manatee: Set correct user on komga-reading-stats secrets

Use hyprctl --batch to send all workspace rules and moves in a
single IPC call, avoiding races that caused workspaces to end up
on the wrong monitor.

README.md

@@ -25,3 +25,13 @@ EDITOR=vim agenix -d "some-secret.age" -i ~/.ssh/alex.pinwheel
 
 Or use some other SSH key that is has been used to key the secret.
 
+# Test VM
+Build the test VM with the command:
+```
+cm  --build-test-vm
+```
+
+and test it with:
+```
+cm  --run-test-vm
+```

alex.tadpole-git.ppp.pm

@@ -1,8 +0,0 @@
------BEGIN OPENSSH PRIVATE KEY-----
-b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABDJGnS+ne
-CYQhwLNFuW0lORAAAAGAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIFoVMhke2g8n48Fa
-nAdf8Q0K52iHn62D37Zq7MVDbAjEAAAAoLI0dbPITXAhkRXqAKJUh9IsWmviAJE8XMUAMQ
-WPKr2GUxRwf9rVrIB3/VEhY2xfTFzFOiyPkMu4zFvBFoYyqlpXaojihfJv+obV+SgtxnPT
-PxmUG5X0HMryYxswpY/kAG4c2Y7iDQZOuN504WSlDV8ZNkmEzr05Nc+JqaY8J70k7Kl1Wr
-qqtbilUNtETsEGUgXaQ/msYWRmt2K8EwiyhdY=
------END OPENSSH PRIVATE KEY-----

alex.tadpole-git.ppp.pm.pub

@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFoVMhke2g8n48FanAdf8Q0K52iHn62D37Zq7MVDbAjE alex.tadpole-git.ppp.pm

config-manager/default.nix

@@ -9,7 +9,7 @@ let
   flakePath = config.config-manager.flakePath;
   nixosConfiguration = config.config-manager.nixosConfiguration;
 
-  nh = inputs.nh.packages."${pkgs.system}".default;
+  nh = inputs.nh.packages."${pkgs.stdenv.hostPlatform.system}".default;
 
   config-manager =
     if flakePath == "" then
@@ -33,7 +33,7 @@ let
 
                 update() {
                   echo -e "\033[0;31mUPDATING FLAKE\033[0m"
-                  nix flake update ${flakePath}
+                  nix flake update --flake ${flakePath}
                 }
 
