feat: init

modules/nixos/core/accounts/default.nix

@@ -0,0 +1,3 @@
+{
+  services.accounts-daemon.enable = true;
+}

modules/nixos/core/default.nix

@@ -0,0 +1,11 @@
+let
+  importList =
+    let
+      content = builtins.readDir ./.;
+      dirContent = builtins.filter (n: content.${n} == "directory") (builtins.attrNames content);
+    in
+    map (name: ./. + "/${name}") dirContent;
+in
+{
+  imports = importList;
+}

modules/nixos/core/doas/default.nix

@@ -0,0 +1,57 @@
+{
+  flake,
+  config,
+  ...
+}:
+let
+  inherit (flake.config.people)
+    user0
+    user1
+    user2
+    user3
+    ;
+  inherit (flake.config.machines)
+    devices
+    ;
+  hostname = config.networking.hostName;
+  mars = devices.mars.name;
+  ceres = devices.ceres.name;
+  venus = devices.venus.name;
+  charon = devices.charon.name;
+  deimos = devices.deimos.name;
+
+  userLogic =
+    if
+      builtins.elem hostname [
+        mars
+        deimos
+        ceres
+      ]
+    then
+      [
+        user0
+        user1
+        user3
+      ]
+    else if hostname == charon then
+      [ user1 ]
+    else if hostname == venus then
+      [ user2 ]
+    else
+      [ ];
+in
+{
+  security = {
+    doas = {
+      enable = true;
+      extraRules = [
+        {
+          keepEnv = true;
+          noPass = true;
+          users = userLogic;
+        }
+      ];
+    };
+    # sudo.enable = false;
+  };
+}

modules/nixos/core/environment/default.nix

@@ -0,0 +1,30 @@
+{
+  pkgs,
+  config,
+  ...
+}:
+{
+  environment = {
+    enableAllTerminfo = true;
+    systemPackages = builtins.attrValues {
+      inherit (pkgs)
+        git
+        grim
+        pijul
+        sshfs
+        tomb
+        just
+        virt-manager
+        ;
+    };
+    variables = {
+      VIDEO_PLAYER = "mpv";
+      EDITOR = "hx";
+      TERM = "ghostty";
+      NIXPKGS_ALLOW_INSECURE = "1";
+      NIXPKGS_ALLOW_UNFREE = "1";
+      GTK_THEME = "catppuccin-macchiato-mauve-compact";
+      # ANTHROPIC_API_KEY = config.sops.secrets.claude-api-key.path;
+    };
+  };
+}

modules/nixos/core/fonts/default.nix

@@ -0,0 +1,107 @@
+{
+  pkgs,
+  flake,
+  ...
+}:
+let
+  inherit (flake.config.aesthetics.themes)
+    fonts
+    ;
+in
+{
+  fonts = {
+    fontconfig = {
+      enable = true;
+      defaultFonts = {
+        serif = [
+          fonts.names.name0
+        ];
+        monospace = [
+          fonts.names.name0
+        ];
+        sansSerif = [
+          fonts.names.name0
+        ];
+        emoji = [
+          "Noto Fonts Color Emoji"
+        ];
+      };
+      antialias = true;
+    };
+    packages = builtins.attrValues {
+      inherit (pkgs)
+        noto-fonts-color-emoji
+        dosis
+        iosevka
+        ;
+      inherit (pkgs.nerd-fonts)
+        _0xproto
+        _3270
+        agave
+        anonymice
+        arimo
+        aurulent-sans-mono
+        bigblue-terminal
+        bitstream-vera-sans-mono
+        blex-mono
+        caskaydia-cove
+        caskaydia-mono
+        code-new-roman
+        comic-shanns-mono
+        commit-mono
+        cousine
+        d2coding
+        daddy-time-mono
+        dejavu-sans-mono
+        departure-mono
+        droid-sans-mono
+        envy-code-r
+        fantasque-sans-mono
+        fira-code
+        fira-mono
+        geist-mono
+        go-mono
+        gohufont
+        hack
+        hasklug
+        heavy-data
+        hurmit
+        im-writing
+        inconsolata
+        inconsolata-go
+        inconsolata-lgc
+        intone-mono
+        iosevka-term
+        iosevka-term-slab
+        jetbrains-mono
+        lekton
+        liberation
+        lilex
+        martian-mono
+        monaspace
+        monofur
+        monoid
+        mononoki
+        mplus
+        noto
+        open-dyslexic
+        overpass
+        profont
+        proggy-clean-tt
+        recursive-mono
+        roboto-mono
+        sauce-code-pro
+        shure-tech-mono
+        space-mono
+        symbols-only
+        terminess-ttf
+        tinos
+        ubuntu
+        ubuntu-mono
+        ubuntu-sans
+        victor-mono
+        zed-mono
+        ;
+    };
+  };
+}

modules/nixos/core/homeManager/default.nix

@@ -0,0 +1,13 @@
+{ flake, ... }:
+{
+  home-manager = {
+    useGlobalPkgs = true;
+    useUserPackages = true;
+    backupFileExtension = "backup5";
+    extraSpecialArgs = {
+      inherit
+        flake
+        ;
+    };
+  };
+}

modules/nixos/core/locale/default.nix

@@ -0,0 +1,30 @@
+{
+  time.timeZone = "America/Winnipeg";
+
+  i18n =
+    let
+      locale = "en_CA.UTF-8";
+    in
+    {
+      defaultLocale = locale;
+
+      extraLocaleSettings = builtins.listToAttrs (
+        map
+          (option: {
+            name = option;
+            value = locale;
+          })
+          [
+            "LC_ADDRESS"
+            "LC_IDENTIFICATION"
+            "LC_MEASUREMENT"
+            "LC_MONETARY"
+            "LC_NAME"
+            "LC_NUMERIC"
+            "LC_PAPER"
+            "LC_TELEPHONE"
+            "LC_TIME"
+          ]
+      );
+    };
+}

modules/nixos/core/nh/default.nix

@@ -0,0 +1,5 @@
+{
+  programs.nh = {
+    enable = true;
+  };
+}

modules/nixos/core/nix/default.nix

@@ -0,0 +1,47 @@
+{
+  config,
+  lib,
+  ...
+}:
+{
+  nixpkgs = {
+    config = {
+      allowUnfree = true;
+      permittedInsecurePackages = [
+        "electron-unwrapped-33.0.2"
+        "electron-31.7.7"
+        "electron-27.3.11"
+        "olm-3.2.16"
+      ];
+    };
+  };
+
+  nix = {
+    extraOptions = ''
+      experimental-features = nix-command flakes
+      keep-outputs = true
+      keep-derivations = true
+    '';
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 10d";
+    };
+    settings = {
+      substituters = [
+      ];
+      trusted-public-keys = [
+      ];
+    };
+  };
+  # Print package list
+  environment.etc."current-system-packages".text =
+    let
+      packages = builtins.map (p: "${p.name}") config.environment.systemPackages;
+
+      sortedUnique = builtins.sort builtins.lessThan (lib.unique packages);
+
+      formatted = builtins.concatStringsSep "\n" sortedUnique;
+    in
+    formatted;
+}

modules/nixos/core/rsync/default.nix

@@ -0,0 +1,3 @@
+{
+  services.rsyncd.enable = true;
+}

modules/nixos/core/ssh/default.nix

@@ -0,0 +1,58 @@
+{
+  flake,
+  config,
+  ...
+}:
+let
+  inherit (flake.config.people)
+    user0
+    user1
+    user2
+    user3
+    ;
+  inherit (flake.config.machines)
+    devices
+    ;
+  hostname = config.networking.hostName;
+  mars = devices.mars.name;
+  deimos = devices.deimos.name;
+  ceres = devices.ceres.name;
+  venus = devices.venus.name;
+  charon = devices.charon.name;
+
+  # Helper function to get SSH keys for a specific user
+  getUserKeys = user: flake.config.people.users.${user}.sshKeys;
+in
+{
+  users.users =
+    if hostname == charon then
+      { }
+    else if hostname == mars then
+      {
+        ${user0} = {
+          openssh.authorizedKeys.keys = getUserKeys user0;
+        };
+        ${user3} = {
+          openssh.authorizedKeys.keys = getUserKeys user3;
+        };
+      }
+    else if
+      builtins.elem hostname [
+        deimos
+        ceres
+      ]
+    then
+      {
+        ${user0} = {
+          openssh.authorizedKeys.keys = getUserKeys user0;
+        };
+      }
+    else if hostname == venus then
+      {
+        ${user2} = {
+          openssh.authorizedKeys.keys = getUserKeys user2;
+        };
+      }
+    else
+      { };
+}

