System Gen178 @ 2026-09-11-01:10:29 by jonas@monolith

.sops.yaml

@@ -4,7 +4,7 @@ keys:
   - &comfy-station age1xkmnvzus6fhundn4c0f6hyuwrj0f0m7x3hxtuhnez6cecr6m032qalw308
   - &monolith age1clh2c489j7mx94aqr44u6k2cx5axqme9rlshqu9l2mcynluwhq6qwn0sv0
 creation_rules:
-  - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
+  - path_regex: secrets/[^/]+$
     key_groups:
     - age:
       - *jonas
@@ -12,24 +12,24 @@ creation_rules:
       - *comfy-station
       - *monolith
 
-  - path_regex: secrets/jonas/[^/]+\.(yaml|json|env|ini)$
+  - path_regex: secrets/jonas/[^/]+$
     key_groups:
     - age:
       - *jonas
 
-  - path_regex: secrets/comfy-station/[^/]+\.(yaml|json|env|ini)$
+  - path_regex: secrets/comfy-station/[^/]+$
     key_groups:
     - age:
       - *comfy-station
       - *jonas
 
-  - path_regex: secrets/harbor/[^/]+\.(yaml|json|env|ini)$
+  - path_regex: secrets/harbor/[^/]+$
     key_groups:
     - age:
       - *harbor
       - *jonas
 
-  - path_regex: secrets/monolith/[^/]+\.(yaml|json|env|ini)$
+  - path_regex: secrets/monolith/[^/]+$
     key_groups:
     - age:
       - *monolith