                 switch() {

flake.lock

@@ -10,11 +10,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1723293904,
+        "lastModified": 1770165109,
-        "narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
+        "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
+        "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb",
         "type": "github"
       },
       "original": {
@@ -23,6 +23,39 @@
         "type": "github"
       }
     },
+    "aquamarine": {
+      "inputs": {
+        "hyprutils": [
+          "hyprland",
+          "hyprutils"
+        ],
+        "hyprwayland-scanner": [
+          "hyprland",
+          "hyprwayland-scanner"
+        ],
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1773436376,
+        "narHash": "sha256-OUPRrprbgN27BXHuWkMAPSCfLLQ/uwpWghEfKYN2iAg=",
+        "owner": "hyprwm",
+        "repo": "aquamarine",
+        "rev": "43f10d24391692bba3d762931ee35e7f17f8e8b8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "aquamarine",
+        "type": "github"
+      }
+    },
     "darwin": {
       "inputs": {
         "nixpkgs": [
@@ -31,11 +64,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1700795494,
+        "lastModified": 1744478979,
-        "narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
+        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
+        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
         "type": "github"
       },
       "original": {
@@ -45,20 +78,39 @@
         "type": "github"
       }
     },
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1773889306,
+        "narHash": "sha256-PAqwnsBSI9SVC2QugvQ3xeYCB0otOwCacB1ueQj2tgw=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "5ad85c82cc52264f4beddc934ba57f3789f28347",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
     "emacs-overlay": {
       "inputs": {
-        "flake-utils": "flake-utils",
         "nixpkgs": [
           "nixpkgs"
         ],
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1725470024,
+        "lastModified": 1774197122,
-        "narHash": "sha256-i2iWRFWaTCahFz9B2vKqIqpPimL/yn1zX3lZ2EkBzc0=",
+        "narHash": "sha256-eidCp9jr4doBF6v2hPwqZkt8fUtW14w7fqHFVtstR94=",
         "owner": "nix-community",
         "repo": "emacs-overlay",
-        "rev": "8a94f9d557f3f8b372f03f18b2e1be3820d7da7f",
+        "rev": "4f7b5653f8845eee7c41c9a029d7bc22aaca4e67",
         "type": "github"
       },
       "original": {
@@ -67,16 +119,48 @@
         "type": "github"
       }
     },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "inputs": {
-        "systems": "systems_2"
+        "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1710146030,
+        "lastModified": 1731533236,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
         "type": "github"
       },
       "original": {
@@ -85,6 +169,46 @@
         "type": "github"
       }
     },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_4"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "hyprland",
+          "pre-commit-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -93,11 +217,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1703113217,
+        "lastModified": 1745494811,
-        "narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
+        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
+        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
         "type": "github"
       },
       "original": {
@@ -113,11 +237,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1725180166,
+        "lastModified": 1774201162,
-        "narHash": "sha256-fzssXuGR/mCeGbzM1ExaTqDz7QDGta3WA4jJsZyRruo=",
+        "narHash": "sha256-th4i3X3P3yikPk3qu1A5DQ40tIztZKvAKPaa9hjXF+U=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "471e3eb0a114265bcd62d11d58ba8d3421ee68eb",
+        "rev": "932ca46013acabbedd13c27dc278e3d043707e46",
         "type": "github"
       },
       "original": {
@@ -126,6 +250,96 @@
         "type": "github"
       }
     },
+    "hyprcursor": {
+      "inputs": {
+        "hyprlang": [
+          "hyprland",
+          "hyprlang"
+        ],
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772461003,
+        "narHash": "sha256-pVICsV7FtcEeVwg5y/LFh3XFUkVJninm/P1j/JHzEbM=",
+        "owner": "hyprwm",
+        "repo": "hyprcursor",
+        "rev": "b62396457b9cfe2ebf24fe05404b09d2a40f8ed7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprcursor",
+        "type": "github"
+      }
+    },
+    "hyprgraphics": {
+      "inputs": {
+        "hyprutils": [
+          "hyprland",
+          "hyprutils"
+        ],
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772461523,
+        "narHash": "sha256-mI6A51do+hEUzeJKk9YSWfVHdI/SEEIBi2tp5Whq5mI=",
+        "owner": "hyprwm",
+        "repo": "hyprgraphics",
+        "rev": "7d63c04b4a2dd5e59ef943b4b143f46e713df804",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprgraphics",
+        "type": "github"
+      }
+    },
+    "hyprland": {
+      "inputs": {
+        "aquamarine": "aquamarine",
+        "hyprcursor": "hyprcursor",
+        "hyprgraphics": "hyprgraphics",
+        "hyprland-guiutils": "hyprland-guiutils",
+        "hyprland-protocols": "hyprland-protocols",
+        "hyprlang": "hyprlang",
+        "hyprutils": "hyprutils",
+        "hyprwayland-scanner": "hyprwayland-scanner",
+        "hyprwire": "hyprwire",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pre-commit-hooks": "pre-commit-hooks",
+        "systems": "systems_2",
+        "xdph": "xdph"
+      },
+      "locked": {
+        "lastModified": 1774136452,
+        "narHash": "sha256-pSwj8WNWXMuZaDqCyhQwlngRD3JyNmZwldSe6UqWAos=",
+        "owner": "hyprwm",
+        "repo": "Hyprland",
+        "rev": "bf31f642b08a8d8ca796a1b713285f2580805c2f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "Hyprland",
+        "type": "github"
+      }
+    },
     "hyprland-contrib": {
       "inputs": {
         "nixpkgs": [
@@ -133,11 +347,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1725276753,
+        "lastModified": 1773993211,
-        "narHash": "sha256-kcV2M7xIoQvLRIrMndysM4E0d2zGSwIDejamT4LKnDg=",
+        "narHash": "sha256-4J6vEtf7dIw3pZ/xM/dU7ECTmr8AsIIUQJba1B8wp5k=",
         "owner": "hyprwm",
         "repo": "contrib",
-        "rev": "ae618eafa81b596db034c5df1d75d4eddf785824",
+        "rev": "43c012d21d9314c585b97ac4f34752f6de93dc8f",
         "type": "github"
       },
       "original": {
@@ -146,23 +360,338 @@
         "type": "github"
       }
     },
-    "nh": {
+    "hyprland-guiutils": {
+      "inputs": {
+        "aquamarine": [
+          "hyprland",
+          "aquamarine"
+        ],
+        "hyprgraphics": [
+          "hyprland",
+          "hyprgraphics"
+        ],
+        "hyprlang": [
+          "hyprland",
+          "hyprlang"
+        ],
+        "hyprtoolkit": "hyprtoolkit",
+        "hyprutils": [
+          "hyprland",
+          "hyprutils"
+        ],
+        "hyprwayland-scanner": [
+          "hyprland",
+          "hyprwayland-scanner"
+        ],
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772467975,
+        "narHash": "sha256-kipyuDBxrZq+beYpZqWzGvFWm4QbayW9agAvi94vDXY=",
+        "owner": "hyprwm",
+        "repo": "hyprland-guiutils",
+        "rev": "5e1c6b9025aaf4d578f3eff7c0eb1f0c197a9507",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprland-guiutils",
+        "type": "github"
+      }
+    },
+    "hyprland-protocols": {
+      "inputs": {
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772460177,
+        "narHash": "sha256-/6G/MsPvtn7bc4Y32pserBT/Z4SUUdBd4XYJpOEKVR4=",
+        "owner": "hyprwm",
+        "repo": "hyprland-protocols",
+        "rev": "1cb6db5fd6bb8aee419f4457402fa18293ace917",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprland-protocols",
+        "type": "github"
+      }
+    },
+    "hyprlang": {
+      "inputs": {
+        "hyprutils": [
+          "hyprland",
+          "hyprutils"
+        ],
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772459629,
+        "narHash": "sha256-/iwvNUYShmmnwmz/czEUh6+0eF5vCMv0xtDW0STPIuM=",
+        "owner": "hyprwm",
+        "repo": "hyprlang",
+        "rev": "7615ee388de18239a4ab1400946f3d0e498a8186",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprlang",
+        "type": "github"
+      }
+    },
+    "hyprtoolkit": {
+      "inputs": {
+        "aquamarine": [
+          "hyprland",
+          "hyprland-guiutils",
+          "aquamarine"
+        ],
+        "hyprgraphics": [
+          "hyprland",
+          "hyprland-guiutils",
+          "hyprgraphics"
+        ],
+        "hyprlang": [
+          "hyprland",
+          "hyprland-guiutils",
+          "hyprlang"
+        ],
+        "hyprutils": [
+          "hyprland",
+          "hyprland-guiutils",
+          "hyprutils"
+        ],
+        "hyprwayland-scanner": [
+          "hyprland",
+          "hyprland-guiutils",
+          "hyprwayland-scanner"
+        ],
+        "nixpkgs": [
+          "hyprland",
+          "hyprland-guiutils",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "hyprland-guiutils",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772462885,
+        "narHash": "sha256-5pHXrQK9zasMnIo6yME6EOXmWGFMSnCITcfKshhKJ9I=",
+        "owner": "hyprwm",
+        "repo": "hyprtoolkit",
+        "rev": "9af245a69fa6b286b88ddfc340afd288e00a6998",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprtoolkit",
+        "type": "github"
+      }
+    },
+    "hyprutils": {
+      "inputs": {
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1773948364,
+        "narHash": "sha256-S76omfIVQ1TpGiXFbqih6o6XcH3sA5+5QI+SXB4HvlY=",
+        "owner": "hyprwm",
+        "repo": "hyprutils",
+        "rev": "b85b779e3e3a1adcd9b098e3447cf48f9e780b35",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprutils",
+        "type": "github"
+      }
+    },
+    "hyprwayland-scanner": {
+      "inputs": {
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772459835,
+        "narHash": "sha256-978jRz/y/9TKmZb/qD4lEYHCQGHpEXGqy+8X2lFZsak=",
