manatee: Add new vdev to zpool

As it breaks tailscale <-> openvpn

> At the time of September 2023, systemd upstream advise to disable DNSSEC
> by default as the current code is not robust enough to deal with
> “in the wild” non-compliant servers, which will usually give you a
> broken bad experience in addition of insecure.

flake.lock

@@ -10,11 +10,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1750173260,
+        "lastModified": 1760836749,
-        "narHash": "sha256-9P1FziAwl5+3edkfFcr5HeGtQUtrSdk/MksX39GieoA=",
+        "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "531beac616433bac6f9e2a19feb8e99a22a66baf",
+        "rev": "2f0f812f69f3eb4140157fe15e12739adf82e32a",
         "type": "github"
       },
       "original": {
@@ -52,11 +52,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751854533,
+        "lastModified": 1760701190,
-        "narHash": "sha256-U/OQFplExOR1jazZY4KkaQkJqOl59xlh21HP9mI79Vc=",
+        "narHash": "sha256-y7UhnWlER8r776JsySqsbTUh2Txf7K30smfHlqdaIQw=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "16b74a1e304197248a1bc663280f2548dbfcae3c",
+        "rev": "3a9450b26e69dcb6f8de6e2b07b3fc1c288d85f5",
         "type": "github"
       },
       "original": {
@@ -73,11 +73,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1751852591,
+        "lastModified": 1760951609,
-        "narHash": "sha256-5+eH9k3QpgxijkCWF12Iq73oqyr9LPkLfAsKS9GDsLU=",
+        "narHash": "sha256-rWkUWKWcLin0+dKvinWC1IZVxJnIvXV3q/wlmmKkzo4=",
         "owner": "nix-community",
         "repo": "emacs-overlay",
-        "rev": "d88b4b41d40b012ca06bbeb465871cd66b8b9d27",
+        "rev": "41bee8f6a80b36b0348a8e750e5db88fea528171",
         "type": "github"
       },
       "original": {
@@ -86,6 +86,24 @@
         "type": "github"
       }
     },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -114,11 +132,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751824240,
+        "lastModified": 1760969583,
-        "narHash": "sha256-aDDC0CHTlL7QDKWWhdbEgVPK6KwWt+ca0QkmHYZxMzI=",
+        "narHash": "sha256-vsf5mvR0xxK4GsfLx5bMJAQ4ysdrKymMIifNw+4TP7g=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "fd9e55f5fac45a26f6169310afca64d56b681935",
+        "rev": "c9d758b500e53db5b74aa02d17dc45b65229e8e9",
         "type": "github"
       },
       "original": {
@@ -134,11 +152,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751715349,
+        "lastModified": 1759613406,
-        "narHash": "sha256-cP76ijtfGTFTpWFfmyFHA2MpDlIyKpWwW82kqQSQ6s0=",
+        "narHash": "sha256-PzgQJydp+RlKvwDi807pXPlURdIAVqLppZDga3DwPqg=",
         "owner": "hyprwm",
         "repo": "contrib",
-        "rev": "dafa5d09b413d08a55a81f6f8e85775d717bacda",
+        "rev": "32e1a75b65553daefb419f0906ce19e04815aa3a",
         "type": "github"
       },
       "original": {
@@ -147,6 +165,27 @@
         "type": "github"
       }
     },
+    "naviterm": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1757496832,
+        "narHash": "sha256-R5EMcms24G6QGk62iNAMApeZmKsHwCDLj68UUdkhSLw=",
+        "owner": "detoxify92",
+        "repo": "naviterm",
+        "rev": "3b3bd2bace3676000f530b2f47fa28f431c56761",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "detoxify92",
+        "repo": "naviterm",
+        "type": "gitlab"
+      }
+    },
     "nh": {
       "inputs": {
         "nixpkgs": [
@@ -154,11 +193,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751375534,
+        "lastModified": 1760961269,
-        "narHash": "sha256-9z1W64dDVtVxqgPzUbjIQqRfygg1hdivUOZ6d/H+yFg=",
+        "narHash": "sha256-Udg6DnM6scJj+imbttJR7GQpG2WWeDZ1JOtySTY99M0=",
         "owner": "viperML",
         "repo": "nh",
-        "rev": "d0abb8eebe32f79ce4659e68dd777cf497a5d3d2",
+        "rev": "e27508e06f74c7f03616150c1ac1431eaef7f443",
         "type": "github"