modules/nixos/core/sysStat/default.nix

@@ -0,0 +1,5 @@
+{
+  services.sysstat = {
+    enable = true;
+  };
+}

modules/nixos/core/system/default.nix

@@ -0,0 +1 @@
+_: { }

modules/nixos/default.nix

@@ -0,0 +1,104 @@
+let
+  inherit (import ../helpers.nix) directoryImport;
+  modules = directoryImport ./.;
+in
+{
+  flake.nixosModules = {
+    mars = {
+      imports = builtins.attrValues {
+        inherit (modules)
+          mullvad
+          syncthing
+          ollama
+          # hypr
+          searx
+          portals
+          xserver
+          flatpak
+          plasma
+          sddm
+          ;
+      };
+    };
+
+    venus = {
+      imports = builtins.attrValues {
+        inherit (modules)
+          plasma
+          sddm
+          tablet
+          ;
+      };
+    };
+
+    deimos = {
+      imports = builtins.attrValues {
+        inherit (modules)
+          # hypr
+          # wayland
+          plasma
+          sddm
+          flatpak
+          xserver
+          ;
+      };
+    };
+
+    charon = {
+      imports = builtins.attrValues {
+        inherit (modules)
+          gnome
+          flatpak
+          xserver
+          ;
+      };
+    };
+
+    ceres = {
+      imports = builtins.attrValues {
+        inherit (modules)
+          acme
+          audiobookshelf
+          caddy
+          jellyfin
+          logrotate
+          mastodon
+          minecraft
+          ollama
+          website
+          postgresql
+          samba
+          searx
+          vaultwarden
+          forgejo
+          xserver
+          ;
+      };
+    };
+
+    mantle = {
+      imports = builtins.attrValues {
+        inherit (modules)
+          sops
+          ;
+      };
+    };
+
+    crust = {
+      imports = builtins.attrValues {
+        inherit (modules)
+          hardware
+          programs
+          ;
+      };
+    };
+
+    core = {
+      imports = builtins.attrValues {
+        inherit (modules)
+          core
+          ;
+      };
+    };
+  };
+}

modules/nixos/desktop/cosmic/default.nix

@@ -0,0 +1,16 @@
+{
+  nix.settings = {
+    substituters = [
+      "https://cosmic.cachix.org/"
+    ];
+    trusted-public-keys = [
+      "cosmic.cachix.org-1:Dya9IyXD4xdBehWjrkPv6rtxpmMdRel02smYzA85dPE="
+    ];
+  };
+
+  environment.sessionVariables.COSMIC_DATA_CONTROL_ENABLED = 1;
+  services = {
+    desktopManager.cosmic.enable = true;
+    displayManager.cosmic-greeter.enable = true;
+  };
+}

modules/nixos/desktop/default.nix

@@ -0,0 +1,11 @@
+let
+  importList =
+    let
+      content = builtins.readDir ./.;
+      dirContent = builtins.filter (n: content.${n} == "directory") (builtins.attrNames content);
+    in
+    map (name: ./. + "/${name}") dirContent;
+in
+{
+  imports = importList;
+}

modules/nixos/desktop/gnome/default.nix

@@ -0,0 +1,55 @@
+{ pkgs, ... }:
+{
+  services = {
+    xserver = {
+      enable = true;
+      displayManager = {
+        gdm.enable = true;
+        gdm.wayland = true;
+      };
+      desktopManager.gnome = {
+        enable = true;
+      };
+    };
+    gnome = {
+      games.enable = false;
+      gnome-online-accounts.enable = true;
+    };
+    udev.packages = builtins.attrValues {
+      inherit (pkgs)
+        gnome-settings-daemon
+        ;
+    };
+    gvfs.enable = true;
+  };
+  environment = {
+    variables = {
+      # WEBKIT_FORCE_SANDBOX = "0";
+      # WEBKIT_DISABLE_COMPOSITING_MODE = "1";
+    };
+    gnome.excludePackages = builtins.attrValues {
+      inherit (pkgs)
+        gnome-photos
+        gnome-tour
+        epiphany # web browser
+        cheese # webcam tool
+        geary # email reader
+        evince # document viewer
+        totem # video player
+        yelp # help viewer
+        gnome-calendar
+        atomix # puzzle game
+        gnome-clocks
+        gnome-weather
+        gnome-maps
+        gnome-contacts
+        gnome-characters
+        gnome-music
+        tali # poker game
+        iagno # go game
+        hitori # sudoku game
+        ;
+    };
+  };
+  programs.dconf.enable = true;
+}

modules/nixos/desktop/hypr/default.nix

@@ -0,0 +1,11 @@
+let
+  importList =
+    let
+      content = builtins.readDir ./.;
+      dirContent = builtins.filter (n: content.${n} == "directory") (builtins.attrNames content);
+    in
+    map (name: ./. + "/${name}") dirContent;
+in
+{
+  imports = importList;
+}

modules/nixos/desktop/hypr/idle/default.nix

@@ -0,0 +1,10 @@
+{
+  flake,
+  pkgs,
+  ...
+}:
+{
+  services.hypridle = {
+    enable = true;
+  };
+}

modules/nixos/desktop/hypr/land/default.nix

@@ -0,0 +1,32 @@
+{
+  pkgs,
+  flake,
+  ...
+}:
+{
+  programs.hyprland = {
+    enable = true;
+    xwayland.enable = true;
+    # package = flake.inputs.hyprland.packages.${pkgs.system}.hyprland;
+    # portalPackage = flake.inputs.hyprland-portal.packages.${pkgs.system}.xdg-desktop-portal-hyprland;
+  };
+  nix = {
+    settings = {
+      substituters = [
+        "https://hyprland.cachix.org"
+      ];
+      trusted-public-keys = [
+        "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
+      ];
+    };
+  };
+  environment = {
+    variables = {
+      WLR_NO_HARDWARE_CURSORS = "1";
+      WLR_DRM_NO_ATOMIC = "1";
+      FLAMESHOT_ENABLE_WAYLAND = "1";
+      USE_WAYLAND_GRIM = "1";
+      USE_WAYLAND_CLIPBOARD = "1";
+    };
+  };
+}

modules/nixos/desktop/plasma/default.nix

@@ -0,0 +1,16 @@
+{ pkgs, ... }:
+{
+  services = {
+    desktopManager.plasma6.enable = true;
+  };
+  environment.plasma6.excludePackages = builtins.attrValues {
+    inherit (pkgs.kdePackages)
+      plasma-browser-integration
+      konsole
+      kate
+      spectacle
+      kdeconnect-kde
+      khelpcenter
+      ;
+  };
+}

modules/nixos/desktop/river/default.nix

@@ -0,0 +1,26 @@
+{
+  programs.river = {
+    enable = true;
+    xwayland.enable = true;
+  };
+  environment = {
+    loginShellInit = ''
+      if [ -z $DISPLAY ] && [ "$(tty)" = "/dev/tty1" ]; then
+        exec river
+      fi
+    '';
+    sessionVariables = {
+      XDG_CURRENT_DESKTOP = "river";
+      XDG_SESSION_TYPE = "wayland";
+      XDG_SESSION_DESKTOP = "river";
+      QT_AUTO_SCREEN_SCALE_FACTOR = "1";
+      QT_QPA_PLATFORM = "wayland;xcb";
+      QT_WAYLAND_DISABLE_WINDOWDECORATION = "1";
+      QT_QPA_PLATFORMTHEME = "qt5ct";
+      _JAVA_AWT_WM_NONEREPARENTING = "1";
+      WLR_DRM_NO_ATOMIC = "1";
+      WLR_NO_HARDWARE_CURSORS = "1";
+    };
+  };
+
+}

modules/nixos/desktop/sddm/default.nix

@@ -0,0 +1,10 @@
+{
+  services = {
+    displayManager = {
+      sddm = {
+        enable = true;
+        wayland.enable = true;
+      };
+    };
+  };
+}

modules/nixos/desktop/wayland/default.nix

@@ -0,0 +1,11 @@
+let
+  importList =
+    let
+      content = builtins.readDir ./.;
+      dirContent = builtins.filter (n: content.${n} == "directory") (builtins.attrNames content);
+    in
+    map (name: ./. + "/${name}") dirContent;
+in
+{
+  imports = importList;
+}

modules/nixos/desktop/wayland/geoclue2/default.nix

@@ -0,0 +1,3 @@
+{
+  services.geoclue2.enable = true;
+}

modules/nixos/desktop/wayland/greetd/default.nix

@@ -0,0 +1,45 @@
+{
+  config,
+  flake,
+  lib,
+  ...
+}:
+let
+  inherit (flake.config.people)
+    user0
+    user1
+    user2
+    ;
+  inherit (flake.config.machines) devices;
+  venus = devices.venus.name;
+  charon = devices.charon.name;
+
+  host = config.networking.hostName;
+in
+{
+  services = {
+    greetd = {
+      enable = true;
+      vt = 7;
+      settings =
+        let
+          default_session = {
+            command = "${lib.meta.getExe config.programs.hyprland.package}";
+            user =
+              if host == charon then
+                user1
+              else if host == venus then
+                user2
+              else
+                user0;
+          };
+        in
+        {
+          inherit
+            default_session
+            ;
+          initial_session = default_session;
+        };
+    };
+  };
+}

modules/nixos/desktop/wayland/network/default.nix

@@ -0,0 +1,3 @@
+{
+  programs.nm-applet.enable = true;
+}

modules/nixos/desktop/wayland/portals/default.nix

@@ -0,0 +1,21 @@
+{ pkgs, flake, ... }:
+{
+  environment.sessionVariables.NIXOS_OZONE_WL = "1";
+
+  xdg = {
+    portal = {
+      enable = true;
+      wlr.enable = true;
+      config.common.default = "*";
+      xdgOpenUsePortal = true;
+      extraPortals = builtins.attrValues {
+        inherit (pkgs)
+          xdg-desktop-portal-gtk
+          # xdg-desktop-portal-hyprland
+          xdg-desktop-portal-wlr
+          ;
+      };
+    };
+  };
+
+}

