
+  };
+
+}

modules/nixos/homelab/caddy/config/opencloud/default.nix

@@ -0,0 +1,54 @@
+{
+  config,
+  flake,
+  ...
+}:
+let
+  inherit (flake.config.services) instances;
+
+  serviceCfg = instances.opencloud;
+  interface0Cfg = serviceCfg.interfaces.interface0;
+  interface1Cfg = serviceCfg.interfaces.interface1;
+  dns0 = instances.web.dns.provider0;
+  dns1 = instances.web.dns.provider1;
+  host0 = interface1Cfg.domain;
+  host1 = "${interface0Cfg.subdomain}.${flake.inputs.linkpage.secrets.domains.projectsite}";
+  credPath = "/var/lib/acme/${host0}";
+in
+{
+  security.acme.certs = {
+    "${host0}" = {
+      dnsProvider = dns0;
+      environmentFile = config.sops.secrets."dns/${dns0}".path;
+      group = "caddy";
+    };
+    "${host1}" = {
+      dnsProvider = dns1;
+      environmentFile = config.sops.secrets."dns/${dns1}".path;
+      group = "caddy";
+    };
+  };
+
+  services.caddy.virtualHosts = {
+    "${host0}" = {
+      extraConfig = ''
+        reverse_proxy ${interface0Cfg.microvm.ip}:${toString serviceCfg.ports.port0} {
+          header_up X-Real-IP {remote_host}
+        }
+        redir /.well-known/carddav /remote.php/dav/ 301
+        redir /.well-known/caldav /remote.php/dav/ 301
+        tls ${interface0Cfg.ssl.cert} ${interface0Cfg.ssl.key}
+      '';
+    };
+    "${host1}" = {
+      extraConfig = ''
+        reverse_proxy ${interface1Cfg.microvm.ip}:${toString serviceCfg.ports.port0} {
+          header_up X-Real-IP {remote_host}
+        }
+        redir /.well-known/carddav /remote.php/dav/ 301
+        redir /.well-known/caldav /remote.php/dav/ 301
+        tls ${credPath}/fullchain.pem ${credPath}/key.pem 
+      '';
+    };
+  };
+}

modules/nixos/homelab/caddy/config/photoprism/default.nix

@@ -0,0 +1,31 @@
+{ flake, config, ... }:
+let
+  inherit (flake.config.services) instances;
+  serviceCfg = instances.photoprism;
+  interface0Cfg = serviceCfg.interfaces.interface0;
+  host0 = interface0Cfg.domain;
+  dns0 = instances.web.dns.provider0;
+  dns0Path = "dns/${dns0}";
+in
+{
+  security.acme.certs."${host0}" = {
+    dnsProvider = dns0;
+    environmentFile = config.sops.secrets.${dns0Path}.path;
+    group = "caddy";
+  };
+
+  services.caddy.virtualHosts."${host0}" = {
+    extraConfig = ''
+      reverse_proxy http://${interface0Cfg.microvm.ip}:80 {
+        header_up X-Forwarded-Proto {scheme}
+        header_up X-Real-IP {remote_host}
+        header_up X-Forwarded-For {remote_host}
+      }
+
+      tls ${interface0Cfg.ssl.cert} ${interface0Cfg.ssl.key}
+
+      encode zstd gzip
+    '';
+  };
+
+}

modules/nixos/homelab/caddy/config/qbittorrent/default.nix

@@ -0,0 +1,39 @@
+{ flake, config, ... }:
+let
+  inherit (flake.config.services) instances;
+  serviceCfg = instances.qbittorrent;
+  interface0Cfg = serviceCfg.interfaces.interface0;
+  host0 = interface0Cfg.domain;
+  dns0 = instances.web.dns.provider0;
+  dns0Path = "dns/${dns0}";
+in
+{
+  security.acme.certs."${host0}" = {
+    dnsProvider = dns0;
+    environmentFile = config.sops.secrets.${dns0Path}.path;
+    group = "caddy";
+  };
+  services = {
+    caddy = {
+      virtualHosts = {
+        "${host0}" = {
+          extraConfig = ''
+            basic_auth {
+              {$CADDY_AUTH_USER} {$CADDY_AUTH_PASSWORD_HASH}
+            }
+            reverse_proxy ${interface0Cfg.microvm.ip}:${toString serviceCfg.ports.port0}
+            tls ${interface0Cfg.ssl.cert} ${interface0Cfg.ssl.key}
+            encode zstd gzip
+          '';
+        };
+      };
+    };
+  };
+  sops.secrets = {
+    "caddy/share-auth" = {
+      owner = "caddy";
+      group = "caddy";
+      mode = "0400";
+    };
+  };
+}

modules/nixos/homelab/caddy/config/syncthing/default.nix

@@ -0,0 +1,35 @@
+{
+  config,
+  flake,
+  ...
+}:
+let
+  inherit (flake.config.services) instances;
+  serviceCfg = instances.syncthing;
+  interface0Cfg = serviceCfg.interfaces.interface0;
+  host0 = interface0Cfg.domain;
+  dns0 = instances.web.dns.provider0;
+  dns0Path = "dns/${dns0}";
+in
+{
+  security.acme.certs."${host0}" = {
+    dnsProvider = dns0;
+    environmentFile = config.sops.secrets.${dns0Path}.path;
+    group = "caddy";
+  };
+  services = {
+    caddy = {
+      virtualHosts = {
+        "${host0}" = {
+          extraConfig = ''
+            reverse_proxy ${interface0Cfg.interface.ip}:${toString serviceCfg.ports.port0} {
+              header_up X-Real-IP {remote_host}
+            }
+            tls ${interface0Cfg.ssl.cert} ${interface0Cfg.ssl.key}
+            encode zstd gzip
+          '';
+        };
+      };
+    };
+  };
+}

modules/nixos/homelab/caddy/config/vaultwarden/default.nix

@@ -0,0 +1,34 @@
+{
+  config,
+  flake,
+  ...
+}:
+let
+  inherit (flake.config.services) instances;
+  serviceCfg = instances.vaultwarden;
+  interfaceCfg = serviceCfg.interfaces.interface0;
+  dns0 = instances.web.dns.provider0;
+  host = interfaceCfg.domain;
+  dns0Path = "dns/${dns0}";
+in
+{
+  security.acme.certs."${host}" = {
+    dnsProvider = dns0;
+    environmentFile = config.sops.secrets.${dns0Path}.path;
+    group = "caddy";
+  };
+
+  services.caddy.virtualHosts = {
+    "${host}" = {
+      extraConfig = ''
+        reverse_proxy ${interfaceCfg.microvm.ip}:${toString serviceCfg.ports.port0} {
+          header_up X-Real-IP {remote_host}
+        }
+
+        tls ${interfaceCfg.ssl.cert} ${interfaceCfg.ssl.key}
+
+        encode zstd gzip
+      '';
+    };
+  };
+}

modules/nixos/homelab/caddy/config/website/default.nix

@@ -0,0 +1,38 @@
+{ flake, config, ... }:
+let
+  inherit (flake.config.services) instances;
+  serviceCfg = instances.website;
+  interface0Cfg = serviceCfg.interfaces.interface0;
+  interface1Cfg = serviceCfg.interfaces.interface1;
+  host0 = interface0Cfg.domain;
+  host1 = flake.inputs.linkpage.secrets.domains.projectsite;
+  dns0 = instances.web.dns.provider0;
+  dns1 = instances.web.dns.provider1;
+  dns0Path = "dns/${dns0}";
+  dns1Path = "dns/${dns1}";
+in
+
+{
+  services.caddy = {
+    virtualHosts = {
+      ${host0}.extraConfig = ''
+        reverse_proxy ${interface0Cfg.microvm.ip}:80
+        tls ${interface0Cfg.ssl.cert} ${interface0Cfg.ssl.key}
+      '';
+      ${host1}.extraConfig = ''
+        reverse_proxy ${interface1Cfg.microvm.ip}:80
+        tls /var/lib/acme/${host1}/fullchain.pem /var/lib/acme/${host1}/key.pem
+      '';
+    };
+  };
+  security.acme.certs = {
+    ${host0} = {
+      dnsProvider = dns0;
+      environmentFile = config.sops.secrets."${dns0Path}".path;
+    };
+    ${host1} = {
+      dnsProvider = dns1;
+      environmentFile = config.sops.secrets."${dns1Path}".path;
+    };
+  };
+}

modules/nixos/homelab/caddy/default.nix

@@ -0,0 +1,34 @@
+{ flake, ... }:
+let
+  inherit (flake.config.services) instances;
+  service = instances.caddy;
+
+  importList =
+    let
+      content = builtins.readDir ./.;
+      dirContent = builtins.filter (n: content.${n} == "directory") (builtins.attrNames content);
+    in
+    map (name: ./. + "/${name}") dirContent;
+
+in
+{
+  imports = importList;
+
+  services.caddy = {
+    enable = true;
+  };
+
+  tmpfiles.rules = [
+    "d /run/secrets/caddy 755 caddy caddy -"
+    "d /var/log/caddy 755 caddy caddy -"
+  ];
+
+  networking = {
+    firewall = {
+      allowedTCPPorts = [
+        service.ports.port0 # 80
+        service.ports.port1 # 443
+      ];
+    };
+  };
+}

modules/nixos/homelab/default.nix

@@ -0,0 +1,11 @@
+let
+  importList =
+    let
+      content = builtins.readDir ./.;
+      dirContent = builtins.filter (n: content.${n} == "directory") (builtins.attrNames content);
+    in
+    map (name: ./. + "/${name}") dirContent;
+in
+{
+  imports = importList;
+}

modules/nixos/homelab/guests/default.nix

@@ -0,0 +1,12 @@
+let
+  inherit (import ./helpers.nix) labHelpers;
+  importList =
+    let
+      content = builtins.readDir ./.;
+      dirContent = builtins.filter (n: content.${n} == "directory") (builtins.attrNames content);
+    in
+    map (name: ./. + "/${name}" { inherit labHelpers; }) dirContent;
+in
+{
+  imports = importList;
+}

modules/nixos/homelab/guests/firefly-iii/config/default.nix

@@ -0,0 +1,240 @@
+{
+  flake,
+  config,
+  ...
+}:
+let
+  inherit (flake.config.people) user0;
+  inherit (flake.config.services) instances;
+  serviceCfg = instances.firefly-iii;
+  smtpCfg = instances.smtp;
+in
+{
+  fireflyVM =
+    {
+      user,
+      ip,
+      mac,
+      userMac,
+      ssh,
+      host,
+      owner,
+      mnt,
+    }:
+    {
+      microvm.vms = {
+        "${serviceCfg.name}-${user}" = {
+          autostart = true;
+          restartIfChanged = true;
+          config = {
+            system.stateVersion = "24.05";
+            time.timeZone = "America/Winnipeg";
+            users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
+            services = {
+              firefly-iii = {
+                enable = true;
+                enableNginx = false;
+                poolConfig = {
+                  "listen.owner" = config.services.caddy.user;
+                  "pm" = "dynamic";
+                  "pm.max_children" = 32;
+                  "pm.start_servers" = 2;
+                  "pm.min_spare_servers" = 2;
+                  "pm.max_spare_servers" = 4;
+                  "pm.max_requests" = 500;
+                };
+                settings = {
+                  APP_URL = "https://${host}";
+                  APP_KEY_FILE = "/etc/firefly-secrets/${user}-pass";
+                  DB_PASSWORD_FILE = "/etc/firefly-secrets/${user}-data";
+                  DB_CONNECTION = "pgsql";
+                  DB_HOST = "/run/postgresql";
+                  DB_DATABASE = serviceCfg.name;
+                  DB_USERNAME = serviceCfg.name;
+                  MAIL_MAILER = smtpCfg.name;
+                  MAIL_HOST = smtpCfg.interfaces.interface0.domain;
+                  MAIL_PORT = smtpCfg.ports.port0;
+                  MAIL_FROM = smtpCfg.interfaces.interface0.email;
+                  MAIL_USERNAME = smtpCfg.interfaces.interface0.email;
+                  MAIL_PASSWORD_FILE = "/etc/firefly-secrets/${user}-smtp";
+                  MAIL_ENCRYPTION = "tls";
+                  SITE_OWNER = owner;
+                };
+              };
+              phpfpm.pools.firefly-iii.phpEnv = {
+                TRUSTED_PROXIES = "*";
+                APP_URL = "https://${host}";
+              };
+              firefly-iii-data-importer = {
+                enable = true;
+              };
+              caddy = {
+                enable = true;
+                virtualHosts.":80" = {
+                  extraConfig = ''
+                    root * ${config.services.firefly-iii.package}/public
+                    file_server
+                    encode gzip
+                    php_fastcgi unix//run/phpfpm/firefly-iii.sock {
+                      env HTTPS {http.request.header.X-Forwarded-Proto}
+                      env HTTP_X_FORWARDED_PROTO {http.request.header.X-Forwarded-Proto}
+                    }
+                  '';
+                };
+              };
+              postgresql = {
+                enable = true;
+                ensureDatabases = [ "firefly-iii" ];
+                ensureUsers = [
+                  {
+                    name = "firefly-iii";
+                    ensureDBOwnership = true;
+                  }
+                ];
+              };
+
+              openssh = {
+                enable = true;
+                settings = {
+                  PasswordAuthentication = false;
+                  PermitRootLogin = "prohibit-password";
+                };
+              };
+            };
+            networking.firewall.allowedTCPPorts = [
+              22
+              smtpCfg.ports.port1
+              serviceCfg.ports.port0
+              serviceCfg.ports.port1
+            ];
+            systemd = {
+              services = {
+                caddy = {
+                  after = [ "phpfpm-firefly-iii.service" ];
+                  requires = [ "phpfpm-firefly-iii.service" ];
+                };
+                fix-secrets-permissions = {
+                  description = "Fix secrets permissions for firefly-iii";
+                  wantedBy = [ "multi-user.target" ];
+                  before = [
+                    "firefly-iii-setup.service"
+                    "phpfpm-firefly-iii.service"
+                  ];
+                  serviceConfig = {
+                    Type = "oneshot";
+                    RemainAfterExit = true;
+                  };
+                  script = ''
+                    mkdir -p /etc/firefly-secrets
+                    cp /run/secrets/${user}-pass /etc/firefly-secrets/${user}-pass
+                    cp /run/secrets/${user}-data /etc/firefly-secrets/${user}-data
+                    cp /run/secrets/${user}-smtp /etc/firefly-secrets/${user}-smtp
+                    chmod 755 /etc/firefly-secrets
+                    chmod 644 /etc/firefly-secrets/*
+                  '';
+                };
+                systemd-networkd.wantedBy = [ "multi-user.target" ];
+              };
+              network = {
+                enable = true;
+                networks."20-lan" = {
+                  matchConfig.Name = "enp0s5";
+                  addresses = [
+                    { Address = "${ip}/24"; }
+                  ];
+                  routes = [
+                    {
+                      Destination = "0.0.0.0/0";
+                      Gateway = "192.168.50.1";
+                    }
+                  ];
+                  dns = [
+                    "1.1.1.1"
+                    "8.8.8.8"
+                  ];
+                };
+              };
+              tmpfiles.rules = [
+                "d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
+              ];
+            };
+            microvm = {
+              vcpu = 1;
+              mem = 512;
+              hypervisor = "qemu";
+              interfaces = [
+                {
+                  type = "tap";
+                  id = "vm-ff-${user}";
+                  mac = mac;
+                }
+                {
+                  type = "user";
+                  id = "vmuser-firefly";
+                  mac = userMac;
+                }
+              ];
+              forwardPorts = [
+                {
+                  from = "host";
+                  host.port = ssh;
+                  guest.port = 22;
+                }
+              ];
+              shares = [
+                {
+                  mountPoint = "/nix/.ro-store";
+                  proto = "virtiofs";
+                  source = "/nix/store";
+                  tag = "read_only_nix_store";
+                }
+                {
+                  mountPoint = "/var/lib/${serviceCfg.name}";
+                  proto = "virtiofs";
+                  source = "${mnt}/${serviceCfg.name}config";
+                  tag = "${serviceCfg.name}_${user}_config";
+                }
+                {
+                  mountPoint = "/var/lib/postgresql";
+                  proto = "virtiofs";
+                  source = "${mnt}/${serviceCfg.name}/data";
+                  tag = "${serviceCfg.name}_${user}_data";
+                }
+                {
+                  mountPoint = "/run/secrets";
+                  proto = "virtiofs";
+                  source = "/run/secrets/${serviceCfg.name}";
+                  tag = "host_secrets";
+                }
+              ];
+            };
+          };
+        };
+      };
+
+      systemd.tmpfiles.rules = [
+        "d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
+        "d ${mnt}/${serviceCfg.name}/config 0751 microvm wheel - -"
+        "d ${mnt}/${serviceCfg.name}/data 0751 microvm wheel - -"
+      ];
+
+      sops = {
+        secrets = builtins.listToAttrs (
+          map
+            (secret: {
+              name = "${serviceCfg.name}/${user}-${secret}";
+              value = {
+                owner = "root";
+                group = "root";
+                mode = "0644";
+              };
+            })
+            [
+              "pass"
+              "data"
+              "smtp"
+            ]
+        );
+      };
+    };
+}

modules/nixos/homelab/guests/firefly-iii/default.nix

@@ -0,0 +1,50 @@
+{
+  config,
+  flake,
+  pkgs,
+  labHelpers,
+  ...
+}:
+let
+  inherit (import ./config { inherit config flake pkgs; }) fireflyVM;
+  inherit (flake.config.people) user0;
+  inherit (flake.config.people.users.${user0}) email;
+  inherit (flake.config.services.instances) firefly-iii;
+  interface0Cfg = firefly-iii.interfaces.interface0;
+
+  fireflyNick = fireflyVM {
+    user = user0;
+    ip = interface0Cfg.microvm.ip;
+    mac = interface0Cfg.microvm.mac;
+    userMac = interface0Cfg.microvm.macUser;
+    ssh = interface0Cfg.microvm.ssh0;
+    host = interface0Cfg.domain;
+    mnt = "";
+    owner = email.address2;
+  };
+
+  # fireflyStacie = fireflyVM {
+  #   user = "stacie";
+  #   ip = ipAddress (id1);
+  #   mac = "02:00:00:00:${id1}:${id1}";
+  #   userMac = "02:00:00:00:00:${id1}";
+  #   ssh = fireflyEris.ssh1;
+  #   host = "";
+  #   mnt = guestPath "stacie";
+  #   owner = "";
+  # };
+
+  # fireflyGarnet = fireflyVM {
+  #   user = "garnet";
+  #   ip = ipAddress (id2);
+  #   mac = "02:00:00:00:${id2}:${id2}";
+  #   userMac = "02:00:00:00:00:${id2}";
+  #   ssh = fireflyEris.ssh2;
+  #   mnt = guestPath "garnet";
+  #   host = "";
+  #   owner = "";
+  # };
+
+in
+fireflyNick
+# // fireflyStacie // fireflyGarnet

modules/nixos/homelab/guests/forgejo/config/default.nix

@@ -0,0 +1,170 @@
+{
+  flake,
+  ...
+}:
+let
+  inherit (flake.config.people) user0;
+  inherit (flake.config.services) instances;
+  serviceCfg = instances.forgejo;
+  smtpCfg = instances.smtp;
+in
+{
+  forgejoVM =
+    {
+      user,
+      ip,
+      mac,
+      userMac,
+      ssh,
+      mnt,
+      host,
+    }:
+    {
+      microvm.vms = {
+        "${serviceCfg.name}-${user}" = {
+          autostart = true;
+          restartIfChanged = true;
+          config = {
+            system.stateVersion = "24.05";
+            time.timeZone = "America/Winnipeg";
+            users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
+            services = {
+              ${serviceCfg.name} = {
+                enable = true;
+                lfs.enable = true;
+                secrets = {
+                  mailer.PASSWD = "/run/secrets/${user}-smtp";
+                };
+                settings = {
+                  server = {
+                    DOMAIN = host;
+                    ROOT_URL = "https://${host}/";
+                    HTTP_PORT = serviceCfg.ports.port0;
+                  };
+                  # If you need to start from scratch, don't forget to turn this off again
+                  service.DISABLE_REGISTRATION = true;
+                  actions = {
+                    ENABLED = true;
+                    DEFAULT_ACTIONS_URL = "github";
+                  };
+                  mirror = {
+                    ENABLED = true;
+                  };
+                  mailer = {
+                    ENABLED = true;
+                    SMTP_ADDR = smtpCfg.interface.interface1.domain;
+                    FROM = smtpCfg.interfaces.interface1.email;
+                    USER = smtpCfg.interfaces.interface1.email;
+                    PROTOCOL = "smtp+starttls";
+                    SMTP_PORT = smtpCfg.ports.port1;
+                    SEND_AS_PLAIN_TEXT = true;
+                    USE_CLIENT_CERT = false;
+                  };
+                };
+              };
+              openssh = {
+                enable = true;
+                settings = {
+                  PasswordAuthentication = false;
+                  PermitRootLogin = "prohibit-password";
+                };
+              };
+            };
+            networking.firewall.allowedTCPPorts = [
+              22 # SSH
+              25 # SMTP
+              139 # SMTP
+              2525 # SMTP
+              smtpCfg.ports.port0
+              serviceCfg.ports.port0
+            ];
+            fileSystems."/tmp" = {
+              device = "tmpfs";
+              fsType = "tmpfs";
+              options = [
+                "size=4G"
+                "mode=1777"
+              ];
+            };
+            systemd = {
+              network = {
+                enable = true;
+                networks."20-lan" = {
+                  matchConfig.Name = "enp0s5";
+                  addresses = [ { Address = "${ip}/24"; } ];
+                  routes = [
+                    {
+                      Destination = "0.0.0.0/0";
+                      Gateway = "192.168.50.1";
+                    }
+                  ];
+                  dns = [
+                    "1.1.1.1"
+                    "8.8.8.8"
+                  ];
+                };
+              };
+              tmpfiles.rules = [
+                "d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
+              ];
+            };
+            systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
+            microvm = {
+              vcpu = 1;
+              mem = 1024;
+              hypervisor = "qemu";
+              interfaces = [
+                {
+                  type = "tap";
+                  id = "vm-fg-${user}";
+                  mac = mac;
+                }
+                {
+                  type = "user";
+                  id = "vmuser-cloud";
+                  mac = userMac;
+                }
+              ];
+              forwardPorts = [
+                {
+                  from = "host";
+                  host.port = ssh;
+                  guest.port = 22;
+                }
+              ];
+              shares = [
+                {
+                  mountPoint = "/nix/.ro-store";
+                  proto = "virtiofs";
+                  source = "/nix/store";
+                  tag = "read_only_nix_store";
+                }
+                {
+                  mountPoint = "/var/lib/${serviceCfg.name}";
+                  proto = "virtiofs";
+                  source = "${mnt}/${serviceCfg.name}";
+                  tag = "${serviceCfg.name}_${user}_data";
+                }
+                {
+                  mountPoint = "/run/secrets";
+                  proto = "virtiofs";
+                  source = "/run/secrets/${serviceCfg.name}";
+                  tag = "host_secrets";
+                }
+              ];
+            };
+          };
+        };
+      };
+
+      systemd.tmpfiles.rules = [
+        "d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
+      ];
+      sops.secrets = {
+        "${serviceCfg.name}/${user}-smtp" = {
+          owner = "root";
+          mode = "0600";
+        };
+      };
+    };
+}

