[nix-darwin] Bump flake.lock, add claude-code

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

dotfiles/config/alacritty/alacritty.toml

@@ -1,4 +1,5 @@
-import = ["/home/imalison/.config/alacritty/themes/themes/dracula.toml"]
+[general]
+import = ["~/.config/alacritty/themes/themes/dracula.toml"]
 
 [font]
 size = 8

dotfiles/config/hypr/hyprland.conf

@@ -0,0 +1,294 @@
+# Hyprland Configuration
+# Based on XMonad configuration from xmonad.hs
+
+# See https://wiki.hyprland.org/Configuring/Monitors/
+monitor=,preferred,auto,auto
+
+# Source a file (multi-file configs)
+# source = ~/.config/hypr/myColors.conf
+
+# Set programs that you use
+$terminal = alacritty
+$fileManager = dolphin
+$menu = rofi -show drun -show-icons
+$runMenu = rofi -show run
+
+# Environment variables
+env = XCURSOR_SIZE,24
+env = QT_QPA_PLATFORMTHEME,qt5ct
+env = GDK_DPI_SCALE,1.25
+env = QT_FONT_DPI,120
+
+# Input configuration
+input {
+    kb_layout = us
+    kb_variant =
+    kb_model =
+    kb_options =
+    kb_rules =
+
+    follow_mouse = 1
+
+    touchpad {
+        natural_scroll = no
+    }
+
+    sensitivity = 0 # -1.0 - 1.0, 0 means no modification.
+}
+
+# General settings
+general {
+    gaps_in = 5
+    gaps_out = 20
+    border_size = 2
+    col.active_border = rgba(edb443ee) rgba(33ccffee) 45deg
+    col.inactive_border = rgba(595959aa)
+
+    layout = master
+
+    allow_tearing = false
+}
+
+# Decoration
+decoration {
+    rounding = 10
+    
+    blur {
+        enabled = true
+        size = 3
+        passes = 1
+    }
+}
+
+# Animations
+animations {
+    enabled = yes
+
+    bezier = myBezier, 0.05, 0.9, 0.1, 1.05
+
+    animation = windows, 1, 7, myBezier
+    animation = windowsOut, 1, 7, default, popin 80%
+    animation = border, 1, 10, default
+    animation = borderangle, 1, 8, default
+    animation = fade, 1, 7, default
+    animation = workspaces, 1, 6, default
+}
+
+# Layout configuration
+dwindle {
+    pseudotile = yes # master switch for pseudotiling. Enabling is bound to mainMod + P in the keybinds section below
+    preserve_split = yes # you probably want this
+}
+
+master {
+    mfact = 0.25
+    orientation = left
+}
+
+# Misc
+misc {
+    force_default_wallpaper = 0
+    disable_hyprland_logo = true
+}
+
+# Scratchpad-like windows
+windowrule = float, title:^(htop)$
+windowrule = size 80% 80%, title:^(htop)$
+
+# Chrome specific rules
+windowrule = float, class:^(chrome)$,title:^(.*@gmail.com.*Gmail.*)$
+windowrule = float, class:^(chrome)$,title:^(Messages)$
+windowrule = size 90% 90%, class:^(chrome)$,title:^(.*@gmail.com.*Gmail.*)$
+windowrule = size 90% 90%, class:^(chrome)$,title:^(Messages)$
+
+# ===== KEY BINDINGS =====
+# Based on XMonad configuration
+
+# Main modifier key (Super/Windows key equivalent to mod4Mask)
+$mainMod = SUPER
+
+# Mod+Alt combination (equivalent to modalt in XMonad)
+$modAlt = SUPER_ALT
+
+# Hyper key (equivalent to mod3Mask in XMonad)
+$hyper = ALT_R
+
+# Program launching
+bind = $mainMod, P, exec, $menu
+bind = $mainMod SHIFT, P, exec, $runMenu
+bind = $mainMod SHIFT, Return, exec, $terminal
+bind = $mainMod, Q, killactive,
+bind = $mainMod SHIFT, C, killactive,
+bind = $mainMod SHIFT, Q, exit,
+bind = $mainMod, E, exec, emacsclient -c
+bind = $mainMod, V, exec, xclip -o | xdotool type --file -
+
+# Chrome/Browser launching (equivalent to bindBringAndRaise)
+bind = $modAlt, C, exec, google-chrome-stable
+
+# Scratchpad equivalents (toggle special workspaces)
+bind = $modAlt, E, togglespecialworkspace, element
+bind = $modAlt, G, togglespecialworkspace, gmail
+bind = $modAlt, H, togglespecialworkspace, htop
+bind = $modAlt, M, togglespecialworkspace, messages
+bind = $modAlt, K, togglespecialworkspace, slack
+bind = $modAlt, S, togglespecialworkspace, spotify
+bind = $modAlt, T, togglespecialworkspace, transmission
+bind = $modAlt, V, togglespecialworkspace, volume
+
+# Move windows to special workspaces
+bind = $modAlt SHIFT, E, movetoworkspace, special:element
+bind = $modAlt SHIFT, G, movetoworkspace, special:gmail
+bind = $modAlt SHIFT, H, movetoworkspace, special:htop
+bind = $modAlt SHIFT, M, movetoworkspace, special:messages
+bind = $modAlt SHIFT, K, movetoworkspace, special:slack
+bind = $modAlt SHIFT, S, movetoworkspace, special:spotify
+bind = $modAlt SHIFT, T, movetoworkspace, special:transmission
+bind = $modAlt SHIFT, V, movetoworkspace, special:volume
+
+# Directional navigation (WASD keys as in XMonad)
+bind = $mainMod, W, movefocus, u
+bind = $mainMod, S, movefocus, d
+bind = $mainMod, A, movefocus, l
+bind = $mainMod, D, movefocus, r
+
+# Move windows directionally
+bind = $mainMod SHIFT, W, movewindow, u
+bind = $mainMod SHIFT, S, movewindow, d
+bind = $mainMod SHIFT, A, movewindow, l
+bind = $mainMod SHIFT, D, movewindow, r
+
+# Resize windows
+bind = $mainMod CTRL, W, resizeactive, 0 -50
+bind = $mainMod CTRL, S, resizeactive, 0 50
+bind = $mainMod CTRL, A, resizeactive, -50 0
+bind = $mainMod CTRL, D, resizeactive, 50 0
+
+# Layout control
+bind = $mainMod, Space, exec, hyprctl dispatch layoutmsg cyclenext
+bind = $mainMod CTRL, Space, fullscreen, 0
+bind = $mainMod, slash, exec, hyprctl dispatch layoutmsg orientationcycle left top
+bind = $mainMod, F, fullscreen, 0
+bind = $mainMod SHIFT, F, fullscreen, 1
+bind = $mainMod, T, togglefloating,
+bind = $mainMod SHIFT, Y, pseudo, # dwindle pseudotile
+bind = $mainMod, J, togglesplit, # dwindle split direction
+bind = $mainMod, comma, exec, hyprctl dispatch splitratio -0.05
+bind = $mainMod, period, exec, hyprctl dispatch splitratio +0.05
+bind = $mainMod, N, exec, hyprctl dispatch layoutmsg addmaster
+bind = $mainMod SHIFT, N, exec, hyprctl dispatch layoutmsg removemaster
+
+# Focus manipulation
+bind = $mainMod, Tab, exec, hyprctl dispatch focuswindow "class:$(hyprctl activewindow -j | jq -r '.class')"
+bind = $mainMod, M, exec, hyprctl dispatch focuswindow "class:master"
+
+# Monitor/Screen control
+bind = $mainMod, Z, focusmonitor, +1
+bind = $mainMod SHIFT, Z, movewindow, mon:+1
+
+# Window management
+bind = $mainMod, G, exec, hyprctl clients -j | jq -r '.[] | select(.workspace.id >= 0) | "\(.title) - \(.class)"' | rofi -dmenu -i -p "Go to window" | head -1 | xargs -I {} hyprctl dispatch focuswindow "title:{}"
+bind = $mainMod, B, exec, SELECTION=$(hyprctl clients -j | jq -r '.[] | select(.workspace.id >= 0) | "\(.title) - \(.class) [\(.address)]"' | rofi -dmenu -i -p "Bring window"); if [ -n "$SELECTION" ]; then ADDRESS=$(echo "$SELECTION" | sed 's/.*\[\(.*\)\]/\1/'); hyprctl dispatch movetoworkspace "$(hyprctl activeworkspace -j | jq -r '.id')",address:"$ADDRESS"; fi
+bind = $mainMod SHIFT, B, exec, hyprctl clients -j | jq -r '.[] | select(.workspace.id >= 0) | "\(.title) - \(.class)"' | rofi -dmenu -i -p "Replace window" | head -1 | xargs -I {} hyprctl dispatch swapwindow "title:{}"
+bind = $mainMod, M, exec, hyprctl dispatch togglespecialworkspace minimized
+bind = $mainMod SHIFT, M, exec, hyprctl dispatch movetoworkspace special:minimized
+bind = $mainMod SHIFT, H, exec, EMPTY_WS=$(hyprctl workspaces -j | jq -r 'map(select(.windows == 0)) | .[0].id // empty'); if [ -z "$EMPTY_WS" ]; then EMPTY_WS=$(hyprctl workspaces -j | jq -r 'max_by(.id).id + 1'); fi; hyprctl dispatch movetoworkspace $EMPTY_WS && hyprctl dispatch workspace $EMPTY_WS
+bind = $mainMod, X, exec, hyprctl dispatch movetoworkspace special:NSP
+
+# Workspace switching
+bind = $mainMod, 1, workspace, 1
+bind = $mainMod, 2, workspace, 2
+bind = $mainMod, 3, workspace, 3
+bind = $mainMod, 4, workspace, 4
+bind = $mainMod, 5, workspace, 5
+bind = $mainMod, 6, workspace, 6
+bind = $mainMod, 7, workspace, 7
+bind = $mainMod, 8, workspace, 8
+bind = $mainMod, 9, workspace, 9
+bind = $mainMod, 0, workspace, 10
+
+# Move windows to workspaces
+bind = $mainMod SHIFT, 1, movetoworkspace, 1
+bind = $mainMod SHIFT, 2, movetoworkspace, 2
+bind = $mainMod SHIFT, 3, movetoworkspace, 3
+bind = $mainMod SHIFT, 4, movetoworkspace, 4
+bind = $mainMod SHIFT, 5, movetoworkspace, 5
+bind = $mainMod SHIFT, 6, movetoworkspace, 6
+bind = $mainMod SHIFT, 7, movetoworkspace, 7
+bind = $mainMod SHIFT, 8, movetoworkspace, 8
+bind = $mainMod SHIFT, 9, movetoworkspace, 9
+bind = $mainMod SHIFT, 0, movetoworkspace, 10
+
+# Move and follow to workspace
+bind = $mainMod CTRL, 1, movetoworkspace, 1
+bind = $mainMod CTRL, 2, movetoworkspace, 2
+bind = $mainMod CTRL, 3, movetoworkspace, 3
+bind = $mainMod CTRL, 4, movetoworkspace, 4
+bind = $mainMod CTRL, 5, movetoworkspace, 5
+bind = $mainMod CTRL, 6, movetoworkspace, 6
+bind = $mainMod CTRL, 7, movetoworkspace, 7
+bind = $mainMod CTRL, 8, movetoworkspace, 8
+bind = $mainMod CTRL, 9, movetoworkspace, 9
+bind = $mainMod CTRL, 0, movetoworkspace, 10
+
+# Media keys and volume control
+bind = , XF86AudioRaiseVolume, exec, set_volume --unmute --change-volume +5
+bind = , XF86AudioLowerVolume, exec, set_volume --unmute --change-volume -5
+bind = , XF86AudioMute, exec, set_volume --toggle-mute
+bind = $mainMod, I, exec, set_volume --unmute --change-volume +5
+bind = $mainMod, K, exec, set_volume --unmute --change-volume -5
+bind = $mainMod, U, exec, set_volume --toggle-mute
+
+# Media player controls
+bind = $mainMod, semicolon, exec, playerctl play-pause
+bind = , XF86AudioPlay, exec, playerctl play-pause
+bind = , XF86AudioPause, exec, playerctl play-pause
+bind = $mainMod, L, exec, playerctl next
+bind = , XF86AudioNext, exec, playerctl next
+bind = $mainMod, J, exec, playerctl previous
+bind = , XF86AudioPrev, exec, playerctl previous
+
+# Brightness control
+bind = , XF86MonBrightnessUp, exec, brightness.sh 5
+bind = , XF86MonBrightnessDown, exec, brightness.sh -5
+
+# Utility bindings
+bind = $hyper, V, exec, rofi_clipit.sh
+bind = $hyper, Y, exec, rofi-pass
+bind = $hyper, H, exec, rofi_shutter
+bind = $hyper, C, exec, shell_command.sh
+bind = $hyper, X, exec, rofi_command.sh
+bind = $hyper SHIFT, L, exec, dm-tool lock
+bind = $hyper, K, exec, rofi_kill_process.sh
+bind = $hyper SHIFT, K, exec, rofi_kill_all.sh
+bind = $hyper, R, exec, rofi-systemd
+bind = $hyper, 9, exec, start_synergy.sh
+bind = $hyper, slash, exec, toggle_taffybar
+bind = $hyper, Space, exec, skippy-xd
+bind = $hyper, I, exec, rofi_select_input.hs
+bind = $hyper, O, exec, rofi_paswitch
+bind = $mainMod, apostrophe, exec, load_default_map
+bind = $modAlt, apostrophe, exec, load_xkb_map
+bind = $mainMod, R, exec, hyprctl reload
+
+# Workspace cycling
+bind = $mainMod, backslash, workspace, previous
+bind = $mainMod, Tab, workspace, previous
+
+# Mouse bindings
+bindm = $mainMod, mouse:272, movewindow
+bindm = $mainMod, mouse:273, resizewindow
+
+# Scroll through existing workspaces with mainMod + scroll
+bind = $mainMod, mouse_down, workspace, e+1
+bind = $mainMod, mouse_up, workspace, e-1
+
+# Special workspaces for "scratchpad" applications
+exec-once = [workspace special:element silent] element-desktop
+exec-once = [workspace special:gmail silent] google-chrome-stable --new-window https://mail.google.com/mail/u/0/#inbox
+exec-once = [workspace special:htop silent] alacritty --title htop -e htop
+exec-once = [workspace special:messages silent] google-chrome-stable --new-window https://messages.google.com/web/conversations
+exec-once = [workspace special:slack silent] slack
+exec-once = [workspace special:spotify silent] spotify
+exec-once = [workspace special:transmission silent] transmission-gtk
+exec-once = [workspace special:volume silent] pavucontrol

dotfiles/config/taffybar/flake.nix

@@ -1,7 +1,7 @@
 {
   inputs = {
-    flake-utils.url = github:numtide/flake-utils;
-    xmonad.url = github:xmonad/xmonad/master;
+    flake-utils.url = "github:numtide/flake-utils";
+    xmonad.url = "github:xmonad/xmonad/master";
     taffybar.url = "github:taffybar/taffybar";
   };
   outputs = { self, flake-utils, taffybar, nixpkgs, xmonad }:
@@ -39,7 +39,7 @@
   let pkgs = import nixpkgs { inherit system overlays; config.allowBroken = true; };
       hpkgs = pkgs.lib.attrsets.getAttrFromPath (xmonad.lib.hpath defComp) pkgs;
   in
-  rec {
+  {
     devShell = hpkgs.shellFor {
       packages = p: [ p.imalison-taffybar p.taffybar ];
       nativeBuildInputs = with hpkgs; [

dotfiles/config/taffybar/taffybar.hs

@@ -218,7 +218,7 @@ main = do
           [ ( "uber-loaner"
             , baseConfig { endWidgets = laptopEndWidgets }
             )
-          , ( "adele"
+          , ( "adell"
             , baseConfig { endWidgets = laptopEndWidgets }
             )
           , ( "stevie-nixos"

dotfiles/config/xmonad/flake.nix

@@ -17,7 +17,7 @@
   in flake-utils.lib.eachDefaultSystem (system:
   let pkgs = import nixpkgs { inherit system overlays; config.allowBroken = true; };
   in
-  rec {
+  {
     devShell = pkgs.haskellPackages.shellFor {
       packages = p: [ p.imalison-xmonad p.xmonad-contrib ];
       buildInputs = with pkgs.haskellPackages; [

dotfiles/config/xmonad/xmonad.hs

@@ -1059,8 +1059,8 @@ addKeys conf@XConfig { modMask = modm } =
     , ((hyper .|. shiftMask, xK_q), spawn "toggle_mute_current_window.sh")
     , ((hctrl, xK_q), spawn "toggle_mute_current_window.sh only")
 
-    , ((0, xF86XK_MonBrightnessUp), spawn "brightness.sh 5")
-    , ((0, xF86XK_MonBrightnessDown), spawn "brightness.sh -5")
+    , ((0, xF86XK_MonBrightnessUp), spawn "brightness.sh up")
+    , ((0, xF86XK_MonBrightnessDown), spawn "brightness.sh down")
 
     ] ++
 

dotfiles/emacs.d/.mc-lists.el

@@ -4,6 +4,7 @@
 (setq mc/cmds-to-run-for-all
       '(
         TeX-insert-backslash
+        align
         backward-sexp
         beginning-of-buffer
         beginning-of-visual-line

dotfiles/emacs.d/README.org

@@ -1138,7 +1138,8 @@ I keep it around just in case I need it.
 *** frame-mode
 #+BEGIN_SRC emacs-lisp
 (defvar imalison:use-frame-mode
-  (s-contains? "xmonad" (shell-command-to-string "wmctrl -m")))
+  (or (s-contains? "xmonad" (shell-command-to-string "wmctrl -m"))
+      (s-contains? "Hyprland" (shell-command-to-string "wmctrl -m"))))
 
 (use-package frame-mode
   :if imalison:use-frame-mode
@@ -1517,6 +1518,7 @@ https://github.com/alpaker/Fill-Column-Indicator/issues/21 for more details
 ** indent-bars
 #+begin_src emacs-lisp
 (use-package indent-bars
+  :disabled t
   :straight (indent-bars :type git :host github :repo "jdtsmith/indent-bars")
   :config
   (require 'indent-bars-ts) 		; not needed with straight
@@ -2522,11 +2524,6 @@ Reduce indentation for some functions
   :config
   (progn (setq edebug-trace t)))
 #+END_SRC
-**** overseer
-#+BEGIN_SRC emacs-lisp
-(use-package overseer
-  :defer t)
-#+END_SRC
 **** Misc
 #+BEGIN_SRC emacs-lisp
 (defun imenu-elisp-sections ()
@@ -3152,10 +3149,32 @@ My org-mode configuration now lives in its own file org-config.org.
     (unbind-key "C-j" magit-hunk-section-map)
     (unbind-key "C-j" magit-file-section-map)
     (unbind-key "C-j" magit-diff-section-base-map)
+    (remove-hook 'magit-status-headers-hook 'magit-insert-tags-header)
+    (setq magit-revision-insert-related-refs nil)
+    (remove-hook 'magit-status-sections-hook 'magit-insert-unpulled-from-upstream)
+    (remove-hook 'magit-status-sections-hook 'magit-insert-unpushed-to-upstream-or-recent)
     (setq magit-last-seen-setup-instructions "1.4.0"
           magit-display-buffer-function
           'magit-display-buffer-same-window-except-diff-v1)
     (magit-auto-revert-mode)
+    (dir-locals-set-class-variables
+     'huge-git-repository
+     '((nil
+        . ((magit-refresh-buffers . nil)
+           (magit-revision-insert-related-refs . nil)))
+       (magit-status-mode
+        . ((eval . (magit-disable-section-inserter 'magit-insert-tags-header))
+           (eval . (magit-disable-section-inserter 'magit-insert-recent-commits))
+           (eval . (magit-disable-section-inserter 'magit-insert-unpushed-to-pushremote))
+           (eval . (magit-disable-section-inserter 'magit-insert-unpushed-to-upstream-or-recent))
+           (eval . (magit-disable-section-inserter 'magit-insert-unpulled-from-pushremote))
+           (eval . (magit-disable-section-inserter 'magit-insert-unpulled-from-pushremote))
+           (eval . (magit-disable-section-inserter 'magit-insert-unpulled-from-upstream))
+           ))
+       ))
+
+    (dir-locals-set-directory-class
+     "/home/imalison/Projects/nixpkgs" 'huge-git-repository)
 
     (add-to-list 'org-show-context-detail '(magit-goto . lineage))
     (advice-add 'magit-diff-visit-file :after 'imalison:after-magit-visit-file)
@@ -3553,6 +3572,15 @@ crux-reopen-as-root-mode makes it so that any file owned by root will automatica
     (setq gptel-model "gpt-4")
     ))
 #+end_src
+** claude-code-ide
+#+begin_src emacs-lisp
+(use-package claude-code-ide
+  :straight (:type git :host github :repo "manzaltu/claude-code-ide.el")
+  :bind ("C-c C-'" . claude-code-ide-menu)
+  :config
+  (claude-code-ide-emacs-tools-setup)
+  (setq claude-code-ide-terminal-backend 'eat))
+#+end_src
 * Cooperation
 ** togetherly
 #+BEGIN_SRC emacs-lisp
@@ -3662,24 +3690,10 @@ I had to disable this mode because something that it does messes with coding set
   (progn
     (add-hook 'prog-mode-hook (lambda () (rainbow-delimiters-mode t)))))
 #+END_SRC
-** undo-tree
-Disabled because it makes it hard to redo things
-#+BEGIN_SRC emacs-lisp
-(use-package undo-tree
-  :disabled t
-  :bind (("C--" . undo-redo)
-         ("C-c u" . undo-tree-visualize)
-         ("C-c r" . undo-tree-redo))
-  :config
-  (diminish 'undo-tree-mode)
-  :init
-  (progn
-    ;;(setq undo-tree-visualizer-diff t) ;; This causes performance problems
-    (setq undo-limit (expt 2 25)
-          undo-strong-limit (expt 2 25))
-    (global-undo-tree-mode)
-    (setq undo-tree-visualizer-timestamps t)))
-#+END_SRC
+** vundo
+#+begin_src emacs-lisp
+(use-package vundo)
+#+end_src
 ** recentf
 #+BEGIN_SRC emacs-lisp
 (use-package recentf

dotfiles/emacs.d/init.el

@@ -66,7 +66,7 @@
 (use-package org
   :straight
   (org :type git :host github :repo "colonelpanic8/org-mode" :local-repo "org"
-       :branch "my-main"
+       :branch "my-main-2025"
        :depth full :pre-build (straight-recipes-org-elpa--build) :build
        (:not autoloads) :files
        (:defaults "lisp/*.el" ("etc/styles/" "etc/styles/*")))

dotfiles/emacs.d/kat-mode.org

@@ -58,41 +58,11 @@ This makes evil-mode play nice with org-fc
                  (file+datetree "~/org/weekly_reviews.org")
                  (file "~/org/weekly_review_template.org")))))
 #+end_src
-
-** Daily Journal Entries
+** Journal
 #+begin_src emacs-lisp
-(defun imalison:journal-filepath-for-date (&optional date)
-  (interactive (list (org-read-date)))
-  (let ((date-str (or date (format-time-string "%Y-%m-%d"))))
-    (imalison:join-paths
-     org-directory "journal" (concat date-str ".org"))))
-
-(defun imalison:open-todays-org-journal ()
-  (interactive)
-  (imalison:open-org-journal (format-time-string "%Y-%m-%d")))
-
-(defun imalison:get-journal-template ()
-  (with-temp-buffer
-  (insert-file-contents (imalison:join-paths org-directory "templates" "daily-journal-template.org"))
-  (buffer-string)))
-
-(defun imalison:open-org-journal (&optional date)
-  (interactive (list (org-read-date nil nil nil "Select a date:")))
-  (let* ((filepath (imalison:journal-filepath-for-date date))
-         (file-existed (file-exists-p filepath))
-         (date-str (or date (format-time-string "%Y-%m-%d")))
-         (time-vals (append '(0 0 0) (nthcdr 3 (parse-time-string date-str))))
-         (original-format-time-string (symbol-function 'format-time-string)))
-    (find-file filepath)
-    (when (not file-existed)
-      (cl-letf (((symbol-function 'format-time-string)
-                 (lambda (format-string &optional _time _universal)
-                   (funcall original-format-time-string format-string (apply #'encode-time time-vals)))))
-        (insert (org-capture-fill-template (imalison:get-journal-template)))))))
-
-(bind-key "C-c j" 'imalison:open-todays-org-journal)
+(setq imalison:journal-template-filepath
+      (imalison:join-paths org-directory "templates" "daily-journal-template.org"))
 #+end_src
-
 ** Insert a link to a task selected from agenda
 #+begin_src emacs-lisp
 (defun imalison:insert-link-to-agenda ()
@@ -161,6 +131,10 @@ This makes evil-mode play nice with org-fc
 * Packages
 #+begin_src emacs-lisp
 (use-package org-drill)
+(require 'package)
+(add-to-list 'package-archives
+             '("melpa" . "https://melpa.org/packages/") t)
+(package-initialize)
 
 #+end_src
 
@@ -168,3 +142,35 @@ This makes evil-mode play nice with org-fc
 #+begin_src emacs-lisp
 (setq org-wild-notifier-day-wide-alert-times nil)
 #+end_src
+
+* Swift
+#+begin_src emacs-lisp
+(require 'package)
+(add-to-list 'package-archives
+             '("melpa" . "https://melpa.org/packages/") t)
+(package-initialize)
+
+(unless (package-installed-p 'swift-mode)
+  (package-refresh-contents)
+  (package-install 'swift-mode))
+
+(unless (package-installed-p 'lsp-mode)
+  (package-refresh-contents)
+  (package-install 'lsp-mode))
+
+;; Swift Mode
+(require 'swift-mode)
+(add-to-list 'auto-mode-alist '("\\.swift\\'" . swift-mode))
+
+;; LSP Mode
+(require 'lsp-mode)
+(add-hook 'swift-mode-hook #'lsp)
+
+;; Set the path to SourceKit-LSP if it's not in your PATH
+(setq lsp-sourcekit-executable "/path/to/sourcekit-lsp")
+
+;; Optional: Set the path to your Swift toolchain if necessary
+(setq lsp-sourcekit-executable-args '("-toolchain" "/path/to/swift-toolchain"))
+
+#+end_src
+

dotfiles/emacs.d/org-api.el

@@ -0,0 +1,91 @@
+(let ((current-dir (if load-file-name (file-name-directory load-file-name) "~/.emacs.d/")))
+  (load (expand-file-name "init.el" current-dir)))
+
+(use-package simple-httpd
+  :demand t)
+
+(require 'simple-httpd)
+
+(defun org-api-get-todo-elements-from-filepath (filepath)
+  (let ((todo-elements nil))
+    (with-current-buffer (find-file-noselect filepath)
+      (save-excursion
+        (goto-char (point-min))
+        (while (re-search-forward org-todo-regexp nil t)
+          (let* ((element (org-element-at-point))
+                 (type (org-element-type element)))
+            (when (eq type 'headline)
+              (let ((todo (org-element-property :todo-keyword element)))
+                (when todo
+                  (push element todo-elements))))))))
+    todo-elements))
+
+(defun org-api-get-agenda-todos ()
+  (let* ((today (calendar-gregorian-from-absolute (org-today))))
+    (mapcan 'org-api-get-todo-elements-from-filepath org-agenda-files)))
+
+(defun org-api-get-element-json (element)
+  (let ((todo (org-element-property :todo-keyword element))
+        (title (org-element-property :raw-value element))
+        (tags (org-element-property :tags element))
+        (level (org-element-property :level element))
+        (scheduled (org-element-property :scheduled element))
+        (deadline (org-element-property :deadline element)))
+    `(("todo" . ,todo)
+      ("title" . ,title)
+      ("tags" . ,tags)
+      ("level" . ,level)
+      ("scheduled" . ,(when scheduled (org-format-timestamp scheduled "%Y-%m-%dT%H:%M:%SZ")))
+      ("deadline" . ,(when deadline (org-format-timestamp deadline "%Y-%m-%dT%H:%M:%SZ"))))))
+
+(defun org-api-item-json (item)
+  (let* ((todo (get-text-property 0 'todo-state item))
+        (title (substring-no-properties item))
+        (tags (get-text-property 0 'tags item))
+        (s (get-text-property 0 'ts-date item))
+        (scheduled (when s
+                     (org-format-timestamp (org-time-from-absolute s) "%Y-%m-%dT%H:%M:%SZ") )))
+    `(("todo" . ,todo)
+      ("title" . ,title)
+      ("tags" . ,tags))))
+
+
+(defun org-api-get-scheduled-or-deadlined (day filepath)
+  (with-current-buffer (find-file-noselect filepath)
+    (org-dlet ((date day))
+      (setf org-agenda-current-date date)
+      (nconc (org-agenda-get-deadlines) (org-agenda-get-scheduled)))))
+
+(defun org-api-get-today-agenda ()
+  (let ((day (calendar-current-date)))
+    (mapcan (lambda (filepath) (org-api-get-scheduled-or-deadlined day filepath))
+            org-agenda-files)))
+
+(defservlet get-all-todos application/json ()
+  (insert (json-encode (mapcar 'org-api-get-element-json (org-api-get-agenda-todos)))))
+
+(defservlet get-todays-agenda application/json ()
+  (insert
+   (json-encode
+    (mapcar 'org-api-item-json
+            (org-api-get-today-agenda)))))
+
+(defservlet create-todo application/json (a b c)
+  (org-api-capture (gethash "title" (json-parse-string (cadr (assoc "Content" c))))))
+
+(cl-defun org-api-build-capture-template
+  (content &key (character "d") (heading "Dynamic"))
+    `(,character ,heading entry (file "~/org/inbox.org")
+                 (function (lambda ()
+                             (imalison:make-org-todo-template :content content)))
+                 :immediate-finish t))
+
+(defun org-api-capture (content)
+  (let* ((org-capture-templates (list (org-api-build-capture-template content))))
+    (org-capture nil "d")))
+
+
+(message "Starting http server")
+(setq httpd-port 2025)
+(httpd-start)
+(message "Finished starting http server")

dotfiles/emacs.d/org-config.org

@@ -62,6 +62,11 @@ We're going to use this to write separate parts of our config to different secti
         (imalison:join-paths imalison:shared-org-dir "ivan_orgzly.org")
         (imalison:join-paths imalison:org-dir "orgzly.org")))
 