flake.lock

@@ -1,5 +1,82 @@
 {
   "nodes": {
+    "cachix": {
+      "inputs": {
+        "devenv": [
+          "wordle-solver",
+          "crate2nix"
+        ],
+        "flake-compat": [
+          "wordle-solver",
+          "crate2nix"
+        ],
+        "git-hooks": "git-hooks",
+        "nixpkgs": "nixpkgs_3"
+      },
+      "locked": {
+        "lastModified": 1767714506,
+        "narHash": "sha256-WaTs0t1CxhgxbIuvQ97OFhDTVUGd1HA+KzLZUZBhe0s=",
+        "owner": "cachix",
+        "repo": "cachix",
+        "rev": "894c649f0daaa38bbcfb21de64be47dfa7cd0ec9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "ref": "latest",
+        "repo": "cachix",
+        "type": "github"
+      }
+    },
+    "crate2nix": {
+      "inputs": {
+        "cachix": "cachix",
+        "devshell": "devshell",
+        "flake-compat": "flake-compat_2",
+        "flake-parts": "flake-parts_2",
+        "nix-test-runner": "nix-test-runner",
+        "nixpkgs": [
+          "wordle-solver",
+          "nixpkgs"
+        ],
+        "pre-commit-hooks": "pre-commit-hooks"
+      },
+      "locked": {
+        "lastModified": 1782759041,
+        "narHash": "sha256-2577vxyoBa8+ZRiXr3CuPtOuEtPRYsFPSZuEc/KI/80=",
+        "owner": "nix-community",
+        "repo": "crate2nix",
+        "rev": "5e1ecfd2d15b34ec90c2e51fdffbe8116595a767",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "crate2nix",
+        "type": "github"
+      }
+    },
+    "devshell": {
+      "inputs": {
+        "nixpkgs": [
+          "wordle-solver",
+          "crate2nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1768818222,
+        "narHash": "sha256-460jc0+CZfyaO8+w8JNtlClB2n4ui1RbHfPTLkpwhU8=",
+        "owner": "numtide",
+        "repo": "devshell",
+        "rev": "255a2b1725a20d060f566e4755dbf571bbbb5f76",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "devshell",
+        "type": "github"
+      }
+    },
     "disko": {
       "inputs": {
         "nixpkgs": [
@@ -48,11 +125,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1781409739,
+        "lastModified": 1788840136,
-        "narHash": "sha256-6dadOVlqPpjy0w4WuwvX+Qx0Kkaabm3tahMrCrr72Rg=",
+        "narHash": "sha256-ej5jnQIfjbw4wwPzy8Y4ntG9F3asdF6YBkLqpYeGUxc=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "ef56de5faccb3ac59d95aa31cce551ff72e35bed",
+        "rev": "555b23e68256c5abfb8a85a385231830d1d7ad1f",
         "type": "gitlab"
       },
       "original": {
@@ -78,16 +155,30 @@
         "type": "github"
       }
     },
+    "flake-compat_2": {
+      "locked": {
+        "lastModified": 1733328505,
+        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "revCount": 69,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.1.0/01948eb7-9cba-704f-bbf3-3fa956735b52/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz"
+      }
+    },
     "flake-parts": {
       "inputs": {
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1778716662,
+        "lastModified": 1788450739,
-        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
+        "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
+        "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
         "type": "github"
       },
       "original": {
@@ -96,6 +187,123 @@
         "type": "github"
       }
     },
+    "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "wordle-solver",
+          "crate2nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1768135262,
+        "narHash": "sha256-PVvu7OqHBGWN16zSi6tEmPwwHQ4rLPU9Plvs8/1TUBY=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "80daad04eddbbf5a4d883996a73f3f542fa437ac",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_3": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib_2"
+      },
+      "locked": {
+        "lastModified": 1785627969,
+        "narHash": "sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "427bf4bd9435fdf21321c8cc628c24efc14c0f7a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "git-hooks": {
+      "inputs": {
+        "flake-compat": [
+          "wordle-solver",
+          "crate2nix",
+          "cachix",
+          "flake-compat"
+        ],
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "wordle-solver",
+          "crate2nix",
+          "cachix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1765404074,
+        "narHash": "sha256-+ZDU2d+vzWkEJiqprvV5PR26DVFN2vgddwG5SnPZcUM=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "2d6f58930fbcd82f6f9fd59fb6d13e37684ca529",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "wordle-solver",
+          "crate2nix",
+          "cachix",
+          "git-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
+    "gitignore_2": {
+      "inputs": {
+        "nixpkgs": [
+          "wordle-solver",
+          "crate2nix",
+          "pre-commit-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -103,11 +311,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781319724,
+        "lastModified": 1788642154,
-        "narHash": "sha256-ZGuxexEMo4Xv28KJ0dX/m/PHN4oZIOnxHZpNTyrvx4M=",
+        "narHash": "sha256-sPpQFVaFTDqO/4vvCAhuAhqTgqN/ygu+9eJcs5eB0js=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "8355f0a16b2dbb06a97959a918af5b239bbe05ae",
+        "rev": "fd0956c99c41ae3c13a73a638f1f7e963aebc4ab",
         "type": "github"
       },
       "original": {
@@ -119,11 +327,11 @@
     },
     "import-tree": {
       "locked": {
-        "lastModified": 1778781969,
+        "lastModified": 1788467110,
-        "narHash": "sha256-Jjuz5CmSkur8KvLDoGa+vylEp+RkQtv4mt/qcMznpH0=",
+        "narHash": "sha256-ljEMTXP/rH0tOvDzc9gzwww6KcHRPRnEHzd9lK48V7s=",
         "owner": "vic",
         "repo": "import-tree",
-        "rev": "d321337efd0f23a9eb14a42adb7b2c29313ab274",
+        "rev": "eb1b52eaecc57f7c136d07ae8a93e724dfecac46",
         "type": "github"
       },
       "original": {
@@ -141,11 +349,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1780375694,
+        "lastModified": 1788840747,
-        "narHash": "sha256-TznzgYVONg28KiSFB2rVdf/eLVIMtEQOxKt13Kzyrp8=",
+        "narHash": "sha256-nZ6Yt+8u5NhPSP46VcYXEcu4cJpeOiR/K+lfyk3COVA=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "e6f8bec35104ca5955efe73742da58d2823684f7",
+        "rev": "1e6052f5ecebddbbb2d372e0fe6f1b7bc4b95a9e",
         "type": "github"
       },
       "original": {
@@ -154,16 +362,32 @@
         "type": "github"
       }
     },
+    "nix-test-runner": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1588761593,
+        "narHash": "sha256-FKJykltAN/g3eIceJl4SfDnnyuH2jHImhMrXS2KvGIs=",
+        "owner": "stoeffel",
+        "repo": "nix-test-runner",
+        "rev": "c45d45b11ecef3eb9d834c3b6304c05c49b06ca2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "stoeffel",
+        "repo": "nix-test-runner",
+        "type": "github"
+      }
+    },
     "nixos-hardware": {
       "inputs": {
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1781168557,
+        "lastModified": 1788860136,
-        "narHash": "sha256-LOnLQ2tpYF9gqIDDr3+j3DbpJJr/QCH6zPRT2GzEUOE=",
+        "narHash": "sha256-MhPMOFV4pVkygWEbQ8t1De/uQ9cWF1u++tRe2L5tG48=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "6358ff76821101c178e3ab4919a62799bfe3652e",
+        "rev": "62173785b9a18c78b4a15aca2623d02bceb9d077",
         "type": "github"
       },
       "original": {
@@ -188,11 +412,26 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1777168982,
+        "lastModified": 1788057806,
-        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
+        "narHash": "sha256-DTQSMxzDWmT0zhguthvegnVkn7CFqGCv4IHCzk5ZUpM=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
+        "rev": "596e2e3940e09b2abbeb03f75fa1828c57fcd72c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixpkgs-lib_2": {
+      "locked": {
+        "lastModified": 1785031560,
+        "narHash": "sha256-OmshNvn2vupOFpYinLUu+1Dnpu4n7Q5N3ggGVNHpkUI=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "0e79af5e3d4dcfcd676ab5ba3f95d2e3352e078c",
         "type": "github"
       },
       "original": {
@@ -203,11 +442,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1781074563,
+        "lastModified": 1788752844,
-        "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
+        "narHash": "sha256-VaWGJ6+cIYN2erfSecbRV+4ljI185Ty2wUrXyvQbgOw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "9ae611a455b90cf061d8f332b977e387bda8e1ca",
+        "rev": "dc5d91f840324650bac8c379428c7037a416959a",
         "type": "github"
       },
       "original": {
@@ -219,11 +458,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1781216227,
+        "lastModified": 1788807765,
-        "narHash": "sha256-9mUW6gNwoN2SWc/l0fW4svPNOulXLl8ijqKyeSOGgJE=",
+        "narHash": "sha256-J9oC0bKnkXUrMegqRTXVkyDFJ0gn2U/Qpoo9HgGMQmA=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "a0374025a863d007d98e3297f6aa46cc3141c2f0",
+        "rev": "93108a538f079596c9a16c72cf03e9322782b6dd",
         "type": "github"
       },
       "original": {
@@ -233,6 +472,50 @@
         "type": "github"
       }
     },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1765186076,
+        "narHash": "sha256-hM20uyap1a0M9d344I692r+ik4gTMyj60cQWO+hAYP8=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "addf7cf5f383a3101ecfba091b98d0a1263dc9b8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "pre-commit-hooks": {
+      "inputs": {
+        "flake-compat": [
+          "wordle-solver",
+          "crate2nix",
+          "flake-compat"
+        ],
+        "gitignore": "gitignore_2",
+        "nixpkgs": [
+          "wordle-solver",
+          "crate2nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1769069492,
+        "narHash": "sha256-Efs3VUPelRduf3PpfPP2ovEB4CXT7vHf8W+xc49RL/U=",
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "rev": "a1ef738813b15cf8ec759bdff5761b027e3e1d23",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "disko": "disko",
@@ -246,7 +529,29 @@
         "nixpkgs": "nixpkgs_2",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "sops-nix": "sops-nix",
-        "spicetify-nix": "spicetify-nix"
+        "spicetify-nix": "spicetify-nix",
+        "wordle-solver": "wordle-solver"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "wordle-solver",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1787022047,
+        "narHash": "sha256-wNlYM/obKOkkRELrOfto1JT5CRANR6hB/RjOELp223U=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "b32685dd7c5a965aa8273adb7ddaf7f5b40d0faa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
       }
     },
     "sops-nix": {
@@ -256,11 +561,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780547341,
+        "lastModified": 1788337237,
-        "narHash": "sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo=",
+        "narHash": "sha256-gkSH8VUtCo6hnysNmb9DbTuDepH2t5pv+QWjP75xKAk=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "9ed65852b6257fbeae4355bc24ecfea307ca759a",
+        "rev": "fbf759290e0cb0a98dfc813a4eb7d53ad1dacb57",
         "type": "github"
       },
       "original": {
@@ -277,11 +582,11 @@
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1781425310,
+        "lastModified": 1788683578,
-        "narHash": "sha256-GTBka4Df/ZOacmisI/DI2LICyNChEqn/giah83LucdM=",
+        "narHash": "sha256-bERpuakmPAC2b36zgXy6OXh+SkZUjbaV+vV2sPmm6p8=",
         "owner": "Gerg-L",
         "repo": "spicetify-nix",
-        "rev": "aeaf7c81a45d3761da61cb05bfc370ac6d1b0441",
+        "rev": "a4ef43fb13e3615f36e5a0935aabe8cc29363dc9",
         "type": "github"
       },
       "original": {
@@ -319,6 +624,29 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "wordle-solver": {
+      "inputs": {
+        "crate2nix": "crate2nix",
+        "flake-parts": "flake-parts_3",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1788884686,
+        "narHash": "sha256-wl0NGoryP5veIaRn6azmejz1JsTbwHlBU/MT/icTKQ4=",
+        "ref": "refs/heads/main",
+        "rev": "a827bd5eef0354f7e4fdca57383971ff6008b5d3",
+        "revCount": 42,
+        "type": "git",
+        "url": "https://git.jroeger.de/jonas/wordle-solver-rs"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.jroeger.de/jonas/wordle-solver-rs"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -29,6 +29,8 @@
     nix-minecraft.inputs.nixpkgs.follows = "nixpkgs";
     spicetify-nix.url = "github:Gerg-L/spicetify-nix";
     spicetify-nix.inputs.nixpkgs.follows = "nixpkgs";
+    wordle-solver.url = "git+https://git.jroeger.de/jonas/wordle-solver-rs";
+    wordle-solver.inputs.nixpkgs.follows = "nixpkgs";
   };
 
   outputs = inputs @ {

home/admin-jroeger/configuration.nix

@@ -9,6 +9,7 @@
   hive.doom.enable = true;
   hive.doom.asDefaultEditor = true;
   hive.doom.enableCopilot = true;
+  hive.doom.enableLtexPlus = true;
   hive.doom.withNixPkgs = true;
   hive.doom.withShellPkgs = true;
   hive.doom.withCXXPkgs = true;

hosts/harbor/configuration.nix

@@ -29,6 +29,14 @@
     owner = config.hive.gotify-instance.user;
     key = "adminPassword";
   };
+  sops.secrets.matrix-hs-secret = {
+    format = "binary";
+    sopsFile = ../../secrets/harbor/hs_ed25519_secret_key;
+  };
+  sops.secrets.hidden-matrix-hostname = {
+    sopsFile = ../../secrets/harbor/hidden-matrix.yaml;
+    key = "hostname";
+  };
 