modules/nixos/homelab/guests/forgejo/default.nix

@@ -0,0 +1,25 @@
+{
+  flake,
+  pkgs,
+  labHelpers,
+  ...
+}:
+let
+  inherit (import ./config { inherit flake pkgs; }) forgejoVM;
+  inherit (flake.config.people) user0;
+  inherit (flake.config.services) instances;
+
+  interface0Cfg = instances.forgejo.interfaces.interface0;
+
+  forgejoNick = forgejoVM {
+    user = user0;
+    ip = interface0Cfg.microvm.ip;
+    mac = interface0Cfg.microvm.mac;
+    userMac = interface0Cfg.microvm.macUser;
+    ssh = interface0Cfg.microvm.ssh;
+    mnt = "";
+    host = interface0Cfg.domain;
+  };
+in
+forgejoNick
+# // forgejoStacie // forgejoGarnet

modules/nixos/homelab/guests/helpers.nix

@@ -0,0 +1,8 @@
+{
+  labHelpers = {
+    guestPath = user: "/mnt/storage/users/${user}/guests";
+    docsPath = user: "/mnt/storage/users/${user}/home/docs";
+    mediaPath = user: "/mnt/storage/users/${user}/home/media";
+    miscPath = user: "/mnt/storage/users/${user}/home/misc";
+  };
+}

modules/nixos/homelab/guests/jellyfin/config/default.nix

@@ -0,0 +1,169 @@
+{
+  config,
+  flake,
+  ...
+}:
+let
+  inherit (flake.config.people) user0;
+  inherit (flake.config.services) instances;
+  serviceCfg = instances.jellyfin;
+  id = 993;
+in
+{
+  forgejoVM =
+    {
+      user,
+      ip,
+      mac,
+      userMac,
+      ssh,
+      mnt,
+      host,
+    }:
+
+    {
+      microvm.vms = {
+        "${serviceCfg.name}-${user}" = {
+          autostart = true;
+          restartIfChanged = true;
+          config = {
+            system.stateVersion = "25.05";
+            time.timeZone = "America/Winnipeg";
+            users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
+            services = {
+              jellyfin = {
+                enable = true;
+                openFirewall = true;
+              };
+              openssh = {
+                enable = true;
+                settings = {
+                  PasswordAuthentication = false;
+                  PermitRootLogin = "prohibit-password";
+                };
+              };
+            };
+            users.users.jellyfin = {
+              isSystemUser = true;
+              group = serviceCfg.name;
+              uid = id;
+            };
+            users.groups.jellyfin = {
+              gid = id;
+            };
+            networking.firewall.allowedTCPPorts = [
+              22
+              serviceCfg.ports.port0
+              serviceCfg.ports.port1
+              serviceCfg.ports.port2
+            ];
+            fileSystems."/tmp" = {
+              device = "tmpfs";
+              fsType = "tmpfs";
+              options = [
+                "size=6G"
+                "mode=1777"
+              ];
+            };
+            systemd = {
+              network = {
+                enable = true;
+                networks."20-lan" = {
+                  matchConfig.Name = "enp0s6";
+                  addresses = [ { Address = "${ip}/24"; } ];
+                  routes = [
+                    {
+                      Destination = "0.0.0.0/0";
+                      Gateway = "192.168.50.1";
+                    }
+                  ];
+                  dns = [
+                    "1.1.1.1"
+                    "8.8.8.8"
+                  ];
+                };
+              };
+              tmpfiles.rules = [
+                "d /var/cache/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
+                "d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
+                "d /var/lib/${serviceCfg.name}-media 0755 ${serviceCfg.name} ${serviceCfg.name} -"
+              ];
+            };
+            systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
+            microvm = {
+              vcpu = 4;
+              mem = 1024 * 3;
+              hypervisor = "qemu";
+              interfaces = [
+                {
+                  type = "tap";
+                  id = "vm-jf-${user}";
+                  mac = mac;
+                }
+                {
+                  type = "user";
+                  id = "vmuser-cloud";
+                  mac = user;
+                }
+              ];
+              forwardPorts = [
+                {
+                  from = "host";
+                  host.port = ssh;
+                  guest.port = 22;
+                }
+              ];
+              shares = [
+                {
+                  mountPoint = "/nix/.ro-store";
+                  proto = "virtiofs";
+                  source = "/nix/store";
+                  tag = "read_only_nix_store";
+                }
+                {
+                  mountPoint = "/var/lib/${serviceCfg.name}";
+                  proto = "virtiofs";
+                  source = "${mnt}/${serviceCfg.name}/data";
+                  tag = "${serviceCfg.name}_${user}_data";
+                }
+                {
+                  mountPoint = "/var/cache/${serviceCfg.name}";
+                  proto = "virtiofs";
+                  source = "${mnt}/${serviceCfg.name}/cache";
+                  tag = "${serviceCfg.name}_${user}_cache";
+                }
+                {
+                  mountPoint = "/var/lib/${serviceCfg.name}-media";
+                  proto = "virtiofs";
+                  source = "${mnt}/${serviceCfg.name}/media";
+                  tag = "${serviceCfg.name}_${user}_media";
+                }
+              ];
+            };
+          };
+        };
+      };
+
+      users = {
+        groups.jellyfin = {
+          gid = id;
+          members = [ user0 ];
+        };
+        users = {
+          jellyfin = {
+            isSystemUser = true;
+            group = serviceCfg.name;
+            uid = id;
+          };
+          caddy.extraGroups = [ "acme" ];
+        };
+      };
+
+      systemd.tmpfiles.rules = [
+        "d ${mnt}/${serviceCfg.name} 0755 microvm wheel - -"
+        "d ${mnt}/${serviceCfg.name}/data 0755 microvm wheel - -"
+        "d ${mnt}/${serviceCfg.name}/cache 0755 microvm wheel - -"
+        "d ${mnt}/${serviceCfg.name}/media 0775 microvm wheel - -"
+      ];
+    };
+}

modules/nixos/homelab/guests/jellyfin/default.nix

@@ -0,0 +1,25 @@
+{
+  flake,
+  pkgs,
+  labHelpers,
+  ...
+}:
+let
+  inherit (import ./config { inherit flake pkgs; }) jellyfinVM;
+  inherit (flake.config.people) user0;
+  inherit (flake.config.services) instances;
+
+  interface0Cfg = instances.jellyfin.interfaces.interface0;
+
+  jellyfinNick = jellyfinVM {
+    user = user0;
+    ip = interface0Cfg.microvm.ip;
+    mac = interface0Cfg.microvm.mac;
+    userMac = interface0Cfg.microvm.macUser;
+    ssh = interface0Cfg.microvm.ssh;
+    mnt = "";
+    host = interface0Cfg.domain;
+  };
+in
+jellyfinNick
+# // forgejoStacie // forgejoGarnet

modules/nixos/homelab/guests/mastodon/config/config/chars.patch

@@ -0,0 +1,20 @@
+diff --git a/app/javascript/mastodon/features/compose/containers/compose_form_container.js b/app/javascript/mastodon/features/compose/containers/compose_form_container.js
+--- a/app/javascript/mastodon/features/compose/containers/compose_form_container.js
++++ b/app/javascript/mastodon/features/compose/containers/compose_form_container.js
+@@ -32,5 +32,5 @@
+   isInReply: state.getIn(['compose', 'in_reply_to']) !== null,
+   lang: state.getIn(['compose', 'language']),
+-  maxChars: state.getIn(['server', 'server', 'configuration', 'statuses', 'max_characters'], 500),
++  maxChars: state.getIn(['server', 'server', 'configuration', 'statuses', 'max_characters'], 5000),
+ });
+
+diff --git a/app/validators/status_length_validator.rb b/app/validators/status_length_validator.rb
+--- a/app/validators/status_length_validator.rb
++++ b/app/validators/status_length_validator.rb
+@@ -2,6 +2,6 @@
+
+ class StatusLengthValidator < ActiveModel::Validator
+-  MAX_CHARS = 500
++  MAX_CHARS = 5000
+   URL_PLACEHOLDER_CHARS = 23
+   URL_PLACEHOLDER = 'x' * 23

modules/nixos/homelab/guests/mastodon/config/default.nix

@@ -0,0 +1,499 @@
+{
+  flake,
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  inherit (flake.config.people) user0;
+  inherit (flake.config.services) instances;
+  serviceCfg = instances.mastodon;
+  smtpCfg = instances.smtp;
+
+in
+{
+  mastodonVM =
+    {
+      user,
+      ip,
+      mac,
+      userMac,
+      ssh,
+      mnt,
+      host,
+    }:
+    {
+      # If you need to start fresh for some reason, run these to create the new Admin account:
+      # sudo -u mastodon mastodon-tootctl accounts create nick --email=nick@localhost --confirmed --role=Owner
+      # sudo -u mastodon mastodon-tootctl accounts approve nick
+      # If you fuck up and lose the password, use this:
+      # sudo mastodon-tootctl accounts modify --reset-password nick
+      # If you really fuck up and name yourself wrong, use this shit
+      # sudo mastodon-tootctl accounts modify username --remove-role
+
+      nixpkgs.overlays = [
+        (final: prev: {
+          mastodon = prev.mastodon.overrideAttrs (oldAttrs: {
+            patches = (oldAttrs.patches or [ ]) ++ [
+              ./config/chars.patch
+            ];
+          });
+        })
+      ];
+
+      microvm.vms = {
+        "${serviceCfg.name}-${user}" = {
+          autostart = true;
+          restartIfChanged = true;
+          config = {
+            system.stateVersion = "24.05";
+            time.timeZone = "America/Winnipeg";
+            users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
+
+            services = {
+              ${serviceCfg.name} = {
+                enable = true;
+                localDomain = host;
+                secretKeyBaseFile = "/etc/mastodon-secrets/${user}-pass";
+                streamingProcesses = 7;
+                trustedProxy = "127.0.0.1";
+                automaticMigrations = true;
+                database = {
+                  createLocally = true;
+                  name = serviceCfg.name;
+                  host = "/run/postgresql";
+                  user = serviceCfg.name;
+                  passwordFile = "/etc/mastodon-secrets/${user}-database";
+                };
+                extraConfig = {
+                  SINGLE_USER_MODE = "false";
+                  SMTP_AUTH_METHOD = "plain";
+                  SMTP_DELIVERY_METHOD = "smtp";
+                  SMTP_ENABLE_STARTTLS_AUTO = "true";
+                  SMTP_SSL = "false";
+                };
+
+                # if you're starting from scratch, you gotta cd into /var/lib/mastodon and run:
+                # sudo -u mastodon mastodon-tootctl search deploy
+
+                elasticsearch = {
+                  preset = "single_node_cluster";
+                  host = "127.0.0.1";
+                  port = 9200;
+                };
+                mediaAutoRemove = {
+                  enable = true;
+                  olderThanDays = 14;
+                };
+                redis = {
+                  createLocally = true;
+                  enableUnixSocket = true;
+                };
+                sidekiqThreads = 25;
+                sidekiqProcesses = {
+                  all = {
+                    jobClasses = [ ];
+                    threads = null;
+                  };
+                  default = {
+                    jobClasses = [ "default" ];
+                    threads = 5;
+                  };
+                  ingress = {
+                    jobClasses = [ "ingress" ];
+                    threads = 5;
+                  };
+                  push-pull = {
+                    jobClasses = [
+                      "push"
+                      "pull"
+                    ];
+                    threads = 5;
+                  };
+                  mailers = {
+                    jobClasses = [ "mailers" ];
+                    threads = 5;
+                  };
+                };
+                smtp = {
+                  authenticate = true;
+                  createLocally = false;
+                  fromAddress = "upRootNutrition <${smtpCfg.interfaces.interface1.email}>";
+                  host = smtpCfg.interfaces.interface1.domain;
+                  passwordFile = "/etc/mastodon-secrets/${user}-smtp";
+                  port = smtpCfg.ports.port1;
+                  user = smtpCfg.interfaces.interface1.email;
+                };
+              };
+              opensearch.enable = true;
+              caddy = {
+                enable = true;
+                virtualHosts = {
+                  ":80" = {
+                    extraConfig = ''
+                      handle_path /system/* {
+                        file_server * {
+                          root /var/lib/mastodon/public-system
+                        }
+                      }
+
+                      handle /api/v1/streaming/* {
+                        reverse_proxy unix//run/mastodon-streaming/streaming.socket {
+                          header_up X-Forwarded-Proto {http.request.header.X-Forwarded-Proto}
+                          header_up X-Forwarded-Host {http.request.header.X-Forwarded-Host}
+                        }
+                      }
+
+                      route * {
+                        file_server * {
+                          root ${pkgs.mastodon}/public
+                          pass_thru
+                        }
+                        reverse_proxy * unix//run/mastodon-web/web.socket {
+                          header_up X-Forwarded-Proto {http.request.header.X-Forwarded-Proto}
+                          header_up X-Forwarded-Host {http.request.header.X-Forwarded-Host}
+                        }
+                      }
+
+                      handle_errors {
+                        root * ${pkgs.mastodon}/public
+                        rewrite 500.html
+                        file_server
+                      }
+
+                      encode gzip
+
+                      header /* {
+                        Strict-Transport-Security "max-age=31536000;"
+                      }
+
+                      header /emoji/* Cache-Control "public, max-age=31536000, immutable"
+                      header /packs/* Cache-Control "public, max-age=31536000, immutable"
+                      header /system/accounts/avatars/* Cache-Control "public, max-age=31536000, immutable"
+                      header /system/media_attachments/files/* Cache-Control "public, max-age=31536000, immutable"
+                    '';
+                  };
+                };
+              };
+
+              postgresql = {
+                enable = true;
+              };
+
+              openssh = {
+                enable = true;
+                settings = {
+                  PasswordAuthentication = false;
+                  PermitRootLogin = "prohibit-password";
+                };
+              };
+            };
+
+            users.users = {
+              ${serviceCfg.name}.extraGroups = [ "postgres" ];
+              caddy.extraGroups = [ serviceCfg.name ];
+              fedifetcher = {
+                isSystemUser = true;
+                group = "fedifetcher";
+                home = "/var/lib/fedifetcher";
+                createHome = true;
+              };
+            };
+
+            users.groups.fedifetcher = { };
+
+            networking.firewall.allowedTCPPorts = [
+              22 # SSH
+              80 # Caddy
+              25 # SMTP
+              139 # SMTP
+              587 # SMTP
+              2525 # SMTP
+              5432 # Postgres
+            ];
+
+            systemd = {
+              services = {
+                mastodon-init-dirs.serviceConfig.PrivateMounts = lib.mkForce false;
+                mastodon-web.serviceConfig.PrivateMounts = lib.mkForce false;
+                mastodon-streaming-1.serviceConfig.PrivateMounts = lib.mkForce false;
+                mastodon-streaming-2.serviceConfig.PrivateMounts = lib.mkForce false;
+                mastodon-streaming-3.serviceConfig.PrivateMounts = lib.mkForce false;
+                mastodon-streaming-4.serviceConfig.PrivateMounts = lib.mkForce false;
+                mastodon-streaming-5.serviceConfig.PrivateMounts = lib.mkForce false;
+                mastodon-streaming-6.serviceConfig.PrivateMounts = lib.mkForce false;
+                mastodon-streaming-7.serviceConfig.PrivateMounts = lib.mkForce false;
+                mastodon-sidekiq-all.serviceConfig.PrivateMounts = lib.mkForce false;
+                mastodon-sidekiq-default.serviceConfig.PrivateMounts = lib.mkForce false;
+                mastodon-sidekiq-ingress.serviceConfig.PrivateMounts = lib.mkForce false;
+                mastodon-sidekiq-mailers.serviceConfig.PrivateMounts = lib.mkForce false;
+                mastodon-sidekiq-push-pull.serviceConfig.PrivateMounts = lib.mkForce false;
+
+                mastodon-elastic-search = {
+                  description = "Recache elastic search";
+                  after = [
+                    "network-online.target"
+                    "mastodon-web.service"
+                  ];
+                  wants = [ "network-online.target" ];
+                  serviceConfig = {
+                    WorkingDirectory = "/var/lib/${serviceCfg.name}";
+                    Type = "oneshot";
+                  };
+                  script = ''
+                    /run/current-system/sw/bin/mastodon-tootctl search deploy --only=instances accounts tags statuses public_statuses
+                  '';
+                };
+
+                mastodon-copy-secrets = {
+                  description = "Copy secrets from virtiofs to local filesystem";
+                  before = [ "mastodon-init-dirs.service" ];
+                  requiredBy = [ "mastodon-init-dirs.service" ];
+
+                  serviceConfig = {
+                    Type = "oneshot";
+                    RemainAfterExit = true;
+                  };
+
+                  script = ''
+                    mkdir -p /etc/mastodon-secrets
+                    cp /run/secrets/${user}-pass /etc/mastodon-secrets/${user}-pass
+                    cp /run/secrets/${user}-database /etc/mastodon-secrets/${user}-database
+                    cp /run/secrets/${user}-redis /etc/mastodon-secrets/${user}-redis
+                    cp /run/secrets/${user}-smtp /etc/mastodon-secrets/${user}-smtp
+                    cp /run/secrets/${user}-fedifetcher-token /etc/mastodon-secrets/${user}-fedifetcher
+                    chmod 755 /etc/mastodon-secrets
+                    chmod 644 /etc/mastodon-secrets/*
+                  '';
+                };
+
+                fedifetcher = {
+                  description = "FediFetcher - Fetch missing posts for Mastodon";
+                  after = [
+                    "network-online.target"
+                    "mastodon-web.service"
+                  ];
+                  wants = [ "network-online.target" ];
+
+                  serviceConfig =
+                    let
+                      fedifetcherConfig = pkgs.writeText "fedifetcher-config.json" (
+                        builtins.toJSON {
+                          server = "https://${host}";
+                          home-timeline-length = 200;
+                          max-followings = 80;
+                          from-notifications = 1;
+                          max-bookmarks = 80;
+                          max-favourites = 40;
+                          backfill-with-context = 1;
+                          backfill-mentioned-users = 1;
+                          remember-users-for-hours = 168;
+                          remember-hosts-for-days = 30;
+                          http-timeout = 5;
+                          lock-hours = 24;
+                          log-level = "INFO";
+                        }
+                      );
+                    in
+                    {
+                      Type = "oneshot";
+                      User = "fedifetcher";
+                      Group = "fedifetcher";
+                      WorkingDirectory = "/var/lib/fedifetcher";
+                      TimeoutStartSec = "300";
+                      PrivateTmp = true;
+                      NoNewPrivileges = true;
+                      ProtectSystem = "strict";
+                      ProtectHome = true;
+                      ReadWritePaths = "/var/lib/fedifetcher";
+                      ExecStart =
+                        let
+                          script = pkgs.writeShellScript "fedifetcher-run" ''
+                            set -e
+
+                            # Wait for Mastodon to be fully ready
+                            for i in {1..30}; do
+                              if ${pkgs.curl}/bin/curl -sf http://localhost:80/health >/dev/null 2>&1; then
+                                echo "Mastodon is ready"
+                                break
+                              fi
+                              echo "Waiting for Mastodon to be ready... ($i/30)"
+                              sleep 2
+                            done
+
+                            export ACCESS_TOKEN=$(cat /etc/mastodon-secrets/${user}-fedifetcher)
+                            ${pkgs.fedifetcher}/bin/fedifetcher \
+                              -c=${fedifetcherConfig} \
+                              --access-token="$ACCESS_TOKEN"
+                          '';
+                        in
+                        "${script}";
+                    };
+                };
+
+                mastodon-init-db.serviceConfig.EnvironmentFile = "/var/lib/mastodon/.secrets_env";
+
+                systemd-tmpfiles-setup.after = [ "var-lib-mastodon.mount" ];
+
+                opensearch-install-plugins = {
+                  description = "Install OpenSearch plugins";
+                  before = [ "opensearch.service" ];
+                  requiredBy = [ "opensearch.service" ];
+                  serviceConfig = {
+                    Type = "oneshot";
+                    RemainAfterExit = true;
+                  };
+                  script = ''
+                    PLUGIN_DIR="/var/lib/opensearch/plugins/analysis-icu"
+                    if [ ! -d "$PLUGIN_DIR" ]; then
+                      # Create the plugins directory if it doesn't exist
+                      mkdir -p /var/lib/opensearch/plugins
+                      
+                      # Install using the proper OpenSearch plugin command
+                      export OPENSEARCH_JAVA_HOME="${pkgs.jdk17}/lib/openjdk"
+                      ${pkgs.opensearch}/bin/opensearch-plugin install --batch analysis-icu || {
+                        echo "Plugin installation failed, but continuing anyway"
+                        exit 0
+                      }
+                    fi
+                  '';
+                };
+              };
+              timers = {
+                mastodon-elastic-search = {
+                  description = "Timer for Mastodon elastic search recaching";
+                  wantedBy = [ "timers.target" ];
+                  timerConfig = {
+                    OnBootSec = "10min";
+                    OnUnitActiveSec = "60min";
+                    Unit = "mastodon-elastic-search.service";
+                  };
+                };
+
+                fedifetcher = {
+                  description = "Timer for FediFetcher";
+                  wantedBy = [ "timers.target" ];
+                  timerConfig = {
+                    OnBootSec = "10min";
+                    OnUnitActiveSec = "15min";
+                    Unit = "fedifetcher.service";
+                    Persistent = true;
+                    AccuracySec = "1min";
+                  };
+                };
+              };
+
+              network = {
+                enable = true;
+                networks."20-lan" = {
+                  matchConfig.Name = "enp0s6";
+                  addresses = [ { Address = "${ip}/24"; } ];
+                  routes = [
+                    {
+                      Destination = "0.0.0.0/0";
+                      Gateway = "192.168.50.1";
+                    }
+                  ];
+                  dns = [
+                    "1.1.1.1"
+                    "8.8.8.8"
+                  ];
+                };
+              };
+
+              tmpfiles.rules = [
+                "d /var/lib/mastodon 0755 mastodon mastodon -"
+                "Z /var/lib/mastodon 0755 mastodon mastodon -"
+                "Z /var/lib/postgresql 0755 postgres postgres -"
+                "d /var/cache/mastodon/precompile 0755 mastodon mastodon -"
+                "d /var/lib/mastodon/public-system 0755 mastodon mastodon -"
+                "d /var/lib/mastodon/public-system/accounts 0755 mastodon mastodon -"
+                "d /var/lib/mastodon/public-system/media_attachments 0755 mastodon mastodon -"
+                "d /var/lib/mastodon/public-system/media_attachments/files 0755 mastodon mastodon -"
+                "d /var/lib/mastodon/public-system/site_uploads 0755 mastodon mastodon -"
+                "d /var/lib/fedifetcher 0755 fedifetcher fedifetcher -"
+              ];
+            };
+
+            microvm = {
+              vcpu = 2;
+              mem = 1024 * 6;
+              hypervisor = "qemu";
+              interfaces = [
+                {
+                  type = "tap";
+                  id = "vm-md-${user}";
+                  mac = mac;
+                }
+                {
+                  type = "user";
+                  id = "vmuser-cloud";
+                  mac = userMac;
+                }
+              ];
+              forwardPorts = [
+                {
+                  from = "host";
+                  host.port = ssh;
+                  guest.port = 22;
+                }
+              ];
+              shares = [
+                {
+                  mountPoint = "/nix/.ro-store";
+                  proto = "virtiofs";
+                  source = "/nix/store";
+                  tag = "read_only_nix_store";
+                }
+                {
+                  mountPoint = "/var/lib/${serviceCfg.name}";
+                  proto = "virtiofs";
+                  source = "${mnt}/${serviceCfg.name}/data";
+                  tag = "${serviceCfg.name}_data";
+                }
+                {
+                  mountPoint = "/var/lib/postgresql";
+                  proto = "virtiofs";
+                  source = "${mnt}/${serviceCfg.name}/database";
+                  tag = "${serviceCfg.name}_${user}_database";
+                }
+                {
+                  mountPoint = "/run/secrets";
+                  proto = "virtiofs";
+                  source = "/run/secrets/${serviceCfg.name}";
+                  tag = "host_secrets";
+                }
+              ];
+            };
+          };
+        };
+      };
+
+      sops = {
+        secrets = builtins.listToAttrs (
+          map
+            (secret: {
+              name = "${serviceCfg.name}/${user}-${secret}";
+              value = {
+                owner = "root";
+                group = "root";
+                mode = "0644";
+              };
+            })
+            [
+              "smtp"
+              "database"
+              "redis"
+              "pass"
+              "fedifetcher"
+            ]
+        );
+      };
+      systemd.tmpfiles.rules = [
+        "d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
+        "d ${mnt}/${serviceCfg.name}/data 0751 microvm wheel - -"
+        "d ${mnt}/${serviceCfg.name}/database 0751 microvm wheel - -"
+      ];
+    };
+}