+(defvar imalison:repeating-org-files
+  (list imalison:org-habits-file imalison:shared-habits-file imalison:shared-repeating-file))
+
+(defvar imalison:include-repeating-in-agenda nil)
+
 (defun imalison:add-to-org-agenda-files (incoming-files)
   (setq org-agenda-files
         (delete-dups
@@ -366,12 +371,13 @@ We're going to use this to write separate parts of our config to different secti
 *** Agenda Files
 #+begin_src emacs-lisp :tangle org-config-config.el
 (imalison:add-to-org-agenda-files
- (nconc (list imalison:org-gtd-file imalison:org-habits-file
-              imalison:org-calendar-file imalison:org-inbox-file
-              imalison:shared-org-gtd-file imalison:shared-habits-file
-              imalison:shared-calendar-file imalison:shared-shopping-file
-              imalison:shared-repeating-file)
+ (nconc (list imalison:org-gtd-file imalison:org-calendar-file
+              imalison:org-inbox-file imalison:shared-org-gtd-file
+              imalison:shared-calendar-file imalison:shared-shopping-file)
         imalison:orgzly-files))
+
+(when imalison:include-repeating-in-agenda
+  (imalison:add-to-org-agenda-files imalison:repeating-org-files))
 #+end_src
 *** Predicates
 #+begin_src emacs-lisp :tangle org-config-config.el
@@ -588,6 +594,43 @@ specific time, they should appear in the agenda at that time!
 (defun imalison:make-org-linked-todo-template ()
   (imalison:make-org-todo-template "[#C] %? %A"))
 #+end_src
+*** Journal
+#+begin_src emacs-lisp :tangle org-config-config.el
+(defun imalison:journal-filepath-for-date (&optional date)
+  (interactive (list (org-read-date)))
+  (let ((date-str (or date (format-time-string "%Y-%m-%d"))))
+    (imalison:join-paths
+     org-directory "journal" (concat date-str ".org"))))
+
+(defun imalison:open-todays-org-journal ()
+  (interactive)
+  (imalison:open-org-journal (format-time-string "%Y-%m-%d")))
+
+(defvar imalison:journal-template-filepath
+  (imalison:join-paths org-directory "capture-templates" "journal.org"))
+
+(defun imalison:get-journal-template ()
+  (with-temp-buffer
+    (insert-file-contents imalison:journal-template-filepath)
+    (buffer-string)))
+
+(defun imalison:open-org-journal (&optional date)
+  (interactive (list (org-read-date nil nil nil "Select a date:")))
+  (let* ((filepath (imalison:journal-filepath-for-date date))
+         (file-existed (file-exists-p filepath))
+         (date-str (or date (format-time-string "%Y-%m-%d")))
+         (time-vals (append '(0 0 0) (nthcdr 3 (parse-time-string date-str))))
+         (original-format-time-string (symbol-function 'format-time-string)))
+    (find-file filepath)
+    (when (not file-existed)
+      (cl-letf (((symbol-function 'format-time-string)
+                 (lambda (format-string &optional _time _universal)
+                   (funcall original-format-time-string format-string (apply #'encode-time time-vals)))))
+        (insert (org-capture-fill-template (imalison:get-journal-template)))))))
+
+(bind-key "C-c j" 'imalison:open-todays-org-journal)
+#+end_src
+
 *** Templates
 #+begin_src emacs-lisp :tangle org-config-config.el
 (use-package org-capture
@@ -626,7 +669,15 @@ SCHEDULED: %^t
 :PROPERTIES:
 :CREATED: %U
 :STYLE: habit
-:END:")))
+:END:"))
+  (add-to-list 'org-capture-templates
+               '("w" "Weekly Planning and Self Assesment"
+                 plain
+                 (function (lambda ()
+                             (find-file (let ((date (format-time-string "%Y-%m-%d")))
+                                    (expand-file-name (concat date ".org")
+                                                      "~/org/weekly")))))
+                 (file "~/org/capture-templates/weekly.org"))))
 #+end_src
 ** Babel
 #+begin_src emacs-lisp :tangle org-config-config.el

dotfiles/emacs.d/snippets/python-mode/inp

@@ -0,0 +1,5 @@
+# -*- mode: snippet -*-
+# name: inp
+# key: inp
+# --
+import numpy as np

dotfiles/emacs.d/snippets/python-mode/isa

@@ -0,0 +1,5 @@
+# -*- mode: snippet -*-
+# name: isa
+# key: isa
+# --
+import sqlalchemy as sa

dotfiles/lib/bin/brightness.hs

@@ -0,0 +1,164 @@
+#!/usr/bin/env runhaskell
+
+import System.Environment (getArgs)
+import System.Process
+import System.Exit
+import Data.List (isPrefixOf, isSuffixOf)
+import Data.Maybe (mapMaybe, fromMaybe)
+import Text.Read (readMaybe)
+import Control.Monad (forM, when)
+import Data.Time.Clock
+import Data.Time.Format
+import System.IO
+
+-- Types
+data Device = Device { deviceName :: String, deviceBrightness :: Int }
+    deriving (Show)
+
+data BrightnessCommand = Absolute Int | Increase Int | Decrease Int | Query
+    deriving (Show)
+
+-- Logging
+logAction :: String -> IO ()
+logAction arg = do
+    time <- getCurrentTime
+    let timeStr = formatTime defaultTimeLocale "%Y-%m-%d %H:%M:%S" time
+    ppid <- readProcess "sh" ["-c", "ps -p $PPID -o comm= 2>/dev/null || echo unknown"] ""
+    pwd <- readProcess "pwd" [] ""
+    let logEntry = "[" ++ timeStr ++ "] Called with: '" ++ arg ++ "' | Parent: " ++
+                   filter (/= '\n') ppid ++ " | PWD: " ++ filter (/= '\n') pwd ++ "\n"
+    appendFile "/tmp/brightness.log" logEntry
+
+-- Parse command line argument
+parseArg :: String -> BrightnessCommand
+parseArg "" = Query
+parseArg ('+':rest) = case readMaybe rest of
+    Just n -> Increase n
+    Nothing -> Query
+parseArg ('-':rest) = case readMaybe rest of
+    Just n -> Decrease n
+    Nothing -> Query
+parseArg s = case readMaybe s of
+    Just n -> Absolute n
+    Nothing -> Query
+
+-- Get list of backlight devices
+getBacklightDevices :: IO [String]
+getBacklightDevices = do
+    output <- readProcess "brightnessctl" ["--list"] ""
+    return $ mapMaybe extractDevice (lines output)
+  where
+    extractDevice line
+        | "Device '" `isInfixOf` line && "class 'backlight'" `isInfixOf` line =
+            let afterDevice = drop (length "Device '") line
+                deviceName = takeWhile (/= '\'') afterDevice
+            in if null deviceName then Nothing else Just deviceName
+        | otherwise = Nothing
+
+-- Get brightness percentage for a device
+getDeviceBrightness :: String -> IO (Maybe Int)
+getDeviceBrightness device = do
+    output <- readProcess "brightnessctl" ["-d", device] ""
+    return $ extractPercentage output
+  where
+    extractPercentage s = case dropWhile (/= '(') s of
+        ('(':rest) -> readMaybe (takeWhile (/= '%') rest)
+        _ -> Nothing
+
+-- Set brightness for a device
+setDeviceBrightness :: String -> String -> IO ()
+setDeviceBrightness device cmd = do
+    _ <- readProcess "brightnessctl" ["-d", device, "set", cmd] ""
+    return ()
+
+-- Build brightness command string
+buildCommand :: BrightnessCommand -> String
+buildCommand (Absolute n) = show n ++ "%"
+buildCommand (Increase n) = show n ++ "%+"
+buildCommand (Decrease n) = show n ++ "%-"
+buildCommand Query = ""
+
+-- Apply brightness change to all devices
+applyBrightness :: BrightnessCommand -> IO ()
+applyBrightness Query = return ()
+applyBrightness cmd = do
+    devices <- getBacklightDevices
+    let cmdStr = buildCommand cmd
+    
+    -- Log what we're about to do
+    appendFile "/tmp/brightness.log" $ 
+        "  Applying: " ++ cmdStr ++ " to devices: " ++ show devices ++ "\n"
+
+    -- Apply to all devices
+    mapM_ (\dev -> setDeviceBrightness dev cmdStr) devices
+
+    -- Sync devices if needed
+    when (length devices > 1) $ do
+        brightnesses <- forM devices $ \dev -> do
+            mbBright <- getDeviceBrightness dev
+            return (dev, mbBright)
+
+        let validBrightnesses = [(d, b) | (d, Just b) <- brightnesses]
+        when (not $ null validBrightnesses) $ do
+            let values = map snd validBrightnesses
+                maxBright = maximum values
+                minBright = minimum values
+
+            -- If devices are out of sync
+            when (maxBright /= minBright) $ do
+                -- Use minimum when brightness is low (15% or below)
+                let syncValue = if maxBright <= 15 then minBright else maxBright
+                -- Log sync decision for debugging
+                appendFile "/tmp/brightness.log" $
+                    "  Syncing: max=" ++ show maxBright ++ "%, min=" ++ show minBright ++
+                    "%, using=" ++ show syncValue ++ "%\n"
+                mapM_ (\dev -> setDeviceBrightness dev (show syncValue ++ "%")) devices
+
+-- Get average brightness across all devices
+getAverageBrightness :: IO Int
+getAverageBrightness = do
+    devices <- getBacklightDevices
+    if null devices
+        then return 50  -- Default fallback
+        else do
+            brightnesses <- forM devices getDeviceBrightness
+            let validValues = [b | Just b <- brightnesses]
+            if null validValues
+                then return 50
+                else return $ sum validValues `div` length validValues
+
+-- Send notification using rumno if available
+sendNotification :: Int -> IO ()
+sendNotification brightness = do
+    rumnoExists <- (== ExitSuccess) <$>
+                   rawSystem "sh" ["-c", "command -v rumno >/dev/null 2>&1"]
+    if rumnoExists
+        then do
+            _ <- readProcess "rumno" ["notify", "-b", show brightness] ""
+            return ()
+        else putStrLn (show brightness)
+
+-- Check if a string contains another
+isInfixOf :: String -> String -> Bool
+isInfixOf needle haystack = any (isPrefixOf needle) (tails haystack)
+  where
+    tails [] = [[]]
+    tails xs@(_:xs') = xs : tails xs'
+
+main :: IO ()
+main = do
+    args <- getArgs
+    let arg = case args of
+                [] -> ""
+                (x:_) -> x
+
+    -- Log the invocation
+    logAction arg
+
+    -- Parse and apply command
+    let cmd = parseArg arg
+    applyBrightness cmd
+
+    -- Get current brightness and notify
+    brightness <- getAverageBrightness
+    sendNotification brightness

dotfiles/lib/bin/brightness.sh

@@ -1,3 +1,92 @@
-#!/usr/bin/env sh
+#!/usr/bin/env bash
 
-volnoti-show $(sudo brightness_manager.py -c "$@" -p)
+# Get the brightness argument (default to empty string to just show current)
+ARG="${1:-}"
+
+# Log the incoming arguments for debugging
+echo "[$(date '+%Y-%m-%d %H:%M:%S')] brightness.sh called with: '$ARG' (all args: $@)" >> /tmp/brightness_bash.log
+
+# Function to get current brightness percentage
+get_brightness_percentage() {
+    # Get list of display backlight devices only (filter by class 'backlight')
+    local devices=$(brightnessctl --list 2>/dev/null | grep 'class.*backlight' | cut -d' ' -f2 | cut -d"'" -f2)
+    local device_count=$(echo "$devices" | wc -w)
+
+    if [ "$device_count" -eq 0 ]; then
+        echo "50"  # Default fallback
+        return
+    fi
+
+    if [ "$device_count" -eq 1 ]; then
+        # Single device - just output its percentage
+        local info=$(brightnessctl 2>/dev/null | grep -oP '\d+%' | head -1 | tr -d '%')
+        if [ -n "$info" ]; then
+            echo "$info"
+        else
+            echo "50"
+        fi
+    else
+        # Multiple devices - calculate average brightness
+        local total=0
+        local count=0
+        for device in $devices; do
+            local info=$(brightnessctl -d "$device" 2>/dev/null | grep -oP '\d+%' | head -1 | tr -d '%')
+            if [ -n "$info" ]; then
+                total=$((total + info))
+                count=$((count + 1))
+            fi
+        done
+
+        if [ "$count" -gt 0 ]; then
+            echo $((total / count))
+        else
+            echo "50"
+        fi
+    fi
+}
+
+# Apply brightness change if argument provided
+if [ -n "$ARG" ]; then
+    # Determine if it's absolute or relative
+    if [[ "$ARG" == "up" ]]; then
+        # Increase by 5%
+        BRIGHTNESS_CMD="5%+"
+    elif [[ "$ARG" == "down" ]]; then
+        # Decrease by 5%
+        BRIGHTNESS_CMD="5%-"
+    elif [[ "$ARG" == +* ]]; then
+        # Relative increase (e.g., +5)
+        BRIGHTNESS_CMD="${ARG:1}%+"
+    elif [[ "$ARG" == -* ]]; then
+        # Relative decrease (e.g., -5)
+        BRIGHTNESS_CMD="${ARG:1}%-"
+    else
+        # Absolute value (e.g., 50)
+        BRIGHTNESS_CMD="${ARG}%"
+    fi
+
+    # Try to apply to all devices
+    # Get list of display backlight devices only (filter by class 'backlight')
+    DEVICES=$(brightnessctl --list 2>/dev/null | grep 'class.*backlight' | cut -d' ' -f2 | cut -d"'" -f2)
+
+    if [ -n "$DEVICES" ]; then
+        # Apply to each device independently without syncing
+        # This allows each device to maintain its own brightness range
+        for device in $DEVICES; do
+            brightnessctl -d "$device" set "$BRIGHTNESS_CMD" >/dev/null 2>&1
+        done
+    else
+        # Fallback: just run brightnessctl without specifying device
+        brightnessctl set "$BRIGHTNESS_CMD" >/dev/null 2>&1
+    fi
+fi
+
+# Get current brightness percentage for display
+BRIGHTNESS=$(get_brightness_percentage)
+
+# Show notification if rumno is available
+if command -v rumno &> /dev/null; then
+    rumno notify -b "$BRIGHTNESS"
+else
+    echo "$BRIGHTNESS"
+fi

dotfiles/lib/bin/brightness_manager.py

@@ -1,88 +0,0 @@
-#!/usr/bin/env python
-import argparse
-import os
-import sys
-import logging
-
-logger = logging.getLogger(__name__)
-
-
-class BrightnessManager(object):
-
-    @classmethod
-    def find_brightness(cls):
-        items_in_backlight_directory = os.listdir("/sys/class/backlight")
-        if len(items_in_backlight_directory) > 1:
-            logger.warning(f"More than one entry in the backlight directory {items_in_backlight_directory}")
-        return cls.from_path(
-            os.path.join("/sys/class/backlight", items_in_backlight_directory[0])
-        )
-
-    @classmethod
-    def from_path(cls, path):
-        logger.warning(f"Using path {path}")
-        return cls(
-            set_brightness_filepath=os.path.join(path, "brightness"),
-            actual_brightness_filepath=os.path.join(path, "actual_brightness"),
-            max_brightness_filepath=os.path.join(path, "max_brightness"),
-        )
-
-    def __init__(
-        self, set_brightness_filepath, max_brightness_filepath, actual_brightness_filepath
-    ):
-        self.set_brightness_filepath = set_brightness_filepath
-        self.max_brightness_filepath = max_brightness_filepath
-        self.actual_brightness_filepath = actual_brightness_filepath
-
-    @property
-    def current_brightness(self):
-        with open(self.actual_brightness_filepath) as fd:
-            return int(fd.read())
-
-    @property
-    def max_brightness(self):
-        with open(self.max_brightness_filepath) as fd:
-            return int(fd.read())
-
-    @current_brightness.setter
-    def current_brightness(self, brightness):
-        with open(self.set_brightness_filepath, 'w') as fd:
-            fd.write(str(brightness))
-
-    def increment_by_proportion(self, proportion):
-        new_brightness = self.current_brightness + int(self.max_brightness * proportion)
-        new_brightness = min(new_brightness, self.max_brightness)
-        self.current_brightness = new_brightness
-
-    @property
-    def current_proportion(self):
-        return float(self.current_brightness) / self.max_brightness
-
-
-def build_parser():
-    parser = argparse.ArgumentParser(
-        description='Interact with macbook brightness',
-    )
-    parser.add_argument(
-        "--change", "-c",
-        help="Change volume by the given percentage",
-        default=0
-    )
-    parser.add_argument(
-        "--print", "-p", dest="do_print",
-        action='store_true',
-        default=False
-    )
-    return parser
-
-
-if __name__ == '__main__':
-    args = build_parser().parse_args()
-    symlink_path = os.readlink("/home/imalison/.config/brightness_manager/symlink")
-    if os.path.exists(symlink_path):
-        manager = BrightnessManager.from_path(symlink_path)
-    else:
-        manager = BrightnessManager.find_brightness()
-    manager.increment_by_proportion(float(args.change) / 100)
-    if args.do_print:
-        print(int(manager.current_proportion * 100))

dotfiles/lib/functions/ns

@@ -1,7 +1,7 @@
 #!/usr/bin/env sh
 
-function nr {
+function ns {
     sk --ansi -i -c 'nix-search "{}"' | get_cols 1
 }
 
-nr "$@"
+ns "$@"

dotfiles/lib/functions/pashowvolume

@@ -2,12 +2,12 @@
 
 function pashowvolume {
 	if paismuted; then
-		volnoti-show -m
+		rumno notify -m
 	else
 		actual=$(pavolume)
 		max=100
 		show=$(( actual < max ? actual : max ))
-		volnoti-show "$show"
+		rumno notify -v "$show"
 	fi
 }
 

dotfiles/lib/functions/pavolume

@@ -1,9 +1,7 @@
 #!/usr/bin/env sh
 
 function pavolume {
-    pacmd list-sinks |
-        awk '/^\s+name: /{indefault = $2 == "<'"$(pasink)"'>"}
-            /^\s+volume: / && indefault {print $5; exit}' | grep -Eo "[0-9]*"
+	pactl get-sink-volume $(pactl get-default-sink) | FS="/" get_cols 2 | grep -oE '[0-9]*'
 }
 
 pavolume

dotfiles/lib/functions/set_volume

@@ -1,10 +1,6 @@
 #!/usr/bin/env sh
 
 function set_volume {
-  current_default=$(pahelper list | grep '*' | all_after_char ":" | xargs)
-  environment_variable_exists USE_ONLY_O_PASINK && pahelper "$current_default"
-
-  # XXX: this does not prevent volumes higher than 100
   pulsemixer "$@"
   pashowvolume
 }

dotfiles/synergy.conf

@@ -13,7 +13,7 @@ section: aliases
   tv:
     imalison-arch
     imalison-desktop
-	imalison-home
+	imalison-home 	justin-bieber-creek
   controlling:
 	uber-loaner
     imalison-mpb-arch
@@ -22,4 +22,5 @@ section: aliases
     kat-uber-loaner
     Dean-PC
     imalison-mbp
+	strixi-minaj
 end

dotfiles/tmux.conf

@@ -0,0 +1,5 @@
+# Automatically rename new sessions to the basename of the current directory
+set-hook -g session-created 'run-shell "tmux rename-session -t #{session_name} $(basename #{pane_current_path})"'
+
+# Also rename when attaching to a session (optional)
+set-hook -g client-session-changed 'run-shell "tmux rename-session -t #{session_name} $(basename #{pane_current_path})"'

nix-darwin/flake.lock

@@ -3,12 +3,12 @@
     "agenix": {
       "inputs": {
         "darwin": "darwin",
-        "home-manager": "home-manager",
+        "home-manager": "home-manager_2",
         "nixpkgs": [
           "railbird-secrets",
           "nixpkgs"
         ],
-        "systems": "systems_2"
+        "systems": "systems"
       },
       "locked": {
         "lastModified": 1707830867,
@@ -27,16 +27,16 @@
     "brew-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1718075954,
-        "narHash": "sha256-4TeUhv5VLEufP+Z/NkKnUk4NUaf59cMsj6NvsVbE+8w=",
+        "lastModified": 1763638478,
+        "narHash": "sha256-n/IMowE9S23ovmTkKX7KhxXC2Yq41EAVFR2FBIXPcT8=",
         "owner": "Homebrew",
         "repo": "brew",
-        "rev": "3f08c75e7b950d4340dab462f3e7f77e8093fa2b",
+        "rev": "fbfdbaba008189499958a7aeb1e2c36ab10c067d",
         "type": "github"
       },
       "original": {
         "owner": "Homebrew",
-        "ref": "4.3.5",
+        "ref": "5.0.3",
         "repo": "brew",
         "type": "github"
       }
@@ -66,25 +66,7 @@
     },
     "flake-utils": {
       "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1710146030,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_2": {
-      "inputs": {
-        "systems": "systems_3"
+        "systems": "systems_2"
       },
       "locked": {
         "lastModified": 1709126324,
@@ -101,6 +83,26 @@
       }
     },
     "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1767930051,
+        "narHash": "sha256-YXtqo8h5bAbqC64XAPMMsZdYk8XkwkyNj/7XOsIyVf8=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "297a08510894822ddd93ee2cfc66d6ac65a3cebb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager_2": {
       "inputs": {
         "nixpkgs": [
           "railbird-secrets",
@@ -125,11 +127,11 @@
     "homebrew-cask": {
       "flake": false,
       "locked": {
-        "lastModified": 1722820732,
-        "narHash": "sha256-Y8TBYxYeUVvgYFylqBUtWxFuOZVstXW+yylI2wz2eQ0=",
+        "lastModified": 1767937441,
+        "narHash": "sha256-hiGvxqI6npGOAnNwMXkF1628IkyKhhYsAqO5kmSAuqM=",
         "owner": "homebrew",
         "repo": "homebrew-cask",
-        "rev": "9e3db5dd3130f9bf388409f39ce1706ca7b59efe",
+        "rev": "cc94d21fe7abb3cc93db50671bf5048176711be9",
         "type": "github"
       },
       "original": {
@@ -141,11 +143,11 @@
     "homebrew-core": {
       "flake": false,
       "locked": {
-        "lastModified": 1722823168,
-        "narHash": "sha256-3sKYVUrhuS1fZJkrYAtB+O67dvaKyTvXXI9UqjAgI8A=",
+        "lastModified": 1767948289,
+        "narHash": "sha256-a6s+kRHOXRq4QoA4bDLZVKpC1woi6tTRqEt8Vk0ikGo=",
         "owner": "homebrew",
         "repo": "homebrew-core",
-        "rev": "dd20841f7fe7375738708bc2f458152906a71f1d",
+        "rev": "f268dcd932823c65f8feb2cfc533300ccbcc4541",
         "type": "github"
       },
       "original": {
@@ -161,29 +163,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1722609272,
-        "narHash": "sha256-Kkb+ULEHVmk07AX+OhwyofFxBDpw+2WvsXguUS2m6e4=",
+        "lastModified": 1767718503,
+        "narHash": "sha256-V+VkFs0aSG0ca8p/N3gib7FAf4cq9jyr5Gm+ZBrHQpo=",
         "owner": "LnL7",
         "repo": "nix-darwin",
-        "rev": "f7142b8024d6b70c66fd646e1d099d3aa5bfec49",
-        "type": "github"
-      },
-      "original": {
-        "owner": "LnL7",
-        "repo": "nix-darwin",
-        "type": "github"
-      }
-    },
-    "nix-darwin_2": {
-      "inputs": {
-        "nixpkgs": "nixpkgs"
-      },
-      "locked": {
-        "lastModified": 1716329735,
-        "narHash": "sha256-ap51w+VqG21vuzyQ04WrhI2YbWHd3UGz0e7dc/QQmoA=",
-        "owner": "LnL7",
-        "repo": "nix-darwin",
-        "rev": "eac4f25028c1975a939c8f8fba95c12f8a25e01c",
+        "rev": "9f48ffaca1f44b3e590976b4da8666a9e86e6eb1",
         "type": "github"
       },
       "original": {
@@ -194,17 +178,14 @@
     },
     "nix-homebrew": {
       "inputs": {
-        "brew-src": "brew-src",
-        "flake-utils": "flake-utils",
-        "nix-darwin": "nix-darwin_2",
-        "nixpkgs": "nixpkgs_2"
+        "brew-src": "brew-src"
       },
       "locked": {
-        "lastModified": 1719720211,
-        "narHash": "sha256-FNK5ZxmNC+V/wOuioc5HqkUy0ld4eW3NqcsZHLYg9HI=",
+        "lastModified": 1764473698,
+        "narHash": "sha256-C91gPgv6udN5WuIZWNehp8qdLqlrzX6iF/YyboOj6XI=",
         "owner": "zhaofengli-wip",
         "repo": "nix-homebrew",
-        "rev": "0afc51fd86693c73e4b60be8ed8c782c4c09b4cc",
+        "rev": "6a8ab60bfd66154feeaa1021fc3b32684814a62a",
         "type": "github"
       },
       "original": {
@@ -215,40 +196,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1687274257,
-        "narHash": "sha256-TutzPriQcZ8FghDhEolnHcYU2oHIG5XWF+/SUBNnAOE=",
-        "path": "/nix/store/22qgs3skscd9bmrxv9xv4q5d4wwm5ppx-source",
-        "rev": "2c9ecd1f0400076a4d6b2193ad468ff0a7e7fdc5",
-        "type": "path"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "type": "indirect"
-      }
-    },
-    "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1716330097,
-        "narHash": "sha256-8BO3B7e3BiyIDsaKA0tY8O88rClYRTjvAp66y+VBUeU=",
+        "lastModified": 1767364772,
+        "narHash": "sha256-fFUnEYMla8b7UKjijLnMe+oVFOz6HjijGGNS1l7dYaQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5710852ba686cc1fd0d3b8e22b3117d43ba374c2",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1722640603,
-        "narHash": "sha256-TcXjLVNd3VeH1qKPH335Tc4RbFDbZQX+d7rqnDUoRaY=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "81610abc161d4021b29199aa464d6a1a521e0cc9",
+        "rev": "16c7794d0a28b5a37904d55bcca36003b9109aaa",
         "type": "github"
       },
       "original": {
@@ -258,7 +210,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_4": {
+    "nixpkgs_2": {
       "locked": {
         "lastModified": 1709703039,
         "narHash": "sha256-6hqgQ8OK6gsMu1VtcGKBxKQInRLHtzulDo9Z5jxHEFY=",
@@ -277,15 +229,15 @@
     "railbird-secrets": {
       "inputs": {
         "agenix": "agenix",
-        "flake-utils": "flake-utils_2",
-        "nixpkgs": "nixpkgs_4"
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1722639965,
-        "narHash": "sha256-ZRe5Z5s/UNaXI2piyncQ3YrFl5q3GryZAfFTyeJ/vhM=",
+        "lastModified": 1766173571,
+        "narHash": "sha256-iYU5oTgXkZHqkb03IDPVMHA4Yte4AFhusTem0nf7pcc=",
         "ref": "refs/heads/master",
-        "rev": "9a92b83c3ad376620db3556c33e51a4300c5badd",
-        "revCount": 73,
+        "rev": "5b42885b7c702fb30b4678e5cb51cc8501fd7830",
+        "revCount": 139,
         "type": "git",
         "url": "ssh://gitea@dev.railbird.ai:1123/railbird/secrets-flake.git"
       },
@@ -296,11 +248,12 @@
     },
     "root": {
       "inputs": {
+        "home-manager": "home-manager",
         "homebrew-cask": "homebrew-cask",
         "homebrew-core": "homebrew-core",
         "nix-darwin": "nix-darwin",
         "nix-homebrew": "nix-homebrew",
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs",
         "railbird-secrets": "railbird-secrets"
       }
     },
@@ -333,21 +286,6 @@
         "repo": "default",
         "type": "github"
       }
-    },
-    "systems_3": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
     }
   },
   "root": "root",