+        "owner": "hyprwm",
+        "repo": "hyprwayland-scanner",
+        "rev": "0a692d4a645165eebd65f109146b8861e3a925e7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprwayland-scanner",
+        "type": "github"
+      }
+    },
+    "hyprwire": {
+      "inputs": {
+        "hyprutils": [
+          "hyprland",
+          "hyprutils"
+        ],
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1773074819,
+        "narHash": "sha256-qRqYnXiKoJLRTcfaRukn7EifmST2IVBUMZOeZMAc5UA=",
+        "owner": "hyprwm",
+        "repo": "hyprwire",
+        "rev": "f68afd0e73687598cc2774804fedad76693046f0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprwire",
+        "type": "github"
+      }
+    },
+    "komga-bookmanager": {
       "inputs": {
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1725287741,
+        "lastModified": 1772988002,
-        "narHash": "sha256-ZxyB7BwxQjoMz5lUnsb+KuTWfRyPtJVqEjnlOoABSUE=",
+        "narHash": "sha256-42Arpp+ShJorA9uR1nNlKuMoDx3y+cHg2BxQUW1fo7U=",
+        "ref": "main",
+        "rev": "bd5ae71978bb60eda28a010956825983dd931e2a",
+        "revCount": 18,
+        "type": "git",
+        "url": "ssh://gitea@git.ppp.pm:1122/alex/komga-bookmanager.git"
+      },
+      "original": {
+        "ref": "main",
+        "type": "git",
+        "url": "ssh://gitea@git.ppp.pm:1122/alex/komga-bookmanager.git"
+      }
+    },
+    "komga-comictracker": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1773858923,
+        "narHash": "sha256-JOm+qe+loPxpjpTn2fN5QuqeGLDqYc1QevNeZZuEkdE=",
+        "ref": "main",
+        "rev": "2ab63ae85af1e2009e4bce10940e8db56827d942",
+        "revCount": 67,
+        "type": "git",
+        "url": "ssh://gitea@git.ppp.pm:1122/alex/komga-comictracker.git"
+      },
+      "original": {
+        "ref": "main",
+        "type": "git",
+        "url": "ssh://gitea@git.ppp.pm:1122/alex/komga-comictracker.git"
+      }
+    },
+    "komga-reading-stats": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1774185820,
+        "narHash": "sha256-ASExCDbdujwneZ/tZeNXxzKPbUFLroBnmPBJ5jEniCI=",
+        "ref": "main",
+        "rev": "769bd540e8975050b2778025fdebc6fdd5c5e2b5",
+        "revCount": 42,
+        "type": "git",
+        "url": "ssh://gitea@git.ppp.pm:1122/alex/komga-reading-stats.git"
+      },
+      "original": {
+        "ref": "main",
+        "type": "git",
+        "url": "ssh://gitea@git.ppp.pm:1122/alex/komga-reading-stats.git"
+      }
+    },
+    "naviterm": {
+      "inputs": {
+        "flake-utils": "flake-utils_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1773476909,
+        "narHash": "sha256-hSg/7xFO+3G3wWFq1480OecREqTY+fu06L06rM2UBmQ=",
+        "owner": "detoxify92",
+        "repo": "naviterm",
+        "rev": "f89dbde00222fb1e4f611419d05583d8edee4c25",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "detoxify92",
+        "repo": "naviterm",
+        "type": "gitlab"
+      }
+    },
+    "nh": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1773920367,
+        "narHash": "sha256-ADGQjlsFzT9POglBkBJZcFqg3go4d+J3E4GS4WlxENY=",
         "owner": "viperML",
         "repo": "nh",
-        "rev": "5dd64eb04fddeac2eb08c018212cc58978934920",
+        "rev": "b00a24b39944efd4ec7944f02e0bd9113d991767",
         "type": "github"
       },
       "original": {
         "owner": "viperML",
         "repo": "nh",
+        "rev": "b00a24b39944efd4ec7944f02e0bd9113d991767",
         "type": "github"
       }
     },
@@ -181,13 +710,35 @@
         "type": "github"
       }
     },
+    "nix-jetbrains-plugins": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": "systems_5"
+      },
+      "locked": {
+        "lastModified": 1774078133,
+        "narHash": "sha256-8Z4VI0CzoQ528LjSpy7t8YRMVUU+50L+wzYxpRXHXBI=",
+        "owner": "nix-community",
+        "repo": "nix-jetbrains-plugins",
+        "rev": "df85a8aace815dec8d78683f9717b2958a8f1364",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-jetbrains-plugins",
+        "type": "github"
+      }
+    },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1725470640,
+        "lastModified": 1774018263,
-        "narHash": "sha256-xaIvCE8ZP65fj2HR7DlDX+iJMBxasfjEv+zc6Cuwf3I=",
+        "narHash": "sha256-HHYEwK1A22aSaxv2ibhMMkKvrDGKGlA/qObG4smrSqc=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "ace1cedf3ecfbac81b29522d71009878951a69eb",
+        "rev": "2d4b4717b2534fad5c715968c1cece04a172b365",
         "type": "github"
       },
       "original": {
@@ -199,32 +750,48 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1725103162,
+        "lastModified": 1772822230,
-        "narHash": "sha256-Ym04C5+qovuQDYL/rKWSR+WESseQBbNAe5DsXNx5trY=",
+        "narHash": "sha256-yf3iYLGbGVlIthlQIk5/4/EQDZNNEmuqKZkQssMljuw=",
-        "owner": "nixos",
+        "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "12228ff1752d7b7624a54e9c1af4b222b3c1073b",
+        "rev": "71caefce12ba78d84fe618cf61644dce01cf3a96",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
+        "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixos-25.11",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1725001927,
+        "lastModified": 1773964973,
-        "narHash": "sha256-eV+63gK0Mp7ygCR0Oy4yIYSNcum2VQwnZamHxYTNi+M=",
+        "narHash": "sha256-NV/J+tTER0P5iJhUDL/8HO5MDjDceLQPRUYgdmy5wXw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6e99f2a27d600612004fbd2c3282d614bfee6421",
+        "rev": "812b3986fd1568f7a858f97fcf425ad996ba7d25",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-24.05",
+        "ref": "nixos-25.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1773821835,
+        "narHash": "sha256-TJ3lSQtW0E2JrznGVm8hOQGVpXjJyXY2guAxku2O9A4=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "b40629efe5d6ec48dd1efba650c797ddbd39ace0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -242,25 +809,57 @@
         "rev": "662a254ea8065a0f104ccf5a46b59252e1e08b58",
         "revCount": 54,
         "type": "git",
-        "url": "ssh://git@codeberg.org/ppp/ppp.pm-site.git"
+        "url": "ssh://gitea@git.ppp.pm:1122/alex/ppp.pm-site.git"
       },
       "original": {
         "ref": "main",
         "type": "git",
-        "url": "ssh://git@codeberg.org/ppp/ppp.pm-site.git"
+        "url": "ssh://gitea@git.ppp.pm:1122/alex/ppp.pm-site.git"
+      }
+    },
+    "pre-commit-hooks": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772893680,
+        "narHash": "sha256-JDqZMgxUTCq85ObSaFw0HhE+lvdOre1lx9iI6vYyOEs=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "8baab586afc9c9b57645a734c820e4ac0a604af9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
       }
     },
     "root": {
       "inputs": {
         "agenix": "agenix",
+        "disko": "disko",
         "emacs-overlay": "emacs-overlay",
         "home-manager": "home-manager_2",
+        "hyprland": "hyprland",
         "hyprland-contrib": "hyprland-contrib",
+        "komga-bookmanager": "komga-bookmanager",
+        "komga-comictracker": "komga-comictracker",
+        "komga-reading-stats": "komga-reading-stats",
+        "naviterm": "naviterm",
         "nh": "nh",
         "nix-gc-env": "nix-gc-env",
+        "nix-jetbrains-plugins": "nix-jetbrains-plugins",
         "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_2",
-        "pppdotpm-site": "pppdotpm-site"
+        "pppdotpm-site": "pppdotpm-site",
+        "whib-backend": "whib-backend",
+        "whib-frontend": "whib-frontend"
       }
     },
     "systems": {
@@ -279,6 +878,21 @@
       }
     },
     "systems_2": {
+      "locked": {
+        "lastModified": 1689347949,
+        "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
+        "owner": "nix-systems",
+        "repo": "default-linux",
+        "rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default-linux",
+        "type": "github"
+      }
+    },
+    "systems_3": {
       "locked": {
         "lastModified": 1681028828,
         "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
@@ -292,6 +906,119 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "systems_4": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_5": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "whib-backend": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1739029248,
+        "narHash": "sha256-ux/Udy0Mhs66P/EQQ8S+xIuXRm9UHEYwSy12IZtlbnA=",
+        "ref": "master",
+        "rev": "222a8f6dde2e9270f6390b5e1e83c7ae1ea48290",
+        "revCount": 371,
+        "type": "git",
+        "url": "ssh://gitea@git.ppp.pm:1122/alex/whib.git"
+      },
+      "original": {
+        "ref": "master",
+        "type": "git",
+        "url": "ssh://gitea@git.ppp.pm:1122/alex/whib.git"
+      }
+    },
+    "whib-frontend": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1761508816,
+        "narHash": "sha256-adV/lyxcmuopyuzZ49v46Yt0gft+ioEL4yl1S+vUbus=",
+        "ref": "master",
+        "rev": "ab10bf50cb6b023a1b99f91c7e8d550231135eef",
+        "revCount": 223,
+        "type": "git",
+        "url": "ssh://gitea@git.ppp.pm:1122/alex/whib-react.git"
+      },
+      "original": {
+        "ref": "master",
+        "type": "git",
+        "url": "ssh://gitea@git.ppp.pm:1122/alex/whib-react.git"
+      }
+    },
+    "xdph": {
+      "inputs": {
+        "hyprland-protocols": [
+          "hyprland",
+          "hyprland-protocols"
+        ],
+        "hyprlang": [
+          "hyprland",
+          "hyprlang"
+        ],
+        "hyprutils": [
+          "hyprland",
+          "hyprutils"
+        ],
+        "hyprwayland-scanner": [
+          "hyprland",
+          "hyprwayland-scanner"
+        ],
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772669058,
+        "narHash": "sha256-XhnY0aRuDo5LT8pmJVPofPOgO2hAR7T+XRoaQxtNPzQ=",
+        "owner": "hyprwm",
+        "repo": "xdg-desktop-portal-hyprland",
+        "rev": "906d0ac159803a7df2dc1f948df9327670380f69",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "xdg-desktop-portal-hyprland",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -6,11 +6,15 @@
 