modules/nixos/homelab/guests/mastodon/default.nix

@@ -0,0 +1,25 @@
+{
+  flake,
+  pkgs,
+  labHelpers,
+  ...
+}:
+let
+  inherit (import ./config { inherit flake pkgs; }) mastodonVM;
+  inherit (flake.config.people) user0;
+  inherit (flake.config.services) instances;
+
+  interface0Cfg = instances.mastodon.interfaces.interface0;
+
+  mastodonNick = mastodonVM {
+    user = user0;
+    ip = interface0Cfg.microvm.ip;
+    mac = interface0Cfg.microvm.mac;
+    userMac = interface0Cfg.microvm.macUser;
+    ssh = interface0Cfg.microvm.ssh;
+    mnt = "";
+    host = interface0Cfg.domain;
+  };
+in
+mastodonNick
+# // mastodonStacie // mastodonGarnet

modules/nixos/homelab/guests/minecraft/config/default.nix

@@ -0,0 +1,162 @@
+{
+  flake,
+  ...
+}:
+let
+  inherit (flake.config.people) user0;
+  serviceCfg = {
+    name = "minecraft";
+  };
+in
+{
+  minecraftVM =
+    {
+      user,
+      ip,
+      mac,
+      userMac,
+      ssh,
+      port,
+      mnt,
+      config,
+      whitelist,
+      worldNumber,
+    }:
+    {
+      microvm.vms = {
+        "${serviceCfg.name}-${user}" = {
+          autostart = true;
+          restartIfChanged = true;
+          config = {
+            system.stateVersion = "24.05";
+            time.timeZone = "America/Winnipeg";
+            users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
+            services = {
+              minecraft-server = {
+                enable = true;
+                eula = true;
+                openFirewall = true;
+                declarative = true;
+                serverProperties = {
+                  "rcon.password" = "/etc/${serviceCfg.name}-secrets/${user}-world${worldNumber}";
+                  server-port = port;
+                }
+                // config;
+                whitelist = whitelist;
+              };
+              openssh = {
+                enable = true;
+                settings = {
+                  PasswordAuthentication = false;
+                  PermitRootLogin = "prohibit-password";
+                };
+              };
+            };
+            networking.firewall.allowedTCPPorts = [
+              22
+              port
+            ];
+            systemd = {
+              services = {
+                "${serviceCfg.name}-copy-secrets" = {
+                  description = "Copy secrets from virtiofs to local filesystem";
+                  before = [ "minecraft-server.service" ];
+                  requiredBy = [ "minecraft-server.service" ];
+
+                  serviceConfig = {
+                    Type = "oneshot";
+                    RemainAfterExit = true;
+                  };
+                  script = ''
+                    mkdir -p /etc/${serviceCfg.name}-secrets
+                    cp /run/secrets/${user}-world${worldNumber} /etc/${serviceCfg.name}-secrets/${user}-world${worldNumber}
+                    chmod 755 /etc/${serviceCfg.name}-secrets
+                    chmod 644 /etc/${serviceCfg.name}-secrets/*
+                  '';
+                };
+                systemd-networkd.wantedBy = [ "multi-user.target" ];
+              };
+              network = {
+                enable = true;
+                networks."20-lan" = {
+                  matchConfig.Name = "enp0s5";
+                  addresses = [
+                    { Address = "${ip}/24"; }
+                  ];
+                  routes = [
+                    {
+                      Destination = "0.0.0.0/0";
+                      Gateway = "192.168.50.1";
+                    }
+                  ];
+                  dns = [
+                    "1.1.1.1"
+                    "8.8.8.8"
+                  ];
+                };
+              };
+              tmpfiles.rules = [
+                "d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
+              ];
+            };
+            microvm = {
+              vcpu = 4;
+              mem = 1024 * 4;
+              hypervisor = "qemu";
+              interfaces = [
+                {
+                  type = "tap";
+                  id = "vm-mc${worldNumber}-${user}";
+                  mac = mac;
+                }
+                {
+                  type = "user";
+                  id = "vmuser-craft";
+                  mac = userMac;
+                }
+              ];
+              forwardPorts = [
+                {
+                  from = "host";
+                  host.port = ssh;
+                  guest.port = 22;
+                }
+              ];
+              shares = [
+                {
+                  mountPoint = "/nix/.ro-store";
+                  proto = "virtiofs";
+                  source = "/nix/store";
+                  tag = "read_only_nix_store";
+                }
+                {
+                  mountPoint = "/var/lib/${serviceCfg.name}";
+                  proto = "virtiofs";
+                  source = "${mnt}/${serviceCfg.name}/world${worldNumber}";
+                  tag = "${serviceCfg.name}_${user}_data";
+                }
+                {
+                  mountPoint = "/run/secrets";
+                  proto = "virtiofs";
+                  source = "/run/secrets/${serviceCfg.name}";
+                  tag = "host_secrets";
+                }
+              ];
+            };
+          };
+        };
+      };
+      networking.firewall.allowedTCPPorts = [ port ];
+
+      systemd.tmpfiles.rules = [
+        "d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
+      ];
+
+      sops.secrets = {
+        "${serviceCfg.name}/${user}-world${worldNumber}" = {
+          owner = "root";
+          mode = "0600";
+        };
+      };
+    };
+}

modules/nixos/homelab/guests/minecraft/default.nix

@@ -0,0 +1,105 @@
+{
+  flake,
+  pkgs,
+  labHelpers,
+  ...
+}:
+let
+  inherit (import ./config { inherit flake pkgs; }) minecraftVM;
+  inherit (flake.config.services) instances;
+  inherit (flake.config.people) user0;
+
+  minecraftNick01 =
+    let
+      interfaceCfg = instances.minecraft.interfaces.interface0;
+    in
+    minecraftVM {
+      user = user0;
+      ip = interfaceCfg.microvm.ip;
+      mac = interfaceCfg.microvm.mac;
+      userMac = interfaceCfg.microvm.macUser;
+      ssh = interfaceCfg.microvm.ssh;
+      port = interfaceCfg.microvm.port;
+      mnt = "";
+      worldNumber = "01";
+      config = {
+        allow-flight = false;
+        allow-nether = true;
+        difficulty = 2;
+        enable-command-block = false;
+        enable-rcon = true;
+        enable-status = true;
+        force-gamemode = true;
+        gamemode = 0;
+        generate-structures = true;
+        hardcore = false;
+        hide-online-players = false;
+        level-name = "Brix on Nix";
+        level-seed = "9064150133272194";
+        max-players = 10;
+        max-world-size = 64000000;
+        motd = "A cool Minecraft server powered by NixOS";
+        online-mode = true;
+        pvp = true;
+        spawn-animals = true;
+        spawn-monsters = true;
+        spawn-npcs = true;
+        spawn-protection = 16;
+        view-distance = 32;
+        white-list = true;
+      };
+      whitelist = {
+        Hefty_Chungus = "b75a9816-d408-4c54-b226-385b59ea1cb3";
+        Hefty_Chungus_Jr = "c3bf8cac-e953-4ea4-ae5f-7acb92a51a85";
+        EclipseMoon01 = "adef4af7-d8c6-4627-b492-e990ea1bb993";
+        Fallaryn = "d8baa117-ab58-4b07-92a5-48fb1978eb49";
+      };
+    };
+
+  minecraftNick02 =
+    let
+      interfaceCfg = instances.minecraft.interfaces.interface1;
+    in
+    minecraftVM {
+      user = user0;
+      ip = interfaceCfg.microvm.ip;
+      mac = interfaceCfg.microvm.mac;
+      userMac = interfaceCfg.microvm.macUser;
+      ssh = interfaceCfg.microvm.ssh;
+      port = interfaceCfg.microvm.port;
+      mnt = "";
+      worldNumber = "02";
+      config = {
+        allow-flight = false;
+        allow-nether = true;
+        difficulty = 2;
+        enable-command-block = false;
+        enable-rcon = true;
+        enable-status = true;
+        force-gamemode = true;
+        gamemode = 0;
+        generate-structures = true;
+        hardcore = false;
+        hide-online-players = false;
+        level-name = "Cuddle Cubes";
+        level-seed = "-2332803749585407299";
+        max-players = 10;
+        max-world-size = 64000000;
+        motd = "A cool Minecraft server powered by NixOS";
+        online-mode = true;
+        pvp = true;
+        spawn-animals = true;
+        spawn-monsters = true;
+        spawn-npcs = true;
+        spawn-protection = 16;
+        view-distance = 32;
+        white-list = true;
+      };
+      whitelist = {
+        Hefty_Chungus = "b75a9816-d408-4c54-b226-385b59ea1cb3";
+        Fallaryn = "d8baa117-ab58-4b07-92a5-48fb1978eb49";
+      };
+    };
+
+in
+minecraftNick01 // minecraftNick02

modules/nixos/homelab/guests/onlyoffice/config/default.nix

@@ -0,0 +1,3 @@
+{
+
+}

modules/nixos/homelab/guests/onlyoffice/default.nix

@@ -0,0 +1,3 @@
+{
+
+}

modules/nixos/homelab/guests/opencloud/config/default.nix

@@ -0,0 +1,186 @@
+{
+  flake,
+  pkgs,
+  ...
+}:
+let
+  inherit (flake.config.people) user0;
+  inherit (flake.config.services.instances) opencloud;
+  serviceCfg = opencloud;
+in
+{
+  opencloudVM =
+    {
+      user,
+      ip,
+      mac,
+      userMac,
+      ssh,
+      mnt,
+      host,
+    }:
+    {
+      microvm.vms = {
+        "${serviceCfg.name}-${user}" = {
+          autostart = true;
+          restartIfChanged = true;
+          config = {
+            system.stateVersion = "24.05";
+            time.timeZone = "America/Winnipeg";
+            users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
+            services = {
+              opencloud = {
+                enable = true;
+                url = "https://${host}";
+                port = 9200;
+                address = "0.0.0.0";
+                stateDir = "/var/lib/${serviceCfg.name}";
+                environmentFile = "/run/secrets/${user}-env";
+              };
+              openssh = {
+                enable = true;
+                settings = {
+                  PasswordAuthentication = false;
+                  PermitRootLogin = "prohibit-password";
+                };
+              };
+            };
+            networking.firewall.allowedTCPPorts = [
+              22
+              587
+              9200
+            ];
+            systemd = {
+              services = {
+                systemd-networkd.wantedBy = [ "multi-user.target" ];
+                opencloud = {
+                  path = [ pkgs.inotify-tools ];
+                };
+                opencloud-fix-permissions = {
+                  description = "Fix OpenCloud storage permissions";
+                  after = [ "opencloud.service" ];
+                  serviceConfig = {
+                    Type = "oneshot";
+                    ExecStart = pkgs.writeShellScript "fix-perms" ''
+                      echo "Starting permission fix..."
+                      OPENCLOUD_UID=$(id -u opencloud)
+                      echo "OpenCloud UID: $OPENCLOUD_UID"
+                      find /var/lib/opencloud/storage/users -type f ! -uid "$OPENCLOUD_UID" 2>/dev/null | while read -r file; do
+                        echo "Fixing file: $file"
+                        chown opencloud:opencloud "$file" 2>/dev/null || true
+                      done
+                      find /var/lib/opencloud/storage/users -type d ! -uid "$OPENCLOUD_UID" 2>/dev/null | while read -r dir; do
+                        echo "Fixing dir: $dir"
+                        chown opencloud:opencloud "$dir" 2>/dev/null || true
+                      done
+                      echo "Permission fix complete"
+                    '';
+                    User = "root";
+                  };
+                };
+              };
+              timers.opencloud-fix-permissions = {
+                description = "Periodically fix OpenCloud storage permissions";
+                wantedBy = [ "timers.target" ];
+                timerConfig = {
+                  OnBootSec = "30s";
+                  OnUnitActiveSec = "2min";
+                  Unit = "opencloud-fix-permissions.service";
+                };
+              };
+              network = {
+                enable = true;
+                networks."20-lan" = {
+                  matchConfig.Name = "enp0s5";
+                  addresses = [
+                    { Address = "${ip}/24"; }
+                  ];
+                  routes = [
+                    {
+                      Destination = "0.0.0.0/0";
+                      Gateway = "192.168.50.1";
+                    }
+                  ];
+                  dns = [
+                    "1.1.1.1"
+                    "8.8.8.8"
+                  ];
+                };
+              };
+              tmpfiles.rules = [
+                "d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
+                "z /etc/opencloud 0700 ${serviceCfg.name} ${serviceCfg.name} -"
+              ];
+            };
+            microvm = {
+              vcpu = 1;
+              mem = 512;
+              hypervisor = "qemu";
+              interfaces = [
+                {
+                  type = "tap";
+                  id = "vm-oc-${user}";
+                  mac = mac;
+                }
+                {
+                  type = "user";
+                  id = "vmuser-cloud";
+                  mac = userMac;
+                }
+              ];
+              forwardPorts = [
+                {
+                  from = "host";
+                  host.port = ssh;
+                  guest.port = 22;
+                }
+              ];
+              shares = [
+                {
+                  mountPoint = "/nix/.ro-store";
+                  proto = "virtiofs";
+                  source = "/nix/store";
+                  tag = "read_only_nix_store";
+                }
+                {
+                  mountPoint = "/var/lib/${serviceCfg.name}";
+                  proto = "virtiofs";
+                  source = "${mnt}/${serviceCfg.name}/data";
+                  tag = "${serviceCfg.name}_${user}_data";
+                }
+                {
+                  mountPoint = "/etc/${serviceCfg.name}";
+                  proto = "virtiofs";
+                  source = "${mnt}/${serviceCfg.name}/config";
+                  tag = "${serviceCfg.name}_${user}_config";
+                }
+                {
+                  mountPoint = "/run/secrets";
+                  proto = "virtiofs";
+                  source = "/run/secrets/${serviceCfg.name}";
+                  tag = "host_secrets";
+                }
+              ];
+            };
+            environment.systemPackages = builtins.attrValues {
+              inherit (pkgs)
+                inotify-tools
+                opencloud
+                ;
+            };
+          };
+        };
+      };
+      systemd.tmpfiles.rules = [
+        "d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
+        "d ${mnt}/${serviceCfg.name}/config 0751 microvm wheel - -"
+        "d ${mnt}/${serviceCfg.name}/data 0751 microvm wheel - -"
+      ];
+      sops.secrets = {
+        "${serviceCfg.name}/${user}-env" = {
+          owner = "root";
+          mode = "0600";
+        };
+      };
+    };
+}

modules/nixos/homelab/guests/opencloud/default.nix

@@ -0,0 +1,46 @@
+{
+  flake,
+  pkgs,
+  labHelpers,
+  ...
+}:
+let
+  inherit (import ./config { inherit flake pkgs; }) opencloudVM;
+  inherit (flake.config.people) user0;
+  inherit (flake.config.services.instances) opencloud;
+
+  interface0Cfg = opencloud.interfaces.interface0;
+
+  opencloudNick = opencloudVM {
+    user = user0;
+    ip = interface0Cfg.microvm.ip;
+    mac = interface0Cfg.microvm.mac;
+    userMac = interface0Cfg.microvm.macUser;
+    ssh = interface0Cfg.microvm.ssh;
+    mnt = "";
+    host = interface0Cfg.domain;
+  };
+
+  # opencloudStacie = opencloudVM {
+  #   user = "stacie";
+  #   ip = ipAddress id1;
+  #   mac = "02:00:00:00:${id1}:${id1}";
+  #   userMac = "02:00:00:00:00:${id1}";
+  #   ssh = opencloud.ssh1;
+  #   mnt = guestPath "stacie";
+  #   host = "";
+  # };
+
+  # opencloudGarnet = opencloudVM {
+  #   user = "garnet";
+  #   ip = ipAddress id2;
+  #   mac = "02:00:00:00:${id2}:${id2}";
+  #   userMac = "02:00:00:00:00:${id2}";
+  #   ssh = opencloud.ssh2;
+  #   mnt = guestPath "garnet";
+  #   host = "";
+  # };
+
+in
+opencloudNick
+# // opencloudStacie // opencloudGarnet

modules/nixos/homelab/guests/photoprism/config/default.nix

@@ -0,0 +1,167 @@
+{
+  flake,
+  lib,
+  ...
+}:
+let
+  inherit (flake.config.people) user0;
+  inherit (flake.config.services.instances) photoprism;
+  serviceCfg = photoprism;
+in
+{
+  photoprismVM =
+    {
+      user,
+      ip,
+      mac,
+      userMac,
+      ssh,
+      mnt,
+      data,
+    }:
+    {
+      microvm.vms = {
+        "${serviceCfg.name}-${user}" = {
+          autostart = true;
+          restartIfChanged = true;
+          config = {
+            system.stateVersion = "24.05";
+            time.timeZone = "America/Winnipeg";
+            users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
+            services = {
+              ${serviceCfg.name} = {
+                enable = true;
+                settings = {
+                  PHOTOPRISM_ADMIN_USER = user;
+                  PHOTOPRISM_DEFAULT_LOCAL = "en";
+                };
+                passwordFile = "/run/secrets/${user}-pass";
+                storagePath = "/var/lib/${serviceCfg.name}";
+                originalsPath = "/var/lib/${serviceCfg.name}-media";
+                importPath = "photos";
+                address = "0.0.0.0";
+              };
+              openssh = {
+                enable = true;
+                settings = {
+                  PasswordAuthentication = false;
+                  PermitRootLogin = "prohibit-password";
+                };
+              };
+            };
+
+            users.users.photoprism = {
+              isSystemUser = true;
+              group = "photoprism";
+              home = "/var/lib/photoprism";
+            };
+            users.groups.photoprism = { };
+
+            networking.firewall.allowedTCPPorts = [
+              22
+              2342
+            ];
+
+            systemd = {
+              services = {
+                photoprism = {
+                  serviceConfig = {
+                    DynamicUser = lib.mkForce false;
+                    User = serviceCfg.name;
+                    Group = serviceCfg.name;
+                  };
+                };
+                systemd-networkd.wantedBy = [
+                  "multi-user.target"
+                ];
+              };
+              network = {
+                enable = true;
+                networks."20-lan" = {
+                  matchConfig.Name = "enp0s5";
+                  addresses = [
+                    { Address = "${ip}/24"; }
+                  ];
+                  routes = [
+                    {
+                      Destination = "0.0.0.0/0";
+                      Gateway = "192.168.50.1";
+                    }
+                  ];
+                  dns = [
+                    "1.1.1.1"
+                    "8.8.8.8"
+                  ];
+                };
+              };
+            };
+
+            microvm = {
+              vcpu = 1;
+              mem = 512;
+              hypervisor = "qemu";
+              interfaces = [
+                {
+                  type = "tap";
+                  id = "vm-pp-${user}";
+                  mac = mac;
+                }
+                {
+                  type = "user";
+                  id = "vmuser-photo";
+                  mac = userMac;
+                }
+              ];
+
+              forwardPorts = [
+                {
+                  from = "host";
+                  host.port = ssh;
+                  guest.port = 22;
+                }
+              ];
+
+              shares = [
+                {
+                  mountPoint = "/nix/.ro-store";
+                  proto = "virtiofs";
+                  source = "/nix/store";
+                  tag = "read_only_nix_store";
+                }
+                {
+                  mountPoint = "/var/lib/${serviceCfg.name}";
+                  proto = "virtiofs";
+                  source = "${mnt}/${serviceCfg.name}";
+                  tag = "${serviceCfg.name}_${user}_data";
+                }
+                {
+                  mountPoint = "/var/lib/${serviceCfg.name}-media";
+                  proto = "virtiofs";
+                  source = data;
+                  tag = "${serviceCfg.name}_${user}_media";
+                }
+                {
+                  mountPoint = "/run/secrets";
+                  proto = "virtiofs";
+                  source = "/run/secrets/${serviceCfg.name}";
+                  tag = "host_secrets";
+                }
+              ];
+            };
+          };
+        };
+      };
+
+      systemd.tmpfiles.rules = [
+        "d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
+        "d ${data}/photos 0751 microvm wheel - -"
+      ];
+
+      sops.secrets = {
+        "${serviceCfg.name}/${user}-pass" = {
+          owner = "root";
+          mode = "0600";
+        };
+      };
+    };
+}