       },
       "original": {
@@ -184,11 +223,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1751432711,
+        "lastModified": 1760958188,
-        "narHash": "sha256-136MeWtckSHTN9Z2WRNRdZ8oRP3vyx3L8UxeBYE+J9w=",
+        "narHash": "sha256-2m1S4jl+GEDtlt2QqeHil8Ny456dcGSKJAM7q3j/BFU=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "497ae1357f1ac97f1aea31a4cb74ad0d534ef41f",
+        "rev": "d6645c340ef7d821602fd2cd199e8d1eed10afbc",
         "type": "github"
       },
       "original": {
@@ -200,11 +239,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1751792365,
+        "lastModified": 1760878510,
-        "narHash": "sha256-J1kI6oAj25IG4EdVlg2hQz8NZTBNYvIS0l4wpr9KcUo=",
+        "narHash": "sha256-K5Osef2qexezUfs0alLvZ7nQFTGS9DL2oTVsIXsqLgs=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "1fd8bada0b6117e6c7eb54aad5813023eed37ccb",
+        "rev": "5e2a59a5b1a82f89f2c7e598302a9cacebb72a67",
         "type": "github"
       },
       "original": {
@@ -216,16 +255,16 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1751274312,
+        "lastModified": 1760862643,
-        "narHash": "sha256-/bVBlRpECLVzjV19t5KMdMFWSwKLtb5RyXdjz3LJT+g=",
+        "narHash": "sha256-PXwG0TM7Ek87DNx4LbGWuD93PbFeKAJs4FfALtp7Wo0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "50ab793786d9de88ee30ec4e4c24fb4236fc2674",
+        "rev": "33c6dca0c0cb31d6addcd34e90a63ad61826b28c",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-24.11",
+        "ref": "nixos-25.05",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -258,12 +297,14 @@
         "emacs-overlay": "emacs-overlay",
         "home-manager": "home-manager_2",
         "hyprland-contrib": "hyprland-contrib",
+        "naviterm": "naviterm",
         "nh": "nh",
         "nix-gc-env": "nix-gc-env",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
         "pppdotpm-site": "pppdotpm-site",
-        "whib-backend": "whib-backend"
+        "whib-backend": "whib-backend",
+        "whib-frontend": "whib-frontend"
       }
     },
     "systems": {
@@ -281,6 +322,21 @@
         "type": "github"
       }
     },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "whib-backend": {
       "inputs": {
         "nixpkgs": [
@@ -301,6 +357,27 @@
         "type": "git",
         "url": "ssh://gitea@git.ppp.pm:1122/alex/whib.git"
       }
+    },
+    "whib-frontend": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1761508816,
+        "narHash": "sha256-adV/lyxcmuopyuzZ49v46Yt0gft+ioEL4yl1S+vUbus=",
+        "ref": "master",
+        "rev": "ab10bf50cb6b023a1b99f91c7e8d550231135eef",
+        "revCount": 223,
+        "type": "git",
+        "url": "ssh://gitea@git.ppp.pm:1122/alex/whib-react.git"
+      },
+      "original": {
+        "ref": "master",
+        "type": "git",
+        "url": "ssh://gitea@git.ppp.pm:1122/alex/whib-react.git"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -38,6 +38,11 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    naviterm = {
+      url = "gitlab:detoxify92/naviterm";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     pppdotpm-site = {
       url = "git+ssh://gitea@git.ppp.pm:1122/alex/ppp.pm-site.git?ref=main";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -47,6 +52,11 @@
       url = "git+ssh://gitea@git.ppp.pm:1122/alex/whib.git?ref=master";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    whib-frontend = {
+      url = "git+ssh://gitea@git.ppp.pm:1122/alex/whib-react.git?ref=master";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
@@ -100,6 +110,7 @@
               ./hosts/tadpole/configuration.nix
               ./hosts/tadpole/home.nix
               inputs.whib-backend.nixosModules.${system}.default
+              inputs.whib-frontend.nixosModules.${system}.default
             ];
           };
 