nix-darwin/flake.nix

@@ -19,28 +19,123 @@
       url = "github:homebrew/homebrew-cask";
       flake = false;
     };
-
+    home-manager.url = "github:nix-community/home-manager";
+    home-manager.inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  outputs = inputs@{ self, nix-darwin, nixpkgs, ... }:
+  outputs = inputs@{ self, nix-darwin, nixpkgs, home-manager, ... }:
   let
+    libDir = ../dotfiles/lib;
     configuration = { pkgs, config, ... }: {
-      environment.systemPackages = with pkgs; [
-	      emacs
-        slack
-        gitFull
-        ripgrep
-        yarn
-        nodePackages.prettier
-        vim
+      networking.hostName = "mac-demarco-mini";
+      imports = [ (import ./gitea-actions-runner.nix) ];
+      services.gitea-actions-runner = {
+        user = "gitea-runner";
+        instances.nix = {
+          enable = true;
+          name = config.networking.hostName;
+          url = "https://dev.railbird.ai";
+          token = "H0A7YXAWsKSp9QzvMymfJI12hbxwR7UerEHpCJUe";
+          labels = [
+            "nix-darwin-${pkgs.system}:host"
+            "macos-aarch64-darwin"
+            "nix:host"
+          ];
+          settings = {
+            cache = {
+              enabled = true;
+            };
+            host = {
+              workdir_parent = "/var/lib/gitea-runner/action-cache-dir";
+            };
+          };
+          hostPackages = with pkgs; [
+            bash
+            coreutils
+            curl
+            direnv
+            gawk
             just
+            git-lfs
+            isort
+            gitFull
+            gnused
+            ncdu
+            nixVersions.stable
+            nodejs
+            openssh
+            wget
+          ];
+        };
+      };
+
+      launchd.daemons.gitea-runner-nix.serviceConfig.EnvironmentVariables = {
+        XDG_CONFIG_HOME = "/var/lib/gitea-runner";
+        XDG_CACHE_HOME = "/var/lib/gitea-runner/.cache";
+        XDG_RUNTIME_DIR = "/var/lib/gitea-runner/tmp";
+      };
+
+      system.primaryUser = "kat";
+
+      # launchd.daemons.gitea-runner-restarter = {
+      #   serviceConfig = {
+      #     ProgramArguments = [
+      #       "/usr/bin/env"
+      #       "bash"
+      #       "-c"
+      #       ''
+      #         SERVICE_NAME="org.nixos.gitea-runner-nix"
+      #         while true; do
+      #         # Check the second column of launchctl list output for our service
+      #         EXIT_CODE=$(sudo launchctl list | grep "$SERVICE_NAME" | awk '{print $2}')
+      #         if [ -z "$EXIT_CODE" ]; then
+      #         echo "$(date): $SERVICE_NAME is running correctly. Terminating the restarter."
+      #         exit 0
+      #         else
+      #         echo "$(date): $SERVICE_NAME is not running or in error state. Attempting to restart..."
+      #         sudo launchctl bootout system/$SERVICE_NAME 2>/dev/null || true
+      #         sudo launchctl load /Library/LaunchDaemons/$SERVICE_NAME.plist
+      #         sleep 2  # Give the service some time to start
+      #         fi
+      #         done
+      #       ''
+      #     ];
+      #     RunAtLoad = true;
+      #     ThrottleInterval = 300;
+      #   };
+      # };
+
+      launchd.daemons.does-anything-work = {
+        serviceConfig = {
+          ProgramArguments = ["/usr/bin/env" "bash" "-c" "date > /var/log/does-anything-work"];
+          RunAtLoad = true;
+        };
+      };
+
+      nixpkgs.overlays = [(import ../nixos/overlay.nix)];
+      environment.systemPackages = with pkgs; [
+        #python-with-my-packages
+        emacs
+        alejandra
+        cocoapods
+        gitFull
+        just
+        tmux
+        htop
+        nodePackages.prettier
+        nodejs
+        ripgrep
+        slack
+	      claude-code
+        typescript
+        vim
+        yarn
       ];
 
       nixpkgs.config.allowUnfree = true;
 
 
       # Auto upgrade nix package and the daemon service.
-      services.nix-daemon.enable = true;
       launchd.user.envVariables.PATH = config.environment.systemPath;
 
       programs.direnv.enable = true;
@@ -48,31 +143,69 @@
       # Necessary for using flakes on this system.
       nix.settings.experimental-features = "nix-command flakes";
 
-      # Create /etc/zshrc that loads the nix-darwin environment.
-      programs.zsh.enable = true;
 
       # Set Git commit hash for darwin-version.
       system.configurationRevision = self.rev or self.dirtyRev or null;
 
-      # Used for backwards compatibility, please read the changelog before changing.
-      # $ darwin-rebuild changelog
+      # Used for backwards compatibility, please read the changelog before changing
       system.stateVersion = 4;
 
       # The platform the configuration will be used on.
+
       nixpkgs.hostPlatform = "aarch64-darwin";
       users.users.kat.openssh.authorizedKeys.keys = inputs.railbird-secrets.keys.kanivanKeys;
+      users.users.gitea-runner = {
+        name = "gitea-runner";
+        isHidden = false;
+        home = "/Users/gitea-runner";
+        createHome = false;
+      };
+
+      home-manager.useGlobalPkgs = true;      home-manager.useUserPackages = true;
+
+      users.users.kat = {
+        name = "kat";
+        home = "/Users/kat";
+      };
+
+      programs.zsh = {
+        enable = true;
+        shellInit = ''
+          fpath+="${libDir}/functions"
+          for file in "${libDir}/functions/"*
+          do
+          autoload "''${file##*/}"
+          done
+        '';
+        interactiveShellInit = ''
+          # eval "$(register-python-argcomplete prb)"
+          # eval "$(register-python-argcomplete prod-prb)"
+          # eval "$(register-python-argcomplete railbird)"
+          # [ -n "$EAT_SHELL_INTEGRATION_DIR" ] && source "$EAT_SHELL_INTEGRATION_DIR/zsh"
+
+          autoload -Uz bracketed-paste-magic
+          zle -N bracketed-paste bracketed-paste-magic
+        '';
+      };
+
+      home-manager.users.kat = {
+        programs.starship = {
+          enable = true;
+        };
+        programs.zsh.enable = true;
+        home.stateVersion = "24.05";
+      };
     };
   in
   {
-    # Build darwin flake using:
-    # $ darwin-rebuild build --flake .#Kats-Mac-mini
-    darwinConfigurations."Kats-Mac-mini" = nix-darwin.lib.darwinSystem {
+    darwinConfigurations."mac-demarco-mini" = nix-darwin.lib.darwinSystem {
       modules = [
+        home-manager.darwinModules.home-manager
         configuration
       ];
     };
 
     # Expose the package set, including overlays, for convenience.
-    darwinPackages = self.darwinConfigurations."Kats-Mac-mini".pkgs;
+    darwinPackages = self.darwinConfigurations."mac-demarco-mini".pkgs;
   };
 }

nix-darwin/gitea-actions-runner.nix

@@ -0,0 +1,176 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.services.gitea-actions-runner;
+
+  settingsFormat = pkgs.formats.yaml {};
+
+  hasDockerScheme = instance:
+    instance.labels == [] || any (label: hasInfix ":docker:" label) instance.labels;
+  wantsContainerRuntime = any hasDockerScheme (attrValues cfg.instances);
+
+  hasHostScheme = instance: any (label: hasSuffix ":host" label) instance.labels;
+
+  tokenXorTokenFile = instance:
+    (instance.token == null && instance.tokenFile != null)
+    || (instance.token != null && instance.tokenFile == null);
+in {
+  options.services.gitea-actions-runner = {
+    package = mkOption {
+      type = types.package;
+      default = pkgs.gitea-actions-runner;
+      defaultText = literalExpression "pkgs.gitea-actions-runner";
+      description = "The gitea-actions-runner package to use.";
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "gitea-runner";
+      description = "The user account under which the Gitea Actions Runner should run.";
+    };
+
+    instances = mkOption {
+      default = {};
+      description = "Gitea Actions Runner instances.";
+      type = types.attrsOf (types.submodule {
+        options = {
+          enable = mkEnableOption "Gitea Actions Runner instance";
+
+          name = mkOption {
+            type = types.str;
+            example = "my-runner";
+            description = "The name identifying the runner instance towards the Gitea/Forgejo instance.";
+          };
+
+          url = mkOption {
+            type = types.str;
+            example = "https://forge.example.com";
+            description = "Base URL of your Gitea/Forgejo instance.";
+          };
+
+          token = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            description = "Plain token to register at the configured Gitea/Forgejo instance.";
+          };
+
+          tokenFile = mkOption {
+            type = types.nullOr (types.either types.str types.path);
+            default = null;
+            description = "Path to a file containing the token to register at the configured Gitea/Forgejo instance.";
+          };
+
+          labels = mkOption {
+            type = types.listOf types.str;
+            default = [];
+            example = ["macos:host" "x86_64:host"];
+            description = "Labels used to map jobs to their runtime environment.";
+          };
+
+          settings = mkOption {
+            description = "Configuration for `act_runner daemon`.";
+            type = types.submodule {
+              freeformType = settingsFormat.type;
+            };
+            default = {};
+          };
+
+          hostPackages = mkOption {
+            type = types.listOf types.package;
+            default = with pkgs; [
+              bash
+              coreutils
+              curl
+              gawk
+              git
+              gnused
+              nodejs
+              wget
+              openssh
+            ];
+            description = "List of packages available to actions when the runner is configured with a host execution label.";
+          };
+        };
+      });
+    };
+  };
+
+  config = mkIf (cfg.instances != {}) {
+    assertions = [
+      {
+        assertion = all tokenXorTokenFile (attrValues cfg.instances);
+        message = "Instances of gitea-actions-runner can have `token` or `tokenFile`, not both.";
+      }
+    ];
+
+    users.users.${cfg.user} = {
+      name = cfg.user;
+      description = "Gitea Actions Runner user";
+    };
+
+    launchd.daemons =
+      (mapAttrs' (
+          name: instance:
+            nameValuePair "gitea-runner-${name}" {
+              serviceConfig = {
+                ProgramArguments = [
+                  "/usr/bin/env"
+                  "bash"
+                  "-c"
+                  ''
+                    cd /var/lib/gitea-runner/${name}
+                    exec ${cfg.package}/bin/act_runner daemon --config ${settingsFormat.generate "config.yaml" instance.settings}
+                  ''
+                ];
+                KeepAlive = true;
+                ThrottleInterval = 5;
+                SessionCreate = true;
+                UserName = cfg.user;
+                GroupName = "staff";
+                WorkingDirectory = "/var/lib/gitea-runner/${name}";
+                EnvironmentVariables = {
+                  PATH = (lib.makeBinPath (instance.hostPackages ++ [cfg.package])) + ":/usr/local/bin:/usr/bin:/usr/sbin:/bin:/sbin";
+                };
+              };
+            }
+        )
+        cfg.instances)
+      // (mapAttrs' (
+          name: instance:
+            nameValuePair "gitea-runner-setup-${name}"
+            {
+              serviceConfig = {
+                EnvironmentVariables =
+                  {}
+                  // optionalAttrs (instance.token != null) {
+                    TOKEN = instance.token;
+                  };
+                RunAtLoad = true;
+                ProgramArguments = [
+                  "${pkgs.writeShellScript "gitea-runner-setup-${name}" ''
+                    mkdir -p /var/lib/gitea-runner/${name}
+                    cd /var/lib/gitea-runner/${name}
+                    if [ ! -e "/var/lib/gitea-runner/${name}/.runner" ]; then
+                        ${cfg.package}/bin/act_runner register --no-interactive \
+                        --instance ${escapeShellArg instance.url} \
+                        --token "$TOKEN" \
+                        --name ${escapeShellArg instance.name} \
+                        --labels ${escapeShellArg (concatStringsSep "," instance.labels)} \
+                        --config ${settingsFormat.generate "config.yaml" instance.settings}
+                    fi
+
+                    # Start the runner
+                    chown -R ${cfg.user} /var/lib/gitea-runner
+                    chown -R ${cfg.user} /var/log/gitea-runner
+                  ''}"
+                ];
+              };
+            }
+        )
+        cfg.instances);
+  };
+}

nixos/base.nix

@@ -1,12 +1,13 @@
 { config, pkgs, forEachUser, makeEnable, realUsers, ... }:
-makeEnable config "modules.base" true {
+makeEnable config "myModules.base" true {
   nixpkgs.config.permittedInsecurePackages = [
-    "openssl-1.0.2u"
     "electron-12.2.3"
-    "etcher"
     "electron-19.1.9"
-    "openssl-1.1.1w"
+    "electron-32.3.3"
+    "etcher"
     "nix-2.16.2"
+    "openssl-1.0.2u"
+    "openssl-1.1.1w"
   ];
 
   # Disabling these waits disables the stuck on boot up issue
@@ -29,14 +30,26 @@ makeEnable config "modules.base" true {
   '';
 
   networking.firewall.enable = false;
+  networking.nameservers = [ "8.8.8.8" "8.8.4.4" ];
   networking.networkmanager = {
     enable = true;
-    enableStrongSwan = true;
     plugins = [ pkgs.networkmanager-l2tp pkgs.networkmanager-openvpn ];
   };
+  networking.resolvconf.enable = false;
+  services.mullvad-vpn.enable = true;
 
   # Audio
-  hardware.pulseaudio.enable = true;
+
+  services.pulseaudio.enable = true;
+  services.pipewire = {
+    enable = false;
+    systemWide = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    jack.enable = true;
+    pulse.enable = true;
+  };
+
 
   # Bluetooth
   hardware.bluetooth.enable = true;
@@ -52,7 +65,7 @@ makeEnable config "modules.base" true {
     defaultLocale = "en_US.UTF-8";
   };
 
-  # Update timezone automatically
+  # # Update timezone automatically
   services.tzupdate.enable = true;
 
   # TODO: Add a comment explaining what this does.
@@ -60,6 +73,13 @@ makeEnable config "modules.base" true {
 
   virtualisation.docker.enable = true;
 
+  virtualisation.podman = {
+    enable = true;
+    autoPrune = {
+      enable = true;
+    };
+  };
+
   hardware.keyboard.zsa.enable = true;
 
   services.logind.extraConfig = "RuntimeDirectorySize=5G";
@@ -70,5 +90,5 @@ makeEnable config "modules.base" true {
   programs.dconf.enable = true;
 
   home-manager.users = forEachUser (import ./home-manager.nix);
-  nix.settings.trusted-users = realUsers;
+  nix.settings.trusted-users = realUsers ++ ["gitea-runner"];
 }

nixos/ben.nix

@@ -1,5 +1,5 @@
 { pkgs, inputs, config, makeEnable, ... }:
-makeEnable config "modules.ben" true {
+makeEnable config "myModules.ben" true {
   home-manager.backupFileExtension = "backup"; # Add this line
   home-manager.users.ben = {
     programs.zsh = {

nixos/bootstrap.nix

@@ -1,4 +1,4 @@
-{ pkgs, config, lib, ... }:
+{ pkgs, ... }:
 {
   imports = [
     ./essential.nix
@@ -21,7 +21,7 @@
     enable = true;
     layout = "us";
     desktopManager = {
-      plasma5.enable = true;
+      plasma6.enable = true;
     };
     displayManager = {
       sddm = {
@@ -36,7 +36,7 @@
       '';
     };
   };
-  nix = rec {
+  nix = {
     extraOptions = ''
       experimental-features = nix-command flakes
     '';

nixos/cache-server.nix

@@ -1,10 +1,10 @@
 { config, lib, ... }:
 with lib;
-let cfg = config.modules.cache-server;
+let cfg = config.myModules.cache-server;
 in
 {
   options = {
-    modules.cache-server = {
+    myModules.cache-server = {
       enable = mkEnableOption "nix cache server";
       port = mkOption {
         type = types.int;

nixos/code.nix

@@ -1,11 +1,22 @@
 { pkgs, config, makeEnable, ... }:
-makeEnable config "modules.code" true {
+makeEnable config "myModules.code" true {
   programs.direnv = {
     enable = true;
     nix-direnv.enable = true;
   };
 
   environment.systemPackages = with pkgs; [
+    # LLM Tools
+    claude-code
+    codex
+
+    # MCP
+    github-mcp-server
+    gitea-mcp-server
+    mcp-nixos
+    playwright-mcp
+    mcp-language-server
+
     # C
     clang
 
@@ -24,6 +35,8 @@ makeEnable config "modules.code" true {
     # Node
     nodePackages.npm
     nodejs
+    yarn
+    prettier
 
     # Typescript
     typescript
@@ -43,8 +56,13 @@ makeEnable config "modules.code" true {
     ruby
 
     # python
-    poetry
     black
+    poetry
+    uv
+
+    # kotlin
+    kotlin
+    kotlin-language-server
 
     # dhall
     haskellPackages.dhall

nixos/configuration.nix

@@ -17,12 +17,17 @@
     ./gitea-runner.nix
     ./gitea.nix
     ./gnome.nix
+    ./home-assistant.nix
     ./imalison.nix
     ./internet-computer.nix
+    ./k3s.nix
     ./kat.nix
     ./keybase.nix
+    ./kubelet.nix
+    ./laptop.nix
     ./nix.nix
     ./nixified.ai.nix
+    ./nvidia.nix
     ./options.nix
     ./plasma.nix
     ./postgres.nix
@@ -30,10 +35,12 @@
     ./secrets.nix
     ./ssh.nix
     ./syncthing.nix
+    ./tts.nix
     ./user-specific.nix
     ./users.nix
     ./vscode.nix
     ./wsl.nix
+    ./wyoming.nix
     ./xmonad.nix
   ];
 
@@ -42,17 +49,16 @@
   };
 
   config = lib.mkIf config.features.full.enable {
-    modules.base.enable = true;
-    modules.desktop.enable = true;
-    modules.plasma.enable = true;
-    modules.gnome.enable = false;
-    modules.xmonad.enable = true;
-    modules.extra.enable = true;
-    modules.electron.enable = true;
-    modules.code.enable = true;
-    modules.games.enable = true;
-    modules.syncthing.enable = true;
-    modules.fonts.enable = true;
-    modules.nixified-ai.enable = false;
+    myModules.base.enable = true;
+    myModules.desktop.enable = true;
+    myModules.plasma.enable = true;
+    myModules.gnome.enable = false;
+    myModules.xmonad.enable = true;
+    myModules.extra.enable = true;
+    myModules.electron.enable = true;
+    myModules.code.enable = true;
+    myModules.games.enable = false;
+    myModules.syncthing.enable = true;
+    myModules.fonts.enable = true;
   };
 }

nixos/desktop.nix

@@ -1,5 +1,5 @@
-{ config, pkgs, makeEnable, ... }:
-makeEnable config "modules.desktop" true {
+{ inputs, config, pkgs, makeEnable, ... }:
+makeEnable config "myModules.desktop" true {
   imports = [
     ./fonts.nix
   ];
@@ -21,6 +21,8 @@ makeEnable config "modules.desktop" true {
     };
   };
 
+  programs.hyprland.enable = true;
+
   services.autorandr = {
     enable = true;
   };
@@ -32,6 +34,8 @@ makeEnable config "modules.desktop" true {
 
   services.gnome.gnome-keyring.enable = true;
 
+  # Visual notification manager
+
   environment.systemPackages = with pkgs; [
     # Appearance
     adwaita-icon-theme
@@ -54,44 +58,48 @@ makeEnable config "modules.desktop" true {
     # Desktop
     alacritty
     blueman
-    clipit
+    # clipit
     d-spy
-    dolphin
+    kdePackages.dolphin
+    # inputs.ghostty.packages."${system}".default
 
     feh
     firefox
     cheese
     gpaste
-    kleopatra
+    kdePackages.kleopatra
     libnotify
     libreoffice
     lxappearance
     lxqt.lxqt-powermanagement
     networkmanagerapplet
-    notify-osd-customizable
-    okular
+    kdePackages.okular
     pinentry
-    psensor
+    # mission-center
     quassel
     remmina
     rofi
+    wofi
     rofi-pass
     rofi-systemd
-    shutter
     simplescreenrecorder
     skippy-xd
     synergy
-    transmission_3-gtk
+    # TODO: reenable
+    # transmission_3-gtk
     vlc
-    volnoti
     xfce.thunar
 
     # Audio
     picard
+    pavucontrol
     playerctl
     pulsemixer
     espeak
 
+    #
+    brightnessctl
+
     # Visualization
     graphviz
     nodePackages.mermaid-cli

nixos/electron.nix

@@ -1,5 +1,5 @@
 { pkgs, config, makeEnable, forEachUser, ... }:
-makeEnable config "modules.electron" false {
+makeEnable config "myModules.electron" false {
   environment.systemPackages = with pkgs; [
     element-desktop
     # bitwarden

nixos/essential.nix

@@ -21,6 +21,7 @@
     gawk
     gcc
     gdb
+    gh
     git-fame
     git-lfs
     git-sync
@@ -47,10 +48,12 @@
     patchelf
     pciutils
     pstree
+    pulseaudio
     python-with-my-packages
     rclone
     rcm
     ripgrep
+    runc
     silver-searcher
     skim
     sshfs
@@ -61,6 +64,7 @@
     unzip
     usbutils
     wget
+    xkcdpass
     yubikey-manager
   ];
 }

nixos/extra.nix

@@ -1,6 +1,5 @@
 { config, pkgs, makeEnable, ... }:
-makeEnable config "modules.extra" false {
-  services.expressvpn.enable = true;
+makeEnable config "myModules.extra" false {
   programs.hyprland.enable = true;
 
   environment.systemPackages = with pkgs; [
@@ -10,7 +9,6 @@ makeEnable config "modules.extra" false {
     asciidoctor
     roomeqwizard
     razergenie
-    expressvpn
     signal-desktop
     gource
     gimp

nixos/flake.nix

@@ -1,19 +1,45 @@
 {
   inputs = {
-    railbird-secrets = {
-      url = "git+ssh://gitea@dev.railbird.ai:1123/railbird/secrets-flake.git";
-    };
-    nixos-hardware = { url = "github:colonelpanic8/nixos-hardware/add-g834jzr"; };
-
     nixpkgs = {
       url = "github:NixOS/nixpkgs/nixos-unstable";
     };
 
-    home-manager = {
-      url = "github:nix-community/home-manager";
+    flake-utils = {
+      url = "github:numtide/flake-utils";
+      inputs.systems.follows = "systems";
+    };
+
+    systems = { url = "github:nix-systems/default"; };
+
+    git-ignore-nix = {
+      url = "github:hercules-ci/gitignore.nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    home-manager = {
+      url = "github:nix-community/home-manager/master";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    nixos-hardware = { url = "github:colonelpanic8/nixos-hardware/my-master"; };
+
+    nixos-wsl = { url = "github:nix-community/NixOS-WSL"; };
+
+    agenix = { url = "github:ryantm/agenix"; };
+
+    railbird-secrets = {
+      url = "git+ssh://gitea@dev.railbird.ai:1123/railbird/secrets-flake.git";
+    };
+
+    xmonad = {
+      url = "github:xmonad/xmonad";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        flake-utils.follows = "flake-utils";
+        git-ignore-nix.follows = "git-ignore-nix";
+      };
+    };
+
     xmonad-contrib = {
       url = "github:IvanMalison/xmonad-contrib/withMyChanges";
       inputs = {
@@ -24,35 +50,21 @@
       };
     };
 
-    xmonad = {
-      url = "github:xmonad/xmonad";
-      inputs = {
-        nixpkgs.follows = "nixpkgs";
-        flake-utils.follows = "flake-utils";
-        git-ignore-nix.follows = "git-ignore-nix";
-      };
-    };
-
     taffybar = {
-      url = "github:taffybar/taffybar";
+      url = "github:taffybar/taffybar/old-master";
       inputs = {
         nixpkgs.follows = "nixpkgs";
-        flake-utils.follows = "flake-utils";
-        git-ignore-nix.follows = "git-ignore-nix";
-        xmonad.follows = "xmonad";
-        gtk-sni-tray.follows = "gtk-sni-tray";
-        gtk-strut.follows = "gtk-strut";
       };
     };
 
     imalison-taffybar = {
       url = "path:../dotfiles/config/taffybar";
-      inputs = {
-        nixpkgs.follows = "nixpkgs";
-        flake-utils.follows = "flake-utils";
-        xmonad.follows = "xmonad";
-        taffybar.follows = "taffybar";
-      };
+      # inputs = {
+      #   nixpkgs.follows = "nixpkgs";
+      #   flake-utils.follows = "flake-utils";
+      #   xmonad.follows = "xmonad";
+      #   taffybar.follows = "taffybar";
+      # };
     };
 
     notifications-tray-icon = {
@@ -62,18 +74,6 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    flake-utils = {
-      url = "github:numtide/flake-utils";
-      inputs.systems.follows = "systems";
-    };
-
-    systems = { url = "github:nix-systems/default"; };
-
-    git-ignore-nix = {
-      url = "github:hercules-ci/gitignore.nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     gtk-sni-tray = {
       url = "github:taffybar/gtk-sni-tray";
       inputs = {
@@ -104,17 +104,13 @@
 
     vscode-server.url = "github:nix-community/nixos-vscode-server";
 
-    nixpkgs-regression = { url = "github:NixOS/nixpkgs"; };
-
     nixified-ai = { url = "github:nixified-ai/flake"; };
 
-    nixos-wsl = { url = "github:nix-community/NixOS-WSL"; };
-
-    agenix.url = "github:ryantm/agenix";
+    nixtheplanet.url = "github:matthewcroughan/nixtheplanet";
   };
 
   outputs = inputs@{
-    self, nixpkgs, nixos-hardware, home-manager, taffybar, xmonad,
+    self, nixpkgs, nixos-hardware, home-manager, taffybar, xmonad, nixtheplanet,
     xmonad-contrib, notifications-tray-icon, nix, agenix, imalison-taffybar, ...
   }:
   let
@@ -126,7 +122,7 @@
       name = machineNameFromFilename filename;
       value = {
         modules = [
-          (machinesFilepath + ("/" + filename)) agenix.nixosModules.default
+          (machinesFilepath + ("/" + filename)) agenix.nixosModules.default nixtheplanet.nixosModules.macos-ventura
         ];
       };
     };
@@ -141,14 +137,44 @@
       };
     };
     mkConfig =
-      args@
       { system ? "x86_64-linux"
       , baseModules ? []
       , modules ? []
       , specialArgs ? {}
       , ...
       }:
-    nixpkgs.lib.nixosSystem (args // {
+    let
+      # Bootstrap nixpkgs for this specific system
+      bootstrapPkgs = import nixpkgs {
+        inherit system;
+        config = {};
+        overlays = [];
+      };
+      # Apply patches to nixpkgs source
+      patchedSource = bootstrapPkgs.applyPatches {
+        name = "nixpkgs-patched";
+        src = nixpkgs;
+        patches = [
+          # Rumno service PR
+          (bootstrapPkgs.fetchpatch {
+            url = "https://github.com/NixOS/nixpkgs/pull/433540.patch";
+            hash = "sha256-G4eJaX351/HMB0z4QNfgob+bVuqCcTEMGE7IPNcIGbw=";
+          })
+          # git-sync-rs package
+          (bootstrapPkgs.fetchpatch {
+            url = "https://patch-diff.githubusercontent.com/raw/NixOS/nixpkgs/pull/434160.patch";
+            hash = "sha256-1xm75lWEKWbX0qsbeXWX3lRRZIFO3/sdrZZYJxKGD2o=";
+          })
+          (bootstrapPkgs.fetchpatch {
+            url = "https://patch-diff.githubusercontent.com/raw/NixOS/nixpkgs/pull/436061.patch";
+            hash = "sha256-HZquaNBB+w5Hm5kdzvaGg7QAOgAf/EPBO7o7pKkIrMY=";
+          })
+        ];
+      };
+      # Get eval-config from patched source
+      evalConfig = import "${patchedSource}/nixos/lib/eval-config.nix";
+    in
+    evalConfig {
       inherit system;
       modules = baseModules ++ modules;
       specialArgs = rec {
@@ -166,7 +192,7 @@
         mapAllKeysToValue = keys: value: builtins.listToAttrs (map (name: { inherit name value; }) keys);
         forEachUser = mapAllKeysToValue realUsers;
       } // specialArgs;
-    });
+    };
   in
   {
     nixConfig = {

nixos/fonts.nix

@@ -1,5 +1,5 @@
 { pkgs, makeEnable, config, ... }:
-makeEnable config "modules.fonts" true {
+makeEnable config "myModules.fonts" true {
   # Enable the gtk icon cache
   gtk.iconCache.enable = true;
 