modules/nixos/homelab/guests/photoprism/default.nix

@@ -0,0 +1,46 @@
+{
+  flake,
+  lib,
+  labHelpers,
+  ...
+}:
+let
+  inherit (import ./config { inherit flake lib; }) photoprismVM;
+  inherit (flake.config.services.instances) photoprism;
+  inherit (flake.config.people) user0;
+  interface0Cfg = photoprism.interfaces.interface0;
+
+  photoprismNick = photoprismVM {
+    user = user0;
+    ip = interface0Cfg.microvm.ip;
+    mac = interface0Cfg.microvm.mac;
+    userMac = interface0Cfg.microvm.macUser;
+    ssh = interface0Cfg.microvm.ssh;
+    mnt = "";
+    data = "";
+    host = interface0Cfg.domain;
+  };
+
+  # photoprismStacie = photoprismVM {
+  #   user = "stacie";
+  #   ip = ipAddress id1;
+  #   mac = "02:00:00:00:${id1}:${id1}";
+  #   userMac = "02:00:00:00:00:${id1}";
+  #   ssh = photoprism.ssh1;
+  #   mnt = guestPath "stacie";
+  #   data = mediaPath "stacie";
+  # };
+
+  # photoprismGarnet = photoprismVM {
+  #   user = "garnet";
+  #   ip = ipAddress id2;
+  #   mac = "02:00:00:00:${id2}:${id2}";
+  #   userMac = "02:00:00:00:00:${id2}";
+  #   ssh = photoprism.ssh2;
+  #   mnt = guestPath "garnet";
+  #   data = mediaPath "stacie";
+  # };
+
+in
+photoprismNick
+# // photoprismStacie // photoprismGarnet

modules/nixos/homelab/guests/qbittorrent/config/default.nix

@@ -0,0 +1,430 @@
+{
+  config,
+  flake,
+  pkgs,
+  ...
+}:
+let
+  inherit (flake.config.people) user0;
+  inherit (flake.config.services) instances;
+  serviceCfg = instances.qbittorrent;
+  dns0 = instances.web.dns.provider0;
+  dns0Path = "dns/${dns0}";
+in
+{
+  qbittorrentVM =
+    {
+      user,
+      ip,
+      mac,
+      userMac,
+      ssh,
+      mnt,
+      host,
+      port,
+      endpoint,
+      address,
+      dns,
+      key,
+    }:
+    {
+      microvm.vms =
+        let
+          torrentPort = port;
+          vpnEndpoint = endpoint;
+          localNet = "192.168.50.0/24";
+        in
+        {
+          "${serviceCfg.name}-${user}" = {
+            autostart = true;
+            config = {
+              system.stateVersion = "25.05";
+
+              # VPN Killswitch - configured BEFORE networking starts
+              boot.kernel.sysctl = {
+                "net.ipv4.ip_forward" = 1;
+              };
+
+              networking = {
+                # Disable default firewall - we're doing it manually
+                firewall.enable = false;
+
+                wg-quick.interfaces = {
+                  wg0 = {
+                    address = address;
+                    dns = dns;
+                    privateKeyFile = "/run/secrets/${user}-wireguard-pass";
+
+                    peers = [
+                      {
+                        publicKey = key;
+                        endpoint = "${vpnEndpoint}:${toString torrentPort}";
+                        allowedIPs = [
+                          "0.0.0.0/0"
+                          "::/0"
+                        ];
+                        persistentKeepalive = 25;
+                      }
+                    ];
+
+                    # Now we can safely open the VPN tunnel for all traffic
+                    postUp = ''
+                      echo "VPN UP: Opening network for VPN and local traffic"
+
+                      # Allow ALL traffic through VPN interface
+                      ${pkgs.iptables}/bin/iptables -A INPUT -i wg0 -j ACCEPT
+                      ${pkgs.iptables}/bin/iptables -A OUTPUT -o wg0 -j ACCEPT
+
+                      # Allow local network traffic (WebUI, management)
+                      ${pkgs.iptables}/bin/iptables -A INPUT -i enp0s5 -s ${localNet} -j ACCEPT
+                      ${pkgs.iptables}/bin/iptables -A OUTPUT -o enp0s5 -d ${localNet} -j ACCEPT
+
+                      # NAT for VPN
+                      ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE
+
+                      # Allow forwarding through VPN (for port forwarding)
+                      ${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -j ACCEPT
+                      ${pkgs.iptables}/bin/iptables -A FORWARD -o wg0 -j ACCEPT
+                      ${pkgs.iptables}/bin/iptables -A FORWARD -i enp0s5 -o wg0 -j ACCEPT
+                      ${pkgs.iptables}/bin/iptables -A FORWARD -o enp0s5 -i wg0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+
+                      echo "VPN UP: Network opened for VPN and local traffic"
+                    '';
+
+                    preDown = ''
+                      echo "VPN DOWN: Removing VPN rules, killswitch remains active"
+                      ${pkgs.iptables}/bin/iptables -D INPUT -i wg0 -j ACCEPT 2>/dev/null || true
+                      ${pkgs.iptables}/bin/iptables -D OUTPUT -o wg0 -j ACCEPT 2>/dev/null || true
+
+                      ${pkgs.iptables}/bin/iptables -D INPUT -i enp0s5 -s ${localNet} -j ACCEPT 2>/dev/null || true
+                      ${pkgs.iptables}/bin/iptables -D OUTPUT -o enp0s5 -d ${localNet} -j ACCEPT 2>/dev/null || true
+
+                      ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -o wg0 -j MASQUERADE 2>/dev/null || true
+
+                      ${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -j ACCEPT 2>/dev/null || true
+                      ${pkgs.iptables}/bin/iptables -D FORWARD -o wg0 -j ACCEPT 2>/dev/null || true
+                      ${pkgs.iptables}/bin/iptables -D FORWARD -i enp0s5 -o wg0 -j ACCEPT 2>/dev/null || true
+                      ${pkgs.iptables}/bin/iptables -D FORWARD -o enp0s5 -i wg0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || true
+
+                      echo "VPN DOWN: Killswitch rules remain - no internet access"
+                    '';
+                  };
+                };
+
+                dhcpcd.enable = false;
+                useNetworkd = true;
+              };
+
+              services = {
+                qbittorrent = {
+                  enable = true;
+                  webuiPort = serviceCfg.ports.port0;
+                  torrentingPort = torrentPort;
+                  openFirewall = false; # We're managing firewall manually
+
+                  serverConfig = {
+                    LegalNotice.Accepted = true;
+
+                    BitTorrent = {
+                      Session = {
+                        Interface = "wg0";
+                        InterfaceName = "wg0";
+                        Port = torrentPort;
+                        MaxConnections = -1;
+                        MaxConnectionsPerTorrent = -1;
+                        MaxUploads = -1;
+                        MaxUploadsPerTorrent = -1;
+                        QueueingSystemEnabled = false;
+                        uTPRateLimited = false;
+                        uTPEnabled = true;
+                        AlternativeGlobalDLSpeedLimit = 0;
+                        AlternativeGlobalUPSpeedLimit = 0;
+                        GlobalMaxInactiveSeedingMinutes = 10224;
+                        GlobalMaxRatio = -1;
+                      };
+                    };
+
+                    Preferences = {
+                      WebUI = {
+                        Username = "user";
+                        Password_PBKDF2 = "@ByteArray(1bJKXLVSLU6kgCHbCS2lDg==:BmyrMaod6dbJqEe7Ud/JgKAxRMqzsAuEjHcTvLzIBgc5rc5Z7J2X9mbH0cDEAhXqc+O3gQxrckt8S2Gf+zlO9w==)";
+                      };
+
+                      General = {
+                        Locale = "en";
+                      };
+
+                      Downloads = {
+                        SavePath = "${mnt}/${serviceCfg.name}/downloads";
+                        TempPathEnabled = false;
+                        PreAllocation = false;
+                      };
+                    };
+                  };
+                };
+
+                openssh = {
+                  enable = true;
+                  settings.PasswordAuthentication = false;
+                };
+              };
+
+              users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
+
+              systemd = {
+                network = {
+                  enable = true;
+                  networks."10-enp" = {
+                    matchConfig.Name = "enp0s5";
+                    addresses = [ { Address = "${ip}/24"; } ];
+                    gateway = [ "192.168.50.1" ];
+                  };
+                };
+
+                tmpfiles.rules = [
+                  "d ${mnt}/${serviceCfg.name} 755 ${serviceCfg.name} ${serviceCfg.name} -"
+                  "d ${mnt}/${serviceCfg.name}/downloads 755 ${serviceCfg.name} ${serviceCfg.name} -"
+                ];
+
+                services = {
+                  # Ensure qBittorrent ONLY starts after VPN is up
+                  qbittorrent = {
+                    after = [
+                      "wg-quick-wg0.service"
+                      "network-online.target"
+                    ];
+                    requires = [ "wg-quick-wg0.service" ];
+                    wants = [ "network-online.target" ];
+                    bindsTo = [ "wg-quick-wg0.service" ]; # Stop if VPN stops
+
+                    serviceConfig = {
+                      Restart = "on-failure";
+                      RestartSec = "10s";
+                    };
+                  };
+
+                  natpmp-portforward = {
+                    description = "NAT-PMP Port Forwarding for VPN";
+                    after = [
+                      "wg-quick-wg0.service"
+                      "qbittorrent.service"
+                    ];
+                    requires = [
+                      "wg-quick-wg0.service"
+                      "qbittorrent.service"
+                    ];
+                    wantedBy = [ "multi-user.target" ];
+
+                    serviceConfig = {
+                      Type = "simple";
+                      Restart = "always";
+                      RestartSec = "10s";
+                    };
+
+                    script = ''
+                      PASSWORD=$(cat /run/secrets/${user}-qbittorrent-pass)
+                      echo "Waiting for qBittorrent to start..."
+                      sleep 10
+
+                      while true; do
+                        echo "Requesting port forwarding from VPN..."
+                        
+                        UDP_OUTPUT=$(${pkgs.libnatpmp}/bin/natpmpc -a 1 0 udp 60 -g 10.2.0.1 2>&1)
+                        UDP_PORT=$(echo "$UDP_OUTPUT" | ${pkgs.gnugrep}/bin/grep "Mapped public port" | ${pkgs.gawk}/bin/awk '{print $4}' | head -1)
+                        
+                        TCP_OUTPUT=$(${pkgs.libnatpmp}/bin/natpmpc -a 1 0 tcp 60 -g 10.2.0.1 2>&1)
+                        TCP_PORT=$(echo "$TCP_OUTPUT" | ${pkgs.gnugrep}/bin/grep "Mapped public port" | ${pkgs.gawk}/bin/awk '{print $4}' | head -1)
+                        
+                        if [ -n "$UDP_PORT" ] && [ -n "$TCP_PORT" ]; then
+                          echo "Port forwarding successful: UDP=$UDP_PORT, TCP=$TCP_PORT"
+                          
+                          # Clean up old dynamic rules
+                          ${pkgs.iptables}/bin/iptables -t nat -D PREROUTING -i enp0s5 -s ${localNet} -p tcp -j DNAT 2>/dev/null || true
+                          ${pkgs.iptables}/bin/iptables -t nat -D PREROUTING -i enp0s5 -s ${localNet} -p udp -j DNAT 2>/dev/null || true
+                          ${pkgs.iptables}/bin/iptables -D FORWARD -i enp0s5 -o wg0 -p tcp -j ACCEPT 2>/dev/null || true
+                          ${pkgs.iptables}/bin/iptables -D FORWARD -i enp0s5 -o wg0 -p udp -j ACCEPT 2>/dev/null || true
+                          ${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -o enp0s5 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || true
+                          
+                          # DNAT: Forward LAN traffic to qBittorrent on WireGuard interface
+                          ${pkgs.iptables}/bin/iptables -t nat -A PREROUTING -i enp0s5 -s ${localNet} -p tcp --dport "$TCP_PORT" -j DNAT --to-destination 10.2.0.2:"$TCP_PORT"
+                          ${pkgs.iptables}/bin/iptables -t nat -A PREROUTING -i enp0s5 -s ${localNet} -p udp --dport "$UDP_PORT" -j DNAT --to-destination 10.2.0.2:"$UDP_PORT"
+                          
+                          # Allow forwarding for these specific ports
+                          ${pkgs.iptables}/bin/iptables -A FORWARD -i enp0s5 -o wg0 -d 10.2.0.2 -p tcp --dport "$TCP_PORT" -j ACCEPT
+                          ${pkgs.iptables}/bin/iptables -A FORWARD -i enp0s5 -o wg0 -d 10.2.0.2 -p udp --dport "$UDP_PORT" -j ACCEPT
+                          ${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -o enp0s5 -s 10.2.0.2 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+                          
+                          echo "Firewall forwarding rules updated for ports: UDP=$UDP_PORT, TCP=$TCP_PORT"
+                          
+                          # Update qBittorrent listening port via API
+                          echo "Logging into qBittorrent API..."
+                          COOKIE=$(${pkgs.curl}/bin/curl -s -i \
+                              --header "Referer: http://localhost:${toString serviceCfg.ports.port0}" \
+                              --data "username=user&password=$PASSWORD" \
+                              "http://localhost:${toString serviceCfg.ports.port0}/api/v2/auth/login" | \
+                              ${pkgs.gnugrep}/bin/grep -i "set-cookie" | ${pkgs.gawk}/bin/awk -F'SID=|;' '{print $2}')
+                          
+                          if [ -n "$COOKIE" ]; then
+                            echo "Authentication successful, updating port..."
+                            ${pkgs.curl}/bin/curl -s \
+                              --cookie "SID=$COOKIE" \
+                              --data "json={\"listen_port\":$UDP_PORT}" \
+                              "http://localhost:${toString serviceCfg.ports.port0}/api/v2/app/setPreferences"
+                            
+                            echo "Updated qBittorrent listening port to $UDP_PORT"
+                          else
+                            echo "WARNING: Failed to authenticate with qBittorrent API"
+                          fi
+                        else
+                          echo "ERROR: Failed to get forwarded ports"
+                          echo "UDP output: $UDP_OUTPUT"
+                          echo "TCP output: $TCP_OUTPUT"
+                        fi
+                        
+                        sleep 45
+                      done
+                    '';
+                  };
+                  killswitch-init = {
+                    description = "Initialize VPN Killswitch Before Network";
+                    wantedBy = [ "network-pre.target" ];
+                    before = [
+                      "network-pre.target"
+                      "network.target"
+                    ];
+                    after = [ "systemd-modules-load.service" ];
+
+                    serviceConfig = {
+                      Type = "oneshot";
+                      RemainAfterExit = true;
+                    };
+
+                    script = ''
+                      echo "KILLSWITCH: Setting up firewall rules BEFORE network services"
+
+                      # Default DROP everything
+                      ${pkgs.iptables}/bin/iptables -P INPUT DROP
+                      ${pkgs.iptables}/bin/iptables -P OUTPUT DROP
+                      ${pkgs.iptables}/bin/iptables -P FORWARD DROP
+
+                      ${pkgs.iptables}/bin/iptables -F
+                      ${pkgs.iptables}/bin/iptables -t nat -F
+                      ${pkgs.iptables}/bin/iptables -X
+
+                      # Allow loopback
+                      ${pkgs.iptables}/bin/iptables -A INPUT -i lo -j ACCEPT
+                      ${pkgs.iptables}/bin/iptables -A OUTPUT -o lo -j ACCEPT
+
+                      # CRITICAL: Only allow WireGuard endpoint traffic before VPN is up
+                      ${pkgs.iptables}/bin/iptables -A OUTPUT -o enp0s5 -p udp --dport ${toString torrentPort} -d ${vpnEndpoint} -j ACCEPT
+                      ${pkgs.iptables}/bin/iptables -A INPUT -i enp0s5 -p udp --sport ${toString torrentPort} -s ${vpnEndpoint} -j ACCEPT
+
+                      # Allow SSH from local network (for management)
+                      ${pkgs.iptables}/bin/iptables -A INPUT -i enp0s5 -s ${localNet} -p tcp --dport 22 -j ACCEPT
+                      ${pkgs.iptables}/bin/iptables -A OUTPUT -o enp0s5 -d ${localNet} -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+
+                      # Block IPv6 completely
+                      ${pkgs.iptables}/bin/ip6tables -P INPUT DROP 2>/dev/null || true
+                      ${pkgs.iptables}/bin/ip6tables -P OUTPUT DROP 2>/dev/null || true
+                      ${pkgs.iptables}/bin/ip6tables -P FORWARD DROP 2>/dev/null || true
+
+                      echo "KILLSWITCH: Initialized - Network locked down"
+                    '';
+                  };
+                };
+              };
+
+              microvm = {
+                vcpu = 1;
+                mem = 1024 * 1;
+                hypervisor = "qemu";
+
+                interfaces = [
+                  {
+                    type = "tap";
+                    id = "vm-qb-${user}";
+                    mac = mac;
+                  }
+                  {
+                    type = "user";
+                    id = "vmuser-share";
+                    mac = userMac;
+                  }
+                ];
+                forwardPorts = [
+                  {
+                    from = "host";
+                    host.port = ssh;
+                    guest.port = 22;
+                  }
+                ];
+                shares = [
+                  {
+                    source = "/nix/store";
+                    mountPoint = "/nix/.ro-store";
+                    tag = "ro-store";
+                    proto = "virtiofs";
+                  }
+                  {
+                    mountPoint = "/var/lib/${serviceCfg.name}";
+                    proto = "virtiofs";
+                    source = "${mnt}/${serviceCfg.name}";
+                    tag = "${serviceCfg.name}_data";
+                  }
+                  {
+                    mountPoint = "/run/secrets";
+                    proto = "virtiofs";
+                    source = "/run/secrets/torrent";
+                    tag = "host_secrets";
+                  }
+                ];
+              };
+              environment.systemPackages = builtins.attrValues {
+                inherit (pkgs)
+                  conntrack-tools
+                  gawk
+                  iptables
+                  libnatpmp
+                  speedtest-go
+                  wireguard-tools
+                  ;
+              };
+            };
+          };
+
+          sops.secrets = {
+            "torrent/${user}-wireguard-pass" = {
+              owner = "root";
+              mode = "0400";
+            };
+            "torrent/${user}-qbittorrent-pass" = {
+              owner = "root";
+              mode = "0400";
+            };
+          };
+
+          systemd = {
+            services.caddy = {
+              serviceConfig = {
+                EnvironmentFile = config.sops.secrets."caddy/share-auth".path;
+              };
+            };
+
+            tmpfiles.rules = [
+              "d ${mnt}/${serviceCfg.name} 0755 microvm wheel - -"
+            ];
+          };
+
+          networking.firewall = {
+            allowedTCPPorts = [
+              38834
+              torrentPort
+            ];
+            allowedUDPPorts = [
+              38834
+              torrentPort
+            ];
+          };
+        };
+    };
+}

modules/nixos/homelab/guests/qbittorrent/default.nix

@@ -0,0 +1,30 @@
+{
+  flake,
+  pkgs,
+  labHelpers,
+  ...
+}:
+let
+  inherit (import ./config { inherit flake pkgs; }) qbittorrentVM;
+  inherit (flake.config.people) user0;
+  inherit (flake.config.services) instances;
+
+  interface0Cfg = instances.qbittorrent.interfaces.interface0;
+
+  qbittorrentNick = qbittorrentVM {
+    user = user0;
+    ip = interface0Cfg.microvm.ip;
+    mac = interface0Cfg.microvm.mac;
+    userMac = interface0Cfg.microvm.macUser;
+    ssh = interface0Cfg.microvm.ssh;
+    mnt = "";
+    host = interface0Cfg.domain;
+    port = 51820;
+    endpoint = "185.111.110.1";
+    address = [ "10.2.0.2/32" ];
+    dns = [ "10.2.0.1" ];
+    key = "QPfiwJQmt5VLEOh1ufLbi1lj6LUnwQY0tgDSh3pWx1k=";
+  };
+in
+qbittorrentNick
+# // qbittorrentStacie // qbittorrentGarnet

modules/nixos/homelab/guests/syncthing/config/default.nix

@@ -0,0 +1,147 @@
+{
+  flake,
+  ...
+}:
+let
+  inherit (flake.config.people) user0;
+  inherit (flake.config.services.instances) syncthing;
+  serviceCfg = syncthing;
+in
+{
+  syncthingVM =
+    {
+      user,
+      ip,
+      mac,
+      userMac,
+      ssh,
+      mnt,
+      folders,
+      devices,
+      tmp,
+      mounts,
+    }:
+    {
+      microvm.vms = {
+        "${serviceCfg.name}-${user}" = {
+          autostart = true;
+          restartIfChanged = true;
+          config = {
+            system.stateVersion = "24.05";
+            time.timeZone = "America/Winnipeg";
+            users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
+            services = {
+              syncthing = {
+                enable = true;
+                overrideDevices = false;
+                overrideFolders = false;
+                openDefaultPorts = true;
+                systemService = true;
+                guiAddress = "0.0.0.0:${toString serviceCfg.ports.port0}";
+                settings = {
+                  folders = folders;
+                  devices = devices;
+                };
+              };
+
+              openssh = {
+                enable = true;
+                settings = {
+                  PasswordAuthentication = false;
+                  PermitRootLogin = "prohibit-password";
+                };
+              };
+            };
+
+            networking.firewall.allowedTCPPorts = [
+              22
+              serviceCfg.ports.port0
+              serviceCfg.ports.port1
+              serviceCfg.ports.port2
+            ];
+
+            systemd = {
+              services = {
+                systemd-networkd.wantedBy = [
+                  "multi-user.target"
+                ];
+              };
+              network = {
+                enable = true;
+                networks."20-lan" = {
+                  matchConfig.Name = "enp0s5";
+                  addresses = [
+                    { Address = "${ip}/24"; }
+                  ];
+                  routes = [
+                    {
+                      Destination = "0.0.0.0/0";
+                      Gateway = "192.168.50.1";
+                    }
+                  ];
+                  dns = [
+                    "1.1.1.1"
+                    "8.8.8.8"
+                  ];
+                };
+              };
+
+              tmpfiles.rules = [
+                "d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
+              ]
+              ++ tmp;
+            };
+            microvm = {
+              vcpu = 1;
+              mem = 512;
+              hypervisor = "qemu";
+              interfaces = [
+                {
+                  type = "tap";
+                  id = "vm-st-${user}";
+                  mac = mac;
+                }
+                {
+                  type = "user";
+                  id = "vm-sync";
+                  mac = userMac;
+                }
+              ];
+              forwardPorts = [
+                {
+                  from = "host";
+                  host.port = ssh;
+                  guest.port = 22;
+                }
+              ];
+              shares = [
+                {
+                  mountPoint = "/nix/.ro-store";
+                  proto = "virtiofs";
+                  source = "/nix/store";
+                  tag = "read_only_nix_store";
+                }
+                {
+                  mountPoint = "/var/lib/${serviceCfg.name}";
+                  proto = "virtiofs";
+                  source = "${mnt}/${serviceCfg.name}";
+                  tag = "${serviceCfg.name}_${user}_data";
+                }
+                {
+                  mountPoint = "/run/secrets";
+                  proto = "virtiofs";
+                  source = "/run/secrets/${serviceCfg.name}";
+                  tag = "host_secrets";
+                }
+              ]
+              ++ mounts;
+            };
+          };
+        };
+      };
+
+      systemd.tmpfiles.rules = [
+        "d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
+      ];
+    };
+}