   # gc settings and binary caches
   nix = {
@@ -82,6 +90,20 @@
   hive.borg-server.repositories.comfy-station.ssh_public_key = builtins.readFile (../../static/keys + "/borg-jonas@comfy-station.pub");
   hive.wg.server.enable = true;
   hive.wg.server.privateKeyFile = config.sops.secrets.wg-priv.path;
+  hive.matrix.enable = true;
+  hive.matrix.hiddenServiceSecret = config.sops.secrets.matrix-hs-secret.path;
+  hive.matrix.hiddenServiceHostnameSopsKey = config.sops.secrets.hidden-matrix-hostname.name;
+  hive.calibre.enable = true;
+  hive.calibre.instanceFQDN = "calibre.jroeger.de";
+  hive.calibre.libraries = ["Rote Bücher" "Bürgerliche Bücher" "Brain Maxxing" "Technik" "Wissenschaft oder so" "Dokumente"];
+  hive.korrosync.enable = true;
+  hive.korrosync.localPort = 7416;
+  hive.korrosync.instanceFQDN = "korrosync.jroeger.de";
+  hive.wallabag.enable = true;
+  hive.wallabag.localPort = 39184;
+  hive.wallabag.instanceFQDN = "wallabag.jroeger.de";
+  hive.wordle-solver.enable = true;
+  hive.wordle-solver.instanceFQDN = "wordle-solver.jroeger.de";
 
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions

hosts/harbor/default.nix

@@ -20,6 +20,11 @@
       self.nixosModules.minecraft-server
       self.nixosModules.borg-server
       self.nixosModules.wireguard-server
+      self.nixosModules.matrix
+      self.nixosModules.calibre
+      self.nixosModules.korrosync-hive
+      self.nixosModules.wallabag
+      self.nixosModules.wordle-solver
     ];
   };
 }

hosts/monolith/configuration.nix

@@ -174,7 +174,7 @@
   boot.plymouth.enable = true;
   boot.initrd.systemd.enable = true;
   boot.supportedFilesystems = ["ntfs"];
-  boot.kernelPackages = pkgs.linuxPackages_latest;
+  boot.kernelPackages = pkgs.linuxPackages_7_1;
 
   # Configure console keymap
   console.keyMap = "de";

modules/desktop/hyprland.nix

@@ -43,7 +43,8 @@
         ];
       };
 
-      environment.systemPackages = with pkgs; [pcmanfm-qt];
+      environment.systemPackages = with pkgs.kdePackages; [dolphin kio-extras];
+      services.gvfs.enable = true;
       services.udisks2.enable = true;
       programs.hyprlock.enable = true;
       security.pam.services.hyprlock = {};

modules/desktop/themes/layan/layan.nix

@@ -30,13 +30,15 @@
       pkgs.tela-circle-icon-theme
     ];
 
-    qt.enable = false;
+    qt.enable = true;
     qt.style.name = "kvantum";
     qt.style.package = pkgs.kdePackages.qtstyleplugin-kvantum;
     qt.platformTheme.name = "gtk";
+    home.sessionVariables = {
+      QT_STYLE_OVERRIDE = "kvantum";
+    };
     systemd.user.settings.Manager.DefaultEnvironment = lib.mapAttrs (_: lib.mkDefault) {
       QT_STYLE_OVERRIDE = "kvantum";
-      QT_QPA_PLATFORMTHEME = "gtk";
     };
     xdg.configFile."Kvantum/kvantum.kvconfig".text = lib.generators.toINI {} {
       General.theme = "LayanDark";

modules/desktop/waybar.nix

@@ -1,10 +1,5 @@
 {
-  flake.homeModules.waybar = {
+  flake.homeModules.waybar = {pkgs, ...}: {
-    config,
-    lib,
-    pkgs,
-    ...
-  }: {
     programs.waybar.enable = true;
     programs.waybar.systemd.enable = true;
 
@@ -12,14 +7,6 @@
     services.network-manager-applet.enable = true;
     services.pasystray.enable = true;
 
-    # is already fixed on latest home-manager rev
-    systemd.user.services = {
-      blueman-applet.Unit.After = lib.mkForce ["graphical-session.target"];
-      network-manager-applet.Unit.After = lib.mkForce ["graphical-session.target"];
-      pasystray.Unit.After = lib.mkForce ["graphical-session.target"];
-      waybar.Unit.After = lib.mkForce ["graphical-session.target"];
-    };
-
     home.packages = with pkgs; [
       pulsemixer
       pavucontrol

modules/doom/doom.nix

@@ -70,6 +70,7 @@
       ++ lib.optionals cfg.withCXXPkgs (cfg.overrideCXXPkgs default-cxx-pkgs)
       ++ lib.optionals cfg.withPythonPkgs (cfg.overridePythonPkgs default-python-pkgs)
       ++ lib.optional cfg.enableCopilot pkgs.unstable.copilot-language-server
+      ++ lib.optional cfg.enableLtexPlus pkgs.ltex-ls-plus
       ++ default-core-pkgs;
     doom-socket-name = "main";
     wrapped-emacs = pkgs.symlinkJoin {
@@ -114,6 +115,7 @@
       asDefaultEditor = lib.mkEnableOption "set the EDITOR variable to use the current emacs server (graphical/non-graphical)";
       enableCopilot = lib.mkEnableOption "Enable Copilot in Doom Emacs";
       enableTidal = lib.mkEnableOption "Enable TidalCycles";
+      enableLtexPlus = lib.mkEnableOption "Enable grammar checks via LtexPlus";
       withLatexPkgs = lib.mkEnableOption "Enable LaTeX packages in doom path";
       withShellPkgs = lib.mkEnableOption "Enable shell packages in doom path";
       withNixPkgs = lib.mkEnableOption "Enable LaTeX packages in doom path";
@@ -232,6 +234,11 @@
             enable = cfg.enableCopilot;
             source = ./static/config.d/copilot.el;
           };
+          "doom-config/config.d/ltex-plus.el" = {
+            enable = cfg.enableLtexPlus;
+            source = ./static/config.d/ltex-plus.el;
+            onChange = "${doom-setup} sync --force -u -e";
+          };
           "doom-config/packages/treesit-docgen.el" = {
             source = ./static/packages/treesit-docgen.el;
           };
@@ -248,6 +255,11 @@
             source = ./static/packages.d/copilot.el;
             onChange = "${doom-setup} sync --force -u -e";
           };
+          "doom-config/packages.d/ltex-plus.el" = {
+            enable = cfg.enableLtexPlus;
+            source = ./static/packages.d/ltex-plus.el;
+            onChange = "${doom-setup} sync --force -u -e";
+          };
           "doom-config/packages.d/tidal.el" = {
             enable = cfg.enableTidal;
             source = ./static/packages.d/tidal.el;
@@ -255,8 +267,9 @@
           };
           "doom-emacs" = {
             source = builtins.fetchGit {
-              url = "https://github.com/doomemacs/doomemacs";
+              url = "https://github.com/doomemacs/core";
-              rev = "a0d6aac43fc94def29c98826e2f0088bcb703d13";
+              rev = "d1986c0181aadcbfe0d118fd1ae713fac8da7fab";
+              submodules = true;
             };
             onChange = "${doom-setup} --force sync -u -e";
           };

modules/doom/static/config.d/ltex-plus.el

@@ -0,0 +1,4 @@
+(use-package! lsp-ltex-plus
+  :defer t
+  :init
+  (lsp-ltex-plus-enable-for-modes))

modules/doom/static/config.el

@@ -115,6 +115,15 @@
   :config
   (setq graphviz-dot-indent-width 4))
 
+(after! svelte-ts-mode
+  (add-to-list 'auto-mode-alist '("\\.svelte\\'" . svelte-ts-mode))
+  (add-hook! 'svelte-ts-mode-hook
+    (setq-local lsp-format-buffer-on-save t)))
+
+(after! typescript-ts-mode
+  (add-hook! 'typescript-ts-mode-hook
+    (setq-local lsp-format-buffer-on-save t)))
+
 (after! auctex
   (add-hook! 'LaTeX-mode-hook 'lsp)
   (map! :map LaTeX-mode-map
@@ -157,13 +166,21 @@
 (set-formatter! 'alejandra '("alejandra" "--quiet") :modes '(nix-mode nix-ts-mode))
 