@@ -21,13 +21,10 @@ makeEnable config "modules.fonts" true {
       source-sans-pro
       source-serif-pro
       twemoji-color-font
-      (nerdfonts.override { fonts = [
-        "JetBrainsMono"
-        "FantasqueSansMono"
-        "Iosevka"
-        "VictorMono"
-        "SourceCodePro"
-      ]; })
+      nerd-fonts.jetbrains-mono
+      nerd-fonts.fantasque-sans-mono
+      nerd-fonts.iosevka
+      nerd-fonts.victor-mono
     ];
     fontconfig = {
       hinting.autohint = true;
@@ -35,7 +32,7 @@ makeEnable config "modules.fonts" true {
       allowBitmaps = true;
       useEmbeddedBitmaps = true;
       defaultFonts = {
-        monospace = [ "Source Code Pro" ];
+        monospace = [ "JetBrains Mono" ];
         sansSerif = [ "Roboto" ];
         serif     = [ "Source Serif Pro" ];
       };

nixos/games.nix

@@ -1,11 +1,8 @@
 { config, pkgs, makeEnable, ... }:
-makeEnable config "modules.games" false {
+makeEnable config "myModules.games" false {
   environment.systemPackages = with pkgs; [
     steam
-    # heroic
-  ];
-  boot.extraModulePackages = with pkgs; [
-    xboxdrv
+    heroic
   ];
   hardware.xone.enable = true;
 }

nixos/git-sync.nix

@@ -1,7 +1,8 @@
-{ ... }: {
+{ pkgs, ... }: {
   home-manager.users.imalison = ({ config, ... }: {
     services.git-sync = {
       enable = true;
+      package = pkgs.git-sync-rs;
       repositories = {
         config = {
           path = config.home.homeDirectory + "/config";
@@ -18,7 +19,7 @@
         };
         katnivan = {
           path = config.home.homeDirectory + "/katnivan";
-          uri = "ssh://gitea@1896Folsom.duckdns.org:1123/colonelpanic/katnivan.git";
+          uri = "ssh://gitea@dev.railbird.ai:1123/colonelpanic/katnivan.git";
           interval = 30;
         };
       };

nixos/gitea-runner.nix

@@ -1,7 +1,7 @@
 { pkgs, config, makeEnable, ... }:
-makeEnable config "modules.gitea-runner" false {
+makeEnable config "myModules.gitea-runner" false {
   age.secrets.gitea-runner-token = {
-    file = ./secrets/gitea-runner-token.${config.networking.hostName}.age;
+    file = ./secrets/gitea-runner-token.age;
     group = "docker";
   };
 
@@ -21,16 +21,17 @@ makeEnable config "modules.gitea-runner" false {
       };
       hostPackages = with pkgs; [
         bash
-        direnv
         coreutils
         curl
+        direnv
+        docker
         gawk
         git-lfs
-        nixFlakes
         gitFull
         gnused
+        just
+        nixVersions.stable
         nodejs
-        docker
         openssh
         wget
       ];

nixos/gitea.nix

@@ -1,5 +1,5 @@
 { config, makeEnable, ... }:
-makeEnable config "modules.gitea" false {
+makeEnable config "myModules.gitea" false {
 
   services.gitea = {
     enable = true;
@@ -8,6 +8,9 @@ makeEnable config "modules.gitea" false {
       enable = true;
       interval = "23:05";
     };
+    settings.service = {
+      DISABLE_REGISTRATION = true;
+    };
     settings.server = {
       DOMAIN = "dev.railbird.ai";
       SSH_PORT = 1123;

nixos/gnome.nix

@@ -1,5 +1,5 @@
 { config, makeEnable, ... }:
-makeEnable config "modules.gnome" false {
+makeEnable config "myModules.gnome" false {
   services.xserver = {
     desktopManager.gnome.enable = true;
     displayManager.gdm.enable = true;

nixos/home-assistant.nix

@@ -0,0 +1,119 @@
+{ pkgs, config, lib, makeEnable, realUsers, ... }:
+makeEnable config "myModules.home-assistant" false {
+  boot.kernel.sysctl = {
+    # For all interfaces (e.g. if you want to accept RA on all):
+    "net.ipv6.conf.all.accept_ra" = lib.mkForce "1";
+    "net.ipv6.conf.all.accept_ra_rt_info_max_plen" = lib.mkForce "64";
+    "net.ipv6.conf.default.accept_ra" = lib.mkForce "1";
+    "net.ipv6.conf.default.accept_ra_rt_info_max_plen" = lib.mkForce "64";
+    "net.ipv6.conf.wlo1.accept_ra" = lib.mkForce "1";
+    "net.ipv6.conf.wlo1.accept_ra_rt_info_max_plen" = lib.mkForce "64";
+
+    # Ensure forwarding is off on all interfaces unless needed
+    "net.ipv6.conf.all.forwarding" = lib.mkForce "0";
+  };
+
+  # services.matter-server = {
+  #   enable = true;
+  #   logLevel = "debug";
+  #   extraArgs = let cert-dir = pkgs.fetchFromGitHub {
+  #     repo = "connectedhomeip";
+  #     owner = "project-chip";
+  #     rev = "6e8676be6142bb541fa68048c77f2fc56a21c7b1";
+  #     hash = "sha256-QwPKn2R4mflTKMyr1k4xF04t0PJIlzNCOdXEiQwX5wk=";
+  #   }; in
+  #   [
+  #     # "--bluetooth-adapter=0"
+  #     "--paa-root-cert-dir=${cert-dir}/credentials/production/paa-root-certs"
+  #     "--enable-test-net-dcl"
+  #     "--ota-provider-dir=/var/lib/matter-server/ota-provider"
+  #   ];
+  # };
+
+  # age.secrets.google-service-account = {
+  #   file = ../secrets/google-assistant-integration-service-key.age;
+  #   owner = "hass";
+  # };
+
+  age.secrets.zwave-js-config-filepath = {
+    file = ./secrets/zwave-js.json.age;
+    owner = "imalison";
+    group = "users";
+    mode = "777";
+  };
+
+  services.zwave-js = {
+    enable = true;
+    serialPort = "/dev/serial/by-id/usb-Silicon_Labs_Zooz_ZST10_700_Z-Wave_Stick_fec41d5809caec11843b63a341be1031-if00-port0";
+    secretsConfigFile = config.age.secrets.zwave-js-config-filepath.path;
+  };
+
+  systemd.services.zwave-js = {
+    serviceConfig = {
+      # DynamicUser = lib.mkForce false;
+    };
+  };
+
+  services.zwave-js-ui = {
+    enable = true;
+    serialPort = "/dev/serial/by-id/usb-Silicon_Labs_Zooz_ZST10_700_Z-Wave_Stick_fec41d5809caec11843b63a341be1031-if00-port0";
+    settings = {
+      HOST = "::";
+      PORT = "8091";
+    };
+  };
+
+  services.home-assistant = {
+    enable = true;
+    extraComponents = [
+      "anthropic"
+      "cast"
+      "dlna_dmr"
+      "esphome"
+      "google_assistant"
+      "google_translate"
+      "homeassistant_hardware"
+      "homeassistant_sky_connect"
+      "homekit_controller"
+      "hue"
+      "ibeacon"
+      "isal"
+      "kef"
+      "kegtron"
+      "matter"
+      "met"
+      "opensky"
+      "otbr"
+      "piper"
+      "radio_browser"
+      "roomba"
+      "spotify"
+      "samsungtv"
+      "thread"
+      "wake_word"
+      "webostv"
+      "whisper"
+      "wyoming"
+      "yale"
+      "zwave_js"
+    ];
+    extraPackages = python3Packages: with python3Packages; [
+      numpy
+      python-matter-server
+      universal-silabs-flasher
+    ];
+    config = {
+      http = {
+        use_x_forwarded_for = true;
+        trusted_proxies = ["0.0.0.0" "127.0.0.1" "::1" "192.168.50.1"];
+      };
+      # google_assistant = {
+      #   project_id = "canyon-run-b104-home-assistant";
+      #   service_account = "!include ${config.age.secrets.google-service-account.path}";
+      #   report_state = true;
+      #   exposed_domains = ["switch" "light"];
+      # };
+      default_config = {};
+    };
+  };
+}

nixos/justfile

@@ -2,7 +2,7 @@ switch *args:
 	sudo nixos-rebuild switch --flake '.#' --impure {{args}}
 
 fix-local-path-issue:
-	nix flake lock --update-input imalison-taffybar
+	nix flake update imalison-taffybar
 
 
 expire-home-manager-generations:

nixos/k3s.nix

@@ -0,0 +1,165 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.myModules.railbird-k3s;
+  mount-path = "/var/lib/railbird/bucket";
+  bucket-name = "railbird-dev-videos";
+  plugins-path = pkgs.buildEnv {
+    name = "combined-cni-plugins";
+    paths = [
+      pkgs.cni-plugins
+      pkgs.calico-cni-plugin
+      pkgs.calico-kube-controllers
+      pkgs.cni-plugin-flannel
+    ];
+  };
+in {
+  options = {
+    myModules.railbird-k3s = {
+      enable = mkEnableOption "railbird k3s";
+      serverAddr = mkOption {
+        type = lib.types.str;
+        default = "";
+      };
+      extraFlags = mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [];
+      };
+    };
+  };
+  config = mkIf cfg.enable {
+    age.secrets."1896Folsom-k3s-token.age".file = ./secrets/1896Folsom-k3s-token.age;
+    age.secrets."k3s-registry.yaml.age".file = ./secrets/k3s-registry.yaml.age;
+    age.secrets.api-service-key = {
+      file = ./secrets/api_service_account_key.json.age;
+      owner = "railbird";
+      group = "users";
+    };
+    environment.etc."rancher/k3s/registries.yaml".source = config.age.secrets."k3s-registry.yaml.age".path;
+    services.dockerRegistry = {
+      enable = true;
+      listenAddress = "0.0.0.0";
+      port = 5279;
+      enableDelete = true;
+      enableGarbageCollect = true;
+    };
+
+    virtualisation.containerd = {
+      enable = true;
+      settings = {
+        plugins."io.containerd.cri.v1.runtime" = {
+          enable_cdi = true;
+          cdi_spec_dirs = [ "/var/run/cdi" ];
+        };
+        plugins."io.containerd.grpc.v1.cri" = {
+          enable_cdi = true;
+          cdi_spec_dirs = [ "/var/run/cdi" ];
+          cni.bin_dir = "${plugins-path}/bin";
+        };
+      };
+    };
+
+    hardware.nvidia-container-toolkit.enable = true;
+    virtualisation.containers = {
+      containersConf.cniPlugins = [
+        pkgs.cni-plugins
+        pkgs.calico-cni-plugin
+        pkgs.calico-kube-controllers
+        pkgs.cni-plugin-flannel
+      ];
+    };
+
+    systemd.services = {
+      nvidia-container-toolkit-cdi-generator = {
+        # Even with `--library-search-path`, `nvidia-ctk` won't find the libs
+        # unless I bodge their path into the environment.
+        environment.LD_LIBRARY_PATH = "${config.hardware.nvidia.package}/lib";
+      };
+    };
+
+    systemd.services.mount-railbird-bucket = {
+      after = ["agenix.service"];
+      wantedBy = [ "multi-user.target" ];
+      description = "Mount railbird bucket";
+      serviceConfig = {
+        Type = "simple";
+        RemainAfterExit = true;
+        Restart = "on-failure";  # Restart the service on failure
+        RestartSec = 5;  # Wait 5 seconds before restarti
+        TimeoutStopSec = 2;
+        ExecStartPre = [
+          "-${pkgs.util-linux}/bin/umount -f ${mount-path}"
+          "${pkgs.coreutils}/bin/mkdir -p ${mount-path}"
+          "${pkgs.coreutils}/bin/chown railbird:users ${mount-path}"
+          "${pkgs.coreutils}/bin/chmod 0775 ${mount-path}"
+        ];
+        ExecStart = let
+          key-file = config.age.secrets.api-service-key.path;
+        in
+        pkgs.writeShellScript "mount-railbird-bucket" ''
+            while true; do
+            if ${pkgs.util-linux}/bin/mount | grep -q "${mount-path}" && [ -d "${mount-path}/dev" ]; then
+            echo "Mount path ${mount-path} is mounted and valid (contains directory 'dev')."
+            else
+            echo "Mount path is not valid or not mounted, attempting remount."
+            ${pkgs.util-linux}/bin/umount -f "${mount-path}" || true
+            ${pkgs.gcsfuse}/bin/gcsfuse --implicit-dirs --key-file "${key-file}" "${bucket-name}" "${mount-path}"
+            fi
+            echo "Sleeping"
+            sleep 30
+            done
+          '';
+        User = "root";
+      };
+    };
+
+    services.k3s = {
+      enable = true;
+      clusterInit = cfg.serverAddr == "";
+      serverAddr = cfg.serverAddr;
+      configPath = pkgs.writeTextFile {
+        name = "k3s-config.yaml";
+        text = ''
+          kubelet-arg:
+          - "eviction-hard=nodefs.available<2Gi"
+          - "eviction-soft=nodefs.available<5Gi"
+          - "eviction-soft-grace-period=nodefs.available=5m"
+        '';
+      };
+      tokenFile = config.age.secrets."1896Folsom-k3s-token.age".path;
+      extraFlags =
+        [
+          "--tls-san ryzen-shine.local"
+          "--tls-san nixquick.local"
+          "--tls-san biskcomp.local"
+          "--tls-san jimi-hendnix.local"
+          "--tls-san dev.railbird.ai"
+          "--node-label nixos-nvidia-cdi=enabled"
+          "--etcd-arg=quota-backend-bytes=8589934592"
+        ]
+        ++ cfg.extraFlags;
+      containerdConfigTemplate = ''
+        {{ template "base" . }}
+
+        plugins."io.containerd.grpc.v1.cri".cdi_spec_dirs = [ "/var/run/cdi" ]
+        plugins."io.containerd.grpc.v1.cri".enable_cdi = true
+
+        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.nvidia]
+        runtime_type = "io.containerd.runc.v2"
+
+        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.nvidia.options]
+        BinaryName = "/run/current-system/sw/bin/nvidia-container-runtime.cdi"
+
+        [debug]
+        level = "trace"
+      '';
+      gracefulNodeShutdown = {
+        enable = true;
+      };
+    };
+  };
+}

nixos/kat.nix

@@ -1,10 +1,11 @@
-{ pkgs, inputs, config, makeEnable, ... }:
-makeEnable config "modules.kat" false {
+{ pkgs, config, makeEnable, ... }:
+makeEnable config "myModules.kat" false {
   environment.systemPackages = with pkgs; [
-    bitwarden
     obsidian
-    obs-studio
-    ffmpeg
+    bitwarden
+    code-cursor
+    obsidian
+    windsurf
   ];
 
   environment.extraInit = ''

nixos/keys.nix

@@ -6,6 +6,8 @@ rec {
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIoHW29TmS5FgK12N+bCXhGWASDdmzqSEA0QxbyGaJ+j nixquick.local"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIaA0tRVTqwBDxY6X03wx+50pbB37y5e8gqFpFMDa/Bj adele.local"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID4j70BoksIEiX+OMBCsSG8wvMIEwoRQf5Gz5ppbm7Iy jimi-hendnix.local"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOYAoN3l15Avweu5fcfcnlRzmFPHtlYIpo02sxBHANZ+ strixy-minaj.local"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFTYwBuQ3CNbkj6gAQ0oqxhPlKZ+X6tUaZotccowzjCW justin-bieber-creek.local"
   ];
   kanivanKeys = [
     "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDUSkj7587e+MAUNyU/KRpw9Vk++53Wv5nB+0V1QgiTO3rMQe6HJt0Tm2wi/o/T8GNjueT2D69YgkqOIF1FQwsj2EFLObcMzeBgs5gTSglqggA2I91BIc1vvgjCDpogOMAzAQGlTxRnqrEXhqG0jJtw8KIzLr9WrvWLdTT4rHtWS8RoOBgkQ8oxbggZ4vtbMBIwoIAYGRr70KBRNCsLTPLa8yEf+DDQxq1entzxSjHXHgyeBSVVpPCrBVmhjandk+lIFInjvAiAE1ZkJHSRccL73ORmgb1crwH7xlD9NwBPmypowMi8UIRMKfL2lNehT0AQIlEAikUBLMDzPIPhnwLZ imalison@ivanm-dfinity-razer.local"
@@ -23,6 +25,8 @@ rec {
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOVGIGnpkU7HNQ/zl/Ffi562M+laWY9/yIjB63BCMiTS kat@nixcomp.local"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO3tlMePru6ZlSuf8yUii3N1dy3WwJnSQAt3EgETkctK kat@jay-lenovo.local"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFrOYD3ReFc2+xFUylBFHREcm1lO7BRJGW5JrOoY3I8s ivanm@strixi-minaj"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINYy93265G59aA1ksckjqlfeHq0vpEpzC8BwqCrpeXdh kat@Kats-Mac-mini.local"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG60q//rVd2JESQT59XLvLdsH9AdYfQXTkXMjx9pH3xp imalison@justin-bieber-creek"
   ];
   deanKeys = [
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICDvbEVL+y7eV4+mtxOuHwyomBBQ6uYMesctstua20+e deanwenstrand@deans-mbp-2.lan"
@@ -38,6 +42,7 @@ rec {
     "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqBnDZXcZIMtOTPxg4pJWyMyNp84kpU2uH88aCkrhMBY2TI4dqAXGY4h1DOyOEyQo9nTgyvdlv4M1Hlp5tzfbuapdTWtt36gb+FKpsTUy8dz45fhKJerUszNbVQ+SpZu4ZFN4Nv9eP3AHO+Mzjcvbf666VMDEzZWu2totd7jxyI9PdK78TD5AOi+kGTtbEgqMpJCcZmJlzJ9NJJ2ejhPCRwcfDrShHcfMeEwWL5MmnzT+WstkRwJAM0f9/ks77jWDnB1Eu55rQykU8zVZ1nz1GiXZcxUpm6B0IRhwn8NGH6nVzSLITtO5eJ7LPQR9XNUODpbrsVGNK6jgGql9gZpYp andy@nixos"
   ];
   willKeys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDqBw9QBC0t1TGu7JdryJ6vX3hkBjNnDLe4GFptN2Y3k willgester@gmail.com"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILgLjW6R+dTEmlUoPfE4GA8gRn93UlcSJqlJP1xw0KWl willgester@gmail.com"
   ];
   loewyKeys = [
@@ -56,6 +61,5 @@ rec {
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAJ6lD0c+frh2vzQjvsrsmJpwM1ovaY59m5NNPml5G+E benjamin.j.corner@gmail.com"
   ];
   interviewKeys = [
-    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDr3Rim92K0aNWh2wCZjZMj927H6NZMvw+Jg5giVEklv/eeXlJn81xm9kFsqWOmN0IyS4X+2V2G/43t4C+REmzMKjkzTu9u6SJi+pC3jdJRm80sJCz2LBdRjPaY3CEubiUdxWvjisE8wUI1YuxxdegJpcemvhZXBfDU+DOqNEtF9KiPhXFMOoGU18k5AqFatdmE4z0H158cc6rCxdEiM8s+H6AJDA+xZSn9BPSx2I/ySRapoN0qJDloV19795ggnegBOjNuGejnKI0RZ8CyTcf1945Yi8/O/i/IChRlxiArjgAbC2DItkQig8YyQYz6WlKE9bwruMqe+8mgBAfuQXH8yTADwD1156VCRGoYAorAz4CLm73oGKtx4pa6WFsklWAIK1UEAhuLT6FKaJ/mmfKxcqdHxj+29FNo3d2Pam/ecFd0aERi5TExH5GKZr+LI7yKQmgk6laiR0n1wZuDwlNN7+69GH+ScxRngGCkc3RdTToqXzEaN3B6EyiAN/sAUgs= finn@LAPTOP-JI7BSSRJ"
   ];
 }

nixos/kubelet-client.crt

@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIIDyTCCAjGgAwIBAgIRAMQBZiVjA5BGSkDldScI9cMwDQYJKoZIhvcNAQELBQAw
+LzEtMCsGA1UEAxMkM2I2N2M2NzgtNzI5My00YTIzLTg3ZWItY2NiMTZjYWFkMzFm
+MB4XDTI0MDkyOTIwNTAzNloXDTI5MDkyODIwNTIzNlowOTEVMBMGA1UEChMMc3lz
+dGVtOm5vZGVzMSAwHgYDVQQDExdzeXN0ZW06bm9kZTpyeXplbi1zaGluZTCCASIw
+DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANIOfbq05IIdgX2jXYLaEt66rkXp
+NlqPNfh6v9nL1Aw6PSM3DEIWXVko8AyduRF4kXNO6xc6l/Rzk03w3qSvJpWpALGD
+JjslgRL4VJWUC6/QydsCO9io7SoUEmXFtDcsW6DftFejosr+56ZnVFrz5MMzfUAL
+Ix6n83NJvXZ8f9oHSX8TFW34ZClLxDq2fprFIs+D2QlFRE50Jr/Q8gPI2OSQDUBW
+DFdQrjt81bLs6doQipUqvHb4/Ms49agHek1ceWIMf+KZWoao5KNQTBe6XL2BUgA/
+MS3ZvQppDDTygA0QkgdtOJyG2lsrAmd7LEXTr9ilsqLV3YQMMKhCifwINa0CAwEA
+AaNWMFQwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMCMAwGA1Ud
+EwEB/wQCMAAwHwYDVR0jBBgwFoAUjvcbOeZ4QIk53EkATOaOFiAZUq0wDQYJKoZI
+hvcNAQELBQADggGBAELWgmdmg9TKjDDqmF6pYr1j43gZYclXW4sB509itSiIeltX
+Isrvn5R5ok0W5Jcl+7QMhpntqIKJi26OqbcdBhqlaVURkBkbrx8aegkWJfPO+Fzz
+NyyiIpk7KQzGy6N5//jfMPZtJfQEQZwMenW0cj7F0QHOdVZy90+JNr2P3uV3Ad7u
+WZuYpbOFjOeQg1hJsX8wEU4KJyptn/kXhM+CqAnQ4S+k2wpjECD8KpWKAmpJWZg0
+RaBPyHZSmWnbXqs4LU6ERaZJxZQG0ODuA18DmGfaAkUUUvE2J0ploc2Y8Xl4zUWW
+Ivwslyx30YO3J9qI30d9tTQw/A0vHCoDNDbCg7lorZqP3TiTG9ANLndPqqg6inYU
+yfj612//JrO8w/4qh7cxR03P35aK0paLC74FaKLtZ5CwPK3BAW/0Zhv5fH4io6hE
+rfJmcjhbKD0Cwr9Dn6wVFz/a33H+0vMohHrVlDk4bSDIymbuJcZpYgR8n5WNQbGu
+nwjiLXCnVxcVjkcj2w==
+-----END CERTIFICATE-----

nixos/kubelet.nix

@@ -0,0 +1,22 @@
+{ config, pkgs, makeEnable, ... }:
+makeEnable config "myModules.kubelet" false {
+  age.secrets."api_service_account_key.json.age".file = ./secrets/api_service_account_key.json.age;
+  services.kubernetes.kubelet = {
+    enable = true;
+    kubeconfig = {
+      server = "https://34.31.205.230";
+      caFile = ./railbird-kubernetes.crt;
+      certFile = ./kubelet-client.crt;
+      keyFile = config.age.secrets."api_service_account_key.json.age".path;
+    };
+    registerNode = true;
+    cni = {
+      packages = [ pkgs.cni-plugins pkgs.calico-cni-plugin ];
+    };
+    extraOpts = ''
+      --fail-swap-on=false
+      # --container-runtime=remote
+      # --container-runtime-endpoint=unix:///run/containerd/containerd.sock
+    '';
+  };
+}

nixos/laptop.nix

@@ -0,0 +1,6 @@
+{ makeEnable, config, ... }:
+makeEnable config "myModules.laptop" true {
+  services.logind = {
+    lidSwitchExternalPower = "ignore";
+  };
+}

nixos/machines/adell.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, inputs, forEachUser, ... }:
+{ lib, pkgs, inputs, forEachUser, ... }:
 
 {
    imports = [
@@ -6,16 +6,24 @@
     inputs.nixos-hardware.nixosModules.dell-xps-17-9700-nvidia
   ];
 
-  modules.base.enable = true;
-  modules.desktop.enable = true;
-  modules.xmonad.enable = true;
-  modules.extra.enable = false;
-  modules.code.enable = true;
-  modules.games.enable = false;
-  modules.syncthing.enable = true;
-  modules.fonts.enable = true;
-  modules.nixified-ai.enable = false;
-  modules.gitea-runner.enable = false;
+  # services.tts.servers.coqui = {
+  #   enable = false;
+  #   useCuda = false;
+  #   port = 11400;
+  # };
+
+  myModules.wyoming.enable = false;
+  myModules.base.enable = true;
+  myModules.desktop.enable = true;
+  myModules.xmonad.enable = true;
+  myModules.extra.enable = false;
+  myModules.code.enable = true;
+  myModules.games.enable = false;
+  myModules.syncthing.enable = true;
+  myModules.fonts.enable = true;
+  myModules.nixified-ai.enable = false;
+  myModules.gitea-runner.enable = false;
+  hardware.nvidia.open = true;
 
   hardware.enableRedistributableFirmware = true;
 
@@ -23,7 +31,7 @@
     android-studio
   ];
 
-  boot.kernelPackages = pkgs.linuxPackages_latest;
+  # boot.kernelPackages = pkgs.linuxPackages_latest;
   boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
@@ -33,7 +41,7 @@
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
-  services.xserver.libinput = {
+  services.libinput = {
     enable = true;
     touchpad.tapping = true;
   };
@@ -59,7 +67,7 @@
 
   swapDevices = [ ];
 
-  networking.hostName = "adele";
+  networking.hostName = "adell";
 
   powerManagement.cpuFreqGovernor = lib.mkDefault "performance";
 

nixos/machines/bencbox.nix

@@ -8,10 +8,10 @@
     sublime
     vlc
   ];
-  modules.desktop.enable = false;
-  modules.plasma.enable = false;
+  myModules.desktop.enable = false;
+  myModules.plasma.enable = false;
   imalison.nixOverlay.enable = false;
-  modules.wsl.enable = true;
+  myModules.wsl.enable = true;
 
   networking.hostName = "bencbox";
 

nixos/machines/biskcomp.nix

@@ -1,4 +1,4 @@
-{ forEachUser, ... }:
+{ pkgs, lib, forEachUser, config, ... }:
 let biskcomp-nginx-hostnames = "192.168.1.44 railbird.ai 1896Folsom.duckdns.org biskcomp.local 0.0.0.0 67.162.131.71";
 in
 {
@@ -13,28 +13,42 @@ in
     extraGroups = ["syncthing"];
   };
 
-  modules.raspberry-pi.enable = true;
-
-  modules.base.enable = true;
-  modules.desktop.enable = true;
-  modules.xmonad.enable = false;
-  modules.extra.enable = false;
-  modules.code.enable = true;
-  modules.games.enable = false;
-  modules.syncthing.enable = true;
-  modules.fonts.enable = true;
-  modules.nixified-ai.enable = false;
-  modules.cache-server = {
+  myModules.home-assistant.enable = true;
+  myModules.raspberry-pi.enable = true;
+  myModules.plasma.enable = false;
+  myModules.base.enable = true;
+  myModules.desktop.enable = false;
+  myModules.xmonad.enable = false;
+  myModules.extra.enable = false;
+  myModules.code.enable = true;
+  myModules.games.enable = false;
+  myModules.syncthing.enable = true;
+  myModules.fonts.enable = true;
+  myModules.nixified-ai.enable = false;
+  myModules.cache-server = {
     enable = false;
     host-string = biskcomp-nginx-hostnames;
     port = 80;
     path = "/nix-cache";
   };
-  modules.gitea.enable = true;
-  modules.gitea-runner.enable = false;
+  myModules.gitea.enable = true;
+  myModules.gitea-runner.enable = false;
+
+  myModules.railbird-k3s = {
+    enable = false;
+    serverAddr = "https://dev.railbird.ai:6443";
+  };
+  services.k3s.disableAgent = true;
+
+  age.secrets.vaultwarden-environment-file = {
+    file = ../secrets/vaultwarden-environment-file.age;
+    owner = "vaultwarden";
+  };
 
   services.vaultwarden = {
     enable = true;
+    backupDir = "/var/backup/vaultwarden";
+    environmentFile = config.age.secrets.vaultwarden-environment-file.path;
     config = {
       ROCKET_ADDRESS = "::1";
       ROCKET_PORT = 8222;
@@ -46,14 +60,62 @@ in
     defaults.email = "IvanMalison@gmail.com";
   };
 