modules/nixos/homelab/guests/syncthing/default.nix

@@ -0,0 +1,118 @@
+{
+  flake,
+  labHelpers,
+  ...
+}:
+let
+  inherit (import ./config { inherit flake; }) syncthingVM;
+  inherit (flake.config.services) instances;
+  inherit (flake.config.people) user0;
+  serviceCfg = instances.syncthing;
+  interface0Cfg = serviceCfg.interfaces.interface0;
+
+  foldersHelper = user: {
+    docs = {
+      enable = true;
+      id = "docs";
+      path = "/var/lib/${serviceCfg.name}/docs";
+      devices = [
+        "${user}Phone"
+      ];
+    };
+    media = {
+      enable = true;
+      id = "media";
+      path = "/var/lib/${serviceCfg.name}/media";
+      devices = [
+        "${user}Phone"
+      ];
+    };
+    misc = {
+      enable = true;
+      id = "misc";
+      path = "/var/lib/${serviceCfg.name}/misc";
+      devices = [
+        "${user}Phone"
+      ];
+    };
+  };
+
+  devicesHelper = user: syncID: device: deviceIP: {
+    "${user}${device}" = {
+      autoAcceptFolders = true;
+      name = "${user}${device}";
+      addresses = [
+        "tcp://${deviceIP}:${toString serviceCfg.ports.port2}"
+      ];
+      id = syncID;
+    };
+  };
+
+  mountsHelper = user: [
+    {
+      mountPoint = "/var/lib/${serviceCfg.name}/docs";
+      proto = "virtiofs";
+      source = "";
+      tag = "${serviceCfg.name}_${user}_docs";
+    }
+    {
+      mountPoint = "/var/lib/${serviceCfg.name}/media";
+      proto = "virtiofs";
+      source = "";
+      tag = "${serviceCfg.name}_${user}_media";
+    }
+    {
+      mountPoint = "/var/lib/${serviceCfg.name}/misc";
+      proto = "virtiofs";
+      source = "";
+      tag = "${serviceCfg.name}_${user}_misc";
+    }
+  ];
+
+  tmpRules = [
+    "d /var/lib/${serviceCfg.name}/docs 0755 ${serviceCfg.name} ${serviceCfg.name} -"
+    "d /var/lib/${serviceCfg.name}/media 0755 ${serviceCfg.name} ${serviceCfg.name} -"
+    "d /var/lib/${serviceCfg.name}/misc 0755 ${serviceCfg.name} ${serviceCfg.name} -"
+  ];
+
+  syncthingNick =
+    let
+      phoneID = "OALKHLZ-OODUWVX-PAC2LI7-UMZMSZO-FELLRCD-RS4DHJS-PVA5YQK-WTFXXQI";
+    in
+    syncthingVM {
+      user = user0;
+      ip = interface0Cfg.microvm.ip;
+      mac = interface0Cfg.microvm.mac;
+      userMac = interface0Cfg.microvm.macUser;
+      ssh = interface0Cfg.microvm.ssh;
+      mnt = "";
+      host = interface0Cfg.domain;
+      folders = foldersHelper user0;
+      devices = devicesHelper user0 phoneID "Phone" "192.168.50.8";
+      tmp = tmpRules;
+      mounts = mountsHelper user0;
+    };
+
+  # syncthingStacie = syncthingVM {
+  #   user = "stacie";
+  #   ip = ipAddress id0;
+  #   mac = "02:00:00:00:${id0}:${id0}";
+  #   userMac = "02:00:00:00:00:${id0}";
+  #   ssh = syncthing.ssh0;
+  #   syncID = "";
+  #   deviceIP = "";
+  # };
+
+  # syncthingGarnet = syncthingVM {
+  #   user = "garnet";
+  #   ip = ipAddress id0;
+  #   mac = "02:00:00:00:${id0}:${id0}";
+  #   userMac = "02:00:00:00:00:${id0}";
+  #   ssh = syncthing.ssh0;
+  #   syncID = "";
+  #   deviceIP = "";
+  # };
+
+in
+syncthingNick
+# // syncthingStacie // syncthingGarnet

modules/nixos/homelab/guests/vaultwarden/config/default.nix

@@ -0,0 +1,165 @@
+{
+  flake,
+  ...
+}:
+let
+  inherit (flake.config.people) user0;
+  inherit (flake.config.services) instances;
+  serviceCfg = instances.vaultwarden;
+  smtpCfg = instances.smtp;
+in
+{
+  vaultwardenVM =
+    {
+      user,
+      ip,
+      mac,
+      userMac,
+      ssh,
+      host,
+      mnt,
+    }:
+    {
+      microvm.vms = {
+        "${serviceCfg.name}-${user}" = {
+          autostart = true;
+          restartIfChanged = true;
+          config = {
+            system.stateVersion = "24.05";
+            time.timeZone = "America/Winnipeg";
+            users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
+            services = {
+              vaultwarden = {
+                enable = true;
+                dbBackend = "sqlite";
+                config = {
+                  # Domain Configuration
+                  DOMAIN = "https://${host}";
+
+                  # Email Configuration
+                  SMTP_AUTH_MECHANISM = "Plain";
+                  SMTP_EMBED_IMAGES = true;
+                  SMTP_FROM = smtpCfg.interfaces.interface0.email;
+                  SMTP_FROM_NAME = serviceCfg.label;
+                  SMTP_HOST = smtpCfg.interfaces.interface0.domain;
+                  SMTP_PORT = smtpCfg.ports.port0;
+                  SMTP_USERNAME = smtpCfg.interfaces.interface0.email;
+                  SMTP_SECURITY = "starttls";
+
+                  # Security Configuration
+                  DISABLE_ADMIN_TOKEN = false;
+
+                  # Event and Backup Management
+                  EVENTS_DAYS_RETAIN = 90;
+
+                  # User Features
+                  SENDS_ALLOWED = true;
+                  SIGNUPS_VERIFY = true;
+                  WEB_VAULT_ENABLED = true;
+
+                  # Rocket (Web Server) Settings
+                  ROCKET_ADDRESS = "0.0.0.0";
+                  ROCKET_PORT = serviceCfg.ports.port0;
+                };
+
+                # Environment file with secrets (mounted from host)
+                environmentFile = "/run/secrets/${user}-env";
+              };
+
+              openssh = {
+                enable = true;
+                settings = {
+                  PasswordAuthentication = false;
+                  PermitRootLogin = "prohibit-password";
+                };
+              };
+            };
+            networking.firewall.allowedTCPPorts = [
+              22
+              587
+            ];
+            systemd = {
+              services = {
+                systemd-networkd.wantedBy = [ "multi-user.target" ];
+              };
+              network = {
+                enable = true;
+                networks."20-lan" = {
+                  matchConfig.Name = "enp0s5";
+                  addresses = [
+                    { Address = "${ip}/24"; }
+                  ];
+                  routes = [
+                    {
+                      Destination = "0.0.0.0/0";
+                      Gateway = "192.168.50.1";
+                    }
+                  ];
+                  dns = [
+                    "1.1.1.1"
+                    "8.8.8.8"
+                  ];
+                };
+              };
+              tmpfiles.rules = [
+                "d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
+              ];
+            };
+            microvm = {
+              vcpu = 1;
+              mem = 1024;
+              hypervisor = "qemu";
+              interfaces = [
+                {
+                  type = "tap";
+                  id = "vm-vw-${user}";
+                  mac = mac;
+                }
+                {
+                  type = "user";
+                  id = "vmuser-vault";
+                  mac = userMac;
+                }
+              ];
+              forwardPorts = [
+                {
+                  from = "host";
+                  host.port = ssh;
+                  guest.port = 22;
+                }
+              ];
+              shares = [
+                {
+                  mountPoint = "/nix/.ro-store";
+                  proto = "virtiofs";
+                  source = "/nix/store";
+                  tag = "read_only_nix_store";
+                }
+                {
+                  mountPoint = "/var/lib/bitwarden_rs";
+                  proto = "virtiofs";
+                  source = "${mnt}/${serviceCfg.name}";
+                  tag = "${serviceCfg.name}_${user}_data";
+                }
+                {
+                  mountPoint = "/run/secrets";
+                  proto = "virtiofs";
+                  source = "/run/secrets/${serviceCfg.name}";
+                  tag = "host_secrets";
+                }
+              ];
+            };
+          };
+        };
+      };
+      systemd.tmpfiles.rules = [
+        "d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
+      ];
+      sops.secrets = {
+        "${serviceCfg.name}/${user}-env" = {
+          owner = "root";
+          mode = "0600";
+        };
+      };
+    };
+}

modules/nixos/homelab/guests/vaultwarden/default.nix

@@ -0,0 +1,45 @@
+{
+  flake,
+  labHelpers,
+  ...
+}:
+let
+  inherit (import ./config { inherit flake; }) vaultwardenVM;
+  inherit (flake.config.people) user0;
+  inherit (flake.config.services.instances) vaultwarden;
+
+  interface0Cfg = vaultwarden.interfaces.interface0;
+
+  vaultwardenNick = vaultwardenVM {
+    user = user0;
+    ip = interface0Cfg.microvm.ip;
+    mac = interface0Cfg.microvm.mac;
+    userMac = interface0Cfg.microvm.macUser;
+    ssh = interface0Cfg.microvm.ssh;
+    mnt = "";
+    host = interface0Cfg.domain;
+  };
+
+  # vaultwardenStacie = vaultwardenVM {
+  #   user = "stacie";
+  #   ip = ipAddress id1;
+  #   mac = "02:00:00:00:${id1}:${id1}";
+  #   userMac = "02:00:00:00:00:${id1}";
+  #   ssh = vaultwarden.ssh1;
+  #   mnt = guestPath "stacie";
+  #   host = "";
+  # };
+
+  # vaultwardenGarnet = vaultwardenVM {
+  #   user = "garnet";
+  #   ip = ipAddress id2;
+  #   mac = "02:00:00:00:${id2}:${id2}";
+  #   userMac = "02:00:00:00:00:${id2}";
+  #   ssh = vaultwarden.ssh2;
+  #   mnt = guestPath "garnet";
+  #   host = "";
+  # };
+
+in
+vaultwardenNick
+# // vaultwardenStacie // vaultwardenGarnet

modules/nixos/homelab/guests/website/config/default.nix

@@ -0,0 +1,82 @@
+{
+  config,
+  flake,
+  pkgs,
+  ...
+}:
+let
+  inherit (flake.config.people) user0;
+  inherit (flake.config.services) instances;
+  serviceCfg = instances.website;
+in
+{
+  websiteVM =
+    {
+      user,
+      ip,
+      mac,
+      userMac,
+      package,
+    }:
+    {
+      microvm.vms.${serviceCfg.name} = {
+        autostart = true;
+        config = {
+          system.stateVersion = "25.05";
+          networking.firewall.allowedTCPPorts = [
+            22
+            80
+          ];
+          services.openssh = {
+            enable = true;
+            settings.PasswordAuthentication = false;
+          };
+
+          environment.etc."website".source = package;
+
+          users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
+
+          systemd = {
+            network = {
+              enable = true;
+              networks."10-enp" = {
+                matchConfig.Name = "enp0s3";
+                addresses = [
+                  { Address = "${ip}/24"; }
+                ];
+                gateway = [ "192.168.50.1" ];
+              };
+            };
+          };
+          services.caddy = {
+            enable = true;
+            virtualHosts.":80".extraConfig = ''
+              root * /etc/website
+              file_server
+              try_files {path} /index.html
+            '';
+          };
+          microvm = {
+            vcpu = 1;
+            mem = 512;
+            hypervisor = "qemu";
+            interfaces = [
+              {
+                type = "tap";
+                id = "vm-ws-${user}";
+                mac = mac;
+              }
+            ];
+            shares = [
+              {
+                source = "/nix/store";
+                mountPoint = "/nix/.ro-store";
+                tag = "ro-store";
+                proto = "virtiofs";
+              }
+            ];
+          };
+        };
+      };
+    };
+}

modules/nixos/homelab/guests/website/default.nix

@@ -0,0 +1,38 @@
+{
+  flake,
+  pkgs,
+  labHelpers,
+  ...
+}:
+let
+  inherit (import ./config { inherit flake pkgs; }) websiteVM;
+  inherit (flake.config.services) instances;
+
+  websiteNick =
+    let
+      websitePkg = flake.self.packages.${pkgs.system}.website;
+      interfaceCfg = instances.website.interfaces.interface0;
+    in
+    websiteVM {
+      user = "uproot";
+      ip = interfaceCfg.microvm.ip;
+      mac = interfaceCfg.microvm.mac;
+      userMac = interfaceCfg.microvm.macUser;
+      package = websitePkg;
+    };
+
+  websiteProject =
+    let
+      websitePkg = flake.inputs.linkpage.packages.${pkgs.stdenv.hostPlatform.system}.websiteFrontend;
+      interfaceCfg = instances.website.interfaces.interface1;
+    in
+    websiteVM {
+      user = "project";
+      ip = interfaceCfg.microvm.ip;
+      mac = interfaceCfg.microvm.mac;
+      userMac = interfaceCfg.microvm.macUser;
+      package = websitePkg;
+    };
+
+in
+websiteNick // websiteProject

modules/nixos/homelab/guests/zookeeper/config/default.nix

@@ -0,0 +1,103 @@
+{
+  flake,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  inherit (flake.config.people) user0;
+  inherit (flake.config.services) instances;
+  serviceCfg = instances.zookeeper;
+in
+{
+  websiteVM =
+    {
+      user,
+      ip,
+      mac,
+      userMac,
+      package,
+    }:
+    {
+
+      microvm.vms = {
+        "${serviceCfg.name}-${user}" = {
+          autostart = true;
+          restartIfChanged = true;
+          config = {
+            system.stateVersion = "24.05";
+            time.timeZone = "America/Winnipeg";
+            users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
+            services.openssh = {
+              enable = true;
+              settings.PasswordAuthentication = false;
+            };
+            networking.firewall.allowedTCPPorts = [ 22 ];
+            systemd = {
+              services = {
+                zookeeper = {
+                  serviceConfig = {
+                    ExecStart = lib.getExe package;
+                    Restart = "always";
+                    RestartSec = 2;
+                    EnvironmentFile = "/run/secrets/${user}-env";
+                  };
+                  wantedBy = [ "multi-user.target" ];
+                };
+                systemd-networkd.wantedBy = [ "multi-user.target" ];
+              };
+              network = {
+                enable = true;
+                networks."20-lan" = {
+                  matchConfig.Name = "enp0s3";
+                  addresses = [ { Address = "${ip}/24"; } ];
+                  routes = [
+                    {
+                      Destination = "0.0.0.0/0";
+                      Gateway = "192.168.50.1";
+                    }
+                  ];
+                  dns = [
+                    "1.1.1.1"
+                    "8.8.8.8"
+                  ];
+                };
+              };
+            };
+            microvm = {
+              vcpu = 1;
+              mem = 512;
+              hypervisor = "qemu";
+              interfaces = [
+                {
+                  type = "tap";
+                  id = "vm-qb-${user}";
+                  mac = mac;
+                }
+              ];
+              shares = [
+                {
+                  mountPoint = "/nix/.ro-store";
+                  proto = "virtiofs";
+                  source = "/nix/store";
+                  tag = "read_only_nix_store";
+                }
+                {
+                  mountPoint = "/run/secrets";
+                  proto = "virtiofs";
+                  source = "/run/secrets/${serviceCfg.name}";
+                  tag = "host_secrets";
+                }
+              ];
+            };
+          };
+        };
+      };
+      sops.secrets = {
+        "${serviceCfg.name}/${user}-env" = {
+          owner = "root";
+          mode = "0600";
+        };
+      };
+    };
+}

modules/nixos/homelab/guests/zookeeper/default.nix

@@ -0,0 +1,25 @@
+{
+  flake,
+  pkgs,
+  labHelpers,
+  ...
+}:
+let
+  inherit (import ./config { inherit flake pkgs; }) zookeeperVM;
+  inherit (flake.config.services) instances;
+  interfaceCfg = instances.zookeeper.interfaces.interface0;
+
+  zookeeperNick =
+    let
+      appPackage = flake.self.packages.${pkgs.system}.zookeeper;
+    in
+    zookeeperVM {
+      user = "boon";
+      ip = interfaceCfg.microvm.ip;
+      mac = interfaceCfg.microvm.mac;
+      userMac = interfaceCfg.microvm.macUser;
+      package = appPackage;
+    };
+
+in
+zookeeperNick

modules/nixos/homelab/orphans/comfyui/default.nix

@@ -0,0 +1,164 @@
+{
+  flake,
+  config,
+  ...
+}:
+let
+  inherit (flake.config.services) instances;
+  serviceCfg = instances.comfyui;
+  localhost = instances.web.localhost.address1;
+  host = serviceCfg.domains.url0;
+  dns = instances.web.dns.provider0;
+  dnsPath = "dns/${dns}";
+
+in
+{
+  virtualisation.docker = {
+    enable = true;
+    enableNvidia = true;
+    autoPrune = {
+      enable = true;
+      dates = "weekly";
+    };
+  };
+
+  virtualisation.oci-containers = {
+    backend = "docker";
+    containers.comfyui = {
+      image = "yanwk/comfyui-boot:cu126-slim";
+      autoStart = true;
+
+      ports = [
+        "${localhost}:${toString serviceCfg.ports.port0}:8188"
+      ];
+
+      volumes = [
+        "${serviceCfg.varPaths.path0}:/root"
+        "${serviceCfg.varPaths.path0}/models:/root/models"
+        "${serviceCfg.varPaths.path0}/custom_nodes:/root/custom_nodes"
+        "${serviceCfg.varPaths.path0}/output:/root/output"
+        "${serviceCfg.varPaths.path0}/input:/root/input"
+        "${serviceCfg.varPaths.path0}/user:/root/user"
+      ];
+
+      environment = {
+        CLI_ARGS = "--listen 0.0.0.0 --port 8188 --preview-method auto --dont-print-server";
+        NVIDIA_VISIBLE_DEVICES = "0";
+        NVIDIA_DRIVER_CAPABILITIES = "compute,utility,graphics";
+      };
+
+      extraOptions = [
+        "--runtime=nvidia"
+        "--gpus=device=0"
+        # Memory limits to prevent OOM
+        "--memory=32g"
+        "--memory-swap=32g"
+        "--shm-size=16g"
+        # Security
+        "--security-opt=no-new-privileges:true"
+        # Network
+        "--network=bridge"
+        # Health check
+        "--health-cmd=curl -f http://localhost:8188/ || exit 1"
+        "--health-interval=30s"
+        "--health-timeout=10s"
+        "--health-retries=3"
+      ];
+    };
+  };
+
+  services.caddy = {
+    enable = true;
+    virtualHosts = {
+      "${host}" = {
+        extraConfig = ''
+          basic_auth {
+            {$CADDY_AUTH_USER} {$CADDY_AUTH_PASSWORD_HASH}
+          }
+
+          # Main reverse proxy with WebSocket support
+          reverse_proxy ${localhost}:${toString serviceCfg.ports.port0} {
+            header_up Host {host}
+            header_up X-Real-IP {remote}
+            header_up X-Forwarded-For {remote}
+            header_up X-Forwarded-Proto {scheme}
+            
+            # WebSocket support - critical for ComfyUI real-time updates
+            header_up Connection {>Connection}
+            header_up Upgrade {>Upgrade}
+            
+            # Longer timeouts for generation tasks
+            transport http {
+              read_timeout 300s
+              write_timeout 300s
+            }
+          }
+
+          tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
+
+          # Security headers
+          header {
+            Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+            X-Frame-Options "DENY"
+            X-Content-Type-Options "nosniff"
+            X-XSS-Protection "1; mode=block"
+            Referrer-Policy "strict-origin-when-cross-origin"
+            -Server
+          }
+
+          # Logging
+          log {
+            output file /var/log/caddy/comfyui-access.log
+            format json
+          }
+        '';
+      };
+    };
+  };
+
+  systemd.tmpfiles.rules = [
+    "d ${serviceCfg.varPaths.path0} 755 root root -"
+    "d ${serviceCfg.secretPaths.path0}/caddy 755 caddy caddy -"
+    "d /var/log/caddy 755 caddy caddy -"
+  ];
+
+  systemd.services.caddy = {
+    serviceConfig = {
+      EnvironmentFile = config.sops.secrets."caddy/${serviceCfg.name}-auth".path;
+    };
+  };
+
+  boot.kernel.sysctl = {
+    "kernel.shmmax" = 68719476736;
+    "kernel.shmall" = 4194304;
+    "vm.swappiness" = 1;
+    "vm.dirty_ratio" = 15;
+    "vm.dirty_background_ratio" = 5;
+  };
+
+  systemd.services.docker-comfyui = {
+    after = [
+      "network-online.target"
+      "docker.service"
+    ];
+    wants = [ "network-online.target" ];
+    requires = [ "docker.service" ];
+  };
+
+  sops.secrets = {
+    "caddy/${serviceCfg.name}-auth" = {
+      owner = "caddy";
+      group = "caddy";
+      mode = "0400";
+    };
+  };
+
+  users.users.caddy.extraGroups = [ "acme" ];
+
+  security.acme.certs."${host}" = {
+    dnsProvider = dns;
+    environmentFile = config.sops.secrets.${dnsPath}.path;
+    group = "caddy";
+  };
+
+}