 ;; nixd
-(after! 'lsp-mode
+(after! lsp-mode
   (lsp-register-client
    (make-lsp-client :new-connection (lsp-stdio-connection "nixd")
                     :major-modes '(nix-mode)
                     :priority 0
                     :server-id 'nixd)))
 
+;; typescript-language-server
+(after! lsp-mode
+  (lsp-register-client
+   (make-lsp-client :new-connection (lsp-stdio-connection '("typescript-language-server" "--stdio"))
+                    :major-modes '(typescript-ts-mode typescript-mode)
+                    :priority 0
+                    :server-id 'typescript-language-server)))
+
 ;;Use TS-modes
 (after! treesit
   (load! "packages/treesit-docgen.el"))
@@ -245,18 +262,30 @@
          (haskell-ts-mode . lsp-deferred)
          (c-or-c++-ts-mode . lsp-deferred)
          (bash-ts-mode . lsp-deferred)
-         (json-ts-mode . lsp-deferred)))
+         (json-ts-mode . lsp-deferred)
+         (typescript-ts-mode . lsp-deferred)
+         (svelte-ts-mode . lsp-deferred)
+         (svelte-mode . lsp-deferred)
+         ))
 
 
-(after! jj-mode
+(use-package! majutsu
-  (map! :leader
+  :config (map! :leader
-        (:prefix ("j" . "Jujutsu")
+                (:prefix ("j" . "majutsu")
-         :desc "Log" "j" #'jj-log
+                 :desc "Log" "j" #'majutsu-log
-         :desc "Describe" "d" #'jj-describe
-         :desc "Abandon" "a" #'jj-abandon
-         :desc "New" "n" #'jj-new
                  )))
 
+
+;; Org-mode custom property for remaining effort (not-done-items)
+(defun my-org-columns-collect-open-effort (property)
+  "Return PROPERTY only or unfinished entries."
+  (if (member (org-get-todo-state) org-not-done-keywords)
+      (org-entry-get nil property)
+    ""))
+
+(setq org-columns-summary-types
+      '(("remaining:" org-columns--summary-sum-times my-org-columns-collect-open-effort)))
+
 (setq auto-mode-alist (cons '("\\.smt$" . smtlib-mode) auto-mode-alist))
 (autoload 'smtlib-mode "smtlib" "Major mode for SMTLIB" t)
 

modules/doom/static/init.el

@@ -83,8 +83,8 @@
 
        :checkers
        syntax              ; tasing you for every semicolon you forget
-       (spell +flyspell) ; tasing you for misspelling mispelling
+       ;;(spell +flyspell) ; tasing you for misspelling mispelling
-       grammar           ; tasing grammar mistake every you make
+       ;;grammar           ; tasing grammar mistake every you make
 
        :tools
        ;;ansible
@@ -144,7 +144,7 @@
        ;;idris             ; a language you can depend on
        (json +tree-sitter)             ; At least it ain't XML
        (java +lsp +tree-sitter)       ; the poster child for carpal tunnel syndrome
-       ;;javascript        ; all(hope(abandon(ye(who(enter(here))))))
+       (javascript +lsp +tree-sitter)        ; all(hope(abandon(ye(who(enter(here))))))
        ;;julia             ; a better, faster MATLAB
        ;;kotlin            ; a better, slicker Java(Script)
        (latex +lsp +latexmk)             ; writing papers in Emacs has never been so fun

modules/doom/static/packages.d/ltex-plus.el

@@ -0,0 +1 @@
+(package! lsp-ltex-plus)

modules/doom/static/packages.el

@@ -83,13 +83,18 @@
            )
   :pin "71f67971bc5eb2974ae2f738512c8f09f0822527")
 
+(package! svelte-ts-mode
+  :recipe (:host github
+           :repo "leafOfTree/svelte-ts-mode"
+           :branch "main")
+  :pin "b1b5b4a5b09493063394a51d0f0f022645a18444")
 (package! pdf-tools)
 (package! eww)
 (package! pandoc-mode)
 (package! tramp)
 (package! graphviz-dot-mode)
 (package! rainbow-delimiters)
-(package! jj-mode :recipe (:host github :repo "bolivier/jj-mode.el"))
+(package! majutsu :recipe (:host github :repo "0WD0/majutsu"))
 
 (let ((package-dir (expand-file-name "packages.d" doom-user-dir)))
   (when (file-directory-p package-dir)

modules/services/calibre.nix

@@ -0,0 +1,122 @@
+{
+  flake.nixosModules.calibre = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }: let
+    cfg = config.hive.calibre;
+    calibre = config.services.calibre-server.package;
+    calibre-user = config.services.calibre-server.user;
+    calibre-group = config.services.calibre-server.group;
+    calibre-users = "${cfg.basePath}/users.sqlite";
+    libraries = map (n: "${cfg.basePath}/${n}") cfg.libraries;
+    ensure-libs = lib.concatStrings (
+      map (l: ''
+        if [ ! -d "${l}" ]; then
+            echo "Creating Calibre libraray directory \"${l}\""
+            mkdir "${l}"
+            chown ${calibre-user}:${calibre-group} "${l}"
+        fi
+
+        if [ ! -f "${l}/metadata.db" ]; then
+            echo "Creating Calibre libraray metadata \"${l}\""
+            ${calibre}/bin/calibredb --with-library="${l}" list
+            chown -R ${calibre-user}:${calibre-group} "${l}"
+        fi
+      '')
+      libraries
+    );
+  in {
+    options.hive.calibre = {
+      enable = lib.mkEnableOption "Enable calibre server";
+      localPort = lib.mkOption {
+        type = lib.types.int;
+        example = 8080;
+        default = 45988;
+        description = "Specify the local port calibre server uses.";
+      };
+      basePath = lib.mkOption {
+        type = lib.types.path;
+        example = "/var/calibre-server";
+        default = "/srv/calibre-server";
+        description = "The base-path for calibre data";
+      };
+      instanceFQDN = lib.mkOption {
+        type = lib.types.singleLineStr;
+        example = "calibre.example.com";
+        description = "Fully qualified domain name of the calibre instance";
+      };
+      libraries = lib.mkOption {
+        type = lib.types.listOf lib.types.singleLineStr;
+        example = ["library1" "private" "foo"];
+        default = ["library"];
+        description = "A list of libraries to serve. (Must be present in the base-path, will be initialized if not existing)";
+      };
+    };
+
+    config = lib.mkIf cfg.enable {
+      services.calibre-server = {
+        enable = true;
+
+        auth.enable = true;
+        auth.mode = "basic";
+        auth.userDb = "${calibre-users}";
+
+        host = "::1";
+        port = cfg.localPort;
+
+        inherit libraries;
+      };
+
+      # Fallback server with only 403
+      services.nginx.virtualHosts.${config.networking.domain} = lib.mkDefault {
+        default = true;
+        locations."/".return = 403;
+        forceSSL = true;
+        enableACME = true;
+      };
+
+      # Virtual host for calibre
+      services.nginx.virtualHosts."${cfg.instanceFQDN}" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://[::1]:${toString cfg.localPort}";
+          extraConfig = ''
+            client_max_body_size 150M;
+          '';
+        };
+      };
+
+      environment.systemPackages = [
+        (pkgs.writeShellScriptBin "calibre-manager-users" ''
+          sudo -u ${calibre-user} ${calibre}/bin/calibre-server --userdb=${calibre-users} --manage-users
+        '')
+      ];
+
+      systemd.services.calibre-init = {
+        description = "Initialize Calibre databases";
+
+        wantedBy = ["calibre-server.service"];
+        before = ["calibre-server.service"];
+
+        serviceConfig = {
+          Type = "oneshot";
+
+          ExecStart = pkgs.writeShellScript "calibre-init" ''
+            if [ ! -d ${cfg.basePath} ]; then
+                echo "Creating Calibre base directory \"${cfg.basePath}\""
+                mkdir ${cfg.basePath}
+                chown ${calibre-user}:${calibre-group} ${cfg.basePath}
+            fi
+
+            ${ensure-libs}
+          '';
+
+          RemainAfterExit = true;
+        };
+      };
+    };
+  };
+}

modules/services/gitea-instance.nix

@@ -2,6 +2,7 @@
   flake.nixosModules.gitea-instance = {
     config,
     lib,
+    pkgs,
     ...
   }: let
     cfg = config.hive.gitea-instance;
@@ -61,6 +62,14 @@
         enableACME = true;
         locations."/" = {
           proxyPass = "http://unix:/run/gitea/gitea.sock";
+          extraConfig = ''
+            client_max_body_size 1G;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Host $host;
+          '';
         };
       };
 