@@ -115,6 +126,7 @@
             modules = [
               ./hosts/test-vm/configuration.nix
               inputs.whib-backend.nixosModules.${system}.default
+              inputs.whib-frontend.nixosModules.${system}.default
             ];
           };
       };

hosts/manatee/configuration.nix

@@ -23,6 +23,8 @@
     ];
   };
 
+  environment.variables.EDITOR = "vim";
+
   environment.systemPackages = with pkgs; [
     vim
     git

hosts/manatee/disk-config.nix

@@ -149,6 +149,39 @@
             };
           };
         };
+        disk3 = {
+          type = "disk";
+          device = "/dev/disk/by-id/ata-TOSHIBA_MG10ACA20TE_85K2A0UCF4MJ";
+          content = {
+            type = "gpt";
+            partitions = {
+              zfs = {
+                size = "100%";
+                content = {
+                  type = "zfs";
+                  pool = "storage";
+                };
+              };
+            };
+          };
+        };
+
+        disk4 = {
+          type = "disk";
+          device = "/dev/disk/by-id/ata-TOSHIBA_MG10ACA20TE_85K2A0V6F4MJ";
+          content = {
+            type = "gpt";
+            partitions = {
+              zfs = {
+                size = "100%";
+                content = {
+                  type = "zfs";
+                  pool = "storage";
+                };
+              };
+            };
+          };
+        };
       };
 
       zpool = {
@@ -166,6 +199,13 @@
                     "disk2"
                   ];
                 }
+                {
+                  mode = "mirror";
+                  members = [
+                    "disk3"
+                    "disk4"
+                  ];
+                }
               ];
             };
           };

hosts/manatee/modules/default.nix

@@ -20,6 +20,7 @@ in
       audiobookshelf.enable = true;
       jellyfin.enable = true;
       immich.enable = true;
+      navidrome.enable = true;
     };
   };
 }

hosts/manatee/modules/navidrome/default.nix

@@ -0,0 +1,33 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  navidromeEnabled = config.mod.navidrome.enable;
+in
+{
+  options = {
+    mod.navidrome = {
+      enable = lib.mkEnableOption "Enable navidrome module";
+    };
+  };
+
+  config = {
+    services = lib.mkIf navidromeEnabled {
+      navidrome = {
+        enable = true;
+        openFirewall = true;
+
+        user = "navidrome";
+        group = "storage";
+        settings = {
+          Port = 4533;
+          Address = "0.0.0.0";
+          MusicFolder = "/mnt/media/public/music";
+        };
+      };
+    };
+  };
+}

hosts/pinwheel/home.nix

@@ -25,6 +25,7 @@
           pkgs.htop
           pkgs.onlyoffice-bin
           pkgs.wdisplays
+          pkgs.vlc
         ];
 
         home.stateVersion = "23.05";

hosts/pinwheel/modules/default.nix

@@ -33,6 +33,7 @@ in
       rust.enable = true;
       scala.enable = true;
       python.enable = true;
+      gleam.enable = true;
 
       keyboard.enable = true;
       containers = {

hosts/pinwheel/modules/emacs/config.org

@@ -479,7 +479,34 @@ Setup prefix for keybindings.
 
 * Flycheck
 #+BEGIN_SRC emacs-lisp
-  (use-package flycheck)
+  (use-package flycheck
+    :preface
+    (defun mp-flycheck-eldoc (callback &rest _ignored)
+      "Print flycheck messages at point by calling CALLBACK."
+      (when-let ((flycheck-errors (and flycheck-mode (flycheck-overlay-errors-at (point)))))
+        (mapc
+         (lambda (err)
+           (funcall callback
+             (format "%s: %s"
+                     (let ((level (flycheck-error-level err)))
+                       (pcase level
+                         ('info (propertize "I" 'face 'flycheck-error-list-info))
+                         ('error (propertize "E" 'face 'flycheck-error-list-error))
+                         ('warning (propertize "W" 'face 'flycheck-error-list-warning))
+                         (_ level)))
+                     (flycheck-error-message err))
+             :thing (or (flycheck-error-id err)
+                        (flycheck-error-group err))
+             :face 'font-lock-doc-face))
+         flycheck-errors)))
+
+    (defun mp-flycheck-prefer-eldoc ()
+      (add-hook 'eldoc-documentation-functions #'mp-flycheck-eldoc nil t)
+      (setq eldoc-documentation-strategy 'eldoc-documentation-compose-eagerly)
+      (setq flycheck-display-errors-function nil)
+      (setq flycheck-help-echo-function nil))
+
+    :hook ((flycheck-mode . mp-flycheck-prefer-eldoc)))
 