modules/nixos/desktop/wayland/regreet/default.nix

@@ -0,0 +1,50 @@
+{
+  pkgs,
+  flake,
+  lib,
+  ...
+}:
+let
+  inherit (flake.config.aesthetics.themes)
+    fonts
+    ;
+in
+{
+  programs.regreet = {
+    enable = false;
+    package = pkgs.greetd.regreet;
+    # settings = {
+    #   appearance = {
+    #     greeting_msg = "Back for more, I see.";
+    #   };
+    #   GTK = {
+    #     application_prefer_dark_theme = true;
+    #     cursor_theme_name = lib.mkForce "catppuccin-macchiato-dark-cursors";
+    #     font_name = lib.mkForce "${fonts.names.name0} ${font.size.desktop}";
+    #     icon_theme_name = lib.mkForce "Papirus-Dark";
+    #     theme_name = lib.mkForce "catppuccin-macchiato-mauve-compact";
+    #   };
+    # };
+    # theme = {
+    #   name = "catppuccin-macchiato-mauve-compact";
+    #   package = pkgs.catppuccin-gtk.override {
+    #     size = "compact";
+    #     variant = "macchiato";
+    #     accents = [
+    #       "mauve"
+    #     ];
+    #   };
+    # };
+    # cursorTheme = {
+    #   name = "catppuccin-macchiato-dark-cursors";
+    #   package = pkgs.catppuccin-cursors.macchiatoDark;
+    # };
+    # iconTheme = {
+    #   name = "Papirus-Dark";
+    #   package = pkgs.catppuccin-papirus-folders.override {
+    #     flavor = "macchiato";
+    #     accent = "mauve";
+    #   };
+    # };
+  };
+}

modules/nixos/desktop/wayland/swaylock/default.nix

@@ -0,0 +1,3 @@
+{
+  security.pam.services.swaylock.text = "auth include login";
+}

modules/nixos/desktop/wayland/thunar/default.nix

@@ -0,0 +1,11 @@
+{ pkgs, ... }:
+{
+  programs.thunar = {
+    enable = true;
+    plugins = [
+      pkgs.xfce.thunar-archive-plugin
+      pkgs.xfce.thunar-volman
+      pkgs.xfce.thunar-media-tags-plugin
+    ];
+  };
+}

modules/nixos/desktop/xserver/default.nix

@@ -0,0 +1,24 @@
+{
+  services = {
+    xserver = {
+      enable = true;
+      xkb = {
+        layout = "us";
+        # variant = "colemak_dh"
+      };
+    };
+    libinput = {
+      enable = true;
+      touchpad = {
+        scrollMethod = "twofinger";
+        naturalScrolling = true;
+        middleEmulation = true;
+        accelSpeed = "5";
+        accelProfile = "adaptive";
+        disableWhileTyping = true;
+      };
+      mouse.accelProfile = "flat";
+    };
+  };
+  console.useXkbConfig = true;
+}

modules/nixos/hardware/android/default.nix

@@ -0,0 +1,25 @@
+{ pkgs, ... }:
+{
+  programs = {
+    adb.enable = true;
+    droidcam.enable = true;
+  };
+  services.udev = {
+    enable = true;
+    packages = builtins.attrValues {
+      inherit (pkgs)
+        android-udev-rules
+        ;
+    };
+    extraRules = ''
+      # Amazon Fire Tablet
+      SUBSYSTEM=="usb", ATTR{idVendor}=="1949", ATTR{idProduct}=="0632", MODE="0666", GROUP="adbusers"
+      SUBSYSTEM=="usb", ATTR{idVendor}=="1949", ATTR{idProduct}=="0632", SYMLINK+="android_adb"
+      SUBSYSTEM=="usb", ATTR{idVendor}=="1949", ATTR{idProduct}=="0632", SYMLINK+="android_fastboot"
+
+      # General Android rules
+      SUBSYSTEM=="usb", ENV{DEVTYPE}=="usb_device", MODE="0666"
+      SUBSYSTEM=="usb", ATTR{idVendor}=="1949", MODE="0666", GROUP="adbusers"
+    '';
+  };
+}

modules/nixos/hardware/audio/default.nix

@@ -0,0 +1,13 @@
+{
+  security.rtkit.enable = true;
+  services = {
+    pipewire = {
+      enable = true;
+      alsa.enable = true;
+      alsa.support32Bit = true;
+      pulse.enable = true;
+      jack.enable = true;
+    };
+    pulseaudio.enable = false;
+  };
+}

modules/nixos/hardware/bluetooth/default.nix

@@ -0,0 +1,29 @@
+{
+  pkgs,
+  config,
+  flake,
+  ...
+}:
+let
+  inherit (flake.config.machines) devices;
+  hostname = config.networking.hostName;
+in
+{
+  hardware = {
+    bluetooth = {
+      enable = true;
+      package = pkgs.bluez;
+      powerOnBoot = true;
+      settings = {
+        General = {
+          Experimental = true;
+          Disable = "Headset";
+        };
+      };
+      disabledPlugins = [
+        "sap"
+      ];
+    };
+  };
+  services.blueman.enable = if hostname == devices.deimos.name then false else true;
+}

modules/nixos/hardware/default.nix

@@ -0,0 +1,11 @@
+let
+  importList =
+    let
+      content = builtins.readDir ./.;
+      dirContent = builtins.filter (n: content.${n} == "directory") (builtins.attrNames content);
+    in
+    map (name: ./. + "/${name}") dirContent;
+in
+{
+  imports = importList;
+}

modules/nixos/hardware/moonlander/default.nix

@@ -0,0 +1,15 @@
+{ pkgs, ... }:
+{
+  hardware.keyboard.zsa.enable = true;
+
+  environment = {
+    enableAllTerminfo = true;
+    systemPackages = builtins.attrValues {
+      inherit (pkgs)
+        zsa-udev-rules
+        keymapp
+        kontroll
+        ;
+    };
+  };
+}

modules/nixos/hardware/printing/default.nix

@@ -0,0 +1,56 @@
+{
+  flake,
+  pkgs,
+  ...
+}:
+let
+  inherit (flake.config.machines.devices)
+    printer0
+    printer1
+    ;
+  genericPPD = "drv:///sample.drv/generic.ppd";
+  pageSize = "Letter";
+in
+{
+  services = {
+    printing = {
+      enable = true;
+      drivers = with pkgs; [
+        brlaser
+        cups-brother-hll2375dw
+      ];
+    };
+  };
+
+  hardware.printers = {
+    ensurePrinters = [
+      {
+        name = printer0.label;
+        location = "Downstairs";
+        deviceUri = "https://${printer0.ip.address0}";
+        model = genericPPD;
+        ppdOptions = {
+          PageSize = pageSize;
+        };
+      }
+      {
+        name = printer1.label;
+        location = "Upstairs";
+        deviceUri = "https://${printer1.ip.address0}";
+        model = genericPPD;
+        ppdOptions = {
+          PageSize = pageSize;
+        };
+      }
+    ];
+    ensureDefaultPrinter = printer1.label;
+  };
+
+  networking = {
+    firewall = {
+      allowedTCPPorts = [
+        631
+      ];
+    };
+  };
+}

modules/nixos/hardware/razer/default.nix

@@ -0,0 +1,3 @@
+{
+  hardware.openrazer.enable = false;
+}

modules/nixos/hardware/tablet/default.nix

@@ -0,0 +1,6 @@
+{
+  hardware.opentabletdriver = {
+    enable = true;
+    daemon.enable = true;
+  };
+}

modules/nixos/programs/coreCtrl/default.nix

@@ -0,0 +1,11 @@
+{ pkgs, ... }:
+{
+  programs.corectrl = {
+    enable = true;
+    package = pkgs.corectrl;
+    gpuOverclock = {
+      enable = true;
+      ppfeaturemask = "0xffffffff";
+    };
+  };
+}

modules/nixos/programs/default.nix

@@ -0,0 +1,11 @@
+let
+  importList =
+    let
+      content = builtins.readDir ./.;
+      dirContent = builtins.filter (n: content.${n} == "directory") (builtins.attrNames content);
+    in
+    map (name: ./. + "/${name}") dirContent;
+in
+{
+  imports = importList;
+}

modules/nixos/programs/disks/default.nix

@@ -0,0 +1,4 @@
+{
+  programs.gnome-disks.enable = true;
+  services.udisks2.enable = true;
+}

modules/nixos/programs/firejail/default.nix

@@ -0,0 +1,3 @@
+{
+  programs.firejail.enable = true;
+}

modules/nixos/programs/goldwarden/default.nix

@@ -0,0 +1,3 @@
+{
+  # programs.goldwarden.enable = true;
+}

modules/nixos/programs/steam/default.nix

@@ -0,0 +1,21 @@
+{ pkgs, ... }:
+{
+  programs = {
+    steam = {
+      enable = true;
+      remotePlay.openFirewall = true;
+      dedicatedServer.openFirewall = true;
+      extraPackages = builtins.attrValues {
+        inherit (pkgs)
+          curl
+          ;
+      };
+      gamescopeSession.enable = true;
+    };
+    java.enable = true;
+  };
+  hardware.steam-hardware.enable = true;
+  programs.gamescope = {
+    enable = true;
+  };
+}

modules/nixos/programs/virtManager/default.nix

@@ -0,0 +1,4 @@
+{
+  programs.virt-manager.enable = true;
+  virtualisation.libvirtd.enable = true;
+}