@@ -77,13 +86,25 @@
       };
 
       # act_runner
-      services.gitea-actions-runner = lib.mkIf cfg.nativeRunner {
+      services.gitea-actions-runner.instances.nixoshost = {
-        instances.nixos-host = {
+        enable = cfg.nativeRunner;
-          enable = true;
         name = "nixos-host-runner";
         url = "https://${cfg.instanceFQDN}";
         tokenFile = "/var/lib/gitea-registration/nixos-host";
 
+        hostPackages = with pkgs; [
+          bash
+          coreutils
+          curl
+          gawk
+          gitMinimal
+          gnused
+          nix
+          nodejs
+          skopeo
+          wget
+        ];
+
         labels = ["nixos:host"];
 
         settings = {
@@ -92,13 +113,9 @@
           };
         };
       };
-      };
+      systemd.services.gitea-runner-nixoshost = lib.mkIf cfg.nativeRunner {
-      systemd.services.gitea-runner-nixos-host = lib.mkIf cfg.nativeRunner {
         after = ["gitea-runner-gen-token.service"];
         requires = ["gitea-runner-gen-token.service"];
-        serviceConfig.Environment = ''
-          PATH=/run/current-system/sw/bin:/usr/bin:/bin
-        '';
       };
       systemd.services.gitea-runner-gen-token = lib.mkIf cfg.nativeRunner {
         wantedBy = ["multi-user.target"];

modules/services/korrosync/_derivation.nix

@@ -0,0 +1,46 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  openssl,
+  pkg-config,
+  cacert,
+  ...
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "korrosync";
+  version = "0.4.0";
+
+  # Use patched version until https://github.com/szaffarano/korrosync/pull/131 is merged
+  src = fetchFromGitHub {
+    owner = "inaltoasinistra";
+    repo = "korrosync";
+    rev = "df735653b100071ce9303f3b7b71cb235189ba5d";
+    hash = "sha256-8Gp5i7pN7gXjGESHNO5h4P1mWXEtR8jAh2Y39Mcur6g=";
+  };
+
+  buildInputs = [
+    openssl
+    pkg-config
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  checkFlags = [
+    "--skip"
+    "cli_should_start_server"
+  ];
+
+  cargoLock.lockFile = "${finalAttrs.src}/Cargo.lock";
+
+  SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+  NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+
+  meta = {
+    description = "KOReader Sync Server";
+    license = lib.licenses.mit;
+    homepage = "https://github.com/szaffarano/korrosync";
+  };
+})

modules/services/korrosync/korrosync-base.nix

@@ -0,0 +1,162 @@
+{self, ...}: {
+  flake.overlays.korrosync = final: prev: {
+    korrosync = final.callPackage ./_derivation.nix {};
+  };
+  flake.nixosModules.korrosync-overlay = {
+    nixpkgs.overlays = [self.overlays.korrosync];
+  };
+  perSystem = {pkgs, ...}: {
+    packages.korrosync = pkgs.callPackage ./_derivation.nix {};
+  };
+
+  flake.nixosModules.korrosync = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }: let
+    cfg = config.services.korrosync;
+  in {
+    options.services.korrosync = {
+      enable = lib.mkEnableOption "Enable KOrrosync service";
+      enable-service = lib.mkOption {
+        type = lib.types.bool;
+        description = "Enable korrosync service";
+        example = true;
+        default = true;
+      };
+      enable-configured-binary = lib.mkEnableOption "Put a korrosync binary into system-packges using the set configuration options.";
+      data-path = lib.mkOption {
+        type = lib.types.path;
+        description = "The path where korrosync saves it's data.";
+        example = "/var/lib/korrosync";
+        default = "/var/lib/korrosync";
+      };
+      user = lib.mkOption {
+        type = lib.types.singleLineStr;
+        description = "The user under with korrosync runs.";
+        example = "korrosync";
+        default = "korrosync";
+      };
+      group = lib.mkOption {
+        type = lib.types.singleLineStr;
+        description = "The group under with korrosync runs.";
+        example = "korrosync";
+        default = "korrosync";
+      };
+      listen-address = lib.mkOption {
+        description = "The listen address of the korrosync server";
+        type = lib.types.singleLineStr;
+        example = "0.0.0.0";
+        default = "127.0.0.1";
+      };
+      listen-port = lib.mkOption {
+        description = "The listen port of the korrosync server";
+        type = lib.types.int;
+        example = 3000;
+        default = 3000;
+      };
+      rate-limit-per-second = lib.mkOption {
+        type = lib.types.int;
+        description = "Rate limit replenishment rate per second";
+        example = 2;
+        default = 2;
+      };
+      rate-limit-burst-size = lib.mkOption {
+        type = lib.types.int;
+        description = "Maximum burst size before rate limiting";
+        example = 5;
+        default = 5;
+      };
+    };
+
+    imports = [
+      self.nixosModules.korrosync-overlay
+    ];
+
+    config = lib.mkIf cfg.enable {
+      # User setup
+      users.users = lib.mkIf (cfg.user == "korrosync") {
+        korrosync = {
+          description = "Korrosync service";
+          useDefaultShell = true;
+          group = cfg.group;
+          isSystemUser = true;
+        };
+      };
+      users.groups = lib.mkIf (cfg.group == "korrosync") {
+        korrosync = {};
+      };
+
+      # Pre-configured binary
+      environment.systemPackages = lib.mkIf cfg.enable-configured-binary [
+        (let
+          envVars = config.systemd.services.korrosync.environment;
+        in
+          pkgs.writeShellScriptBin "korrosync"
+          ''
+            export KORROSYNC_DB_PATH="${envVars.KORROSYNC_DB_PATH}"
+            export KORROSYNC_SERVER_ADDRESS="${envVars.KORROSYNC_SERVER_ADDRESS}"
+            export KORROSYNC_USE_TLS="${envVars.KORROSYNC_USE_TLS}"
+            export KORROSYNC_RATE_LIMIT_PER_SECOND="${envVars.KORROSYNC_RATE_LIMIT_PER_SECOND}"
+            export KORROSYNC_RATE_LIMIT_BURST_SIZE="${envVars.KORROSYNC_RATE_LIMIT_BURST_SIZE}"
+            exec ${pkgs.korrosync}/bin/korrosync "$@"
+          '')
+      ];
+
+      # base service
+      systemd.services.korrosync = {
+        enable = cfg.enable-service;
+        description = "Korrosync - KOReader Sync Server";
+
+        after = ["network.target"];
+        wantedBy = ["multi-user.target"];
+
+        environment = {
+          KORROSYNC_DB_PATH = "${cfg.data-path}/db.redb";
+          KORROSYNC_SERVER_ADDRESS = "${cfg.listen-address}:${toString cfg.listen-port}";
+          KORROSYNC_USE_TLS = "false";
+          KORROSYNC_RATE_LIMIT_PER_SECOND = "${toString cfg.rate-limit-per-second}";
+          KORROSYNC_RATE_LIMIT_BURST_SIZE = "${toString cfg.rate-limit-burst-size}";
+        };
+
+        serviceConfig = {
+          Type = "simple";
+          User = cfg.user;
+          Group = cfg.group;
+          ExecStart = "${pkgs.korrosync}/bin/korrosync serve";
+          Restart = "on-failure";
+          RestartSec = "5s";
+          NoNewPrivileges = true;
+          PrivateTmp = true;
+          ProtectSystem = "strict";
+          ProtectHome = true;
+          ReadWritePaths = cfg.data-path;
+        };
+      };
+
+      # Initialize data directory
+      systemd.services.korrosync-init = {
+        description = "Initialize Korrosync databases";
+
+        wantedBy = ["korrosync.service"];
+        before = ["korrosync.service"];
+
+        serviceConfig = {
+          Type = "oneshot";
+
+          ExecStart = pkgs.writeShellScript "korrosync-init" ''
+            if [ ! -d ${cfg.data-path} ]; then
+                echo "Creating Korrosync base directory \"${cfg.data-path}\""
+                mkdir ${cfg.data-path}
+                chmod 770 ${cfg.data-path}
+                chown ${cfg.user}:${cfg.group} ${cfg.data-path}
+            fi
+          '';
+
+          RemainAfterExit = true;
+        };
+      };
+    };
+  };
+}