   (use-package flycheck-eglot
     :after (flycheck eglot)
@@ -503,6 +530,12 @@ Setup prefix for keybindings.
         (add-hook 'before-save-hook #'eglot-format-buffer -10 t))))
 
   (use-package eglot
+    :preface
+    (defun mp-eglot-eldoc ()
+  	(setq eldoc-echo-area-use-multiline-p nil)
+      (setq eldoc-documentation-strategy
+        'eldoc-documentation-compose-eagerly))
+
     :config
     (add-to-list 'eglot-server-programs
       '(scala-mode .
@@ -511,6 +544,9 @@ Setup prefix for keybindings.
     (add-to-list 'eglot-server-programs
        '(nix-mode . ("nixd")))
 
+    (add-to-list 'eglot-server-programs
+      '(gleam-ts-mode . ("gleam" "lsp")))
+
     (setq-default eglot-workspace-configuration
       '(
         :metals (
@@ -520,6 +556,7 @@ Setup prefix for keybindings.
     )
 
     :hook (
+           (eglot-managed-mode . mp-eglot-eldoc)
            (go-mode . eglot-ensure)
            (go-mode . alex/organize-imports-on-save)
            (go-mode . alex/format-on-save)
@@ -529,6 +566,9 @@ Setup prefix for keybindings.
            (nix-mode . eglot-ensure)
            (nix-mode . alex/format-on-save)
 
+           (gleam-ts-mode . eglot-ensure)
+           (gleam-ts-mode . alex/format-on-save)
+
            (python-mode . eglot-ensure)
            (javascript-mode . eglot-ensure)
            (js-mode . eglot-ensure)
@@ -549,13 +589,6 @@ Setup prefix for keybindings.
     :after eglot
     :config (eglot-booster-mode))
 #+END_SRC
-** Eldoc-box
-#+BEGIN_SRC emacs-lisp
-  (use-package eldoc-box
-    :after eglot
-    :bind (:map eglot-mode-map
-              ("M-h" . eldoc-box-help-at-point)))
-#+END_SRC
 ** Go
 #+BEGIN_SRC emacs-lisp
   (use-package go-mode
@@ -573,6 +606,12 @@ Setup prefix for keybindings.
     )
   )
 #+END_SRC
+** Gleam
+#+BEGIN_SRC emacs-lisp
+  (use-package gleam-ts-mode
+    :mode "\\.gleam\\'"
+  )
+#+END_SRC
 ** YAML
 #+BEGIN_SRC emacs-lisp
   (use-package yaml-mode

hosts/pinwheel/modules/gleam/default.nix

@@ -0,0 +1,25 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  enabled = config.mod.gleam.enable;
+in
+{
+  options = {
+    mod.gleam = {
+      enable = lib.mkEnableOption "enable gleam module";
+    };
+  };
+
+  config = lib.mkIf enabled {
+    home-manager.users.alex = {
+      home.packages = [
+        pkgs.gleam
+        pkgs.erlang
+      ];
+    };
+  };
+}

hosts/pinwheel/modules/go/default.nix

@@ -20,7 +20,9 @@ in
         enable = true;
 
         package = pkgs.go;
-        goPath = "code/go";
+        env = {
+          GOPATH = "/home/alex/code/go";
+        };
       };
 
       home.packages = [

hosts/pinwheel/modules/hyprland/default.nix

@@ -25,11 +25,14 @@ in
 
         extraConfig = ''
           exec-once=waybar
+          exec-once=hyprctl setcursor Adwaita 24
 
           env = GDK_DPI_SCALE,1.5
-          env = XCURSOR_SIZE,64
+          env = HYPRCURSOR_THEME,Adwaita
+          env = HYPRCURSOR_SIZE,24
 