     nixos-hardware.url = "github:nixos/nixos-hardware/master";
 
-    nh = {
+    disko = {
-      url = "github:viperML/nh";
+      url = "github:nix-community/disko";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    nh = {
+      url = "github:viperML/nh/b00a24b39944efd4ec7944f02e0bd9113d991767";
+    };
+
     nix-gc-env.url = "github:Julow/nix-gc-env";
 
     home-manager = {
@@ -28,13 +32,58 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    hyprland = {
+      url = "github:hyprwm/Hyprland";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     hyprland-contrib = {
       url = "github:hyprwm/contrib";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    nix-jetbrains-plugins = {
+      url = "github:nix-community/nix-jetbrains-plugins";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    naviterm = {
+      url = "gitlab:detoxify92/naviterm";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     pppdotpm-site = {
-      url = "git+ssh://git@codeberg.org/ppp/ppp.pm-site.git?ref=main";
+      url = "git+ssh://gitea@git.ppp.pm:1122/alex/ppp.pm-site.git?ref=main";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    whib-backend = {
+      url = "git+ssh://gitea@git.ppp.pm:1122/alex/whib.git?ref=master";
+      # url = "path:/home/alex/code/own/whib";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    whib-frontend = {
+      url = "git+ssh://gitea@git.ppp.pm:1122/alex/whib-react.git?ref=master";
+      # url = "path:/home/alex/code/own/whib-react";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    komga-comictracker = {
+      url = "git+ssh://gitea@git.ppp.pm:1122/alex/komga-comictracker.git?ref=main";
+      # url = "path:/home/alex/code/own/komga-comictracker";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    komga-bookmanager = {
+      url = "git+ssh://gitea@git.ppp.pm:1122/alex/komga-bookmanager.git?ref=main";
+      # url = "path:/home/alex/code/own/komga-bookmanager";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    komga-reading-stats = {
+      url = "git+ssh://gitea@git.ppp.pm:1122/alex/komga-reading-stats.git?ref=main";
+      # url = "path:/home/alex/code/own/komga-reading-stats";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };
@@ -55,6 +104,17 @@
           ];
         };
 
+        manatee = inputs.nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          specialArgs = {
+            inherit inputs;
+          };
+          modules = [
+            ./hosts/manatee/configuration.nix
+            ./hosts/manatee/home.nix
+          ];
+        };
+
         backwards = inputs.nixpkgs.lib.nixosSystem {
           system = "x86_64-linux";
           specialArgs = {
@@ -66,23 +126,37 @@
           ];
         };
 
-        tadpole = inputs.nixpkgs.lib.nixosSystem {
+        tadpole =
+          let
             system = "x86_64-linux";
+          in
+          inputs.nixpkgs.lib.nixosSystem {
+            inherit system;
             specialArgs = {
               inherit inputs;
             };
             modules = [
               ./hosts/tadpole/configuration.nix
               ./hosts/tadpole/home.nix
+              inputs.whib-backend.nixosModules.${system}.default
+              inputs.whib-frontend.nixosModules.${system}.default
             ];
           };
 
-        test-vm = inputs.nixpkgs.lib.nixosSystem {
+        test-vm =
+          let
             system = "x86_64-linux";
+          in
+          inputs.nixpkgs.lib.nixosSystem {
+            inherit system;
             specialArgs = {
               inherit inputs;
             };
-          modules = [ ./hosts/test-vm/configuration.nix ];
+            modules = [
+              ./hosts/test-vm/configuration.nix
+              inputs.whib-backend.nixosModules.${system}.default
+              inputs.whib-frontend.nixosModules.${system}.default
+            ];
           };
       };
 
@@ -93,7 +167,7 @@
         in
         {
           ${system}.default = pkgs.mkShell {
-            packages = [ pkgs.nixfmt-rfc-style ];
+            packages = [ pkgs.nixfmt ];
           };
         };
     };

hosts/backwards/configuration.nix

@@ -15,13 +15,30 @@
 
   console.keyMap = "sv-latin1";
 
-  hardware.pulseaudio.enable = false;
+  services.pulseaudio.enable = false;
   security.rtkit.enable = true;
   services.pipewire = {
     enable = true;
     alsa.enable = true;
     alsa.support32Bit = true;
     pulse.enable = true;
+
+    extraConfig.pipewire."90-hdmi-fix" = {
+      "context.properties" = {
+        "default.clock.rate" = 48000;
+        "default.clock.allowed-rates" = [ 48000 ];
+      };
+    };
+  };
+
+  hardware = {
+    graphics = {
+      enable = true;
+      extraPackages = [
+        pkgs.intel-media-driver
+        pkgs.libvdpau-va-gl
+      ];
+    };
   };
 
   users.users.alex = {
@@ -30,6 +47,8 @@
     extraGroups = [
       "networkmanager"
       "wheel"
+      "video"
+      "render"
     ];
     packages = [ ];
   };

hosts/backwards/modules/age/default.nix

@@ -8,7 +8,7 @@
     };
 
     environment.systemPackages = [
-      inputs.agenix.packages."${pkgs.system}".default
+      inputs.agenix.packages."${pkgs.stdenv.hostPlatform.system}".default
     ];
   };
 }

hosts/backwards/modules/boot/default.nix

@@ -38,6 +38,11 @@ in
 
         efi.canTouchEfiVariables = true;
       };
+
+      extraModprobeConfig = ''
+        options snd-intel-dspcfg dsp_driver=1
+        options snd_hda_intel power_save=0 power_save_controller=N
+      '';
     };
   };
 }

hosts/backwards/modules/calibre-web/default.nix

@@ -1,32 +0,0 @@
-{ lib, config, ... }:
-let
-  enabled = config.mod.calibre-web.enable;
-in
-{
-  options = {
-    mod.calibre-web = {
-      enable = lib.mkEnableOption "add calibre-web module";
-    };
-  };
-
-  config = lib.mkIf enabled {
-    services = {
-      calibre-web = {
-        enable = true;
-
-        user = "alex";
-        group = "users";
-
-        listen = {
-          ip = "0.0.0.0";
-          port = 8083;
-        };
-
-        options = {
-          calibreLibrary = "/home/alex/sync/books";
-          enableBookUploading = true;
-        };
-      };
-    };
-  };
-}