modules/services/korrosync/korrosync-hive.nix

@@ -0,0 +1,65 @@
+{self, ...}: {
+  flake.nixosModules.korrosync-hive = {
+    config,
+    lib,
+    ...
+  }: let
+    cfg = config.hive.korrosync;
+  in {
+    options.hive.korrosync = {
+      enable = lib.mkEnableOption "Enable korrosync server";
+      localPort = lib.mkOption {
+        type = lib.types.int;
+        example = 8080;
+        default = 45988;
+        description = "Specify the local port korrosync server uses.";
+      };
+      instanceFQDN = lib.mkOption {
+        type = lib.types.singleLineStr;
+        example = "calibre.example.com";
+        description = "Fully qualified domain name of the korrosync instance";
+      };
+      blockUserCreation = lib.mkOption {
+        type = lib.types.bool;
+        description = "Disallow /user/create endpoint via nginx";
+        example = true;
+        default = true;
+      };
+    };
+
+    imports = [
+      self.nixosModules.korrosync
+    ];
+
+    config = lib.mkIf cfg.enable {
+      services.korrosync = {
+        enable = true;
+        listen-port = cfg.localPort;
+        listen-address = "127.0.0.1";
+        data-path = "/srv/korrosync";
+        enable-configured-binary = true;
+      };
+
+      # Fallback server with only 403
+      services.nginx.virtualHosts.${config.networking.domain} = lib.mkDefault {
+        default = true;
+        locations."/".return = 403;
+        forceSSL = true;
+        enableACME = true;
+      };
+
+      # Virtual host for korrosync
+      services.nginx.virtualHosts."${cfg.instanceFQDN}" = {
+        forceSSL = true;
+        enableACME = true;
+        locations =
+          {
+            "/".proxyPass = "http://127.0.0.1:${toString cfg.localPort}";
+          }
+          // (lib.optionalAttrs cfg.blockUserCreation {
+            "/users/create".return = 403;
+          });
+      };
+    };
+  };
+}

modules/services/matrix.nix

@@ -0,0 +1,126 @@
+{
+  flake.nixosModules.matrix = {
+    config,
+    lib,
+    ...
+  }: let
+    cfg = config.hive.matrix;
+    ketesa-web-root = fetchTarball {
+      url = "https://github.com/etkecc/ketesa/releases/download/v1.4.0/ketesa.tar.gz";
+      sha256 = "sha256:0za0rddcbxn2ra4xlykn7v8b4j0ddyacivyzp91m80r071ds1dk7";
+    };
+  in {
+    options.hive.matrix = {
+      enable = lib.mkEnableOption "Enable matrix server (synapse)";
+
+      localPort = lib.mkOption {
+        type = lib.types.int;
+        default = 8474;
+        description = "The internal port of the synapse server";
+      };
+
+      ketesaLocalPort = lib.mkOption {
+        type = lib.types.int;
+        default = 8475;
+        description = "The internal port of the ketesa virtual host";
+      };
+
+      hiddenServiceHostnameSopsKey = lib.mkOption {
+        type = lib.types.str;
+        description = "The sops key of the secret containing the hostname of the hidden service";
+      };
+
+      hiddenServiceSecret = lib.mkOption {
+        type = lib.types.path;
+        description = "The file containing the hidden service's secret";
+      };
+    };
+
+    config = lib.mkIf cfg.enable {
+      # Database setup
+      services.postgresql = {
+        enable = true;
+      };
+
+      # Hidden service
+      services.tor = {
+        enable = true;
+        enableGeoIP = false;
+        relay.onionServices.matrix = {
+          secretKey = cfg.hiddenServiceSecret;
+          version = 3;
+          map = [
+            {
+              port = 80;
+              target = {
+                addr = "[::1]";
+                port = cfg.localPort;
+              };
+            }
+            {
+              port = 8080;
+              target = {
+                addr = "127.0.0.1";
+                port = cfg.ketesaLocalPort;
+              };
+            }
+          ];
+        };
+      };
+
+      # Virtual host for ketesa
+      services.nginx.virtualHosts."ketesa-localhost" = {
+        listen = [
+          {
+            addr = "127.0.0.1";
+            port = cfg.ketesaLocalPort;
+          }
+        ];
+        forceSSL = false;
+        enableACME = false;
+        root = "${ketesa-web-root}";
+      };
+
+      # Secret hostname for matrix-synapse
+      sops.templates."hidden-matrix-synapse".owner = "matrix-synapse";
+      sops.templates."hidden-matrix-synapse".content = ''
+        server_name: "${config.sops.placeholder.${cfg.hiddenServiceHostnameSopsKey}}"
+        public_baseurl: "http://${config.sops.placeholder.${cfg.hiddenServiceHostnameSopsKey}}"
+      '';
+
+      # Synapse
+      services.matrix-synapse = {
+        enable = true;
+        settings.listeners = [
+          {
+            port = cfg.localPort;
+            bind_addresses = ["::1"];
+            type = "http";
+            tls = false;
+            x_forwarded = false;
+            resources = [
+              {
+                names = [
+                  "client"
+                ];
+                compress = false;
+              }
+            ];
+          }
+        ];
+        settings = {
+          enable_registration = true;
+          registration_requires_token = true;
+          report_stats = false;
+          federation_domain_whitelist = [];
+          federation_ip_range_blacklist = ["0.0.0.0/0"];
+          matrix_static_files_file_matrix_support_enabled = true;
+        };
+
+        extraConfigFiles = [
+          config.sops.templates."hidden-matrix-synapse".path
+        ];
+      };
+    };
+  };
+}

modules/services/nextcloud-instance.nix

@@ -33,7 +33,7 @@
       services.nextcloud = {
         # Instance
         enable = true;
-        package = pkgs.nextcloud33;
+        package = pkgs.nextcloud34;
         hostName = cfg.instanceFQDN;
         https = cfg.ssl;
         configureRedis = true;