modules/nixos/services/acme/default.nix

@@ -0,0 +1,87 @@
+{
+  config,
+  flake,
+  ...
+}:
+let
+  inherit (flake.config.people) user0;
+  inherit (flake.config.people.users.${user0}) email;
+  inherit (flake.config.services) instances;
+  domain0 = instances.web.domains.url0;
+  domain1 = instances.web.domains.url1;
+  domain3 = instances.web.domains.url3;
+  dns = instances.web.dns.provider0;
+  instanceName = service: (instances.${service}.subdomain);
+  dnsConfig = {
+    dnsProvider = dns;
+    directory = instances.acme.paths.path0;
+    environmentFile = config.sops.secrets."dns/namecheap".path;
+  };
+in
+{
+  security.acme = {
+    acceptTerms = true;
+    defaults = {
+      email = email.address0;
+      server = "https://acme-v02.api.letsencrypt.org/directory";
+    };
+    certs = builtins.listToAttrs (
+      (map
+        (service: {
+          name = "${instanceName service}.${domain0}";
+          value = dnsConfig;
+        })
+        [
+          "jellyfin"
+          "minecraft"
+          "ollama"
+          "syncthing"
+          "searx"
+          "vaultwarden"
+          "audiobookshelf"
+        ]
+      )
+      ++ (map
+        (service: {
+          name = "${instanceName service}.${domain3}";
+          value = dnsConfig;
+        })
+        [
+          "peertube"
+          "forgejo"
+          "mastodon"
+        ]
+      )
+      ++ (map
+        (name: {
+          name = name;
+          value = dnsConfig;
+        })
+        [
+          domain0
+          domain1
+          domain3
+        ]
+      )
+    );
+  };
+  sops =
+    let
+      sopsSecrets = [
+        "pass"
+      ];
+      sopsPath = secret: {
+        path = "/var/lib/secrets/${instances.acme.name}/${dns}-${secret}";
+        owner = "root";
+        mode = "600";
+      };
+    in
+    {
+      secrets = builtins.listToAttrs (
+        map (secret: {
+          name = "dns/${dns}";
+          value = sopsPath secret;
+        }) sopsSecrets
+      );
+    };
+}

modules/nixos/services/audiobookshelf/default.nix

@@ -0,0 +1,58 @@
+{ flake, config, ... }:
+let
+  inherit (flake.config.services.instances) audiobookshelf web;
+  inherit (flake.config.machines.devices) ceres;
+  service = audiobookshelf;
+  host = "${service.subdomain}.${web.domains.url0}";
+  localhost = web.localhost.address0;
+in
+{
+  services = {
+    audiobookshelf = {
+      enable = true;
+      host = localhost;
+      port = service.ports.port0;
+      dataDir = service.name;
+      openFirewall = true;
+    };
+    caddy = {
+      virtualHosts = {
+        "${host}" = {
+          extraConfig = ''
+            redir /.well-known/carddav /remote.php/dav/ 301
+            redir /.well-known/caldav /remote.php/dav/ 301
+
+            reverse_proxy ${localhost}:${toString service.ports.port0}
+
+            tls ${service.ssl.cert} ${service.ssl.key}
+
+            encode gzip zstd
+          '';
+        };
+      };
+    };
+  };
+
+  fileSystems."/var/lib/${service.name}" = {
+    device = service.paths.path0;
+    fsType = "none";
+    options = [
+      "bind"
+    ];
+    depends = [
+      ceres.storage0.mount
+    ];
+  };
+
+  systemd.tmpfiles.rules = [
+    "Z ${service.paths.path0} 0755 ${service.name} ${service.name} -"
+  ];
+
+  networking = {
+    firewall = {
+      allowedTCPPorts = [
+        service.ports.port0
+      ];
+    };
+  };
+}

modules/nixos/services/caddy/default.nix

@@ -0,0 +1,39 @@
+{ flake, ... }:
+let
+  inherit (flake.config.services.instances)
+    caddy
+    web
+    ;
+
+  domain0 = web.domains.url0;
+
+  service = caddy;
+in
+{
+  services.caddy = {
+    enable = true;
+    virtualHosts = {
+      "${domain0}" = {
+        extraConfig = ''
+          tls /var/lib/acme/${domain0}/fullchain.pem /var/lib/acme/${domain0}/key.pem
+          encode zstd gzip
+        '';
+      };
+    };
+  };
+
+  users.users.${service.name}.extraGroups = [
+    "acme"
+    "nextcloud"
+    "mastodon"
+  ];
+
+  networking = {
+    firewall = {
+      allowedTCPPorts = [
+        service.ports.port0
+        service.ports.port1
+      ];
+    };
+  };
+}

modules/nixos/services/default.nix

@@ -0,0 +1,11 @@
+let
+  importList =
+    let
+      content = builtins.readDir ./.;
+      dirContent = builtins.filter (n: content.${n} == "directory") (builtins.attrNames content);
+    in
+    map (name: ./. + "/${name}") dirContent;
+in
+{
+  imports = importList;
+}

modules/nixos/services/flatpak/default.nix

@@ -0,0 +1,3 @@
+{
+  services.flatpak.enable = true;
+}

modules/nixos/services/forgejo/default.nix

@@ -0,0 +1,120 @@
+{
+  flake,
+  config,
+  ...
+}:
+let
+  inherit (flake.config.machines.devices)
+    ceres
+    ;
+  inherit (flake.config.services.instances) smtp forgejo web;
+  service = forgejo;
+  localhost = web.localhost.address0;
+  host = "${service.subdomain}.${web.domains.url3}";
+in
+{
+  services = {
+    forgejo = {
+      enable = true;
+      database.type = "postgres";
+      lfs.enable = true;
+      secrets = {
+        mailer.PASSWD = config.sops.secrets."${service.name}-smtp".path;
+        database.PASSWD = config.sops.secrets."${service.name}-database".path;
+      };
+      dump = {
+        interval = "5:00";
+        type = "zip";
+        file = "forgejo-backup";
+        enable = true;
+      };
+      settings = {
+        server = {
+          DOMAIN = host;
+          ROOT_URL = "https://${host}/";
+          HTTP_PORT = service.ports.port0;
+        };
+        # If you need to start from scratch, don't forget to turn this off again
+        service.DISABLE_REGISTRATION = true;
+        actions = {
+          ENABLED = true;
+          DEFAULT_ACTIONS_URL = "github";
+        };
+        mirror = {
+          ENABLED = true;
+        };
+        mailer = {
+          ENABLED = true;
+          SMTP_ADDR = smtp.hostname;
+          FROM = service.email.address0;
+          USER = service.email.address0;
+          PROTOCOL = "smtp+starttls";
+          SMTP_PORT = smtp.ports.port0;
+          SEND_AS_PLAIN_TEXT = true;
+          USE_CLIENT_CERT = false;
+        };
+      };
+    };
+    caddy = {
+      virtualHosts = {
+        "${host}" = {
+          extraConfig = ''
+            reverse_proxy ${localhost}:${toString service.ports.port0}
+
+            tls ${service.ssl.cert} ${service.ssl.key}
+          '';
+        };
+      };
+    };
+  };
+  sops =
+    let
+      sopsPath = secret: {
+        path = "${service.sops.path0}/${service.name}-${secret}";
+        owner = service.name;
+        mode = "600";
+      };
+    in
+    {
+      secrets = builtins.listToAttrs (
+        map
+          (secret: {
+            name = "${service.name}-${secret}";
+            value = sopsPath secret;
+          })
+          [
+            "smtp"
+            "database"
+          ]
+      );
+    };
+
+  fileSystems."/var/lib/${service.name}" = {
+    device = service.paths.path0;
+    fsType = "none";
+    options = [
+      "bind"
+    ];
+    depends = [
+      ceres.storage0.mount
+    ];
+  };
+
+  systemd.tmpfiles.rules = [
+    "Z ${service.paths.path0} 755 ${service.name} ${service.name} -"
+    "Z ${service.sops.path0} 755 ${service.name} ${service.name} -"
+  ];
+
+  users.users.${service.name}.extraGroups = [
+    "caddy"
+    "postgres"
+  ];
+
+  networking = {
+    firewall = {
+      allowedTCPPorts = [
+        service.ports.port0
+      ];
+    };
+  };
+}

modules/nixos/services/hLedger/default.nix

@@ -0,0 +1,72 @@
+{
+  flake,
+  pkgs,
+  ...
+}:
+let
+  inherit (flake.config.machines.devices)
+    ceres
+    ;
+  inherit (flake.config.services.instances)
+    hledger
+    web
+    ;
+  service = hledger;
+  localhost = web.localhost.address0;
+in
+{
+  services = {
+    hledger-web = {
+      enable = true;
+      host = localhost;
+      # baseUrl = "https://${host}";
+      stateDir = service.paths.path0;
+      port = service.ports.port0;
+      journalFiles = [
+        ".hledger.journal"
+      ];
+      allow = "edit";
+    };
+  };
+
+  environment = {
+    systemPackages = builtins.attrValues {
+      inherit (pkgs)
+        hledger
+        hledger-ui
+        ;
+    };
+  };
+
+  users = {
+    users.${service.name} = {
+      isSystemUser = true;
+      group = service.name;
+      home = service.paths.path0;
+    };
+    groups.${service.name} = { };
+  };
+
+  fileSystems."/var/lib/${service.name}" = {
+    device = service.paths.path0;
+    fsType = "none";
+    options = [
+      "bind"
+    ];
+    depends = [
+      ceres.storage0.mount
+    ];
+  };
+
+  systemd.tmpfiles.rules = [
+    "Z ${service.paths.path0} 0755 ${service.name} ${service.name} -"
+  ];
+
+  networking = {
+    firewall = {
+      allowedTCPPorts = [
+        service.ports.port0
+      ];
+    };
+  };
+}