-  # services.nextcloud = {
-  #   enable = true;
-  #   hostName = "nextcloud.railbird.ai";
-  #   config = {
-  #     dbtype = "pgsql";
-  #     database.createLocally = true;
-  #   };
-  # };
+  services.gitlab = {
+    enable = true;
+    databasePasswordFile = pkgs.writeText "dbPassword" "zgvcyfwsxzcwr85l";
+    initialRootPasswordFile = pkgs.writeText "rootPassword" "dakqdvp4ovhksxer";
+    host = "gitlab.railbird.ai";
+    secrets = {
+      secretFile = pkgs.writeText "secret" "Aig5zaic";
+      otpFile = pkgs.writeText "otpsecret" "Riew9mue";
+      dbFile = pkgs.writeText "dbsecret" "we2quaeZ";
+      jwsFile = pkgs.runCommand "oidcKeyBase" {} "${pkgs.openssl}/bin/openssl genrsa 2048 > $out";
+    };
+  };
+
+  age.secrets.discourse-admin-password = {
+    file = ../secrets/discourse-admin-password.age;
+    mode = "770";
+    owner = "discourse";
+    group = "users";
+  };
+
+  age.secrets.discourse-secret-key-base = {
+    file = ../secrets/discourse-secret-key-base.age;
+    group = "users";
+    owner = "discourse";
+  };
+
+  services.discourse = {
+    enable = false;
+    enableACME = true;
+    hostname = "discourse.railbird.ai";
+    admin = {
+      passwordFile = config.age.secrets.discourse-admin-password.path;
+      email = "support@railbird.ai";
+      fullName = "Admin";
+      username = "admin";
+    };
+    secretKeyBaseFile = config.age.secrets.discourse-secret-key-base.path;
+    database.ignorePostgresqlVersion = true;
+  };
+
+  systemd.services.emacs-org-api = {
+    description = "Emacs org api";
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      ExecStart = ''${pkgs.runtimeShell} -l -c "${lib.getExe' pkgs.emacs "emacs"} --load /home/imalison/.emacs.d/org-api.el --daemon=org-api"'';
+      RemainAfterExit = true;
+      Restart = "on-failure";
+      User = "imalison";
+    };
+  };
+
+  age.secrets.org-api-passwords = {
+    file = ../secrets/org-api-passwords.age;
+    owner = "nginx";
+  };
 
   services.nginx = {
     enable = true;
@@ -61,6 +123,23 @@ in
     recommendedGzipSettings = true;
     recommendedTlsSettings = true;
     virtualHosts = {
+      "org-mode.1896Folsom.duckdns.org" = {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          proxyPass = "http://localhost:2025";
+          basicAuthFile = config.age.secrets.org-api-passwords.path;
+          extraConfig = ''
+            add_header 'Access-Control-Allow-Origin' '*' always;
+            add_header 'Access-Control-Allow-Methods' 'POST, PUT, DELETE, GET, PATCH, OPTIONS' always;
+          '';
+        };
+      };
+      "gitlab.railbird.ai" = {
+        enableACME = true;
+        forceSSL = true;
+        locations."/".proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
+      };
       "vaultwarden.railbird.ai" = {
         enableACME = true;
         forceSSL = true;
@@ -68,13 +147,6 @@ in
           proxyPass = "http://[::1]:8222";
         };
       };
-      "cache.railbird.ai" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://192.168.1.20:3090";
-        };
-      };
       "syncthing.railbird.ai" = {
         enableACME = true;
         forceSSL = true;
@@ -107,20 +179,6 @@ in
     fsType = "ext4";
   };
 
-  services.home-assistant = {
-    enable = false;
-    extraComponents = [
-      # Components required to complete the onboarding
-      "met"
-      "radio_browser"
-    ];
-    config = {
-      # Includes dependencies for a basic setup
-      # https://www.home-assistant.io/integrations/default_config/
-      default_config = {};
-    };
-  };
-
   swapDevices = [
     { device = "/swapfile"; size = 8192; } # size is in MiB
   ];

nixos/machines/david-blade.nix

@@ -5,15 +5,15 @@
     ../configuration.nix
   ];
 
-  modules.base.enable = true;
-  modules.desktop.enable = true;
-  modules.xmonad.enable = false;
-  modules.extra.enable = false;
-  modules.code.enable = true;
-  modules.games.enable = false;
-  modules.syncthing.enable = true;
-  modules.fonts.enable = true;
-  modules.nixified-ai.enable = false;
+  myModules.base.enable = true;
+  myModules.desktop.enable = true;
+  myModules.xmonad.enable = false;
+  myModules.extra.enable = false;
+  myModules.code.enable = true;
+  myModules.games.enable = false;
+  myModules.syncthing.enable = true;
+  myModules.fonts.enable = true;
+  myModules.nixified-ai.enable = false;
 
   hardware.enableRedistributableFirmware = true;
 

nixos/machines/dean-zephyrus.nix

@@ -5,10 +5,10 @@
   ];
   services.xserver.enable = true;
   environment.systemPackages = with pkgs; [sublime];
-  modules.desktop.enable = false;
-  modules.plasma.enable = false;
+  myModules.desktop.enable = false;
+  myModules.plasma.enable = false;
   imalison.nixOverlay.enable = false;
-  modules.wsl.enable = true;
+  myModules.wsl.enable = true;
 
   networking.hostName = "dean-zephyrus";
 

nixos/machines/jay-lenovo-wsl.nix

@@ -5,7 +5,7 @@
   ];
 
   imalison.nixOverlay.enable = false;
-  modules.wsl.enable = true;
+  myModules.wsl.enable = true;
 
   networking.hostName = "jay-lenovo-wsl";
 

nixos/machines/jay-lenovo.nix

@@ -5,12 +5,14 @@
     ../configuration.nix
   ];
 
+  myModules.wyoming.enable = true;
   features.full.enable = true;
 
   environment.systemPackages = with pkgs; [
     android-studio
     linuxPackages_latest.perf
     zenmonitor
+    code-cursor
   ];
 
   hardware.enableRedistributableFirmware = true;
@@ -26,8 +28,8 @@
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
-  modules.postgres.enable = true;
-
+  myModules.postgres.enable = true;
+  myModules.kat.enable = true;
   networking.networkmanager.enable = true;
 
   services.xserver = {

nixos/machines/jimi-hendnix.nix

@@ -5,23 +5,23 @@
     ../configuration.nix
   ];
 
-  modules.base.enable = true;
-  modules.desktop.enable = true;
-  modules.xmonad.enable = true;
-  modules.extra.enable = false;
-  modules.code.enable = true;
-  modules.games.enable = false;
-  modules.syncthing.enable = true;
-  modules.fonts.enable = true;
-  modules.nixified-ai.enable = false;
-  modules.gitea-runner.enable = true;
-  modules.postgres.enable = true;
+  myModules.railbird-k3s = {
+    enable = true;
+    serverAddr = "https://ryzen-shine.local:6443";
+  };
+  myModules.base.enable = true;
+  myModules.desktop.enable = true;
+  myModules.xmonad.enable = true;
+  myModules.extra.enable = false;
+  myModules.code.enable = true;
+  myModules.games.enable = false;
+  myModules.syncthing.enable = true;
+  myModules.fonts.enable = true;
+  myModules.gitea-runner.enable = true;
+  myModules.postgres.enable = true;
 
   hardware.enableRedistributableFirmware = true;
-
-  # install nvidia drivers in addition to intel one
-  hardware.opengl.extraPackages = [ pkgs.linuxPackages.nvidia_x11.out ];
-  hardware.opengl.extraPackages32 = [ pkgs.linuxPackages.nvidia_x11.lib32 ];
+  myModules.nvidia.enable = true;
 
   boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "usb_storage" "usbhid" "sd_mod" ];
   boot.kernelModules = [ "kvm-intel" ];

nixos/machines/justin-bieber-creek.nix

@@ -0,0 +1,207 @@
+{ config, lib, pkgs, forEachUser, ... }:
+
+{
+  imports = [
+    ../configuration.nix
+  ];
+
+  services.synergy.server = {
+    enable = true;
+  };
+
+  myModules.fonts.enable = true;
+  myModules.base.enable = true;
+  myModules.desktop.enable = true;
+  myModules.xmonad.enable = true;
+  myModules.wyoming.enable = true;
+
+  networking.enableIPv6 = true;
+
+  services.synergy.client = {
+    enable = true;
+    serverAddress = "strixi-minaj.local:24800";
+  };
+
+  boot.kernel.sysctl = {
+    # For all interfaces (e.g. if you want to accept RA on all):
+    "net.ipv6.conf.all.accept_ra" = lib.mkForce "1";
+    "net.ipv6.conf.all.accept_ra_rt_info_max_plen" = lib.mkForce "64";
+    "net.ipv6.conf.default.accept_ra" = lib.mkForce "1";
+    "net.ipv6.conf.default.accept_ra_rt_info_max_plen" = lib.mkForce "64";
+    "net.ipv6.conf.wlo1.accept_ra" = lib.mkForce "1";
+    "net.ipv6.conf.wlo1.accept_ra_rt_info_max_plen" = lib.mkForce "64";
+
+    # Ensure forwarding is off on all interfaces unless needed
+    "net.ipv6.conf.all.forwarding" = lib.mkForce "0";
+  };
+
+  systemd.services.otbr-agent = {
+    wants = [ "network-online.target" ];
+    after = [ "network-online.target" ];
+  };
+
+  services.openthread-border-router = {
+    enable = true;
+    backboneInterface = "wpan0";
+    logLevel = "debug";
+    radio =  {
+      device = "/dev/serial/by-id/usb-Nabu_Casa_Home_Assistant_Connect_ZBT-1_0cd053abfa38ef119c66e1d154516304-if00-port0";
+      baudRate = 460800;
+      flowControl = true;
+    };
+    web = {
+      listenPort = 8087;
+    };
+    rest = {
+      listenPort = 8089;
+    };
+  };
+
+  services.matter-server = {
+    enable = true;
+    logLevel = "debug";
+    extraArgs = let cert-dir = pkgs.fetchFromGitHub {
+      repo = "connectedhomeip";
+      owner = "project-chip";
+      rev = "6e8676be6142bb541fa68048c77f2fc56a21c7b1";
+      hash = "sha256-QwPKn2R4mflTKMyr1k4xF04t0PJIlzNCOdXEiQwX5wk=";
+    }; in
+    [
+      "--bluetooth-adapter=0"
+      "--paa-root-cert-dir=${cert-dir}/credentials/production/paa-root-certs"
+      "--enable-test-net-dcl"
+      "--ota-provider-dir=/var/lib/matter-server/ota-provider"
+    ];
+  };
+
+  age.secrets.google-service-account = {
+    file = ../secrets/google-assistant-integration-service-key.age;
+    owner = "hass";
+  };
+
+  services.home-assistant = {
+    enable = true;
+    extraComponents = [
+      "anthropic"
+      "cast"
+      "dlna_dmr"
+      "esphome"
+      "google_assistant"
+      "homeassistant_hardware"
+      "homeassistant_sky_connect"
+      "homekit_controller"
+      "ibeacon"
+      "isal"
+      "kef"
+      "kegtron"
+      "matter"
+      "met"
+      "opensky"
+      "otbr"
+      "piper"
+      "radio_browser"
+      "roomba"
+      "samsungtv"
+      "thread"
+      "wake_word"
+      "webostv"
+      "whisper"
+      "wyoming"
+      "yale"
+    ];
+    extraPackages = python3Packages: with python3Packages; [
+      numpy
+      python-matter-server
+      universal-silabs-flasher
+    ];
+    config = {
+      http = {
+        use_x_forwarded_for = true;
+        trusted_proxies = ["0.0.0.0" "127.0.0.1" "::1" "192.168.50.1"];
+      };
+      google_assistant = {
+        project_id = "canyon-run-b104-home-assistant";
+        service_account = "!include ${config.age.secrets.google-service-account.path}";
+        report_state = true;
+        exposed_domains = ["switch" "light"];
+      };
+      default_config = {};
+    };
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "IvanMalison@gmail.com";
+  };
+
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    recommendedGzipSettings = true;
+    recommendedTlsSettings = true;
+
+    virtualHosts = {
+      "homeassistant.canyonrunb104.duckdns.org" = {
+        enableACME = true;
+        addSSL = true;
+        locations."/" = {
+          proxyPass = "http://localhost:8123";
+          extraConfig = ''
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+          '';
+        };
+      };
+      "ha.canyonrunb104.duckdns.org" = {
+        enableACME = true;
+        addSSL = true;
+        locations."/" = {
+          proxyPass = "http://localhost:8123";
+          extraConfig = ''
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+          '';
+        };
+      };
+    };
+  };
+
+  boot.loader.systemd-boot.configurationLimit = 3;
+
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+  boot.loader.systemd-boot.enable = true;
+
+  # Add Intel Wi-Fi firmware
+  hardware.enableRedistributableFirmware = true;
+  hardware.enableAllFirmware = true;
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/453d28a1-26f2-4b25-ac72-c6d301fd0bb8";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/184E-E5E8";
+      fsType = "vfat";
+    };
+
+  swapDevices = [ ];
+
+  networking.hostName = "justin-bieber-creek";
+
+  networking.useDHCP = false;
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+
+  system.stateVersion = "23.05";
+
+  home-manager.users = forEachUser {
+    home.stateVersion = "23.05";
+  };
+}

nixos/machines/nixquick.nix

@@ -4,13 +4,25 @@
     ../configuration.nix
   ];
 
+  services.macos-ventura = {
+    enable = false;
+    openFirewall = true;
+    vncListenAddr = "0.0.0.0";
+  };
+
   features.full.enable = true;
-  modules.cache-server = {
+  myModules.cache-server = {
     enable = true;
     port = 3090;
   };
-  modules.gitea-runner.enable = true;
-  modules.vscode.enable = true;
+  myModules.gitea-runner.enable = true;
+  myModules.vscode.enable = true;
+  myModules.kat.enable = true;
+  myModules.nvidia.enable = true;
+  myModules.railbird-k3s = {
+    enable = true;
+    serverAddr = "https://dev.railbird.ai:6443";
+  };
 
   networking.hostName = "nixquick";
 
@@ -21,15 +33,6 @@
   boot.extraModulePackages = [ ];
   boot.loader.systemd-boot.enable = true;
 
-  # install nvidia drivers in addition to intel one
-  hardware.opengl.extraPackages = [ pkgs.linuxPackages.nvidia_x11.out ];
-  hardware.opengl.extraPackages32 = [ pkgs.linuxPackages.nvidia_x11.lib32 ];
-  services.xserver = {
-    videoDrivers = [ "nvidia" ];
-  };
-
-  hardware.opengl.driSupport32Bit = true;
-
   hardware.nvidia.modesetting.enable = true;
 
   # This also enables v4l2loopback

nixos/machines/railbird-sf.nix

@@ -12,58 +12,37 @@
   boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];
   boot.loader.systemd-boot.enable = true;
+  myModules.postgres.enable = true;
+  features.full.enable = true;
 
-  hardware.opengl.extraPackages = [ pkgs.linuxPackages.nvidia_x11.out ];
-  hardware.opengl.extraPackages32 = [ pkgs.linuxPackages.nvidia_x11.lib32 ];
-  services.xserver = {
-    videoDrivers = [ "nvidia" ];
-  };
-
-  # Enable OpenGL
-  hardware.opengl = {
-    enable = true;
-    driSupport = true;
-    driSupport32Bit = true;
-  };
+  services.k3s.role = "agent";
+  services.k3s.extraFlags = lib.mkForce ["--node-label nixos-nvidia-cdi=enabled"];
 
   hardware.nvidia = {
-
-    # Modesetting is required.
-    modesetting.enable = true;
-
-    # Nvidia power management. Experimental, and can cause sleep/suspend to fail.
     powerManagement.enable = false;
     # Fine-grained power management. Turns off GPU when not in use.
     # Experimental and only works on modern Nvidia GPUs (Turing or newer).
     powerManagement.finegrained = false;
 
-    # Use the NVidia open source kernel module (not to be confused with the
-    # independent third-party "nouveau" open source driver).
-    # Support is limited to the Turing and later architectures. Full list of
-    # supported GPUs is at:
-    # https://github.com/NVIDIA/open-gpu-kernel-modules#compatible-gpus
-    # Only available from driver 515.43.04+
-    # Currently alpha-quality/buggy, so false is currently the recommended setting.
-    open = false;
-
     # Enable the Nvidia settings menu,
     # accessible via `nvidia-settings`.
     nvidiaSettings = true;
-
-    # Optionally, you may need to select the appropriate driver version for your specific GPU.
-    package = config.boot.kernelPackages.nvidiaPackages.stable;
   };
 
   features.full.enable = false;
-  modules.base.enable = true;
-  modules.desktop.enable = true;
-  modules.xmonad.enable = false;
-  modules.gnome.enable = true;
-  modules.code.enable = true;
-  modules.syncthing.enable = true;
-  modules.fonts.enable = true;
-  modules.plasma.enable = false;
-  modules.gitea-runner.enable = true;
+  myModules.base.enable = true;
+  myModules.desktop.enable = true;
+  myModules.xmonad.enable = false;
+  myModules.code.enable = true;
+  myModules.syncthing.enable = true;
+  myModules.fonts.enable = true;
+  myModules.plasma.enable = true;
+  myModules.nvidia.enable = true;
+  myModules.gitea-runner.enable = true;
+  myModules.railbird-k3s = {
+    enable = false;
+    serverAddr = "https://dev.railbird.ai:6443";
+  };
 
   fileSystems."/" =
     { device = "/dev/disk/by-uuid/a317d456-6f84-41ee-a149-8e466e414aae";

nixos/machines/ryzen-shine-original.nix

@@ -0,0 +1,101 @@
+{ lib, pkgs, forEachUser, ... }:
+
+{
+  imports = [
+    ../configuration.nix
+  ];
+
+  features.full.enable = true;
+  myModules.kubelet.enable = false;
+  myModules.nvidia.enable = true;
+  # Needed for now because monitors have different refresh rates
+  myModules.xmonad.picom.vSync.enable = false;
+  myModules.cache-server = {
+    enable = true;
+    port = 3090;
+  };
+  myModules.gitea-runner.enable = true;
+  myModules.postgres.enable = true;
+  myModules.railbird-k3s = {
+    enable = true;
+    # extraFlags = ["--node-taint preferNoSchedule=true:NoSchedule"];
+  };
+
+  boot.loader.systemd-boot.configurationLimit = 5;
+
+  networking.hostName = "ryzen-shine";
+
+  environment.systemPackages = with pkgs; [
+    linuxPackages_latest.perf
+  ];
+
+  boot.initrd.systemd.enable = true;
+  boot.plymouth = {
+    enable = false;
+  };
+
+  services.autorandr = {
+    enable = true;
+  };
+
+  hardware.enableRedistributableFirmware = true;
+
+  networking.interfaces.enp5s0.useDHCP = true;
+  networking.interfaces.wlp4s0.useDHCP = true;
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
+  boot.initrd.luks.devices."cryptroot".device = "/dev/nvme0n1p5";
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
+
+  # install nvidia drivers in addition to intel one
+  hardware.graphics.extraPackages = [ pkgs.linuxPackages.nvidia_x11.out ];
+  hardware.graphics.extraPackages32 = [ pkgs.linuxPackages.nvidia_x11.lib32 ];
+  services.xserver = {
+    videoDrivers = [ "nvidia" ];
+  };
+
+  hardware.nvidia.modesetting.enable = true;
+
+  hardware.graphics.enable32Bit = true;
+
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/356173ab-d076-43e0-aeb6-6a6829c4402b";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/B270-C7E6";
+    fsType = "vfat";
+  };
+
+  fileSystems."/shared" = {
+    device = "/dev/disk/by-uuid/D4009CE8009CD33A";
+    fsType = "ntfs";
+    options = [ "nofail" "uid=0" "gid=users" "umask=002" ];
+  };
+
+  swapDevices = [
+    { device = "/dev/disk/by-uuid/f719b44e-295a-4909-9a60-84f87acb7f77"; }
+  ];
+
+  # nix.settings.maxJobs = lib.mkDefault 16;
+  # High-DPI console
+  console.font = lib.mkDefault "${pkgs.terminus_font}/share/consolefonts/ter-u28n.psf.gz";
+
+  # services.xrdp.enable = true;
+  # services.xrdp.defaultWindowManager = "startplasma-x11";
+  # services.xrdp.openFirewall = true;
+
+  system.stateVersion = "20.03";
+  home-manager.users = forEachUser {
+    home.stateVersion = "21.05";
+  };
+
+  # users.extraUsers.dean.home = "/shared/dean";
+}

nixos/machines/ryzen-shine-wsl.nix

@@ -0,0 +1,24 @@
+{ lib, pkgs, config, inputs, forEachUser, ... }:
+{
+  imports = [
+    ../configuration.nix
+  ];
+  services.xserver.enable = true;
+  environment.systemPackages = with pkgs; [
+    sublime
+    vlc
+  ];
+  myModules.desktop.enable = false;
+  myModules.plasma.enable = false;
+  imalison.nixOverlay.enable = false;
+  myModules.wsl.enable = true;
+
+  networking.hostName = "ryzen-shine-wsl";
+
+  wsl.defaultUser = "imalison";
+  system.stateVersion = "22.05";
+
+  home-manager.users = forEachUser {
+    home.stateVersion = "22.05";
+  };
+}

nixos/machines/ryzen-shine.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, inputs, forEachUser, ... }:
+{ lib, pkgs, forEachUser, ... }:
 
 {
   imports = [
@@ -6,14 +6,23 @@
   ];
 
   features.full.enable = true;
+  myModules.kubelet.enable = false;
+  myModules.nvidia.enable = true;
   # Needed for now because monitors have different refresh rates
-  modules.xmonad.picom.vSync.enable = false;
-  modules.cache-server = {
+  myModules.xmonad.picom.vSync.enable = false;
+  myModules.cache-server = {
     enable = true;
     port = 3090;
   };
-  modules.gitea-runner.enable = true;
-  modules.postgres.enable = true;
+  myModules.gitea-runner.enable = true;
+  myModules.postgres.enable = true;
+  myModules.railbird-k3s = {
+    enable = true;
+    serverAddr = "https://jimi-hendnix.local:6443";
+    # extraFlags = ["--node-taint preferNoSchedule=true:NoSchedule"];
+  };
+  myModules.nixified-ai.enable = true;
+  boot.kernelPackages = pkgs.linuxPackages_latest;
 
   boot.loader.systemd-boot.configurationLimit = 5;
 
@@ -41,15 +50,6 @@
   boot.loader.efi.canTouchEfiVariables = true;
 
   boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
-  boot.initrd.luks.devices."cryptroot".device = "/dev/nvme0n1p5";
-  boot.initrd.kernelModules = [ "dm-snapshot" ];
-
-  # install nvidia drivers in addition to intel one
-  hardware.graphics.extraPackages = [ pkgs.linuxPackages.nvidia_x11.out ];
-  hardware.graphics.extraPackages32 = [ pkgs.linuxPackages.nvidia_x11.lib32 ];
-  services.xserver = {
-    videoDrivers = [ "nvidia" ];
-  };
 
   hardware.nvidia.modesetting.enable = true;
 
@@ -59,25 +59,21 @@
   boot.extraModulePackages = [ ];
 
   fileSystems."/" = {
-    device = "/dev/disk/by-uuid/356173ab-d076-43e0-aeb6-6a6829c4402b";
+    device = "/dev/disk/by-uuid/9bd06145-8151-4f7b-bcfe-f1809e0db1ea";
     fsType = "ext4";
   };
 
   fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/B270-C7E6";
+    device = "/dev/disk/by-uuid/E1E1-909E";
     fsType = "vfat";
   };
 
   fileSystems."/shared" = {
     device = "/dev/disk/by-uuid/D4009CE8009CD33A";
     fsType = "ntfs";
-    options = [ "nofail" ];
+    options = [ "nofail" "uid=0" "gid=users" "umask=002" ];
   };
 
-  swapDevices = [
-    { device = "/dev/disk/by-uuid/f719b44e-295a-4909-9a60-84f87acb7f77"; }
-  ];
-
   # nix.settings.maxJobs = lib.mkDefault 16;
   # High-DPI console
   console.font = lib.mkDefault "${pkgs.terminus_font}/share/consolefonts/ter-u28n.psf.gz";
@@ -91,5 +87,5 @@
     home.stateVersion = "21.05";
   };
 
-  users.extraUsers.dean.home = "/shared/dean";
+  # users.extraUsers.dean.home = "/shared/dean";
 }

nixos/machines/strixi-minaj-wsl.nix

@@ -4,7 +4,7 @@
     ../configuration.nix
   ];
 
-  modules.wsl.enable = true;
+  myModules.wsl.enable = true;
 
   networking.hostName = "strixi-minaj-wsl";
 
@@ -30,5 +30,6 @@
     "electron-19.1.9"
     "openssl-1.1.1w"
     "nix-2.16.2"
+    "electron-32.3.3"
   ];
 }

nixos/machines/strixi-minaj.nix

@@ -6,56 +6,74 @@
     inputs.nixos-hardware.nixosModules.asus-rog-strix-g834jzr
   ];
 
-  modules.base.enable = true;
-  modules.desktop.enable = true;
-  modules.xmonad.enable = true;
-  modules.extra.enable = false;
-  modules.code.enable = true;
-  modules.games.enable = false;
-  modules.syncthing.enable = true;
-  modules.fonts.enable = true;
-  modules.nixified-ai.enable = false;
-  modules.gitea-runner.enable = false;
+  hardware.nvidia.open = true;
+  myModules.base.enable = true;
+  myModules.desktop.enable = true;
+  myModules.xmonad.enable = true;
+  myModules.extra.enable = false;
+  myModules.code.enable = true;
+  myModules.games.enable = false;
+  myModules.syncthing.enable = true;
+  myModules.fonts.enable = true;
+  myModules.gitea-runner.enable = false;
+  myModules.nvidia.enable = true;
+  myModules.electron.enable = true;
+  myModules.wyoming.enable = false;
+  myModules.tts.enable = false;
 
   hardware.enableRedistributableFirmware = true;
+  # nixpkgs.config.cudaSupport = true;
 
   environment.systemPackages = with pkgs; [
     android-studio
   ];
 
+  services.synergy.server = {
+    enable = true;
+    autoStart = true;
+    configFile = ../../dotfiles/synergy.conf;
+  };
+
+  services.matter-server = {
+    enable = true;
+    logLevel = "debug";
+    extraArgs = ["--bluetooth-adapter=0" "--enable-test-net-dcl"];
+  };
+
+  programs.virt-manager.enable = true;
+  virtualisation.libvirtd.enable = true;
+  virtualisation.spiceUSBRedirection.enable = true;
+
   services.xserver.dpi = 96;
-  boot.kernelPackages = pkgs.linuxPackages_testing;
+  boot.kernelPackages = pkgs.linuxPackages_latest;
   boot.initrd.availableKernelModules = [ "vmd" "xhci_pci" "thunderbolt" "nvme" "usbhid" "usb_storage" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
+  boot.initrd.kernelModules = [ "nvidia" "nvidia_drm" "nvidia_uvm" "nvidia_modeset" ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
-  hardware.graphics = {
-    enable = true;
-    enable32Bit = true;
-  };
+  hardware.nvidia.powerManagement.enable = true;
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
   services.asusd.enable = true;
 
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/fc06a54c-cc45-423a-914b-8dfcb5939106";
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/fc06a54c-cc45-423a-914b-8dfcb5939106";
     fsType = "ext4";
   };
 
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/B28A-829A";
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/B28A-829A";
     fsType = "vfat";
   };
 
-  swapDevices =
-    [ { device = "/dev/disk/by-uuid/27f277a0-b552-43a0-904d-625e48922bb9"; }
+  swapDevices = [
+    { device = "/dev/disk/by-uuid/27f277a0-b552-43a0-904d-625e48922bb9"; }
   ];
 
   networking.hostName = "strixi-minaj";
 
   powerManagement.cpuFreqGovernor = lib.mkDefault "performance";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault true;
 
   home-manager.users = forEachUser {
     home.stateVersion = "23.05";

nixos/nix.nix

@@ -1,7 +1,7 @@
 { inputs, specialArgs, config, lib, ... }:
 {
   imports = [
-    inputs.home-manager.nixosModule
+    inputs.home-manager.nixosModules.home-manager
   ];
 
   options = {
@@ -31,10 +31,12 @@
         substituters = [
           "https://cache.nixos.org"
           "https://cuda-maintainers.cachix.org"
+          "https://ai.cachix.org"
         ];
         trusted-public-keys = [
           "cache.railbird.ai:KhnvcouxtIU2zxUcjJsm4bUK3o1S3p8xMf9qfZGF7/A="
           "cuda-maintainers.cachix.org-1:0dq3bujKpuEPMCX6U4WylrUDZ9JyUG0VpVZa7CNfq5E="
+          "ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc="
         ];
         nix-path = nixPath;
       };
@@ -45,6 +47,8 @@
     };
 
     nixpkgs.overlays = [
+      # (import ./nvidia-container-toolkit-overlay.nix)
+      (import ./runc-overlay.nix)
       (import ./overlay.nix)
     ] ++ (if config.imalison.nixOverlay.enable then [ inputs.nix.overlays.default ] else []);
 

nixos/nixified.ai.nix

@@ -1,16 +1,11 @@
 { inputs, config, specialArgs, ... }:
-specialArgs.makeEnable config "modules.nixified-ai" false {
+specialArgs.makeEnable config "myModules.nixified-ai" false {
    imports = [
-    inputs.nixified-ai.nixosModules.invokeai
+     inputs.nixified-ai.nixosModules.comfyui
    ];
 