hosts/backwards/modules/default.nix

@@ -12,11 +12,9 @@ in
 
       ssh.enable = true;
       git.enable = true;
+      nginx.enable = true;
       syncthing.enable = true;
       restic.enable = true;
-      transmission.enable = true;
-      audiobookshelf.enable = true;
-      calibre-web.enable = true;
     };
   };
 }

hosts/backwards/modules/firefox/default.nix

@@ -0,0 +1,99 @@
+{ pkgs, ... }:
+let
+  wrapped = pkgs.wrapFirefox pkgs.firefox-devedition-unwrapped {
+    extraPolicies = {
+      DisableFirefoxAccounts = false;
+      CaptivePortal = false;
+      DisableFirefoxStudies = true;
+      DisablePocket = true;
+      DisableTelemetry = true;
+      OfferToSaveLogins = false;
+      OfferToSaveLoginsDefault = false;
+      PasswordManagerEnabled = false;
+
+      FirefoxHome = {
+        Search = false;
+        Pocket = false;
+        Snippets = false;
+        TopSites = false;
+        Highlights = false;
+      };
+
+      UserMessaging = {
+        ExtensionRecommendations = false;
+        SkipOnboarding = true;
+      };
+    };
+  };
+
+  ff-alex = pkgs.writeShellApplication {
+    name = "ff-alex";
+    text = ''
+      ${wrapped}/bin/firefox-devedition -P alex --new-window "$@"
+    '';
+  };
+
+  sharedSettings = {
+    "general.smoothScroll" = true;
+    "apz.gtk.kinetic_scroll.enabled" = false;
+    "network.dns.force_waiting_https_rr" = false;
+  };
+in
+{
+  home-manager.users.alex = {
+    programs.firefox = {
+      enable = true;
+
+      package = wrapped;
+
+      profiles = {
+        alex = {
+          id = 0;
+          name = "alex";
+          isDefault = true;
+
+          settings = sharedSettings // { };
+        };
+      };
+    };
+
+    xdg = {
+      # /etc/profiles/per-user/alex/share/applications
+      desktopEntries = {
+        ff-alex = {
+          name = "ff-alex";
+          exec = "${ff-alex}/bin/ff-alex %U";
+          terminal = false;
+        };
+      };
+
+      mimeApps = {
+        enable = true;
+
+        defaultApplications = {
+          "text/html" = "ff-alex.desktop";
+          "x-scheme-handler/http" = "ff-alex.desktop";
+          "x-scheme-handler/https" = "ff-alex.desktop";
+          "application/x-exension-htm" = "ff-alex.desktop";
+          "application/x-exension-html" = "ff-alex.desktop";
+          "application/x-exension-shtml" = "ff-alex.desktop";
+          "application/xhtml+xml" = "ff-alex.desktop";
+          "application/x-exension-xhtml" = "ff-alex.desktop";
+          "application/x-exension-xht" = "ff-alex.desktop";
+        };
+      };
+
+      # https://github.com/nix-community/home-manager/issues/1213
+      configFile."mimeapps.list".force = true;
+    };
+
+    home.packages = [
+      ff-alex
+    ];
+  };
+
+  environment.variables = {
+    MOZ_ENABLE_WAYLAND = 1;
+    BROWSER = "${ff-alex}/bin/ff-alex $@";
+  };
+}

hosts/backwards/modules/games/default.nix

@@ -2,13 +2,16 @@
 {
   home-manager.users.alex = {
     home.packages = [
-      (pkgs.retroarch.override {
+      pkgs.nethack
-        cores = [
+
+      pkgs.moonlight-qt
+
+      pkgs.pcsx2
+      (pkgs.retroarch.withCores (cores: [
         pkgs.libretro.snes9x
         pkgs.libretro.genesis-plus-gx
         pkgs.libretro.swanstation
-        ];
+      ]))
-      })
     ];
   };
 }

hosts/backwards/modules/git/gitconfig

@@ -4,6 +4,3 @@
 
 [url "git@github.com:"]
     insteadOf = https://github.com/
-
-[url "git@codeberg.org:"]
-    insteadOf = https://codeberg.org/

hosts/backwards/modules/gnome/default.nix

@@ -8,14 +8,6 @@
       };
     };
 
-    xserver = {
-      enable = true;
-
-      xkb = {
-        layout = "se";
-        variant = "";
-      };
-
     desktopManager = {
       gnome.enable = true;
     };
@@ -23,6 +15,14 @@
     displayManager = {
       gdm.enable = true;
     };
+
+    xserver = {
+      enable = true;
+
+      xkb = {
+        layout = "se";
+        variant = "";
+      };
     };
   };
 

hosts/backwards/modules/jellyfin/default.nix

@@ -1,44 +0,0 @@
-{ pkgs, ... }:
-{
-  fileSystems."/home/alex/media" = {
-    device = "/dev/disk/by-uuid/ad4acc0f-172c-40f8-8473-777c957e8764";
-    fsType = "ext4";
-    options = [ "nofail" ];
-  };
-
-  # 1. enable vaapi on OS-level
-  nixpkgs.config.packageOverrides = pkgs: {
-    vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
-  };
-
-  hardware = {
-    graphics = {
-      enable = true;
-
-      extraPackages = with pkgs; [
-        intel-media-driver
-        intel-vaapi-driver # previously vaapiIntel
-        vaapiVdpau
-        libvdpau-va-gl
-        intel-compute-runtime # OpenCL filter support (hardware tonemapping and subtitle burn-in)
-        vpl-gpu-rt # QSV on 11th gen or newer
-      ];
-    };
-  };
-
-  services.jellyfin = {
-    enable = true;
-    openFirewall = true;
-
-    user = "alex";
-    group = "users";
-
-    dataDir = "/home/alex/media/jellyfin";
-  };
-
-  environment.systemPackages = [
-    pkgs.jellyfin
-    pkgs.jellyfin-web
-    pkgs.jellyfin-ffmpeg
-  ];
-}

hosts/backwards/modules/network/default.nix

@@ -1,32 +1,48 @@
+{ config, ... }:
 {
   networking = {
     hostName = "backwards";
 
-    networkmanager.enable = false;
+    wireless.enable = false;
-    wireless.enable = true;
-    #wireless.networks are defined in the secret `wpa_supplicant.conf`
 