modules/nixos/homelab/orphans/default.nix

@@ -0,0 +1,11 @@
+let
+  importList =
+    let
+      content = builtins.readDir ./.;
+      dirContent = builtins.filter (n: content.${n} == "directory") (builtins.attrNames content);
+    in
+    map (name: ./. + "/${name}") dirContent;
+in
+{
+  imports = importList;
+}

modules/nixos/homelab/orphans/defenseio/default.nix

@@ -0,0 +1,189 @@
+{
+  flake,
+  pkgs,
+  config,
+  ...
+}:
+let
+  inherit (flake.config.people) user0;
+  inherit (flake.config.machines) devices;
+
+  mars = devices.mars.name;
+  ceres = devices.ceres.name;
+  eris = devices.eris.name;
+  deimos = devices.deimos.name;
+  phobos = devices.phobos.name;
+
+  hostname = config.networking.hostName;
+
+  deviceLogic =
+    var0: var1: var2: var3: var4:
+    if hostname == ceres then
+      var0
+    else if hostname == eris then
+      var1
+    else if hostname == mars then
+      var2
+    else if hostname == deimos then
+      var3
+    else if hostname == phobos then
+      var4
+    else
+      var0;
+
+  macOctet = deviceLogic "57" "58" "59" "60" "61";
+in
+
+{
+  microvm = {
+    vms = {
+      defenseio = {
+        autostart = true;
+        config =
+          let
+            ceresCpu = 28;
+            erisCpu = 5;
+            marsCpu = 18;
+            deimosCpu = 4;
+            phobosCpu = 4;
+
+            macAddress = "02:00:00:00:00:${macOctet}";
+            workers = deviceLogic ceresCpu erisCpu marsCpu deimosCpu phobosCpu;
+          in
+          {
+            environment.systemPackages = [
+              pkgs.git
+              pkgs.ncurses
+              pkgs.python313
+            ];
+
+            microvm = {
+              forwardPorts = [
+                {
+                  from = "host";
+                  host.port = 2058;
+                  guest.port = 22;
+                }
+              ];
+              hypervisor = "qemu";
+              interfaces = [
+                {
+                  type = "user";
+                  id = "uservm-dfo";
+                  mac = macAddress;
+                }
+              ];
+              mem =
+                let
+                  num = num: (num * 1024);
+                  ceresRam = num 45;
+                  erisRam = num 7;
+                  marsRam = num 30;
+                  deimosRam = num 7;
+                  phobosRam = num 7;
+                in
+                deviceLogic ceresRam erisRam marsRam deimosRam phobosRam;
+              shares = [
+                {
+                  mountPoint = "/nix/.ro-store";
+                  proto = "virtiofs";
+                  source = "/nix/store";
+                  tag = "read_only_nix_store";
+                }
+                {
+                  mountPoint = "/var/lib/defenseio-data";
+                  proto = "virtiofs";
+                  source = "/var/lib/defenseio-data";
+                  tag = "defenseio_data";
+                }
+              ];
+              vcpu = workers;
+            };
+
+            networking.firewall.allowedTCPPorts = [
+              22
+            ];
+
+            services = {
+              openssh = {
+                enable = true;
+                settings.PasswordAuthentication = false;
+              };
+            };
+
+            system.stateVersion = "25.05";
+
+            systemd = {
+              network = {
+                enable = true;
+                networks."20-user" = {
+                  matchConfig.MACAddress = macAddress;
+                  networkConfig = {
+                    DHCP = "yes";
+                  };
+                };
+              };
+
+              tmpfiles.rules = [
+                "d /var/lib/defenseio-data 0755 root root - -"
+              ];
+
+              services = {
+                defenseio-miner = {
+                  after = [ "network-online.target" ];
+                  description = "DefenseIOMiner - DFO token miner";
+                  serviceConfig = {
+                    Environment = [
+                      "PATH=/run/current-system/sw/bin"
+                      "TERM=xterm-256color"
+                    ];
+                    ExecStartPre = pkgs.writeShellScript "setup-miner" ''
+                      # Create venv if not already present (persists on virtiofs mount)
+                      if [ ! -d /var/lib/defenseio-data/venv ]; then
+                        ${pkgs.python313}/bin/python -m venv /var/lib/defenseio-data/venv
+                      fi
+
+                      # Install/upgrade dependencies
+                      /var/lib/defenseio-data/venv/bin/pip install --upgrade pip
+                      /var/lib/defenseio-data/venv/bin/pip install requests pycardano cbor2 portalocker
+
+                      # Clone repo if not already present
+                      if [ ! -d /var/lib/defenseio-data/MidnightMiner ]; then
+                        cd /var/lib/defenseio-data
+                        ${pkgs.git}/bin/git clone https://github.com/djeanql/MidnightMiner.git
+                      else
+                        cd /var/lib/defenseio-data/MidnightMiner
+                        ${pkgs.git}/bin/git pull
+                      fi
+
+                      # Show current commit
+                      cd /var/lib/defenseio-data/MidnightMiner
+                      echo "Current commit: $(${pkgs.git}/bin/git log -1 --format='%h - %s')"
+                    '';
+                    ExecStart = pkgs.writeShellScript "run-miner" ''
+                      export PATH=/run/current-system/sw/bin:$PATH
+                      cd /var/lib/defenseio-data/MidnightMiner
+                      /var/lib/defenseio-data/venv/bin/python miner.py --defensio --workers ${toString workers} --no-donation --consolidate addr1q87k2jlckh6ujqx4ymkdd4jrhy6gukdtum0p77pdh5gqcw8ctl65fvaw097l32ta6m8hth3xu9cjfz70y34gs2mdfzlsj465th
+                    '';
+                    Restart = "always";
+                    RestartSec = 10;
+                  };
+                  wants = [ "network-online.target" ];
+                  wantedBy = [ "multi-user.target" ];
+                };
+              };
+            };
+
+            time.timeZone = "America/Winnipeg";
+
+            users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
+
+          };
+      };
+    };
+  };
+  systemd.tmpfiles.rules = [
+    "d /var/lib/defenseio-data 0751 microvm wheel - -"
+  ];
+
+}

modules/nixos/homelab/orphans/defenseioGpu/config/default.nix

@@ -0,0 +1,301 @@
+{
+  flake,
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.gpu-miner;
+
+  # CUDA-enabled packages
+  cudaPackages = pkgs.cudaPackages;
+
+  # Use GCC 13 for CUDA compilation (GCC 14 is too new for CUDA 12.8)
+  # But we need GCC 14's runtime libraries for CXXABI_1.3.15
+  gccCompiler = pkgs.gcc13;
+  gccRuntime = pkgs.gcc14;
+
+  pythonEnv = pkgs.python312.withPackages (
+    ps: with ps; [
+      pip
+      virtualenv
+    ]
+  );
+
+  # Generate complete config.yaml file
+  configFile = pkgs.writeText "config.yaml" ''
+    miner:
+      api_url: https://mine.defensio.io/api
+      max_workers: ${toString cfg.maxWorkers}
+      update_interval: 30
+      retry_delay: 5
+      max_retries: 3
+
+    wallet:
+      consolidate_address: ${cfg.consolidateAddress}
+      auto_register: true
+      wallet_count: ${toString cfg.maxWorkers}
+
+    gpu:
+      enabled: true
+      batch_size: ${toString cfg.batchSize}
+      device_id: ${toString cfg.gpuDeviceId}
+      thread_count: 256
+
+    logging:
+      level: info
+      file: ${cfg.dataDir}/GPU-Miner/miner.log
+      max_size: 10485760
+      backup_count: 5
+
+    performance:
+      target_hashrate: 0
+      monitor_interval: 60
+      stats_update_interval: 10
+
+    database:
+      path: ${cfg.dataDir}/GPU-Miner/miner.db
+      backup_enabled: true
+      backup_interval: 3600
+  '';
+in
+{
+  options.services.gpu-miner = {
+    enable = lib.mkEnableOption "GPU Miner for Defensio (DFO)";
+
+    dataDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/gpu-miner";
+      description = "Directory where the miner data and venv will be stored";
+    };
+
+    consolidateAddress = lib.mkOption {
+      type = lib.types.str;
+      default = "addr1q87k2jlckh6ujqx4ymkdd4jrhy6gukdtum0p77pdh5gqcw8ctl65fvaw097l32ta6m8hth3xu9cjfz70y34gs2mdfzlsj465th";
+      description = "Cardano address for consolidating mined tokens";
+
+    };
+
+    maxWorkers = lib.mkOption {
+      type = lib.types.int;
+      default = 1;
+      description = "Maximum number of worker threads";
+
+    };
+
+    batchSize = lib.mkOption {
+      type = lib.types.int;
+      default = 1000000;
+      description = "GPU batch size for mining";
+    };
+
+    gpuDeviceId = lib.mkOption {
+      type = lib.types.int;
+      default = 0;
+      description = "GPU device ID to use for mining (use nvidia-smi to see available GPUs)";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # Create the data directory
+    systemd.tmpfiles.rules = [
+      "d ${cfg.dataDir} 0755 root root - -"
+    ];
+
+    systemd.services.gpu-miner = {
+      description = "GPU Miner for Defensio (DFO) tokens";
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      environment = {
+        CUDA_PATH = "${cudaPackages.cudatoolkit}";
+        # Use GCC 14 runtime libraries for CXXABI_1.3.15
+        LD_LIBRARY_PATH = lib.makeLibraryPath [
+          cudaPackages.cudatoolkit
+          config.boot.kernelPackages.nvidiaPackages.latest
+          gccRuntime.cc.lib
+        ];
+        __GLX_VENDOR_LIBRARY_NAME = "nvidia";
+        GBM_BACKEND = "nvidia-drm";
+      };
+
+      path = [
+        cudaPackages.cudatoolkit
+        pkgs.git
+        pythonEnv
+        gccCompiler # GCC 13 for CUDA compilation
+        pkgs.gnumake
+        pkgs.patchelf
+        pkgs.stdenv.cc.cc.lib
+        pkgs.binutils
+      ];
+
+      serviceConfig = {
+        Type = "simple";
+        Restart = "always";
+        RestartSec = 10;
+        WorkingDirectory = cfg.dataDir;
+        TimeoutStartSec = "5min";
+
+        # Setup script
+        ExecStartPre = pkgs.writeShellScript "setup-gpu-miner" ''
+          set -e
+          cd ${cfg.dataDir}
+
+          # Clone or update the repository
+          if [ ! -d GPU-Miner ]; then
+            echo "Cloning GPU-Miner repository..."
+            ${pkgs.git}/bin/git clone https://github.com/Herolias/GPU-Miner.git
+          else
+            echo "Updating GPU-Miner repository..."
+            cd GPU-Miner
+            ${pkgs.git}/bin/git pull || true
+            cd ..
+          fi
+
+          cd GPU-Miner
+
+          # Remove and recreate venv to ensure clean state
+          if [ -d venv ]; then
+            echo "Removing existing virtual environment..."
+            rm -rf venv
+          fi
+
+          echo "Creating virtual environment with Python 3.12..."
+          ${pythonEnv}/bin/python -m venv venv
+
+          echo "Installing dependencies..."
+          venv/bin/pip install --upgrade pip
+
+          # Install base dependencies first
+          echo "Installing base dependencies..."
+          venv/bin/pip install colorama pyyaml portalocker
+
+          # Install from requirements.txt if available
+          if [ -f requirements.txt ]; then
+            echo "Installing from requirements.txt..."
+            venv/bin/pip install -r requirements.txt
+          else
+            echo "Installing common dependencies..."
+            venv/bin/pip install requests numpy pycardano cbor2
+          fi
+
+          echo "Dependency installation complete."
+
+          # Patch the GPU binaries for NixOS
+          if [ -d gpu_core/bin/linux ]; then
+            echo "Patching GPU binaries for NixOS..."
+            for so_file in gpu_core/bin/linux/*.so; do
+              if [ -f "$so_file" ]; then
+                echo "Patching $so_file"
+                ${pkgs.patchelf}/bin/patchelf --set-interpreter "$(cat ${pkgs.stdenv.cc}/nix-support/dynamic-linker)" "$so_file" 2>/dev/null || true
+                ${pkgs.patchelf}/bin/patchelf --set-rpath "${
+                  lib.makeLibraryPath [
+                    cudaPackages.cudatoolkit
+                    config.boot.kernelPackages.nvidiaPackages.latest
+                    gccRuntime.cc.lib
+                    pkgs.zlib
+                    pkgs.glib
+                    pkgs.glibc
+                  ]
+                }:$ORIGIN" "$so_file" || echo "Warning: Could not patch $so_file"
+                ${pkgs.patchelf}/bin/patchelf --shrink-rpath "$so_file" 2>/dev/null || true
+              fi
+            done
+            echo "Patching complete."
+          fi
+
+          # Copy the config file
+          echo "Creating config.yaml..."
+          cp ${configFile} config.yaml
+
+          # Ensure database directory exists
+          mkdir -p $(dirname ${cfg.dataDir}/GPU-Miner/miner.db)
+
+          echo "Setup complete."
+          echo "Current commit: $(${pkgs.git}/bin/git log -1 --format='%h - %s')"
+        '';
+
+        # Main execution script
+        ExecStart = pkgs.writeShellScript "run-gpu-miner" ''
+            set -e
+            cd ${cfg.dataDir}/GPU-Miner
+
+            # Set CUDA environment
+            export CUDA_PATH=${cudaPackages.cudatoolkit}
+            export CUDA_ROOT=${cudaPackages.cudatoolkit}
+            export CUDA_HOME=${cudaPackages.cudatoolkit}
+
+            # Use GCC 13 for CUDA compilation (compatible with CUDA 12.8)
+            export CC=${gccCompiler}/bin/gcc
+            export CXX=${gccCompiler}/bin/g++
+            
+            # CRITICAL: Force nvcc to use GCC 13 by creating a wrapper script
+            # The wrapper must pass both --compiler-bindir and ensure CUDA headers are found
+            mkdir -p /tmp/nvcc-wrapper
+            cat > /tmp/nvcc-wrapper/nvcc <<WRAPPER_EOF
+          #!${pkgs.bash}/bin/bash
+          # Add CUDA include path to help nvcc find cuda_runtime.h
+          exec ${cudaPackages.cudatoolkit}/bin/nvcc \\
+            --compiler-bindir ${gccCompiler}/bin \\
+            -I${cudaPackages.cudatoolkit}/include \\
+            "\$@"
+          WRAPPER_EOF
+            chmod +x /tmp/nvcc-wrapper/nvcc
+            
+            # Put our wrapper at the front of PATH
+            export PATH="/tmp/nvcc-wrapper:$PATH"
+
+            # Use GCC 14 runtime libraries for CXXABI_1.3.15 at runtime
+            export LD_LIBRARY_PATH=${
+              lib.makeLibraryPath [
+                cudaPackages.cudatoolkit
+                config.boot.kernelPackages.nvidiaPackages.latest
+                gccRuntime.cc.lib # GCC 14 for runtime
+                pkgs.zlib
+                pkgs.glib
+                pkgs.glibc
+              ]
+            }
+            # Add gpu_core binaries to library path
+            export LD_LIBRARY_PATH="$PWD/gpu_core/bin/linux:$LD_LIBRARY_PATH"
+
+            export __GLX_VENDOR_LIBRARY_NAME=nvidia
+            export GBM_BACKEND=nvidia-drm
+
+            # Verify GPU accessibility
+            echo "Checking GPU availability..."
+            if command -v nvidia-smi &> /dev/null; then
+              nvidia-smi -L || echo "Warning: Could not list GPUs"
+            fi
+
+            echo "Starting GPU miner..."
+            echo "Python version: $(venv/bin/python --version)"
+            echo "Compile-time GCC: ${gccCompiler}/bin/gcc ($(${gccCompiler}/bin/gcc --version | head -n1))"
+            echo "Runtime GCC library: ${gccRuntime.cc.lib}/lib"
+            echo "Working directory: $(pwd)"
+            echo "NVCC wrapper: $(type -p nvcc)"
+
+            # Verify the critical library is available
+            echo "Checking for CXXABI_1.3.15..."
+            if strings ${gccRuntime.cc.lib}/lib/libstdc++.so.6 | grep -q CXXABI_1.3.15; then
+              echo "✓ CXXABI_1.3.15 found in runtime libstdc++"
+            else
+              echo "✗ WARNING: CXXABI_1.3.15 not found"
+            fi
+
+            # Test nvcc compilation
+            echo "Testing nvcc compiler configuration..."
+            /tmp/nvcc-wrapper/nvcc --version
+
+            # Run the miner
+            exec venv/bin/python main.py --workers ${builtins.toString cfg.maxWorkers} 2>&1
+        '';
+        StandardOutput = "journal";
+        StandardError = "journal";
+      };
+    };
+  };
+}

modules/nixos/homelab/orphans/defenseioGpu/default.nix

@@ -0,0 +1,25 @@
+{
+  imports = [
+    ./config
+  ];
+
+  nix.settings = {
+    substituters = [
+      "https://cache.nixos.org"
+      "https://cuda-maintainers.cachix.org"
+    ];
+    trusted-public-keys = [
+      "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+      "cuda-maintainers.cachix.org-1:0dq3bujKpuEPMCX6U4WylrUDZ9JyUG0VpVZa7CNfq5E="
+    ];
+  };
+
+  services.gpu-miner = {
+    enable = true;
+    dataDir = "/var/lib/gpu-miner";
+    consolidateAddress = "addr1q87k2jlckh6ujqx4ymkdd4jrhy6gukdtum0p77pdh5gqcw8ctl65fvaw097l32ta6m8hth3xu9cjfz70y34gs2mdfzlsj465th";
+    maxWorkers = 12;
+    gpuDeviceId = 0;
+  };
+
+}

modules/nixos/homelab/orphans/glance/config/branding.nix

@@ -0,0 +1,7 @@
+{
+  hide-footer = true;
+  # logo-url = "/assets/logo.png";
+  # app-name = "My Dashboard";
+  # favicon-url = "/assets/logo.png";
+  # app-icon-url = "/assets/logo.png";
+}

modules/nixos/homelab/orphans/glance/config/pages.nix

@@ -0,0 +1,50 @@
+{ config, flake, ... }:
+let
+  widgetsPath = ./widgets;
+  widgets = {
+    jellyfin = import (widgetsPath + /jelly) { inherit config flake; };
+    steam = import (widgetsPath + /steam);
+    podcasts = import (widgetsPath + /podcasts.nix);
+    calendar = import (widgetsPath + /calendar.nix);
+    clock = import (widgetsPath + /clock.nix);
+    weather = import (widgetsPath + /weather.nix);
+    reddit = import (widgetsPath + /reddit.nix);
+    videos = import (widgetsPath + /videos.nix);
+    repos = import (widgetsPath + /repos.nix);
+  };
+in
+[
+  {
+    columns = [
+      {
+        size = "full";
+        widgets = [
+          {
+            type = "group";
+            widgets = [
+              widgets.podcasts
+              widgets.videos
+            ];
+          }
+          widgets.reddit
+        ];
+      }
+      {
+        size = "small";
+        widgets = [
+          widgets.steam
+          widgets.repos
+        ];
+      }
+      {
+        size = "small";
+        widgets = [
+          widgets.calendar
+          widgets.weather
+          widgets.clock
+        ];
+      }
+    ];
+    name = "Dashboard";
+  }
+]

modules/nixos/homelab/orphans/glance/config/server.nix

@@ -0,0 +1,16 @@
+{ flake, configHelpers, ... }:
+let
+  inherit (flake.config.people) user0;
+  inherit (flake.config.machines.devices) ceres;
+in
+{
+  assets-path = "/home/${user0}/projects/dotfiles/modules/nixos/services/glance/assets";
+  # host = configHelpers.host;
+  # host = configHelpers.localhost;
+  host = ceres.wireguard.ip0;
+  port = configHelpers.service.ports.port0;
+  # auth = {
+  #   secret-key = config.sops.secrets."${service.name}/key".path;
+  #   users.${user0}.password = config.sops.secrets."${service.name}-${user0}-pass".path;
+  # };
+}

modules/nixos/homelab/orphans/glance/config/theme.nix

@@ -0,0 +1,7 @@
+{
+  background-color = "232 23 18";
+  contrast-multiplier = 1.2;
+  primary-color = "220 83 75";
+  positive-color = "105 48 72";
+  negative-color = "351 74 73";
+}

modules/nixos/homelab/orphans/glance/config/widgets/calendar.nix

@@ -0,0 +1,5 @@
+{
+  type = "calendar";
+  title = "Calendar";
+  style = "vertical-cards";
+}

modules/nixos/homelab/orphans/glance/config/widgets/clock.nix

@@ -0,0 +1,22 @@
+{
+  type = "clock";
+  hour-format = "12h";
+  timezones = [
+    {
+      timezone = "America/Winnipeg";
+      label = "Winnipeg, MB";
+    }
+    {
+      timezone = "Europe/Berlin";
+      label = "Berlin, DE";
+    }
+    {
+      timezone = "Asia/Kolkata";
+      label = "Kolkata, IN";
+    }
+    {
+      timezone = "Asia/Tokyo";
+      label = "Tokyo, JP";
+    }
+  ];
+}