-  environment.systemPackages = [
-    inputs.nixified-ai.packages.${config.nixpkgs.system}.invokeai-nvidia
-  ];
-
-  services.invokeai = {
-    enable = false;
+   services.comfyui = {
+     enable = true;
      host = "0.0.0.0";
-    package = inputs.nixified-ai.packages.${config.nixpkgs.system}.invokeai-nvidia;
    };
 }

nixos/nvidia-container-toolkit-overlay.nix

@@ -0,0 +1,140 @@
+final: prev: {
+  nvidia-container-toolkit = final.stdenv.mkDerivation {
+    pname = "nvidia-container-toolkit-debug";
+    version = prev.nvidia-container-toolkit.version;
+
+    # This is key: multiple outputs, so you can reference them later as:
+    #   $out   -> for main
+    #   $tools -> for the 'tools' output in your new derivation
+    outputs = [ "out" "tools" ];
+
+    # No source required for a pure wrap
+    src = null;
+    dontUnpack = true;
+    dontPatchShell = true;
+    nativeBuildInputs = [ final.installShellFiles ] ++ final.lib.optionals final.stdenv.hostPlatform.isLinux [ final.makeWrapper ];
+
+    buildInputs = [
+      prev.nvidia-container-toolkit
+      prev.nvidia-container-toolkit.tools
+      final.glibc
+      final.coreutils
+      final.bash
+    ];
+
+    # Create wrapper scripts for each set of binaries
+    buildPhase = ''
+      # --- Wrap binaries from the main output of the original toolkit ---
+      mkdir -p wrapper-out
+      if [ -d "${prev.nvidia-container-toolkit}/bin" ]; then
+      for exe in $(ls ${prev.nvidia-container-toolkit}/bin); do
+      cat > wrapper-out/$exe <<EOF
+      #!${final.bash}/bin/bash
+
+      if [ "\$(id -u)" -eq 0 ]; then
+      mkdir -p /var/log/nvidia-container-toolkit
+      chown root:users /var/log/nvidia-container-toolkit
+      chmod 2777 /var/log/nvidia-container-toolkit
+      fi
+
+      # --- STARTUP LOG ---
+      echo "\$(date '+%Y-%m-%d %H:%M:%S') - $exe started" \
+      >> /var/log/nvidia-container-toolkit/$exe.startup.log 2>/dev/null || true
+
+      # --- COMMAND INVOCATION LOG ---
+      echo "\$(date '+%Y-%m-%d %H:%M:%S') - Executing $exe with args: \$@" \
+      >> /var/log/nvidia-container-toolkit/$exe.log 2>/dev/null || true
+
+      # --- Run the real tool, piping stdout+stderr to tee ---
+      ${prev.nvidia-container-toolkit}/bin/$exe "\$@" > \
+      >(tee -a /var/log/nvidia-container-toolkit/$exe.stdout.log) \
+      2> >(tee -a /var/log/nvidia-container-toolkit/$exe.stderr.log >&2)
+
+      exit_code=\$?
+
+      # --- FINISHED LOG ---
+      echo "\$(date '+%Y-%m-%d %H:%M:%S') - Finished $exe with exit code: \$exit_code" >> \
+      /var/log/nvidia-container-toolkit/$exe.log 2>/dev/null || true
+      echo "\$(date '+%Y-%m-%d %H:%M:%S') - $exe finished" \
+      >> /var/log/nvidia-container-toolkit/$exe.startup.log 2>/dev/null || true
+      EOF
+      chmod +x wrapper-out/$exe
+      done
+      fi
+
+      # --- Wrap binaries from the 'tools' output of the original toolkit ---
+      mkdir -p wrapper-tools
+      if [ -d "${prev.nvidia-container-toolkit.tools}/bin" ]; then
+      for exe in $(ls ${prev.nvidia-container-toolkit.tools}/bin); do
+      cat > wrapper-tools/$exe <<EOF
+      #!${final.bash}/bin/bash
+
+      echo "STARTING TOOL"
+
+      if [ "\$(id -u)" -eq 0 ]; then
+      mkdir -p /var/log/nvidia-container-toolkit
+      chown root:users /var/log/nvidia-container-toolkit
+      chmod 2777 /var/log/nvidia-container-toolkit
+      fi
+
+      # --- STARTUP LOG ---
+      echo "\$(date '+%Y-%m-%d %H:%M:%S') - $exe started" \
+      >> /var/log/nvidia-container-toolkit/$exe.startup.log 2>/dev/null || true
+
+      # --- COMMAND INVOCATION LOG ---
+      echo "\$(date '+%Y-%m-%d %H:%M:%S') - Executing $exe with args: \$@" \
+      >> /var/log/nvidia-container-toolkit/$exe.log 2>/dev/null || true
+
+      debug_flag="$([[ $exe = "nvidia-cdi-hook" ]] && echo "--debug")"
+
+
+      ldd ${prev.nvidia-container-toolkit.tools}/bin/$exe
+
+      set +e
+      # --- Run the real tool, piping stdout+stderr to tee ---
+      ${prev.nvidia-container-toolkit.tools}/bin/$exe $debug_flag "\$@" > \
+      >(tee -a /var/log/nvidia-container-toolkit/$exe.stdout.log) \
+      2> >(tee -a /var/log/nvidia-container-toolkit/$exe.stderr.log >&2) || true
+
+      exit_code=\$?
+
+      # --- FINISHED LOG ---
+      echo "\$(date '+%Y-%m-%d %H:%M:%S') - Finished $exe with exit code: \$exit_code" >> \
+      /var/log/nvidia-container-toolkit/$exe.log 2>/dev/null || true
+      echo "\$(date '+%Y-%m-%d %H:%M:%S') - $exe finished" \
+      >> /var/log/nvidia-container-toolkit/$exe.startup.log 2>/dev/null || true
+      EOF
+      chmod +x wrapper-tools/$exe
+      done
+      fi
+    '';
+
+    installPhase = ''
+      # For the main output of our wrapper derivation
+      mkdir -p $out/bin
+
+      if [ -d wrapper-out ]; then
+      cp wrapper-out/* $out/bin/
+      fi
+
+      # For the 'tools' output of our wrapper derivation
+      mkdir -p $tools/bin
+
+      if [ -d wrapper-tools ]; then
+      cp wrapper-tools/* $tools/bin/
+      fi
+    '';
+
+    # If you need runtime dependencies, inherit them from the original package
+    propagatedBuildInputs = prev.nvidia-container-toolkit.propagatedBuildInputs or [];
+    propagatedUserEnvPkgs = prev.nvidia-container-toolkit.propagatedUserEnvPkgs or [];
+
+    meta = {
+      description = "Debug-wrapped NVIDIA Container Toolkit with separate tools output.";
+      homepage = prev.nvidia-container-toolkit.meta.homepage;
+      license = prev.nvidia-container-toolkit.meta.license;
+      maintainers = prev.nvidia-container-toolkit.meta.maintainers;
+      platforms = prev.nvidia-container-toolkit.meta.platforms;
+    };
+  };
+}

nixos/nvidia.nix

@@ -0,0 +1,25 @@
+{ config, pkgs, makeEnable, lib, ... }:
+
+makeEnable config "myModules.nvidia" false {
+  environment.systemPackages = with pkgs; [
+    nvidia-container-toolkit
+    nvidia-container-toolkit.tools
+  ];
+  hardware.nvidia-container-toolkit = {
+    enable = true;
+    mount-nvidia-executables = true;
+    # additionalEdit = ''
+    #   ${lib.getExe pkgs.jq} '
+    #       .devices |= map(
+    #       .containerEdits.hooks |= map(select(.args | index("nvidia-cdi-hook") < 0))
+    #       )' | ${lib.getExe pkgs.jq} '.containerEdits.hooks |= map(select(.args | index("nvidia-cdi-hook") < 0 ))' '';
+  };
+  hardware.nvidia.open = true;
+  hardware.graphics.enable32Bit = true;
+  hardware.graphics.extraPackages = [ config.boot.kernelPackages.nvidia_x11.out ];
+  hardware.graphics.extraPackages32 = [ config.boot.kernelPackages.nvidia_x11.lib32 ];
+  services.xserver = {
+    videoDrivers = [ "nvidia" ];
+  };
+  # nixpkgs.config.cudaSupport = true;
+}

nixos/options.nix

@@ -1,6 +1,6 @@
 { lib, ... }: {
   options = {
-    modules.xmonad.picom.vSync.enable = lib.mkOption {
+    myModules.xmonad.picom.vSync.enable = lib.mkOption {
       default = true;
       type = lib.types.bool;
     };

nixos/overlay.nix

@@ -1,4 +1,68 @@
-final: prev: {
+final: prev:
+{
+  # nvidia-container-toolkit = prev.nvidia-container-toolkit.overrideAttrs(old: {
+  #   postInstall = ''
+  #     ${old.postInstall or ""}
+  #     mv $tools/bin/nvidia-cdi-hook $tools/bin/.nvidia-cdi-hook-wrapped
+  #     cat > $tools/bin/nvidia-cdi-hook <<EOF
+  #     #!${final.bash}/bin/bash
+  #     # Trap any errors, including crashes
+  #     trap 'exit 0' ERR
+  #     set +e
+  #     $tools/bin/.nvidia-cdi-hook-wrapped "\$@" || true
+  #     EOF
+  #     chmod +x $tools/bin/nvidia-cdi-hook
+  #   '';
+  # });
+  runc = final.stdenv.mkDerivation {
+    pname = "runc-with-logging";
+    version = builtins.getAttr "version" prev.runc or "unknown";
+
+    # No sources; we're only wrapping
+    src = null;
+    dontUnpack = true;
+    dontPatchShell = true;
+    dontBuild = true;
+    dontConfigure = true;
+
+    nativeBuildInputs = [final.installShellFiles];
+    buildInputs = [];
+    outputs = ["out" "man"];
+
+    installPhase = ''
+      mkdir -p "$out/bin"
+
+      cat > "$out/bin/runc" <<EOF
+      #!${final.stdenv.shell}
+
+      # If we're running as root, ensure the /var/log/debug/runc directory exists
+      # with the desired permissions.
+      if [ "\$(id -u)" -eq 0 ]; then
+      mkdir -p /var/log/debug/runc
+      chown root:users /var/log/debug/runc
+      chmod 2777 /var/log/debug/runc
+      fi
+
+      # Log this invocation to /var/log/debug/runc/invocations.log
+      echo "\$(date) - runc invoked with: \$@" >> /var/log/debug/runc/invocations.log
+
+      # Hand off control to the original runc from prev.runc.
+      ${prev.runc}/bin/runc --debug "\$@" > \
+      >(tee -a /var/log/debug/runc/stdout.log) \
+      2> >(tee -a /var/log/debug/runc/stderr.log >&2)
+      EOF
+
+      chmod +x "$out/bin/runc"
+
+      installManPage ${prev.runc.man}/*/*.[1-9]
+      mkdir -p $man
+      touch $man/afile
+    '';
+
+    # Optionally inherit original metadata
+    meta = prev.runc.meta // {};
+  };
+
   rofi-systemd = prev.rofi-systemd.overrideAttrs (_: {
     src = prev.fetchFromGitHub {
       repo = "rofi-systemd";
@@ -8,6 +72,20 @@ final: prev: {
     };
   });
 
+  wyoming-satellite = prev.wyoming-satellite.overridePythonAttrs (oldAttrs: {
+    src = prev.fetchFromGitHub {
+      owner = "colonelpanic8";
+      repo = "wyoming-satellite";
+      rev = "509628a9be2cf61116b6d0475e19c0b92a855e0b";
+      hash = "sha256-ewSxVv+8r2VGYNOoj8jiMogXtp1GPApcRc2BH3Q+8W8=";
+    };
+    build-system = with final.python3.pkgs; [ poetry-core setuptools ];
+    pythonImportsCheck = [
+      "wyoming_satellite"
+    ];
+    propagatedBuildInputs = [];
+  });
+
   git-sync = prev.git-sync.overrideAttrs (_: {
     src = prev.fetchFromGitHub {
       repo = "git-sync";
@@ -24,7 +102,11 @@ final: prev: {
       rev = "51b21355696add83f39ccdb8dd82ff5009ba0ae5";
       sha256 = "sha256-crCwRJd859DCIC0pEerpDqdX2j8ZrNAzVaSSB3mTPN8==";
     };
-    nativeBuildInputs = old.nativeBuildInputs ++ [final.pcre];
+    nativeBuildInputs = old.nativeBuildInputs ++ [final.pcre final.gnugrep.pcre2 final.asciidoc];
+    buildInputs = old.buildInputs ++ [final.pcre];
+    nativeInstallCheckInputs = [];
+    doCheck = false;
+    dontCheck = true;
   });
 
   expressvpn = prev.expressvpn.overrideAttrs (_: {
@@ -44,7 +126,7 @@ final: prev: {
     };
   });
 
-  emacs = prev.emacs29.override {
+  emacs = prev.emacs30.override {
     withNativeCompilation = true;
     withTreeSitter = true;
   };
@@ -52,6 +134,7 @@ final: prev: {
   python-with-my-packages = let
     my-python-packages = python-packages:
     with python-packages; [
+      universal-silabs-flasher
       argcomplete
       appdirs
       ipdb
@@ -61,19 +144,43 @@ final: prev: {
       pip
       requests
       tox
-        virtualenv
-        virtualenvwrapper
     ];
   in
   final.python311.withPackages my-python-packages;
 
-  # gitea = prev.gitea.overrideAttrs(_: {
-  #   src = prev.fetchFromGitHub {
-  #     repo = "gitea";
-  #     owner = "colonelpanic8";
-  #     rev = "40e15b12bf104f8018f56e5b826d8a2f8e2587ea";
-  #     sha256 = "sha256-VXP8Ga681rcKn548rOZq9I19abY0GzXRpdiYGpwyMJ4=";
-  #   };
-  #   go = final.buildPackages.go_1_21;
-  # });
+  claude-code = prev.claude-code.overrideAttrs (oldAttrs: rec {
+    version = "1.0.86";
+    src = prev.fetchzip {
+      url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
+      hash = "sha256-mVXS75KgeKgD7EI5t9X6+TkwjBFyBLOo4/m50sS9XdA=";
+    };
+    npmDepsHash = "";
+  });
+
+  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+    (
+      python-final: python-prev: {
+        pysilero-vad = python-prev.pysilero-vad.overridePythonAttrs (_: {
+          src = final.fetchFromGitHub {
+            owner = "colonelpanic8";
+            repo = "pysilero-vad";
+            rev = "846caf4aa6c5f5319b87d3127dfe0aa9e88b338e";
+            hash = "sha256-SjoyiHm2RiLDFbwduKsoPK4/AvQiwZ39ZsPj2etXRV0=";
+          };
+        });
+        home-assistant-chip-wheels = python-prev.home-assistant-chip-wheels.overrideAttrs
+        (oldAttrs: rec {
+          bypassAttestationVerificationPatch = final.fetchpatch {
+            url = "https://raw.githubusercontent.com/tronikos/chip-wheels/8a5ec21d114010723cf428ffe79e244da7562390/8766-Bypass-attestation-verification.patch";
+            sha256 = "sha256-RgmlPRSfw1PPMdHBzpoK2Drrb8nEagATY8Y5ngi7x0k=";
+          };
+          postPatch = ''
+            pushd connectedhomeip
+            patch -p1 < ${bypassAttestationVerificationPatch}
+            popd
+          '' + oldAttrs.postPatch;
+        });
+      }
+    )
+  ];
 }

nixos/plasma.nix

@@ -1,7 +1,22 @@
-{ config, makeEnable, ... }:
-makeEnable config "modules.plasma" true {
-  services.displayManager.sddm.enable = true;
+{ pkgs, config, makeEnable, ... }:
+makeEnable config "myModules.plasma" true {
+  services.accounts-daemon.enable = true;
+  services.displayManager.sddm = {
+    enable = true;
+    settings = {
+      Users = {
+        # Show a maximum number of users
+        MaximumUid = 60000;
+        MinimumUid = 1000;
+        # Enable user icons
+        RememberLastUser = true;
+      };
+    };
+    extraPackages = with pkgs; [
+      # sddm-astronaut
+    ];
+  };
   services.xserver = {
-    desktopManager.plasma5.enable = true;
+    desktopManager.plasma6.enable = true;
   };
 }

nixos/postgres.nix

@@ -1,5 +1,5 @@
 { pkgs, config, makeEnable, realUsers, ... }:
-makeEnable config "modules.postgres" true {
+makeEnable config "myModules.postgres" true {
   services.postgresql = {
     enable = true;
     package = pkgs.postgresql_15;

nixos/rabbitmq.nix

@@ -1,5 +1,5 @@
 { pkgs, config, makeEnable, realUsers, ... }:
-makeEnable config "modules.rabbitmq" true {
+makeEnable config "myModules.rabbitmq" false {
   services.rabbitmq = {
     enable = true;
   };

nixos/railbird-kubernetes.crt

@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIELTCCApWgAwIBAgIRALNxOT7J7N/eK6edp9LbKAIwDQYJKoZIhvcNAQELBQAw
+LzEtMCsGA1UEAxMkM2I2N2M2NzgtNzI5My00YTIzLTg3ZWItY2NiMTZjYWFkMzFm
+MCAXDTIzMTIyOTE5NTQ0MloYDzIwNTMxMjIxMjA1NDQyWjAvMS0wKwYDVQQDEyQz
+YjY3YzY3OC03MjkzLTRhMjMtODdlYi1jY2IxNmNhYWQzMWYwggGiMA0GCSqGSIb3
+DQEBAQUAA4IBjwAwggGKAoIBgQCUYUuTrpDbwUS2B3SYUoa7LI5mi8NNr0lDe1w4
+3yPpVnu6ubvnTNm2j/v88HYwEjlppEg4HjhP7YEJ8gsGdgUCpIaPWTpifVmA7E4o
+2DbJDiePkkUGkNL0whCClOOcO0hyxdk9Pol5wRzci0l6zSalE6DB4rJrmB5Ppl/A
+t2KAVVqpwbynmbijr4yZh7Bp7LfaIrFthlv2ZPEjLfPLz7YthBw9/iUt94mLMyWZ
+BpygA5y/CocQQnnFMnU1o0eUd37YL7zErfIxx/AmL10Sq0qdFXiYOJJqubURbdS8
+DZ6dyHdX+UlxPls2Rlx9nDaiNGFJdzqHJzDdOlzN3kkdDQoO8xUdH9ekFU7rOwkP
+5NpubSwrd1FOGHh+EknugnEQD4Oip/YQ7IUj3Afm5Ag2la9k4WJRgjACbkQ2+k9I
+sFmPmmMVHn9nepCMiYQMjX7ApZw0isDPeVK5EuQeImgu7uNoV8R5VwG0XoBCXz4S
+UqYv11uEsMqFu07Zwlznsxnm0uECAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgIEMA8G
+A1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFI73GznmeECJOdxJAEzmjhYgGVKtMA0G
+CSqGSIb3DQEBCwUAA4IBgQAm19zlm3WVePflA6Zh/FxvE8MirrJF6jmJzRrBCEM5
+DwkSmY3dvONqCYeeNb4+xWXWQ8eVKVlPdkoW3V7H5xnJ63dXRNN2lQ3JpSTG3+yP
+Omp6XGY9mmatdHwyV7N4h10aKEWAuRhy148sdJZLYj0LbR42pCVYhEP4D3Qj7KjN
+PJe+cR8NSpiYmDH5y88Jqubztj5NVcDj/iN9h/7/GajbU6lCgN/SxZgi9cNGjxSb
+JHFHE2Mp3z9sjsieTXMplLqK045TQ2IBqnJyMdKkvSNkRUCbz2yXdiIOKtvU4ly0
+h884z9P5JQ9bxe+6cwYC4ky3G5WYMn++RUsuCk4ScsrbZtM9jpKnz/TygMdVTC5w
+Siq6OHKtAnh8Ax1LEKicg9FLd6ODxR3OVKu+fUPV4XHAWJnmvElGlivjneHiE+OL
+dzgb/CfBEGHYBVc2PDIhwBmUdoEZ/t3UjvmSI46ZblYpWodJvLFwge2HxSivRlLW
+Uh/oPWX5N/CH9I34HTAhI48=
+-----END CERTIFICATE-----

nixos/raspberry-pi.nix

@@ -1,6 +1,6 @@
 { config, pkgs, inputs, makeEnable, ... }:
 
-makeEnable config "modules.raspberry-pi" false {
+makeEnable config "myModules.raspberry-pi" false {
   imports = [
     inputs.nixos-hardware.nixosModules.raspberry-pi-4
   ];
@@ -12,6 +12,7 @@ makeEnable config "modules.raspberry-pi" false {
   # hardware.raspberry-pi."4".audio.enable = true;
 
   boot = {
+    initrd.systemd.tpm2.enable = false;
     initrd.availableKernelModules = [
       "usbhid"
       "usb_storage"

nixos/runc-overlay.nix

@@ -0,0 +1,10 @@
+final: prev: {
+  runc = prev.runc.overrideAttrs (_: {
+    src = prev.fetchFromGitHub {
+      repo = "runc";
+      owner = "colonelpanic8";
+      rev = "4b809881415e99247d8dea2eda862491dbc9acd2";
+      sha256 = "sha256-XOslGNu+ix52938SnnhmWKUaZaTQx9+/o74tnAjmo3I=";
+    };
+  });
+}

nixos/secrets/cache-priv-key.pem.age

@@ -1,48 +1,56 @@
 age-encryption.org/v1
--> ssh-ed25519 ZgrTqA O0XHnLd6cH/2OZyZWRvB028wmx8x8b4ojoqzidpANQM
-tQXIb/FsHcXwBet9icQrU1gYxpWUXOMFnxhHq+pJegc
--> ssh-ed25519 ZaBdSg dXtxOGI6j+NyJadTzlhTkb+6/rf5BEtUeZCnH4SjpA4
-UCqDgtXh3tMFGz0xDyWn5I81S91CRrEJ9j4LAUN14vI
--> ssh-ed25519 MHZylw GGmyYlC28NKCP+uuAQBO3EIqB+XY63SCkDN4e/WdGkY
-GVzmq2tmIJvFnmMnvO12Ok8gOofTRBt20HH586tNzps
--> ssh-ed25519 sIUg6g +VSuYouQxNM8Ch9xTIdokrtAK6RU5NoMNN6nUAr+rQQ
-GDRltKHjD6D4d9Z0vq04M6ELi53GdZZFAZde/V6YzuE
--> ssh-ed25519 TnanwQ HeLm9uq5waI09epfKCsRLFO0Ll/V9Rg6y7LAOjGKLmc
-jjpTs70FeSaxBH3OyvEfGl71kpVRZmtaCkS29VXehVw
+-> ssh-ed25519 ZgrTqA +u18TitbmPrZLwLNMT5C9wbkXPeROgHrh3Tb1RpE52s
+WcIdsXKxuTOEeja8mh5qoZ38hSlyS2K0WFS4sB/yKv8
+-> ssh-ed25519 ZaBdSg f9kJeTDYYwQLbfL0lfSZjAkRj/8i7MOzp9MQ8ojEl0s
+Ez8Pmw5sLZUNWE6nIswzE6mQxZiAhKERLbD7MT/RTN4
+-> ssh-ed25519 MHZylw P/KulIF/w8YmSUpXObabu0El/rGAuETPvMGHLdfpR10
+Mz9S83bVirlz+pjOrEsJP8oRIBz6PdneMopEshYbj/I
+-> ssh-ed25519 sIUg6g mobkna3lBZAMq7IwqR4uV5Bg6c353po4/+YY8Iqg/Bg
+rCyfVkXKoPotBEEb6r3T56sRdjn9fC+taxrnRZuUSvc
+-> ssh-ed25519 TnanwQ hCPpi8mAGltRM8bpl5OoFGVToPy58Pia9ElyCIi1enM
+o9m5Zzl+8kDPEFkQ/evupeGJG6S4aiZk+PaUxlvMTSU
+-> ssh-ed25519 cH4aug mR6lvjeeWSUmK50rsOjGGG6ccwzTpGVt97dW1rEEqQo
+AQvUomG2XgQo6dFIkZ24N97l8/B3F9WnN/KVGzITcz8
+-> ssh-ed25519 ggrAFQ lYeue71aHAhUsy/LOgDPCNmavQEl9VIVnOVC/W/VoWk
+SwYzh1DpS5WHSdX2e16wkDUwm1Sa3ARHPF9UBycdHUg
 -> ssh-rsa gwJx0Q
-a6q+jlWud5INiCOwPH570EdyrEOahksIsz5ehCwi21xUpsw8uDAJvwJZ4LTUk7Pp
-rgCu56ndd0LBqNAsqCO0NeP6rHj11Y9gVI1VAe8JZwQAd9uxP1wCFSamGPBAG3qU
-6K7tSWxUJg5E5N8xn0UVasdC49PSadEBpvWOw7gxUcZSZk+zdXZkmNNJOJjblp48
-BzjLiFs/NEapIrpx80nXurSiyN5IV97vK3owXqqYSKOoBR2JWbVeYVO47cR9UN8G
-df43ozz2wrG3tfVgy23JfRUPinDxPkUJ0AbkpD7aBuEJfFmQSDjyl+wGevf5GAOI
-rTNpOz31YvchkiynnXLhyg
--> ssh-ed25519 YFIoHA 9Sx54ArYGvWtaM64vIuh/xNfC00Kn/6OiIL7zkK/IBI
-cHLc5wccimYC6ICqnz3e1hs+4XAHzRd32dj0/g+4q6s
--> ssh-ed25519 KQfiow p7igfY7SkJe2k9EZMy+VEr+uYnEZZSosmAJKOWwopDU
-z3HZmOrrhK6Ns5z5EOtlgoo6IROMuo2elRrnX/I9YvI
--> ssh-ed25519 kScIxg de1921H/EqUtCsmjytrGa/9vx41qKO/jiTTNRXRK/xg
-IzjtdSwv/FwgGyl6qumTvDi5imcUKolt5upP0hNDd1g
--> ssh-ed25519 HzX1zw u7OB64Wzd4siphc3kyRbPwYswc/vn0eqtUiId5byuVE
-t8CF85/o71ra6IAgXAfcoCZHs4VN/ejOQVsdUZaaLqo
--> ssh-ed25519 KQfiow uzyI3JXAF3twmqSKDZAgNEMv/Su832geK/y46hKiJCg
-qpbPTkQYUcPSuFEXoOnYmGLcAL2TH2XpkBOqeVvUVVk
--> ssh-ed25519 1o2X0w u9pY09CQumynSF+9z59nuEuZFPwdVld8XQOLG0N4llw
-i1HrE7Nk5O/h9eYGeq+nx5UCIgO2c0ROHcwUDiFFxoM
--> ssh-ed25519 KQ5iUA zpOP9fMu7Mqm0LbkA78KInXworz+LGpovjk5mIOOfVM
-Q2y9sMSgwIahs+7ceXY6bYha87uXcD28irc4zRYbOSE
--> ssh-ed25519 AKGkDw mLi5T/ia2gQ9z357LYQUbgUQ37DLPhbRlR3LkPvOPk8
-rPUwUtTwDAbn49GgLO9vfW/P8hfrhf4znvrmHiiPXLE
--> ssh-ed25519 0eS5+A DomPBIFcr3Wxi1sfGzEBKTpRruHijRX5CDh7xk/mQgg
-u9hQHSq3w/NBv3zpIpbX3bMk2vYaNn8dl079zz4cRmE
--> ssh-ed25519 9/4Prw kczIhptmCQmYolhBX+omXqbtTuqqEeL8Mnx2k/1c3Wg
-3QBDp0WfYP8Ni3zZ3xk8yC5WscRa+niwjO+6Q2MR9Is
--> ssh-ed25519 gAk3+Q HhCggnhkMhbZG1VyyjtibA7eAnnhS+ZVDMuKmFW+fiQ
-7URzpfoMkgD/Jn0N2FV5WJxLpDOPkmI3W7yA5G+MyQg
--> ssh-ed25519 X6eGtQ KBzu6+tTigAYC+ifRi5rGyocU0l1PfBj2KuK9yasUiw
-ShtvUv9tuuvYf7dHDnBIQtLWVkN9gaP6ryyeCVoNVIU
--> ssh-ed25519 0ma8Cw 4kkPaMRoYuYflcHDAzBAaWd9+Q3CXV97Hs7d8sFIU3w
-7JQH4QYVnnxhjfr0wQTqLieGc3G5ymEBdivqO2/vEWM
--> ssh-ed25519 Tp0Z1Q 3GL4a2CUqmbEK0POxjUADiUtnA96enIKavGEJBr4QTM
-RP5mZ7PKqB29cU5ir3wiX7CDM6KuqBysO2g9HyONlKE
---- hLdA7jp69UiOM2LP3bMxOCNnHUWwcgL2BbSsz3+D8lM
-2<EFBFBD><EFBFBD><EFBFBD>1<EFBFBD>Q><12><><EFBFBD><1A><>2-<2D><><EFBFBD><13><><EFBFBD><EFBFBD>R<EFBFBD>><3E><12>B<EFBFBD><42><EFBFBD>(<28>^~<7E>(<28>ۻ<1D><><EFBFBD>?<3F><>n*T<><54>MK;oN<6F>W<EFBFBD><57><EFBFBD><EFBFBD>z<EFBFBD><7A><EFBFBD>;K븬=.<2E><><EFBFBD>Ȑ<EFBFBD>J<EFBFBD>U+<2B>a<19><>Q<EFBFBD>Zr<><72>g^<5E><EFBFBD>"R<>0<14><18>J<EFBFBD><4A>c<EFBFBD><63>4d?<3F>Ȧ3<C8A6>,<2C>O<EFBFBD><4F><EFBFBD>
+fbU+nVFbxpVC0D1rxouGi8aOirZ5CYaMlmm+pLmpI81WZRweyi/8j16IvRSqV9CB
+T4uLqBcpsYKVroPIvkIzy1LBUE0LrYj4tVAoAtPWUOk+Z3+pSs9MpTf4nhxjj2UJ
+xXw+Kjw0rlAIy48cG8UssI3MAvF17m3JUG4xJxDmM/69J428tE1xa0JMjMXf/E7s
+g/RSO7cx+Pcn2ClrFdMOVEkVNIKUkJdpymRSdOpwQnwzgOo4NNwBowFv/6OpfFdP
+tS9zX9ZgpcOLKdCV463afYCbZ9z6lsw4KnEUL+bg0QAz8PtlRpF56LUnmBRSWPNN
+nl002m6a+uZZQl1HizgR9Q
+-> ssh-ed25519 YFIoHA Q8+eEd7maA4f64SGQfyk0pRuxY2WiD3UzHuLmzIPvVc
+XWV6IuKDftDStCgj4brPMaTvea+kIlYg7JGnkyX1+Ps
+-> ssh-ed25519 KQfiow rra4AZqxS0duGI0GrMAGt1KnUVRyBbnGcZhsu2QeCxM
+jaIThcqxxxh9atSgrVEzMFsDip5aNTxWaekgIw+lLKw
+-> ssh-ed25519 kScIxg NBVuAT7UXhPMu1THkAXJ1QYNwSnFIgvjQB6jYD7t4AI
+xs+x0xP/jRBsvr2IMhEBrpP0o1Ian9Guw1yuMT0b5XA
+-> ssh-ed25519 HzX1zw yyjdUbfty0hE0jIc2MMYvRkq/c/DABHJczH/CqyOkRw
+c5lkqMwaxsojqx/jYJhMbgWuN0qdgf3VlBYnUHpc/OE
+-> ssh-ed25519 KQfiow 70CAriiLnPXfh3a7HJnjRk0K5vYPc24AKjEWjiD/bSM
+Sp/hULrynhI79p/zh96sD3rIYMTMzGD6CvN+6Dmxhhg
+-> ssh-ed25519 1o2X0w +xLXrJLT2PITsHGkhak6M6/1ifd32sEHcNtI9xdTNTE
+PI80gCMGaR24FRiOmNeReTXrUecgCNJZMInKGNfQHic
+-> ssh-ed25519 KQ5iUA J2rBvdYjd9RYlQtVfaV50ZN0naHT58e3rZrnhgEszkg
+/iG3OU/HVraqegvrTgZz5/gp1HZwyGgGkXhjGYJXAoY
+-> ssh-ed25519 AKGkDw 7gJhihE5rASMzycK4rzrSj3oll5hHqzXNQo1qzoqnwE
+zlisCc+y2x028mosTHDQjrMDAX2lF3HAJ8LLtzuwwZ4
+-> ssh-ed25519 0eS5+A sLIAQR51fxFZatgc7CCJYgjCtfdqYFLBnL4Qs9WmbyM
+CgeHGN6+/ZE/RrQoPlaizGtu3bEz8lPfWEfFYY9wzrA
+-> ssh-ed25519 9/4Prw uytvwSpCRE/5xDu/Og60k6jBF3wyBanyZMWhEjzcf1E
+CM37OOCnORhdGDPXLJ7VIRYJhvMXKxfs6oK9WnHycV4
+-> ssh-ed25519 gAk3+Q hqrzZ+KHXT7mfI/6332ZymbDTQmjS2m7jDhtqNQ44no
+n/k8+t4BcmPy5Tgkl9e8/CSoCcmVp2lkU8rCRlSGfZU
+-> ssh-ed25519 X6eGtQ kO2cKtxVcAIRA3xC4zLLuj2cfZ6CKlOq3aTrB9cqhg8
+tG5GtTne/45DqNkJ8XjOlfbbDGLfTxweUKG1+f7aXNU
+-> ssh-ed25519 0ma8Cw /PwKBNkRtj0mWkG3fJZOIjdLkhWlxxtowVABKjxShG0
+OSfm0wSpyrd8bb836wbFi1BrWHkuZ4DuWw9ZwfMP5b0
+-> ssh-ed25519 Tp0Z1Q qJqv47mimbpQkdiYO5sDqj+Qyi7Nq+y9Bb/EuxneXQg
+F+b8rEY9rxDdPe+mVy0h7AggugMvGi9lvwKDfe/rjJs
+-> ssh-ed25519 ePNWZQ MO3gceW2gDffFS/Tr2F2BkMSKD6Ydn/mRXHqYckGOnU
+3CxqL9EwDQ99T7pN6b/NU0NQungyh2EHE56L8Stuj/U
+-> ssh-ed25519 hILzzA AIf5pdaRPGOtKKV/gY5GM/PNtqSXVhoxB69t5JEgUlA
+d6TC0L2OpbhvaREkVc+rNzY7U8VIQMG0in0UHFsGSUY
+--- 6QUiesVdF1mNKhzpT/tPTMDvL7MAkEbXR2CHau5/SHE
+<EFBFBD>ڙM<EFBFBD><EFBFBD>	x<>0<EFBFBD><30>_<EFBFBD><5F>v<EFBFBD><76><EFBFBD><EFBFBD>uA<75><41>u1ON<4F>*ݩQJ<14><>E@<40>ϚȬ<0E><><EFBFBD>b<EFBFBD>Clg<6C><67><EFBFBD>j<EFBFBD><6A><EFBFBD><EFBFBD>ǘ<EFBFBD><C798>F+6"C<><43><EFBFBD><EFBFBD><08>/Ya<59>#<23>l<EFBFBD>p<EFBFBD><08><18><>E4w<34>/<2F><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>3<>i<><11>L<EFBFBD>
?<3F><>v:2<><1C>ߖY<><59>l<EFBFBD><6C>s<EFBFBD><73><EFBFBD>