-    defaultGateway = "192.168.50.1";
+    networkmanager = {
-    nameservers = [ "1.1.1.1" ];
+      enable = true;
-    interfaces = {
+
-      wlp1s0 = {
+      wifi.backend = "iwd";
-        useDHCP = false;
+
-        ipv4 = {
+      ensureProfiles = {
-          addresses = [
+        environmentFiles = [
-            {
+          config.age.secrets.wireless-network-secrets.path
-              address = "192.168.50.202";
-              prefixLength = 24;
-            }
         ];
+
+        profiles = {
+          w1-f1_5G = {
+            connection = {
+              id = "w1-f1_5G";
+              type = "wifi";
+              interface-name = "wlp1s0";
+            };
+            wifi = {
+              ssid = "w1-f1_5G";
+              mode = "infrastructure";
+            };
+            wifi-security = {
+              key-mgmt = "wpa-psk";
+              psk = "$w1_f1_psk";
+            };
+            ipv4 = {
+              method = "manual";
+              addresses = "192.168.50.202/24";
+              gateway = "192.168.50.1";
+              dns = "1.1.1.1";
+            };
+          };
         };
       };
     };
   };
 
   age.secrets = {
-    "wpa_supplicant.conf" = {
+    "wireless-network-secrets".file = ../../../../secrets/backwards/wireless-network-secrets.age;
-      file = ../../../../secrets/backwards/wpa_supplicant.conf.age;
-      path = "/etc/wpa_supplicant.conf";
-    };
   };
 }

hosts/backwards/modules/nginx/default.nix

@@ -0,0 +1,22 @@
+{ lib, config, ... }:
+let
+  enabled = config.mod.nginx.enable;
+in
+{
+  options = {
+    mod.nginx = {
+      enable = lib.mkEnableOption "Enable nginx module";
+    };
+  };
+
+  config = lib.mkIf enabled {
+    services = {
+      nginx = {
+        enable = true;
+
+        recommendedProxySettings = true;
+        recommendedTlsSettings = true;
+      };
+    };
+  };
+}

hosts/backwards/modules/restic/default.nix

@@ -46,6 +46,7 @@ in
           repositoryFile = config.age.secrets.restic-cloud-sync-repository.path;
 
           paths = [ "/home/alex/sync" ];
+          exclude = [ "/home/alex/sync/reading-material" ];
 
           timerConfig = {
             OnCalendar = "*-*-* 0/12:00:00"; # Every 12th hour, i.e. twice a day
@@ -65,7 +66,8 @@ in
       secrets = {
         "restic-password".file = ../../../../secrets/backwards/restic-password.age;
         "restic-cloud-sync-key".file = ../../../../secrets/backwards/restic-cloud-sync-key.age;
-        "restic-cloud-sync-repository".file = ../../../../secrets/backwards/restic-cloud-sync-repository.age;
+        "restic-cloud-sync-repository".file =
+          ../../../../secrets/backwards/restic-cloud-sync-repository.age;
       };
     };
   };

hosts/backwards/modules/ssh/default.nix

@@ -23,17 +23,34 @@ in
         enable = true;
 
         matchBlocks = {
+          "manatee" = {
+            hostname = "manatee";
+            user = "alex";
+            identityFile = "/home/alex/.ssh/alex.backwards-manatee";
+            port = 1122;
+          };
+
           "git.ppp.pm" = {
             hostname = "git.ppp.pm";
             identityFile = "/home/alex/.ssh/alex.backwards-git.ppp.pm";
           };
 
-          "codeberg.org" = {
+          "*" = {
-            hostname = "codeberg.org";
+            forwardAgent = false;
-            identityFile = "/home/alex/.ssh/alex.backwards-codeberg.org";
+            addKeysToAgent = "no";
+            compression = false;
+            serverAliveInterval = 0;
+            serverAliveCountMax = 3;
+            hashKnownHosts = false;
+            userKnownHostsFile = "~/.ssh/known_hosts";
+            controlMaster = "no";
+            controlPath = "~/.ssh/master-%r@%n:%p";
+            controlPersist = "no";
           };
         };
       };
+
+      home.packages = [ pkgs.sshfs ];
     };
 
     environment.etc."ssh/authorized_keys_command" = {
@@ -84,6 +101,19 @@ in
         path = "${rootSSHKeyPath}/root.backwards.pub";
       };
 
+      "alex.backwards-manatee" = {
+        file = ../../../../secrets/backwards/alex.backwards-manatee.age;
+        path = "/home/alex/.ssh/alex.backwards-manatee";
+        owner = "alex";
+        group = "users";
+      };
+      "alex.backwards-manatee.pub" = {
+        file = ../../../../secrets/backwards/alex.backwards-manatee.pub.age;
+        path = "/home/alex/.ssh/alex.backwards-manatee.pub";
+        owner = "alex";
+        group = "users";
+      };
+
       "alex.pinwheel-backwards.pub" = {
         file = ../../../../secrets/pinwheel/alex.pinwheel-backwards.pub.age;
         path = "${authorizedKeysPath}/alex.pinwheel-backwards.pub";
@@ -101,19 +131,6 @@ in
         owner = "alex";
         group = "users";
       };
-
-      "alex.backwards-codeberg.org" = {
-        file = ../../../../secrets/backwards/alex.backwards-codeberg.org.age;
-        path = "/home/alex/.ssh/alex.backwards-codeberg.org";
-        owner = "alex";
-        group = "users";
-      };
-      "alex.backwards-codeberg.org.pub" = {
-        file = ../../../../secrets/backwards/alex.backwards-codeberg.org.pub.age;
-        path = "/home/alex/.ssh/alex.backwards-codeberg.org.pub";
-        owner = "alex";
-        group = "users";
-      };
     };
   };
 }

hosts/backwards/modules/syncthing/default.nix

@@ -34,6 +34,7 @@ in
         devices = {
           phone.id = config.lib.syncthing.phone;
           pinwheel.id = config.lib.syncthing.pinwheel;
+          tablet.id = config.lib.syncthing.tablet;
         };
 
         folders = {
@@ -74,7 +75,7 @@ in
           };
 
           books = {
-            path = "/home/alex/sync/books";
+            path = "/home/alex/sync/reading-material/books";
             devices = [ "pinwheel" ];
             versioning = {
               type = "staggered";

hosts/manatee/configuration.nix

@@ -0,0 +1,56 @@
+{ pkgs, ... }:
+{
+  imports = [
+    ../../config-manager/default.nix
+    ../../shared-modules/syncthing.nix
+    ./hardware-configuration.nix
+    ./disk-config.nix
+    ./modules
+  ];
+
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
+  nixpkgs.config.allowUnfree = true;
+
+  users.users.alex = {
+    isNormalUser = true;
+    description = "alex";
+    extraGroups = [
+      "wheel"
+      "storage"
+    ];
+  };
+
+  environment.variables.EDITOR = "vim";
+
+  environment.systemPackages = with pkgs; [
+    vim
+    git
+  ];
+
+  config-manager = {
+    flakePath = "/home/alex/config";
+  };
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+  system.stateVersion = "24.11"; # Did you read the comment?
+
+}