-          monitor=eDP-1, 1920x1200, 0x0, 1
+          monitor=eDP-1, 1920x1200, auto-center-down, 1
+          monitor=HDMI-A-1, 2560x1440@100, auto-center-up, 1
 
           workspace = 1, monitor:HDMI-A-1
           workspace = 2, monitor:HDMI-A-1
@@ -177,88 +180,5 @@ in
 
     # openGL is needed for wayland/hyprland
     hardware.graphics.enable = true;
-
-    systemd.user.services.hyprland-monitors = {
-      # systemctl --user restart hyprland-monitors.service
-      # journalctl --user -u hyprland-monitors.service -e -f
-      unitConfig = {
-        Description = "handles hyprland monitor connect/disconnect";
-      };
-
-      wantedBy = [ "graphical-session.target" ];
-      requires = [ "graphical-session.target" ];
-      after = [ "graphical-session.target" ];
-
-      path = [
-        pkgs.coreutils # to include `cat`
-        pkgs.waybar
-        pkgs.hyprland
-        pkgs.socat
-        pkgs.jq
-        pkgs.bc
-        pkgs.libnotify
-      ];
-
-      script =
-        let
-          moveWSToMonitor =
-            monitor: first: last:
-            if last < first then
-              throw "'first' has to be less than or equal to 'last'"
-            else
-              builtins.genList (
-                n: "dispatch moveworkspacetomonitor ${builtins.toString (first + n)} ${monitor}"
-              ) (last - first + 1);
-
-          external = moveWSToMonitor "HDMI-A-1" 1 5;
-          internal = moveWSToMonitor "eDPI-1" 6 10;
-          onlyInternal = moveWSToMonitor "eDPI-1" 1 10;
-        in
-        ''
-          update() {
-            HDMI_STATUS=$(cat /sys/class/drm/card1-HDMI-A-1/status)
-
-            INTERNAL_WIDTH=1920
-            INTERNAL_HEIGHT=1200
-
-            if [ $HDMI_STATUS = "connected" ]; then
-              notify-send "Using external and laptop monitor"
-
-              hyprctl keyword monitor HDMI-A-1,preferred,0x0,1
-
-              HDMI=$(hyprctl monitors -j | jq '.[] | select(.name=="HDMI-A-1")')
-              HDMI_WIDTH=$(echo $HDMI | jq .width)
-              HDMI_HEIGHT=$(echo $HDMI | jq .height)
-
-              INTERNAL_POS_X=$(echo "($HDMI_WIDTH - $INTERNAL_WIDTH) / 2" | bc)
-              if (( $(echo "$INTERNAL_POS_X < 0" | bc) )); then INTERNAL_POS_X=0; fi
-              INTERNAL_POS_Y=$HDMI_HEIGHT
-
-              hyprctl keyword monitor eDP-1,$INTERNAL_WIDTH"x"$INTERNAL_HEIGHT,$INTERNAL_POS_X"x"$INTERNAL_POS_Y,1
-              hyprctl --batch "${lib.strings.concatStringsSep ";" (external ++ internal)}"
-            else
-              notify-send "Using only laptop monitor"
-
-              hyprctl --batch "keyword monitor HDMI-A,disable; keyword monitor eDP-1,$INTERNAL_WIDTH"x"$INTERNAL_HEIGHT,0x0,1"
-              hyprctl --batch "${lib.strings.concatStringsSep ";" onlyInternal}"
-            fi
-          }
-
-          handle() {
-            case $1 in
-              monitoradded\>\>*|monitorremoved\>\>*)
-                echo "handling event: \"$1\""
-                update ;;
-            esac
-          }
-
-          echo "Starting service with instance \"$HYPRLAND_INSTANCE_SIGNATURE\""
-
-          # Do initial configuration
-          update
-
-          socat -U - UNIX-CONNECT:$XDG_RUNTIME_DIR/hypr/$HYPRLAND_INSTANCE_SIGNATURE/.socket2.sock | while read -r line; do handle "$line"; done
-        '';
-    };
   };
 }