nixos/secrets/gitea-runner-token.adele.age

@@ -1,48 +1,52 @@
 age-encryption.org/v1
--> ssh-ed25519 ZgrTqA iez83NCzN7sb/O+bYHDWB/420SYC6Wz++js1clRvSyk
-pkOvxmV4JJLHrzNjF8bpwVxmcH06JF1jUuB+7Hy5QX4
--> ssh-ed25519 ZaBdSg ib4g0QcRi6MPHDLvTgoksKjra3L3PLmIcHZFu332Qnk
-TQTrIrHUv/xmN/kwsAlgOqmj9HAB72ubjiD+zz8JcUI
--> ssh-ed25519 MHZylw SxdlNrD7U4QSXsxOmXDteKpvJ9WGpLrZZjYHnxI3yjc
-6EmdU8LPyanusjmszO3mdDJozxZuLyN7N52kxH0SA40
--> ssh-ed25519 sIUg6g 4pxG9NrxTmoOkKvt/J0LNPG2c0DmbDYe1suvYORTFm4
-eT1/an3xE6iqn0ewms8d6T2tpn5wpeEhC1pab2jb/MY
--> ssh-ed25519 TnanwQ VR8oO8fW7YK85eXxmVJWUysdPOTuy3d0ymLDLOcJnVE
-ATNa9yjmsVpeMuJx+RhhfN18a8p501xkb5cnCaWAqaU
+-> ssh-ed25519 ZgrTqA iW7mNP6ZLuX+VH9RQykM/kD/xYhuZ/req0K977h+0G8
+N8IfXH9wGB4W3cc/t/dMXvpiuA467sYpbSJ1FbNK1nM
+-> ssh-ed25519 ZaBdSg xHC5cGTqglVLNtX9Eq9c1+puKticyX3tC3yJ7XhTCWY
+wAIVpjfcTtthyYiLUr4ZeIMr3R6a9sZKQLBlwGd0JgU
+-> ssh-ed25519 MHZylw xDm+4POwUcPFS16M0EbXcwCY1MCwLodvp5KXINN5dQU
+sBxSYj8reNgfwpUpbRfQHsD9cZxVcv/14d9PPjWkMLg
+-> ssh-ed25519 sIUg6g 5CF+k/ZnWrI85qzWgs93NiPL7XeA7xtt0NikXjdopkc
+jn/MxKBCkV3TZKzHWoK85BPYDyKWZrz2dvnSvmMBJds
+-> ssh-ed25519 TnanwQ dPvxr2PF2huQjuDMm8u9Jtt9qHOGANe8PFTmk9C5MDk
+C3mdAy04NHA6GvxkHY0/mJimmlakqEaM5nQj0yNRR2k
 -> ssh-rsa gwJx0Q
-ReyIQtExcQR/pmOYGamTgTxz1JoyzFgLiJYu02SNGZRyjqNSFeCpQuowjJyYApJM
-aJUpSsyK4vJ1X+2+bbzPTZrp9S2BgmO/3ebCKCm2Y4EhIXZCvffcno8TaoJRysWw
-34EwLZ/30r4iLBscDIQB2oat7hWLJQoLiDreBRS90JZOock9FfGP4SfXirBRfDgr
-gh817YZvIhpTzU8/0gLrsQ9hnN6eNre22N9rLdZSXWFfkeD01723sJMr6w/ntXxb
-gmzuC8JEhicxPkTzwVBeSPzeopHiUrqld5EGe3ZWDHAoYtmQCjN2H0BHQe/B5YJU
-YFU4MZdgUykhrnxM26byDw
--> ssh-ed25519 YFIoHA 2Yv2+qhYd74prfDyu0osYbpXFmE+wMJK6W0JHjgqOGM
-HSHHQOx/COo0s+dAtMITGIfrCcdYUYNzjLuiU+pGccM
--> ssh-ed25519 KQfiow cMKtLUkUMxFeEJdGmmHuRha93zCBNimQadaGZFVc+Bo
-jgaenccqng03pj4WTNlIpmoDL9ZgVHSF0EmYLZ61GRk
--> ssh-ed25519 kScIxg 9vBKRKl4cFUhAsnmu5hW6s1SWe/vjPEJVrAvL/N7DCA
-pPI7ZZPEZNlmR/44AE5WNATCJstiYgEkJQI7sZMtf9c
--> ssh-ed25519 HzX1zw 3aq/89MOxaQyDls41D3My6CWKmrzbP16XWRFnxSkqUs
-wS6sHCOZUV8bn6z4sfhR9q5vVGGKeiFR2x6EmBi5A8g
--> ssh-ed25519 KQfiow mPERPckf5u2yDfdN9rYOKRWMKiNoOBpZUFePccYh7D4
-92HxFjBC97bDWo+zfZNUYBEauSQWvxbAla4AYmhs0xI
--> ssh-ed25519 1o2X0w MGFx77Vg+nydzZqTC/+ohfN/6z6SDuO5ZgzplleGMRY
-ked3VPIEk6QISpBemBNyNdV8a6a4b1KvMi3T8etojvs
--> ssh-ed25519 KQ5iUA CrDNvZYJNgfHnRCD+wiTuMnlZh4XT++FASlPfuTpOAY
-GQKpp+6QKG+0nr2JFWtq87o7Eg9tol64JOkx8g7USpM
--> ssh-ed25519 AKGkDw uEF+jr3sCN3JsMRJrgeV0rJqdhDZog3fjrAe0tsLpjY
-xLpw7Q7YgTw6D7JhqlNV3uSiT4Bt5ARWpo+6RiDd/iI
--> ssh-ed25519 0eS5+A +37WnrBGsf6CJ4Yro/RScEIQpaodiK3tbWr8736ADHg
-4wG1HKA/96vOGO9jCJc/JkK/7KNWr1ovx078kStHH/Y
--> ssh-ed25519 9/4Prw e/mMP+AMG4HMhQcJ2uzfHHXQhmVjE7xoY13Di74OU08
-1JUAd7FEXhncnNP5Ddt0o4vpZ4oj/omIs2aEwtVc0Xw
--> ssh-ed25519 gAk3+Q pe+2dfMK4o5e/qabl42cSMSkkw0MrZIHKZaUCmFt6mQ
-CM8qOOE3/BYAyt/3igyBEhSmFIfhdI27N0zwfmvOGrE
--> ssh-ed25519 X6eGtQ q6vwAZm4onKe4/G8sw/stsgmrikNw1yUsxiiBFYxMlM
-/hCXkTHiMe2AX0BZAmPuP1EnDtrKL9lb0kmErJueTbQ
--> ssh-ed25519 0ma8Cw NNuXxI5c3Bjs3XBn/GSMkn2K1F+X4WAStOWGZpD/lj4
-kVxDinO7MAieUAZ0AoUE0560gXlh6QvIl5SO8qkrfU8
--> ssh-ed25519 Tp0Z1Q G/sxerwQ0vdiC3Evvevy6pkt/lWaIQJ3QVNoX2tIOjs
-8+zWd1lUpOhknOJcABI1TKPNlBQheZD9aNDlGnF4Fkk
---- BjAZNIHU5U4toPAlQqLCB5vXP0MtpeK4zceu+dTdf/k
-S<17>wf<77>D<15>Ѿ<><D1BE>V<EFBFBD>
+arxGqHS2sOD+m05Ce0kw6DMDiK+0Go1t74m6yuJf1/mH2F7uw8sgrZQxdWon+r8t
+ZyroQGRwMAWaya+bL9waDGV6j+MCyIcUa25dQHbGIGUnpKZVoYn8YVFLyiySTkLW
+S5ve3HQNu4pp0EbL/+e3l2E7XPe1ssb4LGbbHZHXm7V4hKwgJqfnX8VUVTlWCHRd
+6Gsd1Wezg4Qz8bnghjaaagWSKDhf8/iZL7B/+8NniZtMsY0Ajeqf6OpJuPdXnmCc
+OnWZHriEhSqB+oEg4vGPU1iuo6WXwDW8oMNZ+2uHHV/UE7hgLfkvZaRUSGfcsK6m
+EMnarBbUfsbsEmzEMMZ0lw
+-> ssh-ed25519 YFIoHA wxFUFWCoLZ5TroHAVB4ffcwNx5vShL8pZZyhNB8P8kA
+4Zl9WdtTlFRf6N45Ib6zdaQup5BfcDIEXPDnLUvG45A
+-> ssh-ed25519 KQfiow x177D9cUo3jd+RzaLaPD/S3GDTE6j+8+V/3qYHkMeyE
+PPnb3/lDia87oycMStdMjns2bDQt4wFln5+SnAAYs+A
+-> ssh-ed25519 kScIxg aol/G1Qs/QbDkPBCqfrLdWCuk1JrIiIV+vGoAQoaWTQ
+8XziIW+ST8De384wav/s8DIenM1oMdnDt7m33K+Fr5I
+-> ssh-ed25519 HzX1zw sHNG8nyVp+YQuWvsyTGGVROGtQwuaWwt2vdgrnMY8F0
+oB96+Cy0BUUJvWyr79x0BvVvE6PGjAWZQ4F5M8tcvfI
+-> ssh-ed25519 KQfiow mAmkvvvUV/Q5uNBlCzbd9pssRfrmVL2j/FdS7b87wSg
+4NvE6fhb9nDzZAAFZ8V7TH7HlI8pneB44miqS6u1Eew
+-> ssh-ed25519 1o2X0w 6BVN/+6QeL+kfP4InEY+jS6khB6NDBWAXnqxUEMFAT0
+y/nSLtF+ViQftlahBPQcGDKcJpDNva3drF6cKC6kdZY
+-> ssh-ed25519 KQ5iUA U8mS+gIc0tXxuPbObNsd1D1hs55JGGcI5loPqrSA+38
+od25qdUN3i3TW82r/I0ASH2TcdedB5fx8bIruiRFvTE
+-> ssh-ed25519 AKGkDw PYy1rFbiygNpHGvLLjpdL576kBK4ZrJMw2xfgYobUks
+VBPTCvuR2sU0jxK+R7PuV32EOuCUL0I7t1GkVeHhsxc
+-> ssh-ed25519 0eS5+A gOl/bjYvFdjKqumiQqSEXgi50Q/WFhDcE9avn2IhT2Q
+O8tSrAwn4rFwgAeKEvBtsjotsQLL1YnUP+Pdv+h+nJI
+-> ssh-ed25519 9/4Prw 8nFSnwnJK2Zmowndn4+oHcZB3lnnc+ftwzulMMLDVig
+BSnOn7wQ/wzeP1BU7aOYkq38yP8oxlxwJ/NP4xAkQyc
+-> ssh-ed25519 gAk3+Q 4874w13segiQbbAIN9qOMOG8/ZJJsw/Cbk8r6x6wHiU
+hiDoRDUe668+nMEeJAmRqqMXvURsm5IZdgejUZ01dx8
+-> ssh-ed25519 X6eGtQ EDpZRMJFeVi9frrLX90RdgY9I5OhDZiL/mUqLjNYcg4
++Pl91UhUK6JCB7qNHCm16b7pzzWPbyJJ9RwbItorMLk
+-> ssh-ed25519 0ma8Cw r/yyr38mx1CRWbrcws+CzFQIcDInpqqhhXi0IwlUPn8
+7MfAXxEt6TYNCglqV1JPvfrotXXFR98UUp0D8iVjg2E
+-> ssh-ed25519 Tp0Z1Q vuqbPEbx+M5BeXNvdV4MW61BqTqmATXP41krZYrqGlw
+FxRpxiYob2OrdL7KmWfExCsxqj7F6rGc83H5xkokKwE
+-> ssh-ed25519 ePNWZQ sZV5J+AbDKJY3JCfMMv4Ar+6dZsfvrUJLuwzq8ZF0zw
+yA85IpelgbbdklaFTkBJhs8KVCqi6gbFwOPplZXPcDQ
+-> ssh-ed25519 hILzzA dUPwyiJPkVnXA/9rfY8a5CQTDYaG+bWJBmWNXbI551Y
+l7XxSTndJ1/OheLTHg4NzkKmFQmUljttxqTt+SWcQiQ
+--- T0uccGgB2l7+horZsw91HVYl2FA1bZo8gJZiXzgTzlU
+<EFBFBD><EFBFBD>"<22>#Qi<51><69>q
^<5E>+<2B>$<24>1<15>4<EFBFBD><34>GqY<71><59><EFBFBD><EFBFBD>G<EFBFBD>'<13><><EFBFBD>򎠖<EFBFBD><F28EA096>.

nixos/secrets/gitea-runner-token.jimi-hendnix.age

@@ -1,49 +1,53 @@
 age-encryption.org/v1
--> ssh-ed25519 ZgrTqA zsIOhgeJ7P+Ahrrh+coSbVgxw6RtPymZs5ll8X2BpTA
-ON9VLFUzhFU/sxslo4Wt7EgohGdY+k58ri+G5naolLs
--> ssh-ed25519 ZaBdSg /OzROBe2BME+hsdWTna+UV4tIEJK9lDDaZQnpUYWfmA
-PjU8bzoct2GPytjXMxbYdPlGi9RgfaGNdlcdx8X9mcs
--> ssh-ed25519 MHZylw RKGcQyfmai8OeNo0c6zyW0KaZ4Mgt66qikomlON272c
-lO2AvsQ/3oWl0aNzitwjnFOV20H//wiuMY1MY/3WDrM
--> ssh-ed25519 sIUg6g 8at+Rg94MgOePuOA9fUCPuxyleQHDaGPnsaNQNy6824
-CCNrSkINVlqAhi2rzAEjnzX+aJBj8S7D5OjOc7+282I
--> ssh-ed25519 TnanwQ JQ5HncLZsUKpXbUhRBvS+UdMa8ARJBRIK75w2kuD0Hs
-6giGtalrSpcO2Xb7IxCvqhi7Op/wdNnhPqGOVxumutc
+-> ssh-ed25519 ZgrTqA sP6niy4AoOncOBGzEvJuN/a+32uMfGMkJiDG3zDPRh4
+yfGqppiyaJ5QB77XT5drEz87dckqy0yPourcmXSXFhw
+-> ssh-ed25519 ZaBdSg ZPaUwjn83U4Ma2JKsEPXHE2/ctupI/OE08Tv4NYjmgY
+kvqkmSTeNMh3Azr9fjZMpEnVUOKKhdYtizJarUAe3Oc
+-> ssh-ed25519 MHZylw uL3mlfZ6fiW5ZpFvMH42X4j195EbLOPKdCCfNmCRSlg
+0U3It9ckLP0Z0xA2RO8NoL7PFYGDvQegeCVHmjos4VY
+-> ssh-ed25519 sIUg6g aw7Jbmm8NpscmD+xa7cbpbGkzj4nM9c+xNU2asOcd38
+rZiK3hfgFgNgrmznwTPDgsjQVwNPyEszKq7mJDUMqBY
+-> ssh-ed25519 TnanwQ fNcNJfc9ePSL3jJvsqnAPKAwkM6WLVsWhsTs5nl0fnU
+35E52O5A1NkX6u6AL+kJ37sdJx+oagYor/ClTQrGf1A
 -> ssh-rsa gwJx0Q
-q9YKescXHdvkSEEL+buHyFpedrkyP8KN+U5mwe4ML9bdFGsEESBjtwRs+wTHBKfR
-DGueZFt8yloafYJJi2bDSOwQM+YQ7l3I9pmkdK8xppUpoxc5lsd3za4tZvl7Q3mQ
-JMgqfQ1pwpPG8YnKEnS1rZ6DFq3wJ4dH5dOkEcSkUflUse2GrVpkFHA6B0iF4Fth
-F8cpVOpBh8zruRp5b1hNlzuC+4E4fgLC/dqo/WK17gEQmPBoVLmZurAsLUz63VBR
-XJ0cphb39Jx+OqID0pfoRx8F7pWNMXeziQ/figtfX1BVsvAgAfG/G52UQIHPBB9l
-lRbUKp533f8J4B3uQlplAQ
--> ssh-ed25519 YFIoHA As3dFA/KZEv4uK3cABiksYAbbRKD/SAYHn6DMu5A/ho
-1Gui6pI2/Y/4fhL+sV+ReE/Q8YzOXpa+el9ieDI63hg
--> ssh-ed25519 KQfiow JfOvjZPAjSMEtyMj1ES5hgZQ3ChceOAgCUlAwdUWvHE
-cHOS/ogIjIt3/cpcsip/OUbTa/XTsqabxpih0Q4d+vs
--> ssh-ed25519 kScIxg Ss92xRhzfFLuQ7cZ9qOXWYlxPosZJiIA5WUtnBn5uAA
-eFbchoQ2WFT5QZlbMp3ie2IO+oN1gDx5LEHYgtmibyU
--> ssh-ed25519 HzX1zw CXFvvKTr+chLDjxeHIQq6YgfsyNguoqQgWMVCriq03s
-AfZclyaLfIyVgRsSt6gFw/n3Gmjz9+qqcbS+jKLUTdU
--> ssh-ed25519 KQfiow hoWtmj8tL3hYQaCusTzoEe2wy/hzOBQF/+ygYN0j0QU
-lvfAsrOv1vtQeYvlacFyg6rlEUeb2nwxelSCkHZL1JQ
--> ssh-ed25519 1o2X0w hSNKyIkQ5HrqUodLzWRrx+7RkxFg9A1TVuXbq+EFlw0
-CXUpZnKGuXV34Tt4YWGL1hheYHSYB2JonuxmZC9BNZg
--> ssh-ed25519 KQ5iUA jbUaWkNa1xj8gKEalGx7wJWcVwwDWQ5Mzq7kw0Rk3BU
-y71HcF0ApASye3RgUHEThP1aFZZX5jocKHL25qZ2yZ8
--> ssh-ed25519 AKGkDw n5MO4SkU61QWZ57aG+383Q3raFRdomDMXGaDMgpQUSs
-4g2UfsdaNa++TRXNrUfVV8pj6irb0W+F10XfVAPJk+Y
--> ssh-ed25519 0eS5+A DMk4jzjnfPWzk3kz1gwebXqJ5a3yAvqTi1fXCEBLi2k
-JL5wGUcHNQDz4Czo6yQ2Eo5sc0/psjo0O0C9unL3V0g
--> ssh-ed25519 9/4Prw 9RMdxeyRXz8pKxAaiOrd/D5UdImOB48C0OE4x1MbSnw
-5m4g4ZSMLP99bYR0+twroVvnowpGBPolw/u0T/wDCmk
--> ssh-ed25519 gAk3+Q Mos0Csznmt3wZF0fE+BKlqTMJgLKR/+Yih7DTNaLF3s
-EfaOXBbeS2q36lUfydPL35GcL0qzxEyG1/g1HUk+Bjc
--> ssh-ed25519 X6eGtQ 3uAhhDAEQQCu7MQmNbEAs8/bDxEeh50VefU+prQN5SU
-jdp6QFF9Yw3zHrbmijJQV0CqlcoOm0BU3fkJTJAsxpY
--> ssh-ed25519 0ma8Cw +7QmGjIuxHsqeDxeLkiSvpaC7ztv+Ix0rEwEhbTeHG0
-DUHK8xqoxnE78AMIh9z846eWcSToc6PruVERTOCdya8
--> ssh-ed25519 Tp0Z1Q Alv9QyL6AzdLRTyN8pn413eeKW32ql3i/WVhasuKETI
-EkkG/JknXDT5opzLSZ3Gbf8d3+FlHwwxzbZK/nCQ6ng
---- zN1cSiDL5ZI84c9DI4ewQLqaGZJS1IR6EoSlpQC44zI
-<EFBFBD>ط<EFBFBD>ۨ9<EFBFBD>H
<01>G<>.Dh{<7B>:<3A><>p<EFBFBD>2<>yY<79><59><EFBFBD>`<60>o<EFBFBD>c<EFBFBD><63>$ŵ<><0E>Z
-<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>T<EFBFBD><EFBFBD><EFBFBD>I<EFBFBD>l2<EFBFBD><EFBFBD>O<EFBFBD><14>P<EFBFBD><50><EFBFBD><EFBFBD><EFBFBD>$<24>G
+YB5IPtZbaRykPX7AAxgzPP5E2dsw/2ONrZPHBFH6lGi2uiwu1S7EIHCvcwod+K63
+qFzyrUBjsrjIX8fvxq6A8MJM+eEO5b+/T57lqkPP7LbQdMNrJnnzRQMke8+ei/sP
+TxPobhgFUu4tr/7czjkm4zlhlERoGx3ntCXfMsz0siXm2YjmA6YAO2Acgo5pRCV9
+T3fs/svWxroVK4vwmHGGct4AuEc+uO+L21UQPjs4ZWmyErwozULva4IY7Yf5xK43
+0pFzEC8U8fZiHt+7LdT73Jg3S2VC8EtRSKCZngdTuFeXBFzeHoY/OKhCe5omkxk+
+Fo9S92qwmzUG99O12esEvw
+-> ssh-ed25519 YFIoHA EuJL9LMHXM+LfMVr4yyGdvuY84yR2+SFwaOWDJMRQkg
+B8XIbbk4lL0CSWL6pa9VPWSqpRl/rYwfub6d3Bmo01s
+-> ssh-ed25519 KQfiow PD8GnvQfTkSmjibvob/8mdxaz7BNYbeF2cWeEkjmlU0
+lRYL58OfPKgM1uo7TpnpMbxeUkyU1bK/EUekEYBOlgA
+-> ssh-ed25519 kScIxg etNtwcVT0aKZcqcdkkSorPCYfRnCwS7nzoVP95uJXRE
+wUi4ILZykIzDphiUyAuDhXahVg+jgyr/2jMb6UWIDvc
+-> ssh-ed25519 HzX1zw Z1Q2LCGEULPMYDn1zey+M9eNM8L4oughwfPG7ZWPvmk
+1o1ZayfZHbpksk/B0OE3wvSZxxbdZuSdTsf+rxK4dHM
+-> ssh-ed25519 KQfiow klFY1JQborTQIi1s+4VbwjFyE2u+EKHz60/jb0SRx2o
+Ly8nlwvtj+FgC5ItYkOxsJS3gm1/7xp5Z+VPpFbtpUI
+-> ssh-ed25519 1o2X0w YuCrWLnH3i4ROYmy6sJk6Sv/WU+RFnxbtfgvgi4Pan4
+yrFZs5853i9TUZKLIYBnlqVtdKsNuYXJ0y+TmFOA9bA
+-> ssh-ed25519 KQ5iUA sB/drv08oppdGHw/T20wM7nopA4j1caWjyzGMmDXBEs
+7GQ7+861qCHWBMQk5fHsR6SpNrMXgRWnGnA3tnV0J7c
+-> ssh-ed25519 AKGkDw tYrmiz1XFrdOBpScEeQgAfpXJiF7Ibr1LiC8/JCIxV4
+2ZjKE1jUEI1pi+EEqVu7dEnH5CU+U/dhwUz421j5BvM
+-> ssh-ed25519 0eS5+A 4ROgGPec3GfcvIr0aHIMaLkmMm60SDKq2vTS40lYKGw
+nAmzcALNfUiwPWLmf26CpR1YVzsvx5A1tM3ioJhsvlo
+-> ssh-ed25519 9/4Prw AwSAFlqHtzMCEfIh71CSufeCXhNGiQ8kp8gh4L7laGw
+y9tsLjmloqAe/zlKwPnudHHZaRL0Cw0p0+GEY0ok3c0
+-> ssh-ed25519 gAk3+Q IF6imwSH+0/XQtsxL1QcwRYioGShcK6AF5SjzzNpwx8
+fkAJ2vfF0sGBVI4vvTkiRJPA/tESjTuB+2osp6LqYes
+-> ssh-ed25519 X6eGtQ 62c7Y/MthvH2L9sbbYbVKMhRF8qXWfWRscxtDZVN4hY
+7xfULkdrsc7WuKhdZCMGriRJXTjiTG+eund2d4pnC8s
+-> ssh-ed25519 0ma8Cw OndnmJU2wuCKyDkIRETf6nuQezgrZPElJc2QWagB9UY
+t/lo5WN6QMSXgEn+KX8pCXta/enG7X6eMi99+N0romo
+-> ssh-ed25519 Tp0Z1Q ENNyao40XIGWU6oYTYpCJ4U3jz62whUk36N4aeRz6VQ
+rJR4iY0K9gOJVRE9fms4qeGeqvKBZsooH/S/nQgcttk
+-> ssh-ed25519 ePNWZQ aFZ/We5kGaVWRsJjqjHC7Q/VC9mI5sjasJub821LpXM
+a9nrDrNUKcbYXVT6kNtDD/ZHQ4l6FkD2kY/kqzkHqyk
+-> ssh-ed25519 hILzzA zSldTXdvyHKkoePZ9Q8ouCWpucslG48KRBIcRCS10mE
+aVXXai1pDqz67g6TwoggiaZ9DgVFY/JmuhHdJyDifus
+--- 7HTdgWTcmzZAAcD1JYjGrC8KuULch3L5/MEXQPB/F6M
+<0B><1F>0|5<><35><EFBFBD>^<12>~
+2<19><>}<07><><EFBFBD>"s<><73><<3C><>qP5<50>&<26><><EFBFBD><10><><EFBFBD>hȠܘS<1B><><EFBFBD><1D><>4`<><7F>=Q<><51><07>f6<66>r^<5E>