modules/nixos/services/jellyfin/default.nix

@@ -0,0 +1,79 @@
+{ flake, ... }:
+let
+  inherit (flake.config.people)
+    user0
+    ;
+  inherit (flake.config.machines.devices)
+    ceres
+    ;
+  inherit (flake.config.services.instances)
+    jellyfin
+    web
+    ;
+  service = jellyfin;
+  localhost = web.localhost.address0;
+  host = "${service.subdomain}.${web.domains.url0}";
+in
+{
+  services = {
+    jellyfin = {
+      enable = true;
+      openFirewall = true;
+      user = user0;
+    };
+    jellyseerr = {
+      openFirewall = true;
+      enable = true;
+    };
+    caddy = {
+      virtualHosts = {
+        "${host}" = {
+          extraConfig = ''
+            redir /.well-known/carddav /remote.php/dav/ 301
+            redir /.well-known/caldav /remote.php/dav/ 301
+
+            reverse_proxy ${localhost}:${toString service.ports.port1}
+
+            tls ${service.ssl.cert} ${service.ssl.key}
+          '';
+        };
+      };
+    };
+  };
+
+  fileSystems =
+    let
+      settings = {
+        fsType = "none";
+        options = [
+          "bind"
+        ];
+        depends = [
+          ceres.storage0.mount
+        ];
+      };
+    in
+    {
+      "/var/lib/${service.name}" = {
+        device = service.paths.path0;
+      } // settings;
+      "/var/cache/${service.name}" = {
+        device = "${service.paths.path0}/cache";
+      } // settings;
+    };
+
+  systemd.tmpfiles.rules = [
+    "Z ${service.paths.path0} 0755 ${user0} ${service.name} -"
+    "Z ${service.paths.path0}/cache 0755 ${user0} ${service.name} -"
+  ];
+
+  networking = {
+    firewall = {
+      allowedTCPPorts = [
+        service.ports.port0
+        service.ports.port1
+        service.ports.port2
+      ];
+    };
+  };
+}

modules/nixos/services/logrotate/default.nix

@@ -0,0 +1,3 @@
+{
+  services.logrotate.enable = true;
+}

modules/nixos/services/mastodon/config/chars.patch

@@ -0,0 +1,34 @@
+diff --git a/app/javascript/mastodon/features/compose/components/compose_form.jsx b/app/javascript/mastodon/features/compose/components/compose_form.jsx
+index 9222b2dc8..962310a28 100644
+--- a/app/javascript/mastodon/features/compose/components/compose_form.jsx
++++ b/app/javascript/mastodon/features/compose/components/compose_form.jsx
+@@ -100,7 +100,7 @@ class ComposeForm extends ImmutablePureComponent {
+     const fulltext = this.getFulltextForCharacterCounting();
+     const isOnlyWhitespace = fulltext.length !== 0 && fulltext.trim().length === 0;
+
+-    return !(isSubmitting || isUploading || isChangingUpload || length(fulltext) > 500 || (isOnlyWhitespace && !anyMedia));
++    return !(isSubmitting || isUploading || isChangingUpload || length(fulltext) > 5000 || (isOnlyWhitespace && !anyMedia));
+   };
+
+   handleSubmit = (e) => {
+@@ -297,7 +297,7 @@ class ComposeForm extends ImmutablePureComponent {
+             </div>
+
+             <div className='character-counter__wrapper'>
+-              <CharacterCounter max={500} text={this.getFulltextForCharacterCounting()} />
++              <CharacterCounter max={5000} text={this.getFulltextForCharacterCounting()} />
+             </div>
+           </div>
+         </div>
+diff --git a/app/validators/status_length_validator.rb b/app/validators/status_length_validator.rb
+index dc841ded3..9cb1ec94b 100644
+--- a/app/validators/status_length_validator.rb
++++ b/app/validators/status_length_validator.rb
+@@ -1,7 +1,7 @@
+ # frozen_string_literal: true
+
+ class StatusLengthValidator < ActiveModel::Validator
+-  MAX_CHARS = 500
++  MAX_CHARS = 5000
+   URL_PLACEHOLDER_CHARS = 23
+   URL_PLACEHOLDER = 'x' * 23

modules/nixos/services/mastodon/default.nix

@@ -0,0 +1,214 @@
+{
+  flake,
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  inherit (flake.config.machines.devices)
+    ceres
+    ;
+  inherit (flake.config.services.instances) smtp mastodon web;
+  service = mastodon;
+  host = "${mastodon.subdomain}.${web.domains.url3}";
+  localhost = web.localhost.address0;
+in
+{
+  # If you need to start fresh for some reason, run these to create the new Admin account:
+  # sudo -u mastodon mastodon-tootctl accounts create nick --email=nick@localhost --confirmed --role=Owner
+  # sudo -u mastodon mastodon-tootctl accounts approve nick
+
+  # If you fuck up and lose the password, use this:
+  # sudo mastodon-tootctl accounts modify --reset-password nick
+
+  # If you really fuck up and name yourself wrong, use this shit
+  # sudo mastodon-tootctl accounts modify username --remove-role
+
+  # nixpkgs.overlays = [
+  #   (
+  #     final: prev: {
+  #       mastodon = prev.mastodon.overrideAttrs (oldAttrs: {
+  #         postPatch =
+  #           (oldAttrs.postPatch or "")
+  #           + ''
+  #             patch -p1 < ${./chars.patch}
+  #           '';
+  #       });
+  #     }
+  #   )
+  # ];
+
+  services = {
+    mastodon = {
+      enable = true;
+      localDomain = host;
+      secretKeyBaseFile = "/var/lib/mastodon/secrets/secret-key-base";
+      streamingProcesses = 7;
+      trustedProxy = localhost;
+      automaticMigrations = true;
+      database = {
+        createLocally = true;
+        name = service.name;
+        host = "/run/postgresql";
+        user = service.name;
+        passwordFile = config.sops.secrets.mastodon-database.path;
+      };
+      extraConfig = {
+        SINGLE_USER_MODE = "true";
+        SMTP_AUTH_METHOD = "plain";
+        SMTP_DELIVERY_METHOD = "smtp";
+        SMTP_ENABLE_STARTTLS_AUTO = "true";
+        SMTP_SSL = "false";
+      };
+      mediaAutoRemove = {
+        enable = true;
+        olderThanDays = 14;
+      };
+      redis = {
+        createLocally = true;
+        enableUnixSocket = true;
+      };
+      sidekiqThreads = 25;
+      sidekiqProcesses = {
+        all = {
+          jobClasses = [
+          ];
+          threads = null;
+        };
+        default = {
+          jobClasses = [
+            "default"
+          ];
+          threads = 5;
+        };
+        ingress = {
+          jobClasses = [
+            "ingress"
+          ];
+          threads = 5;
+        };
+        push-pull = {
+          jobClasses = [
+            "push"
+            "pull"
+          ];
+          threads = 5;
+        };
+        mailers = {
+          jobClasses = [
+            "mailers"
+          ];
+          threads = 5;
+        };
+      };
+      smtp = {
+        authenticate = true;
+        createLocally = false;
+        fromAddress = "upRootNutrition <${service.email.address0}>";
+        host = smtp.hostname;
+        passwordFile = config.sops.secrets.mastodon-smtp.path;
+        port = smtp.ports.port0;
+        user = service.email.address0;
+      };
+    };
+    caddy = {
+      virtualHosts = {
+        "${host}" = {
+          extraConfig = ''
+            handle_path /system/* {
+              file_server * {
+                root /var/lib/mastodon/public-system
+              }
+            }
+
+            handle /api/v1/streaming/* {
+              reverse_proxy unix//run/mastodon-streaming/streaming.socket
+            }
+
+            route * {
+              file_server * {
+                root ${pkgs.mastodon}/public
+                pass_thru
+              }
+              reverse_proxy * unix//run/mastodon-web/web.socket
+            }
+
+            tls ${service.ssl.cert} ${service.ssl.key}
+
+            handle_errors {
+              root * ${pkgs.mastodon}/public
+              rewrite 500.html
+              file_server
+            }
+
+            encode gzip
+
+            header /* {
+              Strict-Transport-Security "max-age=31536000;"
+            }
+            header /emoji/* Cache-Control "public, max-age=31536000, immutable"
+            header /packs/* Cache-Control "public, max-age=31536000, immutable"
+            header /system/accounts/avatars/* Cache-Control "public, max-age=31536000, immutable"
+            header /system/media_attachments/files/* Cache-Control "public, max-age=31536000, immutable"
+          '';
+        };
+      };
+    };
+  };
+
+  systemd.services.caddy.serviceConfig.ReadWriteDirectories = lib.mkForce [
+    "/var/lib/caddy"
+    "/run/mastodon-web"
+  ];
+
+  sops =
+    let
+      sopsPath = secret: {
+        path = "${service.sops.path0}/${service.name}-${secret}";
+        owner = service.name;
+        mode = "600";
+      };
+    in
+    {
+      secrets = builtins.listToAttrs (
+        map
+          (secret: {
+            name = "${service.name}-${secret}";
+            value = sopsPath secret;
+          })
+          [
+            "smtp"
+            "database"
+            "redis"
+          ]
+      );
+    };
+
+  fileSystems."/var/lib/${service.name}" = {
+    device = service.paths.path0;
+    fsType = "none";
+    options = [
+      "bind"
+    ];
+    depends = [
+      ceres.storage0.mount
+    ];
+  };
+
+  systemd.tmpfiles.rules = [
+    "Z ${service.paths.path0} 0755 ${service.name} ${service.name} -"
+    "Z ${service.sops.path0} 0755 ${service.name} ${service.name} -"
+  ];
+
+  users.users.${service.name}.extraGroups = [
+    "postgres"
+  ];
+
+  networking = {
+    firewall = {
+      allowedTCPPorts = [
+      ];
+    };
+  };
+}