modules/services/wallabag.nix

@@ -0,0 +1,53 @@
+{
+  flake.nixosModules.wallabag = {
+    config,
+    lib,
+    ...
+  }: let
+    cfg = config.hive.wallabag;
+  in {
+    options.hive.wallabag = {
+      enable = lib.mkEnableOption "Enable wallabag service";
+      localPort = lib.mkOption {
+        type = lib.types.int;
+        example = 8080;
+        default = 8088;
+        description = "Specify the local port wallabag server uses.";
+      };
+      instanceFQDN = lib.mkOption {
+        type = lib.types.singleLineStr;
+        example = "wallabag.example.com";
+        description = "Fully qualified domain name of the wallabag instance";
+      };
+    };
+
+    config = lib.mkIf cfg.enable {
+      # Fallback server with only 403
+      services.nginx.virtualHosts.${config.networking.domain} = lib.mkDefault {
+        default = true;
+        locations."/".return = 403;
+        forceSSL = true;
+        enableACME = true;
+      };
+
+      # Virtual host for wallabag
+      services.nginx.virtualHosts."${cfg.instanceFQDN}" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/".proxyPass = "http://127.0.0.1:${toString cfg.localPort}";
+      };
+
+      virtualisation.oci-containers.containers.wallabag = {
+        image = "wallabag/wallabag:latest";
+        ports = ["127.0.0.1:${toString cfg.localPort}:80"];
+        volumes = [
+          "wallabag-data:/var/www/wallabag/data"
+          "wallabag-images:/var/www/wallabag/web/assets/images"
+        ];
+        environment = {
+          "SYMFONY__ENV__DOMAIN_NAME" = "https://${cfg.instanceFQDN}";
+        };
+      };
+    };
+  };
+}

modules/services/wordle-solver.nix

@@ -0,0 +1,36 @@
+{inputs, ...}: {
+  flake.nixosModules.wordle-solver = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }: let
+    cfg = config.hive.wordle-solver;
+  in {
+    options.hive.wordle-solver = {
+      enable = lib.mkEnableOption "Enable wordle-solver site";
+      instanceFQDN = lib.mkOption {
+        type = lib.types.singleLineStr;
+        example = "wordle-solver.example.com";
+        description = "Fully qualified domain name of the wordle-solver host";
+      };
+    };
+
+    config = lib.mkIf cfg.enable {
+      # Fallback server with only 403
+      services.nginx.virtualHosts.${config.networking.domain} = lib.mkDefault {
+        default = true;
+        locations."/".return = 403;
+        forceSSL = true;
+        enableACME = true;
+      };
+
+      # Virtual host for wordle-solver
+      services.nginx.virtualHosts."${cfg.instanceFQDN}" = {
+        forceSSL = true;
+        enableACME = true;
+        root = "${inputs.wordle-solver.packages.${pkgs.system}.wordle-solver-web}/";
+      };
+    };
+  };
+}

modules/tools/bulk-transcode/bulk-transcode.sh

@@ -4,10 +4,14 @@ declare -rA presets=(
     [davinci-resolve]="-c:v dnxhd -profile:v dnxhr_hq -pix_fmt yuv422p -c:a pcm_s16le"
     [instagram]="-vf scale='if(gte(iw/ih,1),1920,-1)':'if(gte(iw/ih,1),-1,1920)':flags=lanczos -r 30 -c:v libx264 -profile:v high -level 4.1 -pix_fmt yuv420p -preset slow -crf 18 -bf 2 -g 15 -keyint_min 15 -x264-params \"open-gop=0:cabac=1:b-pyramid=none\" -movflags +faststart -c:a aac -b:a 96k"
     [insta-4k]="-r 30 -c:v libx264 -profile:v high -level 4.1 -pix_fmt yuv420p -preset slow -crf 18 -bf 2 -g 15 -keyint_min 15 -x264-params \"open-gop=0:cabac=1:b-pyramid=none\" -movflags +faststart -c:a aac -b:a 96k"
-    [storage-hevc]="-c:v libx265 -preset slower -crf 18 -pix_fmt yuv420p10le -x265-params aq-mode=3:aq-strength=1.0:psy-rd=1.8:psy-rdoq=1.0 -c:a copy"
+    [network-hevc]="-c:v libx265 -preset slow -crf 26 -x265-params aq-mode=3:aq-strength=1.0:psy-rd=1.8:psy-rdoq=1.0 -pix_fmt yuv422p -c:a copy"
-    [storage-av1]="-c:v libsvtav1 -preset 6 -crf 28 -pix_fmt yuv420p -g 240 -svtav1-params tune=0:aq-mode=2 -c:a copy"
+    [storage-hevc-faster]="-c:v libx265 -preset slow -crf 26 -x265-params aq-mode=3:aq-strength=1.0:psy-rd=1.8:psy-rdoq=1.0 -c:a copy"
-    [storage-av1-1080p]="-vf scale='if(gte(iw/ih,1),1920,-1)':'if(gte(iw/ih,1),-1,1920)' -c:v libsvtav1 -preset 6 -crf 28 -pix_fmt yuv420p -g 240 -svtav1-params tune=0:aq-mode=2 -c:a copy"
+    [storage-hevc]="-c:v libx265 -preset slower -crf 22 -x265-params aq-mode=3:aq-strength=1.0:psy-rd=1.8:psy-rdoq=1.0 -c:a copy"
-    [storage-av1-nvenc]="-c:v av1_nvenc -cq 28 -preset slow -pix_fmt yuv420p10le -c:a copy"
+    [storage-av1]="-c:v libsvtav1 -preset 6 -crf 28 -g 240 -svtav1-params tune=0:aq-mode=2 -c:a copy"
+    [storage-av1-1080p]="-vf scale='if(gte(iw/ih,1),1920,-1)':'if(gte(iw/ih,1),-1,1920)' -c:v libsvtav1 -preset 6 -crf 28 -g 240 -svtav1-params tune=0:aq-mode=2 -c:a copy"
+    [storage-av1-nvenc]="-c:v av1_nvenc -cq 28 -preset slow -c:a copy"
+    [network-hevc]="-c:v libx265 -preset slower -crf 22 -x265-params aq-mode=3:aq-strength=1.0:psy-rd=1.8:psy-rdoq=1.0 -pix_fmt yuv420p -c:a aac -b:a 128k"
+    [network-hevc-faster]="-c:v libx265 -preset slow -crf 26 -x265-params aq-mode=3:aq-strength=1.0:psy-rd=1.8:psy-rdoq=1.0 -pix_fmt yuv420p -c:a aac -b:a 128k"
     [network]="-c:v libx264 -preset slow -crf 22 -pix_fmt yuv420p -c:a aac -b:a 128k"
     [network-1080p]="-vf scale='if(gte(iw/ih,1),1920,-1)':'if(gte(iw/ih,1),-1,1920)' -c:v libx264 -preset slow -crf 22 -pix_fmt yuv420p -c:a aac -b:a 128k"
     [whatsapp]="-vf scale='if(gte(iw/ih,1),1920,-1)':'if(gte(iw/ih,1),-1,1920)' -c:v libx264 -preset slow -crf 30 -profile:v baseline -level 3.0 -pix_fmt yuv420p -r 25 -g 50 -c:a aac -b:a 160k -r:a 44100"
@@ -17,10 +21,14 @@ declare -rA containers=(
     [davinci-resolve]="mov"
     [instagram]="mp4"
     [insta-4k]="mp4"
-    [storage-hevc]="mkv"
+    [network-hevc]="mp4"
+    [storage-hevc-faster]="mp4"
+    [storage-hevc]="mp4"
     [storage-av1]="mkv"
     [storage-av1-1080p]="mkv"
     [storage-av1-nvenc]="mkv"
+    [network-hevc]="mp4"
+    [network-hevc-faster]="mp4"
     [network]="mp4"
     [network-1080p]="mp4"
     [whatsapp]="mp4"