hosts/manatee/disk-config.nix

@@ -0,0 +1,243 @@
+{
+  inputs,
+  pkgs,
+  config,
+  ...
+}:
+{
+  imports = [ inputs.disko.nixosModules.disko ];
+
+  config = {
+    users.groups.storage = { };
+
+    users.users.storage = {
+      isSystemUser = true;
+      description = "storage";
+      group = "storage";
+    };
+
+    systemd.tmpfiles.settings = {
+      "10-media-public" = {
+        "/mnt/media/public" = {
+          d = {
+            # Create directory
+            user = "storage";
+            group = "storage";
+            mode = "2775";
+          };
+          z = {
+            # Ensure permissions are inherited
+            user = "storage";
+            group = "storage";
+            mode = "2775";
+          };
+        };
+      };
+
+      "10-cameras-public" = {
+        "/mnt/cameras/public" = {
+          d = {
+            # Create directory
+            user = "storage";
+            group = "storage";
+            mode = "2775";
+          };
+          z = {
+            # Ensure permissions are inherited
+            user = "storage";
+            group = "storage";
+            mode = "2775";
+          };
+        };
+      };
+
+      "10-sync-public" = {
+        "/mnt/sync/public" = {
+          d = {
+            # Create directory
+            user = "storage";
+            group = "storage";
+            mode = "2775";
+          };
+          z = {
+            # Ensure permissions are inherited
+            user = "storage";
+            group = "storage";
+            mode = "2775";
+          };
+        };
+      };
+    };
+
+    environment.systemPackages = [
+      pkgs.smartmontools
+    ];
+
+    services.smartd = {
+      enable = true;
+      devices = [
+        { device = config.disko.devices.disk.root.device; }
+        { device = config.disko.devices.disk.disk1.device; }
+        { device = config.disko.devices.disk.disk2.device; }
+      ];
+    };
+
+    services.zfs.autoScrub.enable = true;
+
+    networking.hostId = "0a9474e7"; # Required by ZFS
+    disko.devices = {
+      disk = {
+        root = {
+          type = "disk";
+          device = "/dev/nvme0n1";
+          content = {
+            type = "gpt";
+            partitions = {
+              ESP = {
+                size = "500M";
+                type = "EF00";
+                content = {
+                  type = "filesystem";
+                  format = "vfat";
+                  mountpoint = "/boot";
+                  mountOptions = [ "umask=0077" ];
+                };
+              };
+
+              root = {
+                size = "100%";
+                content = {
+                  type = "filesystem";
+                  format = "ext4";
+                  mountpoint = "/";
+                };
+              };
+            };
+          };
+        };
+
+        disk1 = {
+          type = "disk";
+          device = "/dev/disk/by-id/ata-ST8000VN004-3CP101_WWZ8QCG4";
+          content = {
+            type = "gpt";
+            partitions = {
+              zfs = {
+                size = "100%";
+                content = {
+                  type = "zfs";
+                  pool = "storage";
+                };
+              };
+            };
+          };
+        };
+
+        disk2 = {
+          type = "disk";
+          device = "/dev/disk/by-id/ata-ST8000VN004-3CP101_WWZ8QDJ5";
+          content = {
+            type = "gpt";
+            partitions = {
+              zfs = {
+                size = "100%";
+                content = {
+                  type = "zfs";
+                  pool = "storage";
+                };
+              };
+            };
+          };
+        };
+        disk3 = {
+          type = "disk";
+          device = "/dev/disk/by-id/ata-TOSHIBA_MG10ACA20TE_85K2A0UCF4MJ";
+          content = {
+            type = "gpt";
+            partitions = {
+              zfs = {
+                size = "100%";
+                content = {
+                  type = "zfs";
+                  pool = "storage";
+                };
+              };
+            };
+          };
+        };
+
+        disk4 = {
+          type = "disk";
+          device = "/dev/disk/by-id/ata-TOSHIBA_MG10ACA20TE_85K2A0V6F4MJ";
+          content = {
+            type = "gpt";
+            partitions = {
+              zfs = {
+                size = "100%";
+                content = {
+                  type = "zfs";
+                  pool = "storage";
+                };
+              };
+            };
+          };
+        };
+      };
+
+      zpool = {
+        storage = {
+          type = "zpool";
+
+          mode = {
+            topology = {
+              type = "topology";
+              vdev = [
+                {
+                  mode = "mirror";
+                  members = [
+                    "disk1"
+                    "disk2"
+                  ];
+                }
+                {
+                  mode = "mirror";
+                  members = [
+                    "disk3"
+                    "disk4"
+                  ];
+                }
+              ];
+            };
+          };
+
+          rootFsOptions = {
+            mountpoint = "none";
+            compression = "zstd";
+            xattr = "sa";
+            "com.sun:auto-snapshot" = "false";
+          };
+
+          datasets = {
+            media = {
+              type = "zfs_fs";
+              mountpoint = "/mnt/media";
+              options.mountpoint = "legacy"; # otherwise we get a race between systemd and zfs; https://github.com/nix-community/disko/issues/214
+            };
+
+            cameras = {
+              type = "zfs_fs";
+              mountpoint = "/mnt/cameras";
+              options.mountpoint = "legacy"; # otherwise we get a race between systemd and zfs; https://github.com/nix-community/disko/issues/214
+            };
+
+            sync = {
+              type = "zfs_fs";
+              mountpoint = "/mnt/sync";
+              options.mountpoint = "legacy"; # otherwise we get a race between systemd and zfs; https://github.com/nix-community/disko/issues/214
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/manatee/hardware-configuration.nix

@@ -0,0 +1,46 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "nvme"
+    "ahci"
+    "usb_storage"
+    "usbhid"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  swapDevices = [
+    {
+      device = "/swapfile";
+      size = 32 * 1024; # 32GB
+    }
+  ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp3s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp4s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/manatee/home.nix

@@ -0,0 +1,24 @@
+{ inputs, pkgs, ... }:
+{
+  imports = [ inputs.home-manager.nixosModules.home-manager ];
+
+  config = {
+    home-manager = {
+      useGlobalPkgs = true;
+      useUserPackages = true;
+
+      users.alex = {
+        programs.home-manager.enable = true;
+
+        home.username = "alex";
+        home.homeDirectory = "/home/alex";
+
+        home.packages = [
+          pkgs.streamrip
+        ];
+
+        home.stateVersion = "24.11";
+      };
+    };
+  };
+}

hosts/manatee/modules/age/default.nix

@@ -0,0 +1,14 @@
+{ inputs, pkgs, ... }:
+{
+  imports = [ inputs.agenix.nixosModules.default ];
+
+  config = {
+    age = {
+      identityPaths = [ "/etc/ssh/manatee" ];
+    };
+
+    environment.systemPackages = [
+      inputs.agenix.packages."${pkgs.stdenv.hostPlatform.system}".default
+    ];
+  };
+}

hosts/manatee/modules/audiobookshelf/default.nix

@@ -10,17 +10,25 @@ in
   };
 
   config = lib.mkIf enabled {
-    fileSystems."/home/alex/media" = {
+    mod.homepage.services = [
-      device = "/dev/disk/by-uuid/ad4acc0f-172c-40f8-8473-777c957e8764";
+      {
-      fsType = "ext4";
+        name = "Audiobookshelf";
-      options = [ "nofail" ];
+        port = 8000;
+        description = "Audiobooks & podcasts";
+      }
+    ];
+
+    users.users.audiobookshelf = {
+      isSystemUser = true;
+      description = "audiobookshelf";
+      group = "storage";
     };
 
     services.audiobookshelf = {
       enable = true;
 