modules/nixos/services/minecraft/default.nix

@@ -0,0 +1,102 @@
+{
+  config,
+  flake,
+  ...
+}:
+let
+  inherit (flake.config.machines.devices)
+    ceres
+    ;
+  inherit (flake.config.services.instances)
+    minecraft
+    ;
+  service = minecraft;
+in
+{
+  services = {
+    minecraft-server = {
+      enable = true;
+      eula = true;
+      openFirewall = true;
+      declarative = true;
+      serverProperties = {
+        "rcon.password" = config.sops.secrets."${service.name}-pass".path;
+        allow-flight = false;
+        allow-nether = true;
+        difficulty = 2;
+        enable-command-block = false;
+        enable-rcon = true;
+        enable-status = true;
+        force-gamemode = true;
+        gamemode = 0;
+        generate-structures = true;
+        hardcore = false;
+        hide-online-players = false;
+        level-name = "Brix on Nix";
+        level-seed = "9064150133272194";
+        max-players = 10;
+        max-world-size = 64000000;
+        motd = "A cool Minecraft server powered by NixOS";
+        online-mode = true;
+        pvp = true;
+        server-port = service.ports.port0;
+        spawn-animals = true;
+        spawn-monsters = true;
+        spawn-npcs = true;
+        spawn-protection = 16;
+        view-dtstance = 32;
+        white-list = true;
+      };
+      whitelist = {
+        Hefty_Chungus = "b75a9816-d408-4c54-b226-385b59ea1cb3";
+        Hefty_Chungus_Jr = "c3bf8cac-e953-4ea4-ae5f-7acb92a51a85";
+        EclipseMoon01 = "adef4af7-d8c6-4627-b492-e990ea1bb993";
+        Fallaryn = "d8baa117-ab58-4b07-92a5-48fb1978eb49";
+      };
+    };
+  };
+  sops =
+    let
+      sopsPath = secret: {
+        path = "${service.sops.path0}/${service.name}-${secret}";
+        owner = service.name;
+        mode = "600";
+      };
+    in
+    {
+      secrets = builtins.listToAttrs (
+        map
+          (secret: {
+            name = "${service.name}-${secret}";
+            value = sopsPath secret;
+          })
+          [
+            "pass"
+          ]
+      );
+    };
+
+  fileSystems."/var/lib/${service.name}" = {
+    device = service.paths.path0;
+    fsType = "none";
+    options = [
+      "bind"
+    ];
+    depends = [
+      ceres.storage0.mount
+    ];
+  };
+
+  systemd.tmpfiles.rules = [
+    "Z ${service.paths.path0} 0755 ${service.name} ${service.name} -"
+    "Z ${service.sops.path0} 0755 ${service.name} ${service.name} -"
+  ];
+
+  networking = {
+    firewall = {
+      allowedTCPPorts = [
+        service.ports.port0
+      ];
+    };
+  };
+}

modules/nixos/services/mullvad/default.nix

@@ -0,0 +1,6 @@
+{
+  services.mullvad-vpn = {
+    enable = true;
+    enableExcludeWrapper = false;
+  };
+}

modules/nixos/services/nextcloud/default.nix

@@ -0,0 +1,129 @@
+{
+  flake,
+  config,
+  pkgs,
+  ...
+}:
+let
+  inherit (flake.config.people) user0;
+  inherit (flake.config.people.users.${user0}) name;
+  inherit (flake.config.machines.devices) ceres;
+  inherit (flake.config.services.instances) nextcloud nginx web;
+  service = nextcloud;
+  localhost = web.localhost.address0;
+  host = "${service.subdomain}.${web.domains.url1}";
+in
+{
+  services = {
+    nextcloud = {
+      appstoreEnable = true;
+      autoUpdateApps.enable = true;
+      configureRedis = true;
+      enable = true;
+      hostName = host;
+      https = true;
+      package = pkgs.nextcloud30;
+      phpOptions."opcache.interned_strings_buffer" = "24";
+      extraAppsEnable = true;
+      extraApps = {
+        inherit (config.services.service.package.packages.apps)
+          contacts
+          calendar
+          ;
+      };
+      config = {
+        adminpassFile = config.sops.secrets."${service.name}-pass".path;
+        adminuser = name;
+        dbtype = "pgsql";
+      };
+      database = {
+        createLocally = true;
+      };
+      settings = {
+        default_phone_region = "CA";
+        log_type = "file";
+        mail_sendmailmode = "pipe";
+        mail_smtpmode = "sendmail";
+        maintenance_window_start = 4;
+        overwriteprotocol = "https";
+        trusted_proxies = [
+          localhost
+        ];
+      };
+    };
+
+    nginx = {
+      enable = true;
+      virtualHosts.${host}.listen = [
+        {
+          addr = web.localhost.address1;
+          port = nginx.ports.port0;
+        }
+      ];
+    };
+
+    caddy = {
+      virtualHosts = {
+        "${host}" = {
+          extraConfig = ''
+            reverse_proxy ${localhost}:${toString nginx.ports.port0}
+
+            tls ${service.ssl.cert} ${service.ssl.key}
+          '';
+        };
+      };
+    };
+  };
+
+  sops =
+    let
+      sopsPath = secret: {
+        path = "${service.sops.path0}/${service.name}-${secret}";
+        owner = service.name;
+        mode = "600";
+      };
+    in
+    {
+      secrets = builtins.listToAttrs (
+        map
+          (secret: {
+            name = "${service.name}-${secret}";
+            value = sopsPath secret;
+          })
+          [
+            "pass"
+          ]
+      );
+    };
+
+  fileSystems."/var/lib/${service.name}" = {
+    device = service.paths.path0;
+    fsType = "none";
+    options = [
+      "bind"
+    ];
+    depends = [
+      ceres.storage0.mount
+    ];
+  };
+
+  systemd.tmpfiles.rules = [
+    "Z ${service.paths.path0} 750 ${service.name} ${service.name} -"
+    "Z ${service.sops.path0} 750 ${service.name} ${service.name} -"
+  ];
+
+  users.users.${service.name}.extraGroups = [
+    "caddy"
+    "nginx"
+    "postgres"
+  ];
+
+  networking = {
+    firewall = {
+      allowedTCPPorts = [
+        nginx.ports.port0
+        service.ports.port0
+      ];
+    };
+  };
+}

modules/nixos/services/ollama/default.nix

@@ -0,0 +1,118 @@
+{
+  flake,
+  config,
+  pkgs,
+  ...
+}:
+let
+  inherit (flake.config.machines.devices)
+    mars
+    ceres
+    ;
+  inherit (flake.config.services.instances)
+    ollama
+    web
+    ;
+  service = ollama;
+  localhost = web.localhost.address0;
+  hostname = config.networking.hostName;
+  host = "${service.subdomain}.${web.domains.url0}";
+
+  caddyLogic =
+    if hostname == ceres.name then
+      {
+        caddy = {
+          virtualHosts = {
+            ${host} = {
+              extraConfig = ''
+                reverse_proxy ${localhost}:${toString service.ports.port0}
+
+                tls ${service.ssl.cert} ${service.ssl.key}
+              '';
+            };
+          };
+        };
+      }
+    else
+      { };
+
+  mountLogic =
+    if hostname == ceres.name then
+      {
+        "/var/lib/${service.name}" = {
+          device = service.paths.path0;
+          fsType = "none";
+          options = [
+            "bind"
+          ];
+          depends = [
+            ceres.storage0.mount
+          ];
+        };
+      }
+    else
+      { };
+in
+{
+  services = {
+    ollama =
+      {
+        enable = true;
+        group = service.name;
+        host = "http://${localhost}";
+        user = service.name;
+      }
+      // (
+        if hostname == mars.name then
+          {
+            # models = service.paths.path1;
+            acceleration = "rocm";
+            package = pkgs.ollama.override {
+              config = {
+                rocmSupport = true;
+                cudaSupport = false;
+              };
+            };
+          }
+        else
+          {
+            port = service.ports.port1;
+            acceleration = false;
+            models = service.paths.path0;
+          }
+      );
+    open-webui = {
+      enable = true;
+      host = localhost;
+      port = service.ports.port0;
+      environment = {
+        ENABLE_OLLAMA_API = "True";
+        ANONYMIZED_TELEMETRY = "False";
+        DO_NOT_TRACK = "True";
+        SCARF_NO_ANALYTICS = "True";
+        OLLAMA_BASE_URL = "http://${localhost}:${toString service.ports.port1}";
+        WEBUI_AUTH = "True";
+      };
+    };
+  } // caddyLogic;
+
+  systemd.tmpfiles.rules = [
+    (
+      if hostname == mars.name then
+        "Z ${service.paths.path1} 0777 ${service.name} ${service.name} -"
+      else
+        "Z ${service.paths.path0} 0755 ${service.name} ${service.name} -"
+    )
+  ];
+
+  networking = {
+    firewall = {
+      allowedTCPPorts = [
+        # 8080
+        service.ports.port0
+        service.ports.port1
+      ];
+    };
+  };
+  fileSystems = mountLogic;
+}