hosts/pinwheel/modules/music/default.nix

@@ -1,4 +1,5 @@
 {
+  inputs,
   pkgs,
   lib,
   config,
@@ -13,18 +14,18 @@ in
       settings = {
         bind =
           let
-            prev = "${pkgs.playerctl}/bin/playerctl -p spotify previous";
+            prev = "${pkgs.playerctl}/bin/playerctl -p naviterm,spotify previous";
-            next = "${pkgs.playerctl}/bin/playerctl -p spotify next";
+            next = "${pkgs.playerctl}/bin/playerctl -p naviterm,spotify next";
           in
           [
             ", XF86AudioPrev, exec, ${prev}"
             ", XF86AudioNext, exec, ${next}"
-            ", XF86AudioPlay, exec, ${pkgs.playerctl}/bin/playerctl -p spotify play-pause"
+            ", XF86AudioPlay, exec, ${pkgs.playerctl}/bin/playerctl -p naviterm,spotify play-pause"
-            ", XF86AudioPause, exec, ${pkgs.playerctl}/bin/playerctl -p spoitfy play-pause"
+            ", XF86AudioPause, exec, ${pkgs.playerctl}/bin/playerctl -p naviterm,spoitfy play-pause"
 
             "$mod ALT, LEFT, exec, ${prev}"
             "$mod ALT, RIGHT, exec, ${next}"
-            "$mod ALT, DOWN, exec, ${pkgs.playerctl}/bin/playerctl -p spotify play-pause"
+            "$mod ALT, DOWN, exec, ${pkgs.playerctl}/bin/playerctl -p naviterm,spotify play-pause"
           ];
       };
     };
@@ -32,6 +33,7 @@ in
     home.packages = [
       pkgs.playerctl
       pkgs.spotify
+      inputs.naviterm.packages.${pkgs.system}.default
     ];
   };
 

hosts/pinwheel/modules/openvpn/default.nix

@@ -18,13 +18,12 @@ in
     home-manager.users.alex = {
       home.packages = [
         pkgs.openvpn
-        pkgs.update-systemd-resolved
       ];
     };
 
     services.resolved = {
-      enable = false;
+      enable = true;
-      dnssec = "true";
+      dnssec = "false";
       domains = [ "~." ];
       fallbackDns = [
         "1.1.1.1#one.one.one.one"

hosts/pinwheel/modules/ssh/default.nix

@@ -19,12 +19,6 @@
           port = 1122;
         };
 
-        "andromeda" = {
-          hostname = "andromeda.a2x.se";
-          user = "alex";
-          identityFile = "/home/alex/.ssh/alex.pinwheel-andromeda";
-        };
-
         "tadpole" = {
           hostname = "65.21.106.222";
           user = "alex";
@@ -118,19 +112,6 @@
       group = "users";
     };
 
-    "alex.pinwheel-andromeda" = {
-      file = ../../../../secrets/pinwheel/alex.pinwheel-andromeda.age;
-      path = "/home/alex/.ssh/alex.pinwheel-andromeda";
-      owner = "alex";
-      group = "users";
-    };
-    "alex.pinwheel-andromeda.pub" = {
-      file = ../../../../secrets/pinwheel/alex.pinwheel-andromeda.pub.age;
-      path = "/home/alex/.ssh/alex.pinwheel-andromeda.pub";
-      owner = "alex";
-      group = "users";
-    };
-
     "alex.pinwheel-tadpole" = {
       file = ../../../../secrets/pinwheel/alex.pinwheel-tadpole.age;
       path = "/home/alex/.ssh/alex.pinwheel-tadpole";

hosts/pinwheel/modules/waybar/default.nix

@@ -7,14 +7,14 @@
 let
   hyprlandEnabled = config.mod.hyprland.enable;
 