modules/nixos/homelab/orphans/glance/config/widgets/jelly/config/default.nix

@@ -0,0 +1,326 @@
+''
+  {{ $mediaServer := .Options.StringOr "media-server" "" }}
+      {{ $baseURL := .Options.StringOr "base-url" "" }}
+      {{ $apiKey := .Options.StringOr "api-key" "" }}
+      {{ $userName := .Options.StringOr "user-name" "" }}
+
+      {{ define "errorMsg" }}
+        <div class="widget-error-header">
+          <div class="color-negative size-h3">ERROR</div>
+          <svg class="widget-error-icon" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5">
+            <path stroke-linecap="round" stroke-linejoin="round" d="M12 9v3.75m-9.303 3.376c-.866 1.5.217 3.374 1.948 3.374h14.71c1.73 0 2.813-1.874 1.948-3.374L13.949 3.378c-.866-1.5-3.032-1.5-3.898 0L2.697 16.126ZM12 15.75h.007v.008H12v-.008Z"></path>
+          </svg>
+        </div>
+        <p class="break-all">{{ . }}</p>
+      {{ end }}
+
+      {{ if or
+        (eq $mediaServer "")
+        (eq $baseURL "")
+        (eq $apiKey "")
+        (and (eq $mediaServer "jellyfin") (eq $userName ""))
+      }}
+        {{ template "errorMsg" "Some required options are not set" }}
+      {{ else }}
+
+      {{ $historyLength := .Options.StringOr "history-length" "10" }}
+      {{ $mediaTypes := .Options.StringOr "media-types" "" }}
+      {{ if eq $mediaServer "tautulli" }}
+        {{ $mediaTypes = .Options.StringOr "media-types" "movie,episode,track" }}
+      {{ else if or (eq $mediaServer "jellyfin") (eq $mediaServer "emby") }}
+        {{ $mediaTypes = .Options.StringOr "media-types" "Movie,Episode,Audio" }}
+      {{ end }}
+      {{ $isSmallColumn := .Options.BoolOr "small-column" false }}
+      {{ $isCompact := .Options.BoolOr "compact" true }}
+      {{ $showThumbnail := .Options.BoolOr "show-thumbnail" false }}
+      {{ $thumbAspectRatio := .Options.StringOr "thumbnail-aspect-ratio" "" }}
+      {{ $showUser := .Options.BoolOr "show-user" true }}
+      {{ $timeAbsolute := .Options.BoolOr "time-absolute" false }}
+      {{ $timeFormat := .Options.StringOr "time-format" "Jan 02 15:04" }}
+
+      {{ $userID := "" }}
+      {{ $historyRequestURL := "" }}
+      {{ $usersRequestURL := "" }}
+      {{ $historyCall := "" }}
+      {{ $usersCall := "" }}
+      {{ $history := "" }}
+      {{ $users := "" }}
+
+      {{ if eq $mediaServer "plex" }}
+        {{ $historyRequestURL = concat $baseURL "/status/sessions/history/all" }}
+        {{ $historyCall = newRequest $historyRequestURL
+          | withParameter "limit" $historyLength
+          | withParameter "sort" "viewedAt:desc"
+          | withHeader "Accept" "application/json"
+          | withHeader "X-Plex-Token" $apiKey
+          | getResponse }}
+
+        {{ if $historyCall.JSON.Exists "MediaContainer" }}
+          {{ $history = $historyCall.JSON.Array "MediaContainer.Metadata" }}
+        {{ else }}
+          {{ template "errorMsg" (concat "Could not fetch " $mediaServer " API.") }}
+        {{ end }}
+
+        {{ $usersRequestURL = concat $baseURL "/accounts" }}
+        {{ $usersCall = newRequest $usersRequestURL
+          | withHeader "Accept" "application/json"
+          | withHeader "X-Plex-Token" $apiKey
+          | getResponse }}
+        {{ $users = $usersCall.JSON.Array "MediaContainer.Account" }}
+
+      {{ else if eq $mediaServer "tautulli" }}
+        {{ $historyRequestURL = concat $baseURL "/api/v2" }}
+        {{ $historyCall = newRequest $historyRequestURL
+          | withParameter "apikey" $apiKey
+          | withParameter "cmd" "get_history"
+          | withParameter "length" $historyLength
+          | withParameter "media_type" $mediaTypes
+          | withHeader "Accept" "application/json"
+          | getResponse }}
+
+        {{ if eq $historyCall.Response.StatusCode 200 }}
+          {{ $history = $historyCall.JSON.Array "response.data.data" }}
+        {{ else }}
+          {{ template "errorMsg" (concat "Could not fetch " $mediaServer " API.") }}
+        {{ end }}
+
+      {{ else if or (eq $mediaServer "jellyfin") (eq $mediaServer "emby") }}
+        {{ $usersRequestURL = concat $baseURL "/Users" }}
+        {{ $usersCall = newRequest $usersRequestURL
+          | withParameter "api_key" $apiKey
+          | withHeader "Accept" "application/json"
+          | getResponse }}
+
+        {{ $usersList := $usersCall.JSON.Array "" }}
+        {{ range $i, $user := $usersList }}
+          {{ if eq ($user.String "Name") $userName }}
+            {{ $userID = $user.String "Id" }}
+            {{ break }}
+          {{ end }}
+        {{ end }}
+        {{ if eq $userID "" }}
+          {{ template "errorMsg" (concat "User '" $userName "' not found.") }}
+        {{ end }}
+
+        {{ $historyRequestURL = concat $baseURL "/Users/" $userID "/Items" }}
+        {{ $historyCall = newRequest $historyRequestURL
+          | withParameter "api_key" $apiKey
+          | withParameter "Limit" $historyLength
+          | withParameter "IncludeItemTypes" $mediaTypes
+          | withParameter "Recursive" "true"
+          | withParameter "isPlayed" "true"
+          | withParameter "sortBy" "DatePlayed"
+          | withParameter "sortOrder" "Descending"
+          | withParameter "Fields" "UserDataLastPlayedDate"
+          | withHeader "Accept" "application/json"
+          | getResponse }}
+
+        {{ $history = $historyCall.JSON.Array "Items" }}
+      {{ end }}
+
+      {{ if and (eq $historyCall.Response.StatusCode 200) (eq (len $history) 0) }}
+        <p>Nothing has been played. Start streaming something!</p>
+      {{ else }}
+        <div class="carousel-container show-right-cutoff">
+          <div class="cards-horizontal carousel-items-container">
+            {{ range $n, $item := $history }}
+              {{ $mediaType := "" }}
+              {{ $isMovie := false }}
+              {{ $isShows := false }}
+              {{ $isMusic := false }}
+              {{ $title := "" }}
+              {{ $showTitle := "" }}
+              {{ $showSeason := "" }}
+              {{ $showEpisode := "" }}
+              {{ $artist := "" }}
+              {{ $albumTitle := "" }}
+              {{ $thumbURL := "" }}
+              {{ $playedAt := "" }}
+
+              {{ if eq $mediaServer "plex" }}
+                {{ $userID = $item.Int "accountID" }}
+                {{ range $n, $u := $users }}
+                  {{ if eq $userID ($u.Int "id") }}
+                    {{ $userName = $u.String "name" }}
+                    {{ break }}
+                  {{ end }}
+                {{ end }}
+
+                {{ $mediaType = $item.String "type" }}
+                {{ $isMovie = eq $mediaType "movie" }}
+                {{ $isShows = eq $mediaType "episode" }}
+                {{ $isMusic = eq $mediaType "track" }}
+
+                {{ $title = $item.String "title" }}
+                {{ if $isShows }}
+                  {{ $showTitle = $item.String "grandparentTitle" }}
+                  {{ $showSeason = $item.String "parentIndex" }}
+                  {{ $showEpisode = $item.String "index" }}
+                {{ else if $isMusic }}
+                  {{ $artist = $item.String "grandparentTitle" }}
+                  {{ $albumTitle = $item.String "parentTitle" }}
+                {{ end }}
+
+                {{ $thumbID := $item.String "thumb" }}
+                {{ if or $isShows $isMusic}}
+                  {{ $thumbID = $item.String "parentThumb" }}
+                {{ end }}
+                {{ $thumbURL = concat $baseURL $thumbID "?X-Plex-Token=" $apiKey }}
+
+                {{ $time := $item.String "viewedAt" }}
+                {{ if $timeAbsolute }}
+                  {{ $playedAt = $time | parseLocalTime "unix" | formatTime $timeFormat }}
+                {{ else }}
+                  {{ $playedAt = $time | parseRelativeTime "unix" }}
+                {{ end }}
+
+              {{ else if eq $mediaServer "tautulli" }}
+                {{ $userName = $item.String "user" }}
+                {{ $mediaType = $item.String "media_type" }}
+                {{ $isMovie = eq $mediaType "movie" }}
+                {{ $isShows = eq $mediaType "episode" }}
+                {{ $isMusic = eq $mediaType "track" }}
+
+                {{ $title = $item.String "title" }}
+                {{ if $isShows }}
+                  {{ $showTitle = $item.String "grandparent_title" }}
+                  {{ $showSeason = $item.String "parent_media_index" }}
+                  {{ $showEpisode = $item.String "media_index" }}
+                {{ else if $isMusic }}
+                  {{ $artist = $item.String "grandparent_title" }}
+                  {{ $albumTitle = $item.String "parent_title" }}
+                {{ end }}
+
+                {{ $thumbID := $item.String "thumb" }}
+                {{ $thumbURL = concat $baseURL "/api/v2?apikey=" $apiKey "&cmd=pms_image_proxy&img=" $thumbID }}
+
+                {{ $time := $item.String "date" }}
+                {{ if $timeAbsolute }}
+                  {{ $playedAt = $time | parseLocalTime "unix" | formatTime $timeFormat }}
+                {{ else }}
+                  {{ $playedAt = $time | parseRelativeTime "unix" }}
+                {{ end }}
+
+              {{ else if or (eq $mediaServer "jellyfin") (eq $mediaServer "emby") }}
+                {{ $mediaType = $item.String "Type" }}
+                {{ $isMovie = eq $mediaType "Movie" }}
+                {{ $isShows = eq $mediaType "Episode" }}
+                {{ $isMusic = eq $mediaType "Audio" }}
+
+                {{ $title = $item.String "Name" }}
+                {{ if $isShows }}
+                  {{ $showTitle = $item.String "SeriesName" }}
+                  {{ $showSeason = $item.String "ParentIndexNumber" }}
+                  {{ $showEpisode = $item.String "IndexNumber" }}
+                {{ else if $isMusic }}
+                  {{ $artist = $item.String "AlbumArtist" }}
+                  {{ $albumTitle = $item.String "Album" }}
+                {{ end }}
+
+                {{ $thumbID := $item.String "Id" }}
+                {{ if $isShows }}
+                  {{ $thumbID  = $item.String "SeasonId" }}
+                {{ end }}
+                {{ $thumbURL = concat $baseURL "/Items/" $thumbID "/Images/Primary?api_key=" $apiKey }}
+
+                {{ $time := $item.String "UserData.LastPlayedDate" }}
+                {{ if $timeAbsolute }}
+                  {{ $playedAt = $time | parseLocalTime "rfc3339" | formatTime $timeFormat }}
+                {{ else }}
+                  {{ $playedAt = $time | parseRelativeTime "rfc3339" }}
+                {{ end }}
+              {{ end }}
+
+              {{ $showInfoFormat := concat "Season " $showSeason " Episode " $showEpisode}}
+              {{ if $isCompact }}
+                {{ $showInfoFormat = concat "S" $showSeason "E" $showEpisode}}
+              {{ end }}
+
+              <div class="card widget-content-frame">
+                {{ if $showThumbnail }}
+                  <img src="{{ $thumbURL | safeURL }}"
+                    alt="{{ $title }} thumbnail"
+                    loading="lazy"
+                    class="media-server-thumbnail shrink-0"
+                    style="
+                      object-fit: cover;
+                      border-radius: var(--border-radius) var(--border-radius) 0 0;
+                      {{ if eq $thumbAspectRatio "square" }}
+                        aspect-ratio: 1;
+                      {{ else if eq $thumbAspectRatio "portrait" }}
+                        aspect-ratio: 3/4;
+                      {{ else if eq $thumbAspectRatio "landscape" }}
+                        aspect-ratio: 4/3;
+                      {{ else }}
+                        aspect-ratio: initial;
+                      {{ end }}
+                    "
+                  />
+                {{ end }}
+
+                <div class="grow padding-inline-widget margin-top-10 margin-bottom-10">
+                  <ul class="flex flex-column justify-evenly margin-bottom-3 {{if $isSmallColumn}}size-h6{{end}}" style="height: 100%;">
+                    {{ if $isCompact }}
+                      <ul class="list-horizontal-text flex-nowrap">
+                        {{ if $showUser }}
+                          <li class="color-primary text-truncate">{{ $userName }}</li>
+                        {{ end }}
+
+                        {{ if $timeAbsolute }}
+                          <li class="text-truncate">{{ $playedAt }}</li>
+                        {{ else }}
+                          <li class="shrink-0">
+                            <span {{ $playedAt }}></span>
+                            {{ if not $showUser }}
+                              <span> ago</span>
+                            {{ end }}
+                          </li>
+                        {{ end }}
+                      </ul>
+
+                      {{ if $isShows }}
+                        <ul class="list-horizontal-text flex-nowrap">
+                          <li class="text-truncate">{{ $showInfoFormat }}</li>
+                          <li class="text-truncate">{{ $showTitle }}</li>
+                        </ul>
+                      {{ else if $isMusic }}
+                        <ul class="list-horizontal-text flex-nowrap">
+                          <li class="text-truncate">{{ $artist }}</li>
+                          <li class="text-truncate">{{ $albumTitle }}</li>
+                        </ul>
+                      {{ end }}
+
+                      <li class="text-truncate">{{ $title }}</li>
+                    {{ else }}
+                      {{ if $showUser }}
+                        <li class="color-primary text-truncate">{{ $userName }}</li>
+                      {{ end }}
+
+                      {{ if $timeAbsolute }}
+                        <li class="text-truncate">{{ $playedAt }}</li>
+                      {{ else }}
+                        <li class="text-truncate">
+                          <span {{ $playedAt }}></span>
+                          <span> ago</span>
+                        </li>
+                      {{ end }}
+
+                      {{ if $isShows }}
+                        <li class="text-truncate">{{ $showTitle }}</li>
+                        <li class="text-truncate">{{ $showInfoFormat }}</li>
+                      {{ else if $isMusic }}
+                        <li class="text-truncate">{{ $artist }}</li>
+                        <li class="text-truncate">{{ $albumTitle }}</li>
+                      {{ end }}
+
+                      <li class="text-truncate">{{ $title }}</li>
+                    {{ end }}
+                  </ul>
+                </div>
+              </div>
+            {{ end }}
+          </div>
+        </div>
+      {{ end }}
+      {{ end }}
+''

modules/nixos/homelab/orphans/glance/config/widgets/jelly/default.nix

@@ -0,0 +1,30 @@
+{ config, flake, ... }:
+let
+  inherit (flake.config.people) user0;
+  inherit (flake.config.people.users.${user0}) name;
+  inherit (flake.config.services.instances) glance jellyfin web;
+  service = glance;
+  jellyfinUserName = name;
+  jellyfinHost = "https://${jellyfin.subdomain}.${web.domains.url0}";
+in
+{
+  type = "custom-api";
+  title = "Jellyfin History";
+  frameless = true;
+  cache = "5m";
+  options = {
+    media-server = "jellyfin";
+    base-url = jellyfinHost;
+    api-key = config.sops.secrets."${service.name}-${jellyfin.name}".path;
+    user-name = jellyfinUserName;
+    history-length = "10";
+    small-column = true;
+    compact = true;
+    show-thumbnail = false;
+    thumbnail-aspect-ratio = "default";
+    show-user = true;
+    time-absolute = false;
+    time-format = "Jan 02 15:04";
+  };
+  template = import ./config;
+}

modules/nixos/homelab/orphans/glance/config/widgets/monitor.nix

@@ -0,0 +1,6 @@
+{
+  type = "monitor";
+  cache = "1m";
+  title = "Services";
+
+}

modules/nixos/homelab/orphans/glance/config/widgets/podcasts.nix

@@ -0,0 +1,22 @@
+let
+  podcastHelper = url: title: {
+    url = url;
+    title = title;
+    hide-description = true;
+    hide-categories = true;
+  };
+  podcastData = [
+    (podcastHelper "https://sigmanutrition.libsyn.com/rss/" "Sigma Nutrition Radio")
+    (podcastHelper "https://wakingup.libsyn.com/rss" "Making Sense with Sam Harris")
+    (podcastHelper "https://feeds.simplecast.com/uNKL_XD_" "Docs Who Lift")
+    (podcastHelper "https://feeds.redcircle.com/677da6c9-d33f-49df-95d7-dc8821b797b4" "Mayo Clinic on Nutrition")
+  ];
+  podcastEntries = builtins.map (podcast: podcast) podcastData;
+in
+{
+  type = "rss";
+  title = "Podcasts";
+  style = "detailed-list";
+  collapse-after = 3;
+  feeds = podcastEntries;
+}

modules/nixos/homelab/orphans/glance/config/widgets/reddit.nix

@@ -0,0 +1,21 @@
+let
+  subList = [
+    "privacy"
+    "selfhosted"
+    "vegan"
+  ];
+
+  subredditEntries = builtins.map (sub: {
+    type = "reddit";
+    subreddit = sub;
+    collapse-after = 5;
+    show-thumbnails = true;
+    sort-by = "top";
+    top-period = "day";
+  }) subList;
+
+in
+{
+  type = "group";
+  widgets = subredditEntries;
+}

modules/nixos/homelab/orphans/glance/config/widgets/repos.nix

@@ -0,0 +1,15 @@
+{
+  type = "releases";
+  show-source-icon = true;
+  collapse-after = 7;
+  repositories = [
+    "jmshrv/finamp"
+    "futo-org/android-keyboard"
+    "hyprwm/Hyprland"
+    "mollyim/mollyim-android"
+    "jarnedemeulemeester/findroid"
+    "brandonp2412/Flexify"
+    "accrescent/accrescent"
+    "ImranR98/Obtainium"
+  ];
+}

modules/nixos/homelab/orphans/glance/config/widgets/steam/config/default.nix

@@ -0,0 +1,14 @@
+''
+  <ul class="list list-gap-10 collapsible-container" data-collapse-after="5">
+    {{ range .JSON.Array "specials.items" }}
+      <li>
+        <a class="size-h4 color-highlight block text-truncate" href="https://store.steampowered.com/app/{{ .Int "id" }}/">{{ .String "name" }}</a>
+        <ul class="list-horizontal-text">
+          <li>{{ .Int "final_price" | toFloat | mul 0.01 | printf "$%.2f" }}</li>
+          {{ $discount := .Int "discount_percent" }}
+          <li{{ if ge $discount 1 }} class="color-positive"{{ end }}>{{ $discount }}% off</li>
+        </ul>
+      </li>
+    {{ end }}
+  </ul>
+''

modules/nixos/homelab/orphans/glance/config/widgets/steam/default.nix

@@ -0,0 +1,7 @@
+{
+  type = "custom-api";
+  title = "Steam Specials";
+  cache = "12h";
+  url = "https://store.steampowered.com/api/featuredcategories?cc=ca";
+  template = import ./config;
+}

modules/nixos/homelab/orphans/glance/config/widgets/videos.nix

@@ -0,0 +1,14 @@
+{
+  type = "videos";
+  style = "vertical-list";
+  collapse-after = 6;
+  channels = [
+    "UCfQgsKhHjSyRLOp9mnffqVg"
+    "UCld68syR8Wi-GY_n4CaoJGA"
+    "UChIs72whgZI9w6d6FhwGGHA"
+    "UCes5DW7sk9WU8oqE9HGJdpg"
+    "UCOksmJqNzaYLhplfs7Sl8cA"
+    "UCQNmHyGAKqzOT_JsVEs4eag"
+    "UCd8rTrNRM6DYR4TXgSqNw8g"
+  ];
+}

modules/nixos/homelab/orphans/glance/config/widgets/weather.nix

@@ -0,0 +1,7 @@
+{
+  type = "weather";
+  title = "Weather";
+  units = "metric";
+  hour-format = "12h";
+  location = "Winnipeg, Manitoba, Canada";
+}

modules/nixos/homelab/orphans/glance/default.nix

@@ -0,0 +1,82 @@
+{ config, flake, ... }:
+let
+  inherit (flake.config.services.instances)
+    glance
+    jellyfin
+    web
+    ;
+  inherit (flake.config.machines.devices) ceres mars deimos;
+  configHelpers = {
+    service = glance;
+    hostname = config.networking.hostName;
+    localhost = web.localhost.address1;
+    host = configHelpers.service.domains.url0;
+  };
+  configPath = ./config;
+  configImports = {
+    server = import (configPath + /server.nix) { inherit flake configHelpers; };
+    branding = import (configPath + /branding.nix);
+    theme = import (configPath + /theme.nix);
+    pages = import (configPath + /pages.nix) { inherit config flake; };
+  };
+in
+{
+  services = {
+    glance = {
+      enable = true;
+      settings = configImports;
+    };
+    caddy = {
+      virtualHosts = {
+        "${configHelpers.host}" = {
+          extraConfig = ''
+            @allowed_ips {
+              remote_ip ${mars.wireguard.ip0} ${deimos.wireguard.ip0}
+            }
+
+            handle @allowed_ips {
+              redir /.well-known/carddav /remote.php/dav/ 301
+              redir /.well-known/caldav /remote.php/dav/ 301
+              reverse_proxy ${ceres.wireguard.ip0}:${toString configHelpers.service.ports.port0}
+            }
+            handle {
+              respond "Access Denied" 403
+            }
+            tls ${configHelpers.service.ssl.cert} ${configHelpers.service.ssl.key}
+          '';
+        };
+      };
+    };
+  };
+  sops =
+    let
+      sopsPath = secret: {
+        path = "/run/secrets/${configHelpers.service.name}-${secret}";
+        owner = "root";
+        group = "root";
+        mode = "644";
+      };
+    in
+    {
+      secrets = builtins.listToAttrs (
+        map
+          (secret: {
+            name = "${configHelpers.service.name}/${secret}";
+            value = sopsPath secret;
+          })
+          [
+            # "key"
+            # "${user0}-pass"
+            jellyfin.name
+          ]
+      );
+    };
+
+  networking = {
+    firewall = {
+      interfaces.wg0.allowedTCPPorts = [
+        configHelpers.service.ports.port0
+      ];
+    };
+  };
+}