modules/nixos/services/owncast/default.nix

@@ -0,0 +1,43 @@
+{ flake, ... }:
+let
+  inherit (flake.config.services.instances)
+    owncast
+    web
+    ;
+  service = owncast;
+  localhost = web.localhost.address1;
+  host = "${service.subdomain}.${web.domains.url1}";
+in
+{
+  services = {
+    owncast = {
+      enable = true;
+      listen = localhost;
+      port = service.ports.port0;
+      openFirewall = true;
+    };
+
+    caddy = {
+      virtualHosts = {
+        "${host}" = {
+          extraConfig = ''
+            reverse_proxy ${localhost}:${toString service.ports.port0}
+
+            tls ${service.ssl.cert} ${service.ssl.key}
+          '';
+        };
+      };
+    };
+  };
+
+  networking = {
+    firewall = {
+      allowedTCPPorts = [
+        service.ports.port0
+        service.ports.port1
+      ];
+    };
+  };
+
+  # OBS Server rtmp://192.168.50.140:1935/live
+}

modules/nixos/services/peertube/default.nix

@@ -0,0 +1,151 @@
+{
+  flake,
+  config,
+  pkgs,
+  ...
+}:
+let
+  inherit (flake.config.machines.devices)
+    ceres
+    ;
+  inherit (flake.config.services.instances)
+    caddy
+    peertube
+    smtp
+    web
+    ;
+  service = peertube;
+  localhost = web.localhost.address0;
+  host = "${service.subdomain}.${web.domains.url3}";
+in
+{
+  services = {
+    peertube = {
+      configureNginx = false;
+      enable = true;
+      enableWebHttps = true;
+      group = service.name;
+      listenWeb = caddy.ports.port1;
+      listenHttp = service.ports.port0;
+      localDomain = host;
+      serviceEnvironmentFile = config.sops.secrets."${service.name}-root".path;
+      user = service.name;
+      plugins = {
+        enable = true;
+        plugins = builtins.attrValues {
+          inherit (pkgs)
+            peertube-plugin-livechat
+            peertube-plugin-matomo
+            peertube-plugin-transcoding-custom-quality
+            peertube-theme-dark
+            ;
+        };
+      };
+
+      secrets = {
+        secretsFile = config.sops.secrets."${service.name}-secret".path;
+      };
+      settings = {
+        instance = {
+          name = "upRootNutrition";
+        };
+        log = {
+          level = "debug";
+        };
+        smtp = {
+          transport = "smtp";
+          disable_starttls = false;
+          from_address = service.email.address0;
+          hostname = smtp.hostname;
+          port = smtp.ports.port0;
+          username = service.email.address0;
+          tls = false;
+        };
+      };
+      database = {
+        createLocally = true;
+        passwordFile = config.sops.secrets."${service.name}-database".path;
+      };
+      redis = {
+        enableUnixSocket = true;
+        createLocally = true;
+        passwordFile = config.sops.secrets."${service.name}-redis".path;
+      };
+      smtp = {
+        createLocally = true;
+        passwordFile = config.sops.secrets."${service.name}-smtp".path;
+      };
+    };
+
+    caddy = {
+      virtualHosts = {
+        ${host} = {
+          extraConfig = ''
+            reverse_proxy ${localhost}:${toString service.ports.port0}
+
+            tls ${service.ssl.cert} ${service.ssl.key}
+
+          '';
+        };
+      };
+    };
+  };
+
+  sops =
+    let
+      sopsPath = secret: {
+        path = "${service.sops.path0}/${service.name}-${secret}-pass";
+        owner = service.name;
+        mode = "600";
+      };
+    in
+    {
+      secrets = builtins.listToAttrs (
+        map
+          (secret: {
+            name = "${service.name}-${secret}";
+            value = sopsPath secret;
+          })
+          [
+            "smtp"
+            "database"
+            "redis"
+            "root"
+            "secret"
+          ]
+      );
+    };
+
+  fileSystems."/var/lib/${service.name}" = {
+    device = service.paths.path0;
+    fsType = "none";
+    options = [
+      "bind"
+    ];
+    depends = [
+      ceres.storage0.mount
+    ];
+  };
+
+  systemd.tmpfiles.rules = [
+    "Z ${service.paths.path0} 755 ${service.name} ${service.name} -"
+    "Z ${service.sops.path0} 755 ${service.name} ${service.name} -"
+  ];
+
+  users.users.${service.name}.extraGroups = [
+    "nginx"
+    "caddy"
+  ];
+
+  networking = {
+    firewall = {
+      allowedTCPPorts = [
+        service.ports.port0
+        service.ports.port1
+        service.ports.port2
+        service.ports.port3
+        service.ports.port4
+      ];
+    };
+  };
+}

modules/nixos/services/postgresql/default.nix

@@ -0,0 +1,60 @@
+{ flake, ... }:
+let
+  inherit (flake.config.machines.devices)
+    ceres
+    ;
+  inherit (flake.config.services.instances)
+    postgresql
+    ;
+
+  service = postgresql;
+in
+{
+  services = {
+    postgresqlBackup = {
+      enable = true;
+      location = service.paths.path0;
+      databases = [
+        "mastodon"
+        "nextcloud"
+        "peertube"
+        "forgejo"
+      ];
+    };
+    postgresql = {
+      enable = true;
+    };
+  };
+  networking = {
+    firewall = {
+      allowedTCPPorts = [
+        service.ports.port0
+      ];
+    };
+  };
+
+  fileSystems."/var/lib/postgresql" = {
+    device = service.paths.path0;
+    fsType = "none";
+    options = [
+      "bind"
+    ];
+    depends = [
+      ceres.storage0.mount
+    ];
+  };
+
+  systemd.tmpfiles.rules = [
+    "Z ${service.paths.path0} 700 ${service.name} ${service.name} -"
+  ];
+
+  users.users.${service.name}.extraGroups = [
+    "nextcloud"
+    "mastodon"
+    "forgejo"
+  ];
+
+  system.activationScripts.postgresCommands = ''
+    chown -R ${service.name}:${service.name} ${service.paths.path0}
+  '';
+}

modules/nixos/services/samba/default.nix

@@ -0,0 +1,42 @@
+{
+  pkgs,
+  flake,
+  ...
+}:
+let
+  inherit (flake.config.services.instances)
+    samba
+    jellyfin
+    audiobookshelf
+    ;
+  service = samba;
+in
+{
+  # If you ever need to start fresh, you need to add yourself to the Samba users database:
+  # sudo smbpasswd -a username
+  services = {
+    samba = {
+      package = pkgs.samba4Full;
+      enable = true;
+      openFirewall = true;
+      settings = {
+        ${jellyfin.name} = {
+          path = jellyfin.paths.path0;
+          writable = "true";
+        };
+        ${audiobookshelf.name} = {
+          path = audiobookshelf.paths.path0;
+          writable = "true";
+        };
+      };
+    };
+  };
+
+  networking = {
+    firewall = {
+      allowedTCPPorts = [
+        service.ports.port0
+      ];
+    };
+  };
+}

modules/nixos/services/searx/default.nix

@@ -0,0 +1,207 @@
+{
+  flake,
+  lib,
+  config,
+  ...
+}:
+let
+  inherit (flake.config.machines.devices) ceres;
+  inherit (flake.config.services.instances) searx web;
+  service = searx;
+  hostname = config.networking.hostName;
+  localhost = web.localhost.address0;
+  host = "${service.subdomain}.${web.domains.url0}";
+in
+{
+  services =
+    {
+      searx = {
+        enable = true;
+        redisCreateLocally = true;
+        uwsgiConfig = {
+          socket = "/run/searx/searx.sock";
+          http = ":${builtins.toString service.ports.port0}";
+          chmod-socket = "660";
+        };
+        settings = {
+          general = {
+            debug = false;
+            instance_name = "SearXNG Instance";
+            donation_url = false;
+            contact_url = false;
+            privacypolicy_url = false;
+            enable_metrics = false;
+          };
+          ui = {
+            static_use_hash = true;
+            default_locale = "en";
+            query_in_title = true;
+            infinite_scroll = true;
+            center_alignment = true;
+            default_theme = "simple";
+            theme_args.simple_style = "auto";
+            search_on_category_select = true;
+            hotkeys = "vim";
+          };
+          search = {
+            safe_search = 0;
+            autocomplete_min = 2;
+            autocomplete = "duckduckgo";
+            ban_time_on_fail = 5;
+            max_ban_time_on_fail = 120;
+          };
+          server =
+            {
+              port = service.ports.port0;
+              bind_address = localhost;
+              secret_key = config.sops.secrets.searx-key.path;
+              limiter = false;
+              public_instance = false;
+              image_proxy = true;
+              method = "GET";
+            }
+            // (
+              if hostname == ceres.name then
+                {
+                  base_url = "https://${host}";
+                }
+              else
+                { }
+            );
+          engines = lib.mapAttrsToList (name: value: { inherit name; } // value) {
+            "duckduckgo".disabled = false;
+            "brave".disabled = false;
+            "bing".disabled = false;
+            "mojeek".disabled = true;
+            "mwmbl".disabled = false;
+            "mwmbl".weight = 0.4;
+            "qwant".disabled = true;
+            "crowdview".disabled = false;
+            "crowdview".weight = 0.5;
+            "curlie".disabled = true;
+            "ddg definitions".disabled = false;
+            "ddg definitions".weight = 2;
+            "wikibooks".disabled = false;
+            "wikidata".disabled = false;
+            "wikiquote".disabled = true;
+            "wikisource".disabled = true;
+            "wikispecies".disabled = false;
+            "wikispecies".weight = 0.5;
+            "wikiversity".disabled = false;
+            "wikiversity".weight = 0.5;
+            "wikivoyage".disabled = false;
+            "wikivoyage".weight = 0.5;
+            "currency".disabled = true;
+            "dictzone".disabled = true;
+            "lingva".disabled = true;
+            "bing images".disabled = false;
+            "brave.images".disabled = false;
+            "duckduckgo images".disabled = false;
+            "google images".disabled = false;
+            "qwant images".disabled = true;
+            "1x".disabled = true;
+            "artic".disabled = false;
+            "deviantart".disabled = false;
+            "flickr".disabled = true;
+            "imgur".disabled = false;
+            "library of congress".disabled = false;
+            "material icons".disabled = true;
+            "material icons".weight = 0.2;
+            "openverse".disabled = false;
+            "pinterest".disabled = true;
+            "svgrepo".disabled = false;
+            "unsplash".disabled = false;
+            "wallhaven".disabled = false;
+            "wikicommons.images".disabled = false;
+            "yacy images".disabled = true;
+            "bing videos".disabled = false;
+            "brave.videos".disabled = true;
+            "duckduckgo videos".disabled = true;
+            "google videos".disabled = false;
+            "qwant videos".disabled = false;
+            "dailymotion".disabled = true;
+            "google play movies".disabled = true;
+            "invidious".disabled = true;
+            "odysee".disabled = true;
+            "peertube".disabled = true;
+            "piped".disabled = true;
+            "rumble".disabled = false;
+            "sepiasearch".disabled = false;
+            "vimeo".disabled = true;
+            "youtube".disabled = false;
+            "brave.news".disabled = true;
+            "google news".disabled = true;
+          };
+          outgoing = {
+            request_timeout = 5.0;
+            max_request_timeout = 15.0;
+            pool_connections = 100;
+            pool_maxsize = 15;
+            enable_http2 = true;
+          };
+          enabled_plugins = [
+            "Basic Calculator"
+            "Hash plugin"
+            "Tor check plugin"
+            "Open Access DOI rewrite"
+            "Hostnames plugin"
+            "Unit converter plugin"
+            "Tracker URL remover"
+          ];
+        };
+      };
+    }
+    // (
+      if hostname == ceres.name then
+        {
+          caddy = {
+            virtualHosts = {
+              "${host}" = {
+                extraConfig = ''
+                  redir /.well-known/carddav /remote.php/dav/ 301
+                  redir /.well-known/caldav /remote.php/dav/ 301
+
+                  reverse_proxy ${localhost}:${toString service.ports.port0}
+
+                  tls ${service.ssl.cert} ${service.ssl.key}
+                '';
+              };
+            };
+          };
+        }
+      else
+        { }
+    );
+
+  users.groups.searx.members = [ "caddy" ];
+  # systemd.services.caddy.serviceConfig.ProtectHome = false;
+
+  sops =
+    let
+      sopsPath = secret: {
+        path = "${service.sops.path0}/${service.name}-${secret}";
+        owner = service.name;
+        mode = "600";
+      };
+    in
+    {
+      secrets = builtins.listToAttrs (
+        map
+          (secret: {
+            name = "${service.name}-${secret}";
+            value = sopsPath secret;
+          })
+          [
+            "key"
+          ]
+      );
+    };
+
+  networking = {
+    firewall = {
+      allowedTCPPorts = [
+        service.ports.port0
+      ];
+    };
+  };
+}