secrets/harbor/hidden-matrix.yaml

@@ -0,0 +1,26 @@
+hostname: ENC[AES256_GCM,data:XRWNaOW738h9s1ppu6mopw6fEdrO7FoH0Tg3sqxFacMGvwIUonCaTm0dKtuqaToq8PNVlOE3Fkg74bMnzJ4=,iv:7iRalbTlrpoGXkNBm+StetvMBQyxtT0+ZYhMyBmipts=,tag:HQqnBP2Wj6I3bZTsoc27Yw==,type:str]
+registration_secret: ENC[AES256_GCM,data:jPiq+n3c2o4lC1AnA6E=,iv:kTjRl3ipV8WSEXqLUgveUQtxq1QWeNIUN17o2xGS3dI=,tag:He2zK/jXRi4GOWisw4yjSA==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaTWJ6djJqU0FtdUkvL2d6
+            SWt3NHBSUS9jQmlJVUVpaUZ3RGVJS0NCT2t3CkhvZzc3cUIyV3ZlT1ZVMUhFbDRE
+            RWtGTmxFQllnOTdJQ3ppNCtNcG9qbmcKLS0tIEdQNGlpQzBVU2c4alVrTUlmeXNZ
+            enRwUWl0Mzd6bmtRaDhkSlN0cGVRVG8KpJqu51CIRNK/nVLnUoFhPSyEWdW0TdqS
+            EUbDt71zKUEg4jHe+RqR9ThT2PSY3j03ZtkCYJ+aDIftWJrmpisUew==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1wf0rq27v0n27zfy0es8ns3n25e2fdt063dgn68tt3f89rgrtu9csq4yhsp
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2TWZxVDEzckNjMTRrNXpF
+            RGtMUmVVMjdjbVNzWHBHc21aV1RQZGExSmlrCnNpbXZLUHhnaWxNbFNyUHVnM05F
+            cWVYSFhGbUF2ejlGRjNvRWp6SFFQMncKLS0tIGt2VXhmcGFGOTNlSzdCM3Y3NFNr
+            NStxbkN4VitSOUJwN3BxWjljM1QvUWMK4dgk/luLWp9qDGLOp9vy/xJco/dLvepz
+            SSXKtuT3UbbyWqjV6AJ/slzsVWbBQCnf4fkJKpBnlCiqprjaFehXFg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1expg8vyduf290pz7l4f3mjzvk9f0azfdn48pyjzs3m6p7v4qjq0qwtn36z
+    lastmodified: "2026-07-17T21:59:19Z"
+    mac: ENC[AES256_GCM,data:hZ14dzYNrXLr2FK7LPZoggYT36n0kD2gX1Nd3OM256+uJcvLV1jyqhGqeg+xWLVWC4R31YZlhHWQwA6ZcGrzgk/ograarGEgE1pDkG74+02fRyqcvC6SxvF8I1hq2FxDKzmAK89lXh7GTjiFmo9nqrkgA1aDTnogW0FHoJhVB+4=,iv:3cPMHQmpc+Lfu2GpiGKn9H9y1DNo0dhGfr8M5zzXvl8=,tag:6uhGRnBXN7Mnw6M1iULZCQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2

secrets/harbor/hs_ed25519_secret_key

@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:1OXbkYAQrKgB49ex8UUOJXSirXD0Pjbm+IvUUniYLrCU8mItyuEvyuU3KNifn4ygkcm2pJ/oVbHpNtUvikxUWgrAVbc2t1U0GaEpTEEz/Si9g4uliJov4Qke+RZtz4Mh,iv:eReke55jV8N44YgNQEQffLPrk2+0DK0T9knPAFofW5Y=,tag:/653TVicd4StzEanhH9vFw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvSk5XM1dIVXZvOHFzbzRo\nSzcvZEtWMGZtaTIxa1hRbUZXVFRodC9JRkdBCkJ3V0t4R2N4bEdTUFNrNU9vUGs1\nVjRGZ1VzZnBBYUpIL1JXcmNtNEhWM0UKLS0tIG5XbjdobkFrMGZXaHlaRFdwMWo0\nU21MNnlNbkk1TVcwbEtsUC81Q1JBbFUKkgAiQCIscxuuIG+7Aplx67L4G1F4pMhX\n3UUnR6uWlrhhYS84K/oRb5h7tqHcK2ZPNRQtf66+QYLeYnoQkw2fAA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1wf0rq27v0n27zfy0es8ns3n25e2fdt063dgn68tt3f89rgrtu9csq4yhsp"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKRFdkTmlZc3RqVWwvMXJE\nZHVhNzNRWE1Wc3Y0M0VjR1M4R1pITlBBRTJrCllETlFiaEJGcHN0WW1jTnVldTZl\nV2ZxbUtBdytFeDFocXhVZ1Z3M01TWW8KLS0tIEpyeTJhMy95NnNaU3Fhbm91TVpu\nZjNjdmQwWGJ6YUlCRXh6Uk54eHlPUGMK5RGFrteIcon1CpVWddI0jftU3Q/SXGdz\nw9DwqtwkFTQpvRl2RGSJToipGwy91Pn3vubF+U77xEcPvtAhW8cIcQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1expg8vyduf290pz7l4f3mjzvk9f0azfdn48pyjzs3m6p7v4qjq0qwtn36z"
+			}
+		],
+		"lastmodified": "2026-07-17T20:23:08Z",
+		"mac": "ENC[AES256_GCM,data:vwz/UOSbE3p57HzYx5Im2Zgq/W7qHh9SSX10k6sIzJJQHIKTSFJaA8qwYJIStz8ULyBw0CDcROun+1RBhdpUCBDNl/fVcXHVgk39ubBbLJji0z84eW1qZmg9/WAW7y/nAid1SH5TU95OwC1KCUxSLzDdUNuO2YdRwvQ10ST8QJo=,iv:9yJ0yP7SoNhuFJ9LR1BXileQTYNus/FwSKLZETXY8Hg=,tag:S8tXzl6DhN/u6wMjIsr13w==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.13.2"
+	}
+}

templates/_rust/.envrc

@@ -11,6 +11,8 @@ fi
 
 watch_file nix/**
 watch_file -- **/*.nix
+watch_file Cargo.toml
+watch_file rust-toolchain.toml
 # Adding files to git includes them in a flake
 # But it is also a bit much reloading.
 # watch_file .git/index .git/HEAD

templates/_rust/flake.nix

@@ -1,13 +1,13 @@
 {
-  description = "Rust-Hello";
+  description = "Rust-Package";
 
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    flake-parts.url = "github:hercules-ci/flake-parts";
     rust-overlay = {
       url = "github:oxalica/rust-overlay";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    flake-utils.url = "github:numtide/flake-utils";
     crate2nix = {
       url = "github:nix-community/crate2nix";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -15,20 +15,25 @@
   };
 
   outputs = inputs @ {
+    flake-parts,
     crate2nix,
-    flake-utils,
-    nixpkgs,
     rust-overlay,
     ...
   }:
-    flake-utils.lib.eachDefaultSystem (
+    flake-parts.lib.mkFlake {inherit inputs;} {
-      system: let
+      systems = [
-        # Overlay pkgs with rust-bin
+        "aarch64-linux"
-        overlays = [(import rust-overlay)];
+        "aarch64-darwin"
-        pkgs = import nixpkgs {
+        "x86_64-darwin"
-          inherit system overlays;
+        "x86_64-linux"
-        };
+      ];
 
+      perSystem = {
+        pkgs,
+        system,
+        self',
+        ...
+      }: let
         # Use rust-bin to generate the toolchain from rust-toolchain.toml
         rust-toolchain = pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml;
 
@@ -48,14 +53,20 @@
           inherit pkgs buildRustCrateForPkgs;
         };
       in {
-        packages = rec {
+        # Overlay pkgs with rust-bin
-          hello = cargoNix.rootCrate.build;
+        _module.args.pkgs = import inputs.nixpkgs {
-          default = hello;
+          inherit system;
+          overlays = [(import rust-overlay)];
         };
 
-        devShell = pkgs.mkShell {
+        packages = {
+          hello = cargoNix.rootCrate.build;
+          default = self'.packages.hello;
+        };
+
+        devShells.default = pkgs.mkShell {
           buildInputs = [rust-toolchain];
         };
-      }
+      };
-    );
+    };
 }

templates/_rust/rust-toolchain.toml

@@ -1,3 +1,3 @@
 [toolchain]
-channel = "1.85.0"
+channel = "1.96.0"
 components = [ "rustfmt", "rustc-dev", "rust-analyzer", "rust-src"]