modules/nixos/homelab/orphans/midnight/default.nix

@@ -0,0 +1,173 @@
+{
+  flake,
+  config,
+  pkgs,
+  ...
+}:
+let
+  inherit (flake.config.people) user0;
+  inherit (flake.config.machines) devices;
+
+  mars = devices.mars.name;
+  ceres = devices.ceres.name;
+  eris = devices.eris.name;
+  deimos = devices.deimos.name;
+  phobos = devices.phobos.name;
+
+  hostname = config.networking.hostName;
+
+  deviceLogic =
+    var0: var1: var2: var3: var4:
+    if hostname == ceres then
+      var0
+    else if hostname == eris then
+      var1
+    else if hostname == mars then
+      var2
+    else if hostname == deimos then
+      var3
+    else if hostname == phobos then
+      var4
+    else
+      var0;
+
+  macOctet = deviceLogic "57" "58" "59" "60" "61";
+in
+{
+  microvm = {
+    vms = {
+      miner = {
+        autostart = true;
+        config =
+          let
+            macAddress = "02:00:00:00:00:${macOctet}";
+            workers = deviceLogic 35 4 18 5 6;
+          in
+          {
+            environment.systemPackages = [
+              pkgs.git
+              pkgs.ncurses
+              pkgs.python313
+            ];
+
+            microvm = {
+              forwardPorts = [
+                {
+                  from = "host";
+                  host.port = 2057;
+                  guest.port = 22;
+                }
+              ];
+              hypervisor = "qemu";
+              interfaces = [
+                {
+                  type = "tap";
+                  id = "vm-miner";
+                  mac = "02:00:00:00:57:${macOctet}";
+                }
+                {
+                  type = "user";
+                  id = "uservm-miner";
+                  mac = macAddress;
+                }
+              ];
+              mem = deviceLogic 45000 5120 22000 6144 7168;
+              shares = [
+                {
+                  mountPoint = "/nix/.ro-store";
+                  proto = "virtiofs";
+                  source = "/nix/store";
+                  tag = "read_only_nix_store";
+                }
+                {
+                  mountPoint = "/var/lib/midnight-data";
+                  proto = "virtiofs";
+                  source = "/var/lib/midnight-data";
+                  tag = "midnight_data";
+                }
+              ];
+              vcpu = workers;
+            };
+
+            networking.firewall.allowedTCPPorts = [
+              22
+            ];
+
+            services = {
+              openssh = {
+                enable = true;
+                settings.PasswordAuthentication = false;
+              };
+            };
+
+            system.stateVersion = "25.05";
+
+            systemd = {
+              network = {
+                enable = true;
+                networks."20-user" = {
+                  matchConfig.MACAddress = macAddress;
+                  networkConfig = {
+                    DHCP = "yes";
+                  };
+                };
+              };
+
+              tmpfiles.rules = [
+                "d /var/lib/midnight-data 0755 root root - -"
+              ];
+
+              services = {
+                midnight-miner = {
+                  after = [ "network-online.target" ];
+                  description = "MidnightMiner - Cardano NIGHT token miner";
+                  serviceConfig = {
+                    Environment = [
+                      "PATH=/run/current-system/sw/bin"
+                      "TERM=xterm-256color"
+                    ];
+                    ExecStartPre = pkgs.writeShellScript "setup-miner" ''
+                      # Create venv if not already present (persists on virtiofs mount)
+                      if [ ! -d /var/lib/midnight-data/venv ]; then
+                        ${pkgs.python313}/bin/python -m venv /var/lib/midnight-data/venv
+                      fi
+
+                      # Install/upgrade dependencies
+                      /var/lib/midnight-data/venv/bin/pip install --upgrade pip
+                      /var/lib/midnight-data/venv/bin/pip install requests pycardano cbor2 portalocker
+
+                      # Clone repo if not already present
+                      if [ ! -d /var/lib/midnight-data/MidnightMiner ]; then
+                        cd /var/lib/midnight-data
+                        ${pkgs.git}/bin/git clone https://github.com/djeanql/MidnightMiner.git
+                      else
+                        cd /var/lib/midnight-data/MidnightMiner
+                        ${pkgs.git}/bin/git pull
+                      fi
+                    '';
+                    ExecStart = pkgs.writeShellScript "run-miner" ''
+                      export PATH=/run/current-system/sw/bin:$PATH
+                      cd /var/lib/midnight-data/MidnightMiner
+                      /var/lib/midnight-data/venv/bin/python miner.py --workers ${toString workers} --no-donation
+                    '';
+                    Restart = "always";
+                    RestartSec = 10;
+                  };
+                  wants = [ "network-online.target" ];
+                  wantedBy = [ "multi-user.target" ];
+                };
+              };
+            };
+
+            time.timeZone = "America/Winnipeg";
+
+            users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
+
+          };
+      };
+    };
+  };
+  systemd.tmpfiles.rules = [
+    "d /var/lib/midnight-data 0751 microvm wheel - -"
+  ];
+}

modules/nixos/homelab/orphans/ollama/default.nix

@@ -0,0 +1,11 @@
+let
+  importList =
+    let
+      content = builtins.readDir ./.;
+      dirContent = builtins.filter (n: content.${n} == "directory") (builtins.attrNames content);
+    in
+    map (name: ./. + "/${name}") dirContent;
+in
+{
+  imports = importList;
+}

modules/nixos/homelab/orphans/ollama/ollamaCeres/default.nix

@@ -0,0 +1,75 @@
+{
+  flake,
+  ...
+}:
+let
+  inherit (flake.config.machines.devices)
+    ceres
+    ;
+  inherit (flake.config.services.instances)
+    ollama
+    web
+    ;
+  service = ollama;
+  localhost = web.localhost.address0;
+  host = service.domains.url0;
+in
+{
+  services = {
+    ollama = {
+      enable = true;
+      group = service.name;
+      host = "http://${localhost}";
+      user = service.name;
+      port = service.ports.port1;
+      acceleration = "cuda";
+      models = service.paths.path0;
+    };
+    open-webui = {
+      enable = true;
+      host = localhost;
+      port = service.ports.port0;
+      environment = {
+        ENABLE_OLLAMA_API = "True";
+        ANONYMIZED_TELEMETRY = "False";
+        DO_NOT_TRACK = "True";
+        SCARF_NO_ANALYTICS = "True";
+        OLLAMA_BASE_URL = "http://${localhost}:${toString service.ports.port1}";
+        WEBUI_AUTH = "True";
+      };
+    };
+    caddy = {
+      virtualHosts = {
+        ${host} = {
+          extraConfig = ''
+            reverse_proxy ${localhost}:${toString service.ports.port0}
+            tls ${service.ssl.cert} ${service.ssl.key}
+          '';
+        };
+      };
+    };
+  };
+  systemd.tmpfiles.rules = [
+    "Z ${service.paths.path0} 0755 ${service.name} ${service.name} -"
+  ];
+  networking = {
+    firewall = {
+      allowedTCPPorts = [
+        service.ports.port0
+        service.ports.port1
+      ];
+    };
+  };
+  fileSystems = {
+    "/var/lib/${service.name}" = {
+      device = service.paths.path0;
+      fsType = "none";
+      options = [
+        "bind"
+      ];
+      depends = [
+        ceres.storage0.mount
+      ];
+    };
+  };
+}

modules/nixos/homelab/orphans/ollama/ollamaMars/default.nix

@@ -0,0 +1,47 @@
+{
+  flake,
+  ...
+}:
+let
+  inherit (flake.config.services.instances)
+    ollama
+    web
+    ;
+  service = ollama;
+  localhost = web.localhost.address1;
+in
+{
+  services = {
+    ollama = {
+      enable = true;
+      group = service.name;
+      host = "http://${localhost}";
+      user = service.name;
+      acceleration = "rocm";
+    };
+    open-webui = {
+      enable = true;
+      host = localhost;
+      port = service.ports.port0;
+      environment = {
+        ENABLE_OLLAMA_API = "True";
+        ANONYMIZED_TELEMETRY = "False";
+        DO_NOT_TRACK = "True";
+        SCARF_NO_ANALYTICS = "True";
+        OLLAMA_BASE_URL = "http://${localhost}:${toString service.ports.port1}";
+        WEBUI_AUTH = "True";
+      };
+    };
+  };
+  systemd.tmpfiles.rules = [
+    "Z ${service.paths.path1} 0777 ${service.name} ${service.name} -"
+  ];
+  networking = {
+    firewall = {
+      allowedTCPPorts = [
+        service.ports.port0
+        service.ports.port1
+      ];
+    };
+  };
+}

modules/nixos/homelab/orphans/peertube/default.nix

@@ -0,0 +1,151 @@
+{
+  flake,
+  config,
+  pkgs,
+  ...
+}:
+let
+  inherit (flake.config.machines.devices)
+    ceres
+    ;
+  inherit (flake.config.services.instances)
+    caddy
+    peertube
+    smtp
+    web
+    ;
+  service = peertube;
+  localhost = web.localhost.address0;
+  host = service.domains.url0;
+in
+{
+  services = {
+    peertube = {
+      configureNginx = false;
+      enable = true;
+      enableWebHttps = true;
+      group = service.name;
+      listenWeb = caddy.ports.port1;
+      listenHttp = service.ports.port0;
+      localDomain = host;
+      serviceEnvironmentFile = config.sops.secrets."${service.name}/root".path;
+      user = service.name;
+      plugins = {
+        enable = true;
+        plugins = builtins.attrValues {
+          inherit (pkgs)
+            peertube-plugin-livechat
+            peertube-plugin-matomo
+            peertube-plugin-transcoding-custom-quality
+            peertube-theme-dark
+            ;
+        };
+      };
+
+      secrets = {
+        secretsFile = config.sops.secrets."${service.name}/secret".path;
+      };
+      settings = {
+        instance = {
+          name = "upRootNutrition";
+        };
+        log = {
+          level = "debug";
+        };
+        smtp = {
+          transport = smtp.name;
+          disable_starttls = false;
+          from_address = service.email.address1;
+          hostname = smtp.hostname;
+          port = smtp.ports.port1;
+          username = smtp.email.address1;
+          tls = false;
+        };
+      };
+      database = {
+        createLocally = true;
+        passwordFile = config.sops.secrets."${service.name}/database".path;
+      };
+      redis = {
+        enableUnixSocket = true;
+        createLocally = true;
+        passwordFile = config.sops.secrets."${service.name}/redis".path;
+      };
+      smtp = {
+        createLocally = true;
+        passwordFile = config.sops.secrets."${service.name}/smtp".path;
+      };
+    };
+
+    caddy = {
+      virtualHosts = {
+        ${host} = {
+          extraConfig = ''
+            reverse_proxy ${localhost}:${toString service.ports.port0}
+
+            tls ${service.ssl.cert} ${service.ssl.key}
+
+          '';
+        };
+      };
+    };
+  };
+
+  sops =
+    let
+      sopsPath = secret: {
+        path = "${service.sops.path0}/${service.name}/${secret}";
+        owner = service.name;
+        mode = "600";
+      };
+    in
+    {
+      secrets = builtins.listToAttrs (
+        map
+          (secret: {
+            name = "${service.name}/${secret}";
+            value = sopsPath secret;
+          })
+          [
+            "database"
+            "redis"
+            "root"
+            "secret"
+            "smtp"
+          ]
+      );
+    };
+
+  fileSystems."/var/lib/${service.name}" = {
+    device = service.paths.path0;
+    fsType = "none";
+    options = [
+      "bind"
+    ];
+    depends = [
+      ceres.storage0.mount
+    ];
+  };
+
+  systemd.tmpfiles.rules = [
+    "Z ${service.paths.path0} 755 ${service.name} ${service.name} -"
+    "Z ${service.sops.path0} 755 ${service.name} ${service.name} -"
+  ];
+
+  users.users.${service.name}.extraGroups = [
+    "nginx"
+    "caddy"
+  ];
+
+  networking = {
+    firewall = {
+      allowedTCPPorts = [
+        service.ports.port0
+        service.ports.port1
+        service.ports.port2
+        service.ports.port3
+        service.ports.port4
+      ];
+    };
+  };
+}

modules/nixos/homelab/orphans/searx/config/engines.nix

@@ -0,0 +1,65 @@
+{ lib, ... }:
+lib.mapAttrsToList (name: value: { inherit name; } // value) {
+  "duckduckgo".disabled = false;
+  "brave".disabled = false;
+  "bing".disabled = false;
+  "mojeek".disabled = true;
+  "mwmbl".disabled = false;
+  "mwmbl".weight = 0.4;
+  "qwant".disabled = true;
+  "crowdview".disabled = false;
+  "crowdview".weight = 0.5;
+  "curlie".disabled = true;
+  "ddg definitions".disabled = false;
+  "ddg definitions".weight = 2;
+  "wikibooks".disabled = false;
+  "wikidata".disabled = false;
+  "wikiquote".disabled = true;
+  "wikisource".disabled = true;
+  "wikispecies".disabled = false;
+  "wikispecies".weight = 0.5;
+  "wikiversity".disabled = false;
+  "wikiversity".weight = 0.5;
+  "wikivoyage".disabled = false;
+  "wikivoyage".weight = 0.5;
+  "currency".disabled = true;
+  "dictzone".disabled = true;
+  "lingva".disabled = true;
+  "bing images".disabled = false;
+  "brave.images".disabled = false;
+  "duckduckgo images".disabled = false;
+  "google images".disabled = false;
+  "qwant images".disabled = true;
+  "1x".disabled = true;
+  "artic".disabled = false;
+  "deviantart".disabled = false;
+  "flickr".disabled = true;
+  "imgur".disabled = false;
+  "library of congress".disabled = false;
+  "material icons".disabled = true;
+  "material icons".weight = 0.2;
+  "openverse".disabled = false;
+  "pinterest".disabled = true;
+  "svgrepo".disabled = false;
+  "unsplash".disabled = false;
+  "wallhaven".disabled = false;
+  "wikicommons.images".disabled = false;
+  "yacy images".disabled = true;
+  "bing videos".disabled = false;
+  "brave.videos".disabled = true;
+  "duckduckgo videos".disabled = true;
+  "google videos".disabled = false;
+  "qwant videos".disabled = false;
+  "dailymotion".disabled = true;
+  "google play movies".disabled = true;
+  "invidious".disabled = true;
+  "odysee".disabled = true;
+  "peertube".disabled = true;
+  "piped".disabled = true;
+  "rumble".disabled = false;
+  "sepiasearch".disabled = false;
+  "vimeo".disabled = true;
+  "youtube".disabled = false;
+  "brave.news".disabled = true;
+  "google news".disabled = true;
+}

modules/nixos/homelab/orphans/searx/config/general.nix

@@ -0,0 +1,8 @@
+{
+  debug = false;
+  instance_name = "SearXNG Instance";
+  donation_url = false;
+  contact_url = false;
+  privacypolicy_url = false;
+  enable_metrics = false;
+}

modules/nixos/homelab/orphans/searx/config/outgoing.nix

@@ -0,0 +1,7 @@
+{
+  request_timeout = 5.0;
+  max_request_timeout = 15.0;
+  pool_connections = 100;
+  pool_maxsize = 15;
+  enable_http2 = true;
+}

modules/nixos/homelab/orphans/searx/config/plugins.nix

@@ -0,0 +1,9 @@
+[
+  "Basic Calculator"
+  "Hash plugin"
+  "Tor check plugin"
+  "Open Access DOI rewrite"
+  "Hostnames plugin"
+  "Unit converter plugin"
+  "Tracker URL remover"
+]

modules/nixos/homelab/orphans/searx/config/search.nix

@@ -0,0 +1,7 @@
+{
+  safe_search = 0;
+  autocomplete_min = 2;
+  autocomplete = "duckduckgo";
+  ban_time_on_fail = 5;
+  max_ban_time_on_fail = 120;
+}

modules/nixos/homelab/orphans/searx/config/server.nix

@@ -0,0 +1,27 @@
+{
+  flake,
+  config,
+  configHelpers,
+  ...
+}:
+let
+  inherit (flake.config.machines.devices) ceres;
+in
+{
+  port = configHelpers.service.ports.port0;
+  bind_address =
+    if configHelpers.hostname == ceres.name then ceres.wireguard.ip0 else configHelpers.localhost;
+  secret_key = config.sops.secrets."searx/key".path;
+  limiter = false;
+  public_instance = false;
+  image_proxy = true;
+  method = "GET";
+}
+// (
+  if configHelpers.hostname == ceres.name then
+    {
+      base_url = "https://${configHelpers.host}";
+    }
+  else
+    { }
+)

modules/nixos/homelab/orphans/searx/config/ui.nix

@@ -0,0 +1,11 @@
+{
+  static_use_hash = true;
+  default_locale = "en";
+  query_in_title = true;
+  infinite_scroll = true;
+  center_alignment = true;
+  default_theme = "simple";
+  theme_args.simple_style = "auto";
+  search_on_category_select = true;
+  hotkeys = "vim";
+}

modules/nixos/homelab/orphans/searx/default.nix

@@ -0,0 +1,101 @@
+{
+  flake,
+  lib,
+  config,
+  ...
+}:
+let
+  inherit (flake.config.machines.devices) ceres mars deimos;
+  inherit (flake.config.services.instances) searx web;
+  configHelpers = {
+    service = searx;
+    hostname = config.networking.hostName;
+    localhost = web.localhost.address0;
+    host = configHelpers.service.domains.url0;
+  };
+  configPath = ./config;
+  configImports = {
+    general = import (configPath + /general.nix);
+    ui = import (configPath + /ui.nix);
+    search = import (configPath + /search.nix);
+    server = import (configPath + /server.nix) { inherit config flake configHelpers; };
+    engines = import (configPath + /engines.nix) { inherit lib; };
+    outgoing = import (configPath + /outgoing.nix);
+    enabled_plugins = import (configPath + /plugins.nix);
+  };
+
+in
+{
+  services = {
+    searx = {
+      enable = true;
+      redisCreateLocally = true;
+      uwsgiConfig = {
+        socket = "/run/searx/searx.sock";
+        http = ":${builtins.toString configHelpers.service.ports.port0}";
+        chmod-socket = "660";
+      };
+      settings = configImports;
+    };
+  }
+  // (
+    if configHelpers.hostname == ceres.name then
+      {
+        caddy = {
+          virtualHosts = {
+            "${configHelpers.host}" = {
+              extraConfig = ''
+                @allowed_ips {
+                  remote_ip ${mars.wireguard.ip0} ${deimos.wireguard.ip0}
+                }
+
+                handle @allowed_ips {
+                  redir /.well-known/carddav /remote.php/dav/ 301
+                  redir /.well-known/caldav /remote.php/dav/ 301
+                  reverse_proxy ${ceres.wireguard.ip0}:${toString configHelpers.service.ports.port0}
+                }
+                handle {
+                  respond "Access Denied" 403
+                }
+                tls ${configHelpers.service.ssl.cert} ${configHelpers.service.ssl.key}
+              '';
+            };
+          };
+        };
+      }
+    else
+      { }
+  );
+
+  users.groups.searx.members = [ "caddy" ];
+  # systemd.services.caddy.serviceConfig.ProtectHome = false;
+
+  sops =
+    let
+      sopsPath = secret: {
+        path = "${configHelpers.service.sops.path0}/${configHelpers.service.name}-${secret}";
+        owner = configHelpers.service.name;
+        mode = "600";
+      };
+    in
+    {
+      secrets = builtins.listToAttrs (
+        map
+          (secret: {
+            name = "${configHelpers.service.name}/${secret}";
+            value = sopsPath secret;
+          })
+          [
+            "key"
+          ]
+      );
+    };
+
+  networking = {
+    firewall = {
+      interfaces.wg0.allowedTCPPorts = [
+        configHelpers.service.ports.port0
+      ];
+    };
+  };
+}

modules/nixos/homelab/restic/default.nix

@@ -0,0 +1,65 @@
+{
+  config,
+  flake,
+  ...
+}:
+let
+  inherit (flake.config.services) instances;
+  inherit (flake.config.people) user0;
+  envFile = "backblaze/env";
+  repoFile = "backblaze/repo";
+  passFile = "restic/pass";
+in
+{
+  services.restic = {
+    backups = {
+      remote = {
+        environmentFile = config.sops.secrets.${envFile}.path;
+        initialize = true;
+        passwordFile = config.sops.secrets.${passFile}.path;
+        repositoryFile = config.sops.secrets.${repoFile}.path;
+        timerConfig = {
+          OnCalendar = "0/4:00";
+          Persistent = true;
+        };
+        paths =
+          let
+            inst = instance: instances.${instance}.mntPaths.path0;
+          in
+          [
+            "/home/${user0}/.ssh"
+            (inst "firefly-iii")
+            (inst "forgejo")
+            (inst "mastodon")
+            (inst "opencloud1")
+            (inst "minecraft0")
+            (inst "minecraft1")
+            (inst "vaultwarden")
+            ((inst "jellyfin") + "/cache")
+            ((inst "jellyfin") + "/data")
+            ((inst "jellyfin") + "/media/music")
+          ];
+      };
+    };
+  };
+
+  sops = {
+    secrets = builtins.listToAttrs (
+      map
+        (secret: {
+          name = secret;
+          value = {
+            path = "/run/secrets/${secret}";
+            owner = "root";
+            group = "root";
+            mode = "0600";
+          };
+        })
+        [
+          envFile
+          repoFile
+          passFile
+        ]
+    );
+  };
+}

modules/nixos/homelab/samba/default.nix

@@ -0,0 +1,11 @@
+let
+  importList =
+    let
+      content = builtins.readDir ./.;
+      dirContent = builtins.filter (n: content.${n} == "directory") (builtins.attrNames content);
+    in
+    map (name: ./. + "/${name}") dirContent;
+in
+{
+  imports = importList;
+}

modules/nixos/homelab/samba/sambaCeres/default.nix

@@ -0,0 +1,57 @@
+{
+  flake,
+  ...
+}:
+let
+  inherit (flake.config.services) instances;
+  inherit (flake.config.people) user0;
+  service = instances.samba;
+  jellyfin = instances.jellyfin;
+in
+{
+  # If you ever need to start fresh, you need to add yourself to the Samba users database:
+  # sudo smbpasswd -a username
+  services = {
+    samba = {
+      # package = pkgs.samba4Full;
+      enable = true;
+      openFirewall = true;
+      settings = {
+        "storage" = {
+          path = "/mnt/storage/${instances.jellyfin.name}/media";
+          browseable = "yes";
+          writeable = "yes";
+          "guest ok" = "no";
+          "create mask" = "0664";
+          "directory mask" = "0775";
+          "force user" = jellyfin.name;
+          "force group" = jellyfin.name;
+          "force create mode" = "0664";
+          "force directory mode" = "0775";
+        };
+        "transfer" = {
+          path = "/mnt/transfer";
+          browseable = "yes";
+          "read only" = "no";
+          "guest ok" = "no";
+          "create mask" = "0664";
+          "directory mask" = "0775";
+          "force user" = user0;
+          "force group" = "users";
+        };
+      };
+    };
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /mnt/transfer 2775 ${user0} users -"
+  ];
+
+  networking = {
+    firewall = {
+      allowedTCPPorts = [
+        service.ports.port0
+      ];
+    };
+  };
+}

modules/nixos/homelab/samba/sambaEris/default.nix

@@ -0,0 +1,38 @@
+{
+  flake,
+  ...
+}:
+let
+  inherit (flake.config.services) instances;
+  inherit (flake.config.people) user0;
+  service = instances.samba;
+in
+{
+  # If you ever need to start fresh, you need to add yourself to the Samba users database:
+  # sudo smbpasswd -a username
+  services = {
+    samba = {
+      enable = true;
+      openFirewall = true;
+      settings = {
+        "storage" = {
+          path = "/mnt/storage";
+          writable = "yes";
+          "valid users" = user0;
+          "force user" = user0;
+          "force group" = "users";
+          "create mask" = "0644";
+          "directory mask" = "0755";
+        };
+      };
+    };
+  };
+
+  networking = {
+    firewall = {
+      allowedTCPPorts = [
+        service.ports.port0
+      ];
+    };
+  };
+}