nixos/secrets/gitea-runner-token.nixquick.age

@@ -1,48 +1,54 @@
 age-encryption.org/v1
--> ssh-ed25519 ZgrTqA Hv1BMWICdw57RojY05L13liVfrg9qt6WxhiK6SAnqnc
-vveVXJsn4MVYTLX/HvKaofXWOeJ0IMdWSeDljKSlSwg
--> ssh-ed25519 ZaBdSg iyNGSlaHdvTctpECP5qXFSO0gC0skd25gCidX8mJhXE
-4lC4UIFuPimSfPuavLjhR94M5roDeco5yRDClI4P0V8
--> ssh-ed25519 MHZylw a8Ueer7YzQ1f4PPgedktuyNWa1r4cE3u2nDU61nC7UU
-SETxeXg59NOznOfuLvduM2tKUolThR+CNWVCAj4fahc
--> ssh-ed25519 sIUg6g A/C7Vtugn4p3w7gc6s/ZBbTIUW2dOEcGwSVfm0kwY1c
-66bSBWF+ZVKHvmEi+OEnfQF9m+7u+W0VnbDHxw9WY/Q
--> ssh-ed25519 TnanwQ E2I98KMUGzMDiyJLUeZcLpb++1v8udmnONioiVmVzyk
-Sbc6bfi8VUyO6eBBkyv5DoEfVNd99K1G8NexeDmuDhA
+-> ssh-ed25519 ZgrTqA KAallXaJm9d3NA+JofTDTGO7DWLW/3nnPwdENTmWb1Y
+g7ZbN/HSQnq6s0q/kODuUErpeGmva8cigKs7uWEKLQk
+-> ssh-ed25519 ZaBdSg L4iLzfCax5N4NsTo1FYh310fLaXy8uP+Wjc7yBFrtGI
+AZdap+gnBw1m82Z+UKejMsTaKimEhhpjINETmL7E1AE
+-> ssh-ed25519 MHZylw i7iKbbyuyjDyCNbQt4oPew3yrrQadegbONVrBRCHaTQ
+zkSp83E6YiqfrLpL7zoiQ5ysrjtwMkMLQQ0/ZKXClWE
+-> ssh-ed25519 sIUg6g 7hL+PB7PZqa1JWZMUHxKWyvccyDk9HmtVqmqIWeqvDk
+0zGF8d2u5Y6+hIEG9VEFEzck1dTmjdf1y8RlVi4lXfc
+-> ssh-ed25519 TnanwQ 6vRamxwaQxu+gMknMzbxuqFsVVzZlxdrfUDoGkVS0zA
+tlGEWc8C947o0MyCWa+Jt/NBQiQn8FqaCJXkLcUPaSc
 -> ssh-rsa gwJx0Q
-vwnSvESPfLtlWVchHtsmPAYqUnSoKIjf16qwk6rKD976cDQt8TEQqKjbGExHNBZF
-hnXfPxLy4at1cJzPCVOsumGVdkTkGPhMkyOSTnzipGBA0hiFZ/YKmoqyl8MnOy9H
-RVd51JJLdmUUDUsVLdv8DEbYw2mTmLJsoum+LXi1oYHrYqhQvC2PhXH8b/jfn0En
-vYrzIxbFaJ/xw6o+T+4G/5d3DCX4fb9ccYHnLhv9GQWvQPH+wEfYkKBaxriur1ir
-9gkE1kErSzemr0sND5NoZKkGqf4P4ear3Vnjtf1gg1Can3Fqutb0B9ou71RD111J
-SupcBHc0D7Kc47CTzI/V4w
--> ssh-ed25519 YFIoHA HSIHZ70ZSLrbeieWFfRI8Syj5QVr3X3g3J68ZEsOSSg
-8veYBdbZfkqQ/7YvpFeE7pjWR1hZ9HF4JfM5yPUdl3Y
--> ssh-ed25519 KQfiow 4Ofzo/KS6qE+bb2O2l9p+Xl7sVSyYztBW1wy7e8aGCk
-gzeCLM85g+tSGYFAM3z03HVwyO67sriOVgL6uiOGWV0
--> ssh-ed25519 kScIxg MNZ5ZwjuGahkB/N3KlIzCwQjtenikYhCcqOqUsotG3c
-SvDAuGNWu1SG7EEQLJboFJ0VKEAbcc1rZbg9LCdxtyk
--> ssh-ed25519 HzX1zw 9Z3XU4h4otPcP+3hx4gA3t3/T5RJAOyf/Lm/gWK8Y28
-WEpitv/XIXxHg0Rmf2zibIq8Vrf01ieEPJ9teXgHp1g
--> ssh-ed25519 KQfiow HF3fZ69+NwB+1tyZDoBb+vL7S0sAB4VtFbteA8l3myE
-EPE0dZ4HAsE2SLXT+BlDUrWGGNKlBUQZLYVKiOYwvs0
--> ssh-ed25519 1o2X0w NQodm0eoA8H57E1Lgt11GubQIXXn+9a9Ho79akD1FQ8
-pG8VFyXUBsrTKEZnR/pCU5pZaIBu8s4l02tv27IFBO4
--> ssh-ed25519 KQ5iUA /XRx2bwU4u47q0pmFFjnmopgeAFDRcdwVUgiZvFZBEU
-hb7OR5qsZ2ctqoi9F9yoJiOSCMIEFhsKTxmTzTlNcgs
--> ssh-ed25519 AKGkDw MDy7x7w+m12Un+WJzIjlT1sqFUqyMgvs5cUX96YtTBE
-4idv3M2g8lkjGTXiH3zxR3sORP3K6OijlCF2vTlGDs0
--> ssh-ed25519 0eS5+A GxaSMOtNOuri6nFhtEmPCUAYO7ULTRgfhoSEhwsQhTA
-eFGFTZB2z4zBOp+yuU9ryvhNh25v5S5bT77+XYlZ3eo
--> ssh-ed25519 9/4Prw 2dVb0418rDvJEJ8yYDm3+eofjwEA0r8tuloPN+VC01c
-uVjqjHdZCvfZJKZukaDT0m2SL1S0CMB/exuNeIEBlH4
--> ssh-ed25519 gAk3+Q 659Yfnz4QIdJCq1X3FxiDyL2F9QQEBSxyjnx+SCl3CI
-VuGpJwysc8y3Mq/HrIJP5DY1DdMJC7QlXTlyoCaWbzw
--> ssh-ed25519 X6eGtQ hYe08q7Sofe8mdwVTCitTayJNbV9Tl9Bkt4RPexxMDU
-FhU5gPGYUi6DBMt2O1wY5uL25dyI3aGhXEFXfgyUgBQ
--> ssh-ed25519 0ma8Cw z0Di7JjAJLIcQx2+B01JVBRbmh9fV1T0+Q6E8S+xGjw
-507pjrUEDf7r/DY0zC3gGj78uifvpe13BHKVtetSPFw
--> ssh-ed25519 Tp0Z1Q PMwAaVX/1envqO+cf93hMvw7skIHIwDHizPpjn3zLWk
-sNGxgzKWwS29pTBnv8YVQwGm7WzH0LnYXfqYjwsJ+gw
---- 7ziHLKL/XsD7aJ+uEbNNNwxEC05vAINt+E5+Lvhm7oE
-<EFBFBD><15>;<3B>K<EFBFBD><4B><EFBFBD>Tc6L<08>$<03>s<04>O[3<><33><EFBFBD>U<EFBFBD><55><EFBFBD>t6<74>s	a S<>n<12><>#jE^qh<19><04>5eɈQA<><41><EFBFBD><13><>2<EFBFBD><15>I/
+SnNMJbhqxWsqMZNchdohyc6Hi2PJRZiee2sKyvvH25BxgPJHw7S6PDte8SWrgWFH
+KWNnjpd2RnFqJfeYiu0qbGaNsRAI99wxyMOC0SmDceg++RCfvZEKIs04llf9fvQ+
+ab/Y5GezpjjWDH39OLnWD0wukzwVu+yK8agt9JcbEEWjbn/UjN8mPTEVY++VV4w3
+8IWZ3pnCsnIQxHdGUN0aXF4yRsC7I7TVKD2rDHxrIJzOclQCSiWfZByB2wDa5DPs
+V84hHeCkf4JKdXElr2Tf8dVtOwcK23vM2NbpbPxiEPMnoYgeGd73R9x4VIV8pAsB
+kbQ8zE6d+LO+TsrK1/9oXg
+-> ssh-ed25519 YFIoHA 3UOkdWBLYbRH7PhtBEqjX9A0xjD63ONIW/J0Yl1HEQs
+YNeSBIunjPE15CA39GEoVdMB5UrkLS1l/n0ngm3to2o
+-> ssh-ed25519 KQfiow lsdHi8xvUI4WNUQCrxr5LFDvRHEtlO/VBrKzNbOLGCs
+dI1pgwgo/TCbesf8D331rBzS/FTAdCHF2T14D2B2zG0
+-> ssh-ed25519 kScIxg jty48sh4if8Bt7IH9bIOqnQuf13zmnspFSr7pgyR2RM
+zw/XYL4bD45cW302H0MqYDs14ZtEoWvB7yixwR2TZ9E
+-> ssh-ed25519 HzX1zw WZw8qtZX3AjGpEFb8c8gFse32uUevrde83z48jH05z4
+2AvX+mnP5OPwm6030cmL2ILl7j3RLU+FyweYuyecAzk
+-> ssh-ed25519 KQfiow 4zhsmYxGU9XHF/TcVfTEVfn5hFoea3JqesJ4VvX4JgQ
+b1ssWS7Is8R+Ej2BFCYQsY4oCotNEh8nj7WeLQdN1q8
+-> ssh-ed25519 1o2X0w evUbWnUB0Ok8picoVn0ldKDm5cVTkUutZ99uanvElV4
+hshiwu5uDJ3eZPvCoHWPeElVELr9gNQ85qA42H+PPGw
+-> ssh-ed25519 KQ5iUA nE7sWg802JHghC8NWRYuGvgSsN6MRPpm/BdRgO2t83Q
+jQ5ha4nR1PRgs2xuLpeo/W/EcoEKUpWbTWLdlC90LF8
+-> ssh-ed25519 AKGkDw KeQGXmuaFursrugf8u+ddgqbzN/ESKkyyYfln3jxYE0
+yfNls/7e+Fukv+zjJjMJCAQQkcEJXX1L+ZD3SQdyMmU
+-> ssh-ed25519 0eS5+A N5mD/DBTBBhi5ltyy/EYjR9GlNwyFc8r2KLffBIZtlc
+XLeSTdkOgGQrrACvCNhvEisulQYxF03ZvA5lgZnInAY
+-> ssh-ed25519 9/4Prw khs1EvslINRv9Yx5TJwL70gW+cTdg4UJB/7l8WgH8Es
+ONwhyX+rnZC+6WD2K6fDLw3t+KgiQt5/lvpsbBzkswI
+-> ssh-ed25519 gAk3+Q Hx8o0h3xeYuaBveuo4gKycn0KsM7J9OiF9Pj7Z03eAI
+kIVm0PDp2OT49ZNhIS/K9yFmRxI53W7oHc9v4J/6pU8
+-> ssh-ed25519 X6eGtQ wISwiR7Nj1a/784FVC+dJEV+2eNif93hSlE7Kn9DjX8
+CKtgttiy5x6/EH0XOaiz1nljRgLAcSycLkPb1Bdq4T0
+-> ssh-ed25519 0ma8Cw OkumQjJnLgc60Xvn5tby9cokoCBtURQBrI6V6u7/Qj4
+uL+jd32n718fJNcg1sQRXzafiMIjxAejQTauqw74k0I
+-> ssh-ed25519 Tp0Z1Q 3i8dPg6LgJzCei4YUr/qEpWKIo3EbOo2yOzlBCf85XI
+jNpGWmeXpY4EezdMfl9GftHgRYuTJSn/3CGWIjsQiaU
+-> ssh-ed25519 ePNWZQ /owyowojAjn49k1iaL2I0RqT9+Agw3jWTna+xhqCHg8
+7454vfPVu4yhfRsYsGVuXh2onCxKNBLYTWnQT5O1ul4
+-> ssh-ed25519 hILzzA wU4u2Hg3OWEoMvAnJvFVlSe5wfJok+s3eO1fXDeYlTM
+6wR9HVJqJ84sXKQh1cVjXh89k3ufl8ly9SSTuqcTgeE
+--- RI1rrLgOqHyWHSXIPj/3UDn8Hr4kN4XuTvdFwoDgvJ0
+<EFBFBD><EFBFBD><EFBFBD>-<1D>!<21><>[L[
+U{<7B><>Ȩگ<1B>r<EFBFBD><72><1A><>2<EFBFBD><1D><>8<EFBFBD>Y<EFBFBD>!|<7C><>bf<62>!ۉ<><DB89><EFBFBD>a)D<14><1C>k<EFBFBD>F@<40>eE
+
<01><>

nixos/secrets/gitea-runner-token.ryzen-shine.age

@@ -1,51 +1,52 @@
 age-encryption.org/v1
--> ssh-ed25519 ZgrTqA l7b6HZA5Pn8b0JcA4Drxz/MgCc2Vy96cuvJm024GBV4
-Qbzrab8vi32f9nL4tNuO1eLmL7t7l8ri083/bJt9TKM
--> ssh-ed25519 ZaBdSg xQvCrHhvZkKg6YVjrQidt5d4Yat0appAXOmdmiTCGW0
-jtMIU5mgNSP8jTdZ+Fc9Rtrb0N7nDEX4YWEcRftH81k
--> ssh-ed25519 MHZylw 8jPM+M5F8TVcRVBlYMw3u+anhGNDV+I9byTL+UdNUw0
-8tI8XcvFrvjZfdp7aMYQtOICIEpdS3dNwvB2NAdtB38
--> ssh-ed25519 sIUg6g QUlb06s5McWj7TQYV5OtiE/9rIOQXMZkMstC3nbM3g8
-ZSuvWblNVwUGRlav24YiaHaCSVu9uIn5B8YUoOQTfMg
--> ssh-ed25519 TnanwQ jC5hLdBycUMEo79xZH1dC0dAGDWNfK5f1HeTbCojqQI
-VyeoOHLGLyTOjpQL9Z+DTYVQTUbKAJtVWvAtS7Xl8Ho
+-> ssh-ed25519 ZgrTqA CPrjj7T5NeRsez8trFCuUa3RHqv0R8asSUNzltE+Jmk
+PQB3AmBVk5qJ6apWRXMdFMZNiPrHWg/ez0iEed82nBo
+-> ssh-ed25519 ZaBdSg L0O7WxoubsPPQ2O+m4BEJ9AgsFsxNgVm9o611koL4jk
+LoVXuDhX+zwzgmm6DcgHGC8ftSE89UNqp2u5H+SyI4o
+-> ssh-ed25519 MHZylw rV0KEGnqdoDm1rgalNxpz1bNr+xRGF6QV24QaAnohWc
+YzdAcO8K1lMoti1+E0GWL3ETh6rzxi0RMUWBFbqCh48
+-> ssh-ed25519 sIUg6g pJjRKHyRk6UG3d9pdDOe5+OWyU8YxjiruCG5sesDQSQ
+sRFyPunqdheU1vdCBqTJVuiNTvq+4V+Ty+1gUe0wxBs
+-> ssh-ed25519 TnanwQ 7qUae58rs3ONPXO/ki/f22QudK0vDw+fGMoD700wBSs
+oE6z/V2mj3WnF2POTVN66iWSaDBQMdXOsMhGCmkU8TQ
 -> ssh-rsa gwJx0Q
-j1LuNJAQUtCVH3YBG0wHXOtuJTb04sXmO2NVAqNdpMB4IDbwsdModSpsolLRW/sY
-QI8pTyPUyelGNvHWlaTEO78uaAjhB087cOPLNQjzuJjfSb/iGvgT3pcbKQCUs/fL
-UeQ4GEn1osPKrQa/Ywq99p/ZIUo8cWBoF93XQu5TL1Df6N7WvqjnyITF8iq1Y7UN
-XqJRSHtSebbzQ3I8D1uxpQHKe/N0R38i79Diup4uSK92Vu0hOZBOtXNGXbFbyIPd
-s0qLefLab/mVqqlQLTowunXSpM84dXp88QvU93erz74yIjmIzjYq8/h3DJgETkSh
-ef7OahlFg/foYR2j1EptGw
--> ssh-ed25519 YFIoHA CyCFDmrT1afqK5jkipGMzF+Db+wzqpWSnRR2MIZdaE4
-Tlf8meKbQ+r7oHYwLj19J+6N17IL/8NJhCruJKUitMA
--> ssh-ed25519 KQfiow GBRy1163xGhooVG1px0ETlkuVGiusDf/JYCAIwAjGH8
-LjFxa2JI5ZndHu1YToGRjotf8gDo6gYexSdbwWidhc8
--> ssh-ed25519 kScIxg fJx/JjS8tyhVKbyo9V0xlMiZBhakIFj+zfUeNxYWOm0
-qYP82ArNgJCIlPhlEOnM3fnDJnd9RkUNywlHeOvoLyg
--> ssh-ed25519 HzX1zw HTZ0CSFMYuh5Ra9nAm6TWu1lpv7BuQ+40L5xBNIHISE
-fYoRzc17wWT5XbF5q9qRfHQyOenjEkpKhpH0HldNGiI
--> ssh-ed25519 KQfiow sW1XrFS7i5LeabsgZcAnLOkYe/bRaD6LSebkoUBncAI
-HwwrjK3y79fUxe4RH7pYTS+Cde67Ab1eEZpD5co5K6s
--> ssh-ed25519 1o2X0w l9kJtrgEg2FixlWurLcyGLPJ1mnelNfLHumTBUzpCyQ
-h70/N3WdlC2U80swdJCsEKyOxKab5Rj4oi7QhTaFrhc
--> ssh-ed25519 KQ5iUA GgJtHkp7ZN5nLNQWxXeGryc42t5TMyFR6uFCo8mewEA
-4N5/TMBOSuMR4FvvjCBfIw5x3ZyoXsFr5Js5skhddew
--> ssh-ed25519 AKGkDw vQGsaD5ESmjKCrb3GlsGFrQy5vu2fC3EKDfFRLvqoXA
-QZJk2k9HqbgQgPF8cJkiXe+H6F8Z74f1b7F/+PiDg70
--> ssh-ed25519 0eS5+A j44yFKhyfrvTGHqKStPnfD4NXs9pzLPaCrkAGLC9Xw0
-4oXlhcN0z2RIziOEp/8Wh9rTTDEEMBwkWKDCtpsfOU4
--> ssh-ed25519 9/4Prw 9qIDRdHxU/1/3iFNF9K5T7dmpH3V/ClNCRkYUyCJORE
-dDBImEifhhecn5pH8D+XgPpA391rgDHLKO1KZMHxBts
--> ssh-ed25519 gAk3+Q tyfFkdySrXzo4MJl1oSkrjJxiQXM6O96trOnw5G53yw
-6NYRBoJte5yTRIvcuKCsKBq4W1852osSEfBjU8rYmjY
--> ssh-ed25519 X6eGtQ ///3dXDGSC5uX5LiGmavuWX3DVvdWSvl/rqbBUb6fDk
-fUYA8tDoN5d2a6jYrgNHEBzexNWNq6KlTSl6rM53y/E
--> ssh-ed25519 0ma8Cw xH0J+3k7olUKPwDv3VlIXbEG/9Rjw8vqpSM3sZ9yNAo
-//kmMwpmnEGr0yezK+e7D95M3dvDQ6eue9UiGxxJD4E
--> ssh-ed25519 Tp0Z1Q vWnA3ngODCxpeJ8/AuHNpBOEjlotJNKJp0CTMW5eTGU
-LKgXRPEV1U9EDCM8R9FUmdpO58zs3bHn6Vs0wXPb/CM
---- gnNjQuPf7DycI857Ipcq0BxEr2tKePqV33VnyAopiqc
-<EFBFBD>7f<37>^<5E><>u<EFBFBD>]Kt<14><><05>
-G9<EFBFBD><EFBFBD>E<0F><>#8<>j
Sz[<5B><><EFBFBD>?<1F>,<2C><><EFBFBD>
-
-<EFBFBD><EFBFBD>i:8Жb<D096>΋<EFBFBD>69O̻<4F><CCBB>i<03>MBm
+wl6GDAMAtSrOKHDGJ0dYgyIRx7OmJUCW8tsx8/+V21Ej8xggIs3vI38pGI0a50U4
+kSfEGbZ11JeCu6/tB1/nLLAxphlYQ7b0N3JdDfq3HMUaDwH36M22TuFqM2ImIHv0
+pbbMigEeV+3wMZWyxWXtdykir744++PfTqORca2djDHxcSeRYI0EtIKBy/2FV+G2
+gJMkH5NSwLLRtE+UbLxQWpuf1MwKcxAKntCB2E/uXMCjqcZyaNRsZ93tzlRGNPTu
+bX08JqQtrEt6gliEVu++vRXAw22akyCc37g8moEwBbbzQpN+xlzOO71jxjIC/ngw
+pSoKrBRA+K7Fo7ddkLRA/g
+-> ssh-ed25519 YFIoHA 1qWAqxlBztJsh3pabBIrNUxYcG5cFfF+/wmbM4apiww
+MunZIq7qYuKbb5tfY3UGpciL4wF+l6Gm60sh8Ku9pQg
+-> ssh-ed25519 KQfiow EP1dxCL53vb3kbhXjaC8E+jSBs2q3+un5Kh90eYpO2A
+n7H3CuFzNg6QqWe+AgiOvltsdkTpxIO9mxtEn3SXlsc
+-> ssh-ed25519 kScIxg H+xADSG4oz9cibgjN1/6+ftob8AQE9DAhGgJGve5GH0
+zLXmA1ITGRCWFZAWAjcZjZk1Rg5XiT/XeCM0q7FMEcQ
+-> ssh-ed25519 HzX1zw XKSGYMAAYBiD818wBZWoscMz2acQpNP2XbVjRulZaQ8
+C4uawHEOl+Hy4LBhLB4Y2vCR4nQ46EwnBFyZoJ+7xYA
+-> ssh-ed25519 KQfiow vnZC2GU+eb4eyZSRTiXBbI5Kf46HyvR/puRUWc5d6Sg
+/9U/ru2Th/H+E5d2mldTo2ZO0uo2Ik7kpM5mqvJz0HE
+-> ssh-ed25519 1o2X0w bDozNoD0vRnQrFLBo5N1EckUNOVXgmNsnqMuO1O7O1Q
+eCMC1Jg0rhHlo7Ypp7Yr3B7zBy77ppt3A8GSSgI4DsY
+-> ssh-ed25519 KQ5iUA 2t+/W3pXYwiF1Upfuy8+vIxFtw8Blggr6/LXFJi1FX0
++6BsdojuS7dB69RLjFxSuQkzhdP6Ku0Jthls4ogSsSU
+-> ssh-ed25519 AKGkDw JfA+G0ccMPfpazuEKf1V1Xjb+vwDFfyVDzHxMhQoK0o
+BxZn0d+TMJs5L3CG14bHN/kboclC7DM3TZ7n7KjBEOI
+-> ssh-ed25519 0eS5+A E4piUd1KILBvVfFU1kgj5X0SgekOHQqWbLxErZHObDs
+VHj6c0B+U4/KXOZlYI0hCQ5pkp5qMiIgYqbe3WwcnQ8
+-> ssh-ed25519 9/4Prw jqtBpYw9LZsQmvwmNiP/bNZYpgSJ8zDu3fx2iIol8TM
+wfX4POaKNEGezdrYZrEdjumebzv4iS1lu0p/K8/2yXg
+-> ssh-ed25519 gAk3+Q 4D6BPLfkKPNurNqUL/JU8XZxKE+AdfPHvBBfeNwS1Gk
+sJafikLuSqXFhe25M4ftaX3eQVZ3rPJvxaXZV6KKVMw
+-> ssh-ed25519 X6eGtQ xdDO+LiOHlU4FVOOHdBopj2ZB6z1F3rSyAgivz0YKzc
+z4oZHwyRR0K+v4K3IZoNRqy1RZQqMr6p4HN5LTznOKM
+-> ssh-ed25519 0ma8Cw dyP/HDlpaEMvVgluPMxf84c9bEcL6hM7MWLNc+jSFGQ
+7fpKsQh6no3U2FgJi6I1eiR2b04vZs/OMcE+ruCeHVU
+-> ssh-ed25519 Tp0Z1Q d02Fj4muSbNTJ48jvfZjkdP+DwGaDLuNdiBH5fz/yRA
+JIF2uJzw+5ztiszAlrQq2KBM7w+joy8xZY/lGO0j4lw
+-> ssh-ed25519 ePNWZQ L/ui8x1wpfFsd8ajp+sXAWe/vTxhvjBPOweLBlp8R1o
+NOTLdHRmz76WtLT0SNw2hINQ/7+sD2X1kKp/onCbFgI
+-> ssh-ed25519 hILzzA 0q0ZQsrl5ws4kLuXQdOWqJT9hUGnLRvvy3W6vKSliFg
+rIHtbHdPt5Z1L59ha2qJNscwbivg43gROhpnwP6akRw
+--- TlXyvptuilmI9g4ZpvTOj0zCtQpmVnheItCp0FIVwuQ
+@3<><33>`<60><><EFBFBD>Hˈ<1A><><EFBFBD>tG<1C>9y<39>/<2F><><EFBFBD>fژFm<46><EFBFBD>~u;<3B><>p7<70>a<EFBFBD><61>`<60><><EFBFBD>Se<53><65><EFBFBD><EFBFBD>e$@T<>8<EFBFBD>Z<><5A>%<25><04><>k<EFBFBD>~F