-  spotify-status = pkgs.writeShellScript "spotify-status" ''
+  music-status = pkgs.writeShellScript "music-status" ''
-    STATUS=$(${pkgs.playerctl}/bin/playerctl -p spotify status 2>&1)
+    STATUS=$(${pkgs.playerctl}/bin/playerctl -p naviterm,spotify status 2>&1)
 
     if [ "$STATUS" = "No players found" ]; then
       echo ""
     else
       FORMAT="{{markup_escape(xesam:title)}} - {{markup_escape(xesam:artist)}}"
-      OUTPUT=$(${pkgs.playerctl}/bin/playerctl -p spotify metadata --format "$FORMAT")
+      OUTPUT=$(${pkgs.playerctl}/bin/playerctl -p naviterm,spotify metadata --format "$FORMAT")
       case "$STATUS" in
         "Playing")
           echo "<span font='14' rise='-3000'></span> $OUTPUT"
@@ -126,7 +126,7 @@ in
           modules-left = lib.mkIf hyprlandEnabled [ "hyprland/workspaces" ];
           modules-right = [
             "custom/work-vpn-status"
-            "custom/spotify"
+            "custom/music"
             "custom/container-status"
             "custom/dunst"
             "bluetooth"
@@ -142,8 +142,8 @@ in
             interval = 2;
           };
 
-          "custom/spotify" = {
+          "custom/music" = {
-            exec = spotify-status;
+            exec = music-status;
             interval = 2;
             max-length = 70;
             tooltip = false;
@@ -222,7 +222,10 @@ in
           height = 30;
           spacing = 20;
           fixed-center = false;
-          output = [ "HDMI-A-1" ];
+          output = [
+            "HDMI-A-1"
+            "DP-3"
+          ];
 
           modules-left = lib.mkIf hyprlandEnabled [ "hyprland/workspaces" ];
           modules-right = [

hosts/pinwheel/modules/work/default.nix

@@ -16,25 +16,11 @@ in
       GITHUB_TOKEN = "$(${pkgs.coreutils}/bin/cat ${config.age.secrets.work-github-token.path})";
     };
 
-    home.packages =
+    home.packages = [
-      let
-        intellij = (
-          pkgs.jetbrains.idea-ultimate.overrideAttrs (
-            final: prev: {
-              version = "2024.2.4";
-              src = pkgs.fetchurl {
-                url = "https://download.jetbrains.com/idea/ideaIU-${final.version}.tar.gz";
-                sha256 = "8411fda793a20356a4982e4f18f6691839d8a471e2081ab6d8cc78b3f8b02532";
-              };
-            }
-          )
-        );
-      in
-      [
       # (pkgs.callPackage ./pants.nix { inherit (pkgs) system; })
       # (pkgs.callPackage ./syb-cli.nix { })
 
-        (pkgs.jetbrains.plugins.addPlugins intellij [ "ideavim" ])
+      (pkgs.jetbrains.plugins.addPlugins pkgs.jetbrains.idea-ultimate [ "ideavim" ])
 
       (pkgs.google-cloud-sdk.withExtraComponents [
         pkgs.google-cloud-sdk.components.gke-gcloud-auth-plugin
@@ -51,7 +37,9 @@ in
     ];
 
     programs.go = lib.mkIf goEnabled {
-      goPrivate = [ "$(${pkgs.coreutils}/bin/cat ${config.age.secrets.work-go-private.path})" ];
+      env = {
+        GOPRIVATE = [ "$(${pkgs.coreutils}/bin/cat ${config.age.secrets.work-go-private.path})" ];
+      };
     };
 
     programs.git = lib.mkIf gitEnabled {

hosts/tadpole/modules/certs/default.nix

@@ -18,6 +18,11 @@
         group = "nginx";
       };
 
+      "whib.ppp.pm" = {
+        webroot = "/var/lib/acme/acme-challenge/";
+        group = "nginx";
+      };
+
       "api.whib.ppp.pm" = {
         webroot = "/var/lib/acme/acme-challenge/";
         group = "nginx";

hosts/tadpole/modules/default.nix

@@ -23,6 +23,7 @@ in
 
       pppdotpm-site.enable = true;
       whib-backend.enable = true;
+      whib-frontend.enable = true;
     };
   };
 }

hosts/tadpole/modules/whib/default.nix

@@ -4,24 +4,30 @@
   ...
 }:
 let
-  enabled = config.mod.whib-backend.enable;
+  backendEnabled = config.mod.whib-backend.enable;
+  frontendEnabled = config.mod.whib-frontend.enable;
 in
 {
   options = {
     mod.whib-backend = {
       enable = lib.mkEnableOption "enable WHIB backend";
     };
+
+    mod.whib-frontend = {
+      enable = lib.mkEnableOption "enable WHIB frontend";
+    };
   };
 