modules/nixos/services/syncthing/default.nix

@@ -0,0 +1,56 @@
+{ flake, ... }:
+let
+  inherit (flake.config.machines.devices)
+    synology
+    phone
+    tablet
+    ;
+  inherit (flake.config.services.instances)
+    syncthing
+    web
+    ;
+  service = syncthing;
+  localhost = web.localhost.address0;
+in
+{
+  services = {
+    syncthing = {
+      enable = true;
+      overrideDevices = false;
+      overrideFolders = false;
+      openDefaultPorts = true;
+      systemService = true;
+      guiAddress = "${localhost}:${toString service.ports.port0}";
+      settings = {
+        devices = {
+          ${synology.name} = {
+            autoAcceptFolders = true;
+            name = synology.name;
+            addresses = [
+              "tcp://${synology.ip.address0}:${toString service.ports.port2}"
+            ];
+            id = synology.sync.address0;
+          };
+          ${phone.name} = {
+            autoAcceptFolders = true;
+            name = phone.name;
+            addresses = [
+              "tcp://${phone.ip.address0}:${toString service.ports.port2}"
+            ];
+            id = phone.sync.address0;
+          };
+        };
+      };
+    };
+  };
+
+  networking = {
+    firewall = {
+      allowedTCPPorts = [
+        service.ports.port0
+        service.ports.port1
+        service.ports.port2
+      ];
+    };
+  };
+}

modules/nixos/services/vaultwarden/default.nix

@@ -0,0 +1,98 @@
+{
+  flake,
+  config,
+  ...
+}:
+let
+  inherit (flake.config.services.instances) smtp vaultwarden web;
+  service = vaultwarden;
+  localhost = web.localhost.address0;
+  host = "${service.subdomain}.${web.domains.url0}";
+in
+{
+  services = {
+    vaultwarden = {
+      backupDir = service.paths.path0;
+      enable = true;
+      environmentFile = config.sops.secrets."${service.name}/env".path;
+      config = {
+        # Domain Configuration
+        DOMAIN = "https://${host}";
+
+        # Email Configuration
+        SMTP_AUTH_MECHANISM = "Plain";
+        SMTP_EMBED_IMAGES = true;
+        SMTP_FROM = service.email.address0;
+        SMTP_FROM_NAME = service.label;
+        SMTP_HOST = smtp.hostname;
+        SMTP_PORT = smtp.ports.port0;
+        SMTP_SECURITY = "starttls";
+        SMTP_USERNAME = service.email.address0;
+
+        # Security Configuration
+        DISABLE_ADMIN_TOKEN = false;
+
+        # Event and Backup Management
+        EVENTS_DAYS_RETAIN = 90;
+
+        # User Features
+        SENDS_ALLOWED = true;
+        SIGNUPS_VERIFY = true;
+        WEB_VAULT_ENABLED = true;
+
+        # Rocket (Web Server) Settings
+        ROCKET_ADDRESS = localhost;
+        ROCKET_PORT = service.ports.port0;
+      };
+    };
+    caddy = {
+      virtualHosts = {
+        "${host}" = {
+          extraConfig = ''
+            reverse_proxy ${localhost}:${toString service.ports.port0} {
+              header_up X-Real-IP {remote_host}
+            }
+
+            tls ${service.ssl.cert} ${service.ssl.key}
+
+            encode zstd gzip
+          '';
+        };
+      };
+    };
+  };
+
+  sops =
+    let
+      sopsPath = secret: {
+        path = "${service.sops.path0}/${service.name}-${secret}";
+        owner = service.name;
+        mode = "600";
+      };
+    in
+    {
+      secrets = builtins.listToAttrs (
+        map
+          (secret: {
+            name = "${service.name}/${secret}";
+            value = sopsPath secret;
+          })
+          [
+            "env"
+          ]
+      );
+    };
+
+  systemd.tmpfiles.rules = [
+    "Z ${service.paths.path0} 0755 ${service.name} ${service.name} -"
+    "Z ${service.sops.path0} 755 ${service.name} ${service.name} -"
+  ];
+
+  networking = {
+    firewall = {
+      allowedTCPPorts = [
+        service.ports.port0
+      ];
+    };
+  };
+}

modules/nixos/services/website/default.nix

@@ -0,0 +1,33 @@
+{ flake, ... }:
+let
+  inherit (flake.config.services.instances)
+    upRootNutrition
+    web
+    ;
+  service = upRootNutrition;
+  host = web.domains.url3;
+in
+{
+  services = {
+    caddy = {
+      virtualHosts = {
+        "${host}" = {
+          extraConfig = ''
+            root * ${service.paths.path0}
+
+            file_server
+
+            encode gzip
+
+            try_files {path} /index.html
+
+            tls ${service.ssl.cert} ${service.ssl.key}
+          '';
+        };
+      };
+    };
+  };
+  systemd.tmpfiles.rules = [
+    "Z ${service.paths.path0} 755 caddy caddy -"
+  ];
+}

modules/nixos/sops/default.nix

@@ -0,0 +1,70 @@
+{
+  flake,
+  config,
+  ...
+}:
+let
+  inherit (flake.config.people)
+    user0
+    user1
+    user2
+    user3
+    ;
+  inherit (flake.config.machines)
+    devices
+    ;
+  hostname = config.networking.hostName;
+  mars = devices.mars.name;
+  ceres = devices.ceres.name;
+  venus = devices.venus.name;
+  charon = devices.charon.name;
+  deimos = devices.deimos.name;
+
+  userLogic =
+    if
+      builtins.elem hostname [
+        mars
+        deimos
+        ceres
+      ]
+    then
+      user0
+    else if hostname == charon then
+      user1
+    else if hostname == venus then
+      user2
+    else
+      "";
+in
+{
+  sops = {
+    defaultSopsFile = ../../../secrets/secrets.yaml;
+    validateSopsFiles = false;
+    age = {
+      keyFile = "/var/lib/sops-nix/key.txt";
+      generateKey = false;
+    };
+    secrets =
+      if hostname == charon then
+        { }
+      else
+        {
+          "ssh/private" = {
+            path = "/home/${userLogic}/.ssh/id_ed25519";
+            owner = userLogic;
+          };
+          "ssh/public" = {
+            path = "/home/${userLogic}/.ssh/id_ed25519.pub";
+            owner = userLogic;
+          };
+          "ssh/hosts" = {
+            path = "/home/${userLogic}/.ssh/known_hosts";
+            owner = userLogic;
+          };
+          # "claude-api-key" = {
+          #   path = "/home/${user0}/.config/zed/claude-api-key";
+          #   owner = user0;
+          # };
+        };
+  };
+}