-  config = lib.mkIf enabled {
+  config = {
     assertions = [
       {
-        assertion = config.services.nginx.enable;
+        assertion = backendEnabled && config.services.nginx.enable;
         message = "Option 'config.services.nginx' must be enabled";
       }
     ];
 
-    services.whib-backend = {
+    services = {
+      whib-backend = lib.mkIf backendEnabled {
         enable = true;
 
         backend = {
@@ -50,6 +56,15 @@ in
         };
       };
 
+      whib-frontend = lib.mkIf frontendEnabled {
+        enable = true;
+
+        domain = "whib.ppp.pm";
+        useACMEHost = "whib.ppp.pm";
+        backendHost = "https://api.whib.ppp.pm";
+      };
+    };
+
     age.secrets = {
       "whib-backend-env-vars".file = ../../../../secrets/tadpole/whib-backend-env-vars.age;
       "whib-postgres-env-vars".file = ../../../../secrets/tadpole/whib-postgres-env-vars.age;

hosts/test-vm/configuration.nix

@@ -3,6 +3,7 @@
   imports = [
     ./ppp.pm-site.nix
     ./whib-backend.nix
+    ./whib-frontend.nix
   ];
 
   config = {
@@ -13,6 +14,7 @@
     mod = {
       pppdotpm-site.enable = false;
       whib-backend.enable = true;
+      whib-frontend.enable = true;
     };
 
     users.users.a = {
@@ -24,9 +26,9 @@
     security.sudo.wheelNeedsPassword = false;
 
     virtualisation.vmVariant = {
-      # following configuration is added only when building VM with build-vm
+      # following configuration is added only when building VM the *first* time with `build-vm`
       virtualisation = {
-        diskSize = 4096;
+        diskSize = 8192;
         memorySize = 2048;
         cores = 3;
         graphics = false;

hosts/test-vm/whib-frontend.nix

@@ -0,0 +1,34 @@
+{ lib, config, ... }:
+let
+  enabled = config.mod.whib-frontend.enable;
+in
+{
+  options = {
+    mod.whib-frontend = {
+      enable = lib.mkEnableOption "enable WHIB backend";
+    };
+  };
+
+  config = lib.mkIf enabled {
+    services.whib-frontend = {
+      enable = true;
+
+      domain = "whib-frontend.local";
+      port = "8081";
+      backendHost = "https://api.whib.ppp.pm/"; # "whib-backend.local";
+    };
+
+    virtualisation.vmVariant = {
+      virtualisation = {
+        forwardPorts = [
+          {
+            # Service API
+            from = "host";
+            host.port = 8081;
+            guest.port = 8081;
+          }
+        ];
+      };
+    };
+  };
+}

secrets/secrets.nix

@@ -17,8 +17,6 @@ in {
   "pinwheel/alex.pinwheel-tadpole.pub.age".publicKeys = [ pinwheel tadpole alex ];
   "pinwheel/alex.pinwheel-github.com.age".publicKeys = [ pinwheel alex ];
   "pinwheel/alex.pinwheel-github.com.pub.age".publicKeys = [ pinwheel alex ];
-  "pinwheel/alex.pinwheel-andromeda.age".publicKeys = [ pinwheel alex ];
-  "pinwheel/alex.pinwheel-andromeda.pub.age".publicKeys = [ pinwheel alex ];
   "pinwheel/alex.pinwheel-codeberg.org.age".publicKeys = [ pinwheel alex ];
   "pinwheel/alex.pinwheel-codeberg.org.pub.age".publicKeys = [ pinwheel alex ];
   "pinwheel/alex.pinwheel-git.ppp.pm.age".publicKeys = [ pinwheel alex ];