-      user = "alex";
+      user = "audiobookshelf";
-      group = "users";
+      group = "storage";
 
       host = "0.0.0.0";
       port = 8000;

hosts/manatee/modules/boot/default.nix

@@ -0,0 +1,43 @@
+{
+  inputs,
+  lib,
+  config,
+  ...
+}:
+let
+  configurationLimit = config.mod.gc.configurationLimit;
+in
+{
+  imports = [ inputs.nix-gc-env.nixosModules.default ];
+
+  options = {
+    mod.gc = {
+      configurationLimit = lib.mkOption {
+        type = lib.types.int;
+        default = 10;
+        description = "number of configuration generations to keep";
+      };
+    };
+  };
+
+  config = {
+    nix.gc = {
+      automatic = true;
+      dates = "weekly";
+
+      # `delete_generations` added by nix-gc-env
+      delete_generations = "+${builtins.toString configurationLimit}";
+    };
+
+    boot = {
+      loader = {
+        systemd-boot = {
+          enable = true;
+          inherit configurationLimit;
+        };
+
+        efi.canTouchEfiVariables = true;
+      };
+    };
+  };
+}

hosts/manatee/modules/certs/default.nix

@@ -0,0 +1,44 @@
+{ config, ... }:
+{
+  security.acme = {
+    acceptTerms = true;
+
+    defaults = {
+      email = "acme@ppp.pm";
+    };
+
+    certs = {
+      "ha.ppp.pm" = {
+        dnsProvider = "hetzner";
+        environmentFile = config.age.secrets.hetzner-dns.path;
+        group = "nginx";
+
+        extraLegoFlags = [
+          "--dns.resolvers=1.1.1.1:53,8.8.8.8:53"
+          "--dns.propagation-wait=60s" # Wait for 60 seconds for DNS propagation
+          "--dns-timeout=60"
+          "--http-timeout=60"
+        ];
+      };
+
+      "komga.ppp.pm" = {
+        dnsProvider = "hetzner";
+        environmentFile = config.age.secrets.hetzner-dns.path;
+        group = "nginx";
+
+        extraLegoFlags = [
+          "--dns.resolvers=1.1.1.1:53,8.8.8.8:53"
+          "--dns.propagation-wait=60s"
+          "--dns-timeout=60"
+          "--http-timeout=60"
+        ];
+      };
+    };
+  };
+
+  age = {
+    secrets = {
+      "hetzner-dns".file = ../../../../secrets/manatee/hetzner-dns.age;
+    };
+  };
+}

hosts/manatee/modules/default.nix

@@ -0,0 +1,27 @@
+{ lib, ... }:
+let
+  toModulePath = dir: _: ./. + "/${dir}";
+  filterDirs = dirs: lib.attrsets.filterAttrs (_: type: type == "directory") dirs;
+in
+{
+  imports = lib.mapAttrsToList toModulePath (filterDirs (builtins.readDir ./.));
+
+  config = {
+    mod = {
+      gc.configurationLimit = 10;
+
+      ssh.enable = true;
+      git.enable = true;
+
+      nginx.enable = true;
+      syncthing.enable = true;
+      transmission.enable = true;
+      audiobookshelf.enable = true;
+      jellyfin.enable = true;
+      immich.enable = true;
+      navidrome.enable = true;
+      komga.enable = true;
+      homepage.enable = true;
+    };
+  };
+}

hosts/manatee/modules/git/default.nix

@@ -0,0 +1,39 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  enabled = config.mod.git.enable;
+in
+{
+  options = {
+    mod.git = {
+      enable = lib.mkEnableOption "enable git module";
+    };
+  };
+
+  config = lib.mkIf enabled {
+    home-manager.users.alex = {
+      programs.git = {
+        enable = true;
+
+        includes = [
+          { path = ./gitconfig; }
+        ];
+
+        settings = {
+          rerere.enable = true;
+        };
+      };
+
+      home.packages = [ pkgs.tig ];
+
+      home.file.".tigrc".text = ''
+        set main-view-line-number = yes
+        set main-view-line-number-interval = 1
+      '';
+    };
+  };
+}

hosts/manatee/modules/git/gitconfig

@@ -0,0 +1,9 @@
+[user]
+    name = Alexander Heldt
+    email = me@alexanderheldt.se
+
+[url "git@github.com:"]
+    insteadOf = https://github.com/
+
+[url "gitea@git.ppp.pm:"]
+    insteadOf = https://git.ppp.pm/

hosts/manatee/modules/home-assistant/default.nix

@@ -0,0 +1,243 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  nginxEnabled = config.mod.nginx.enable;
+
+  script = pkgs.writeShellScript "bt-reset" ''
+    set -euo pipefail
+    export PATH="${
+      lib.makeBinPath [
+        pkgs.bluez
+        pkgs.util-linux
+        pkgs.kmod
+        pkgs.gnugrep
+        pkgs.coreutils
+      ]
+    }"
+
+    logger -t bt-reset "Starting Bluetooth adapter reset..."
+
+    # Exit early if the adapter is already present and running
+    if hciconfig hci0 2>/dev/null | grep -q "UP RUNNING"; then
+      logger -t bt-reset "hci0 is already UP RUNNING — nothing to do"
+      exit 0
+    fi
+
+    # If hci0 exists but isn't UP, try bringing it up
+    if hciconfig hci0 2>/dev/null; then
+      logger -t bt-reset "hci0 exists but not running — bringing it up"
+      hciconfig hci0 up || true
+      sleep 2
+
+      if hciconfig hci0 2>/dev/null | grep -q "UP RUNNING"; then
+        logger -t bt-reset "hci0 is UP now"
+        systemctl restart bluetooth.service
+        logger -t bt-reset "bluetooth.service restarted — done"
+        exit 0
+      fi
+    fi
+
+    # Hard reset: reload the btusb kernel module (works for USB adapters)
+    logger -t bt-reset "hci0 missing — reloading btusb module..."
+    modprobe -r btusb 2>/dev/null || true
+    sleep 3
+    modprobe btusb
+    sleep 3
+
+    if hciconfig hci0 2>/dev/null; then
+      hciconfig hci0 up
+      logger -t bt-reset "hci0 restored after module reload"
+    else
+      logger -t bt-reset "ERROR: hci0 not found after module reload"
+      exit 1
+    fi
+
+    # Restart the bluetooth systemd service so bluetoothd picks up the adapter
+    systemctl restart bluetooth.service
+    logger -t bt-reset "bluetooth.service restarted — done"
+  '';
+in
+{
+  mod.homepage.services = [
+    {
+      name = "Home Assistant";
+      port = 8123;
+      description = "Home automation";
+    }
+  ];
+
+  hardware.bluetooth.enable = true;
+
+  virtualisation.oci-containers = {
+    backend = "podman";
+
+    containers.homeassistant = {
+      image = "ghcr.io/home-assistant/home-assistant:stable";
+
+      volumes = [
+        "/home/alex/.config/home-assistant:/config"
+        # Pass in bluetooth
+        "/run/dbus:/run/dbus:ro"
+      ];
+
+      environment.TZ = "Europe/Stockholm";
+
+      extraOptions = [
+        "--network=host"
+
+        # Allows HA to perform low-level network operations (scan/reset adapter)
+        "--cap-add=NET_ADMIN"
+        "--cap-add=NET_RAW"
+
+        # Pass in Zigbee antenna
+        "--device=/dev/serial/by-id/usb-Nabu_Casa_ZBT-2_9C139EAAD464-if00:/dev/ttyACM0"
+      ];
+    };
+  };
+
+  services = {
+    blueman.enable = true;
+
+    nginx = lib.mkIf nginxEnabled {
+      recommendedProxySettings = true;
+
+      virtualHosts."ha.ppp.pm" = {
+        forceSSL = true;
+        useACMEHost = "ha.ppp.pm";
+
+        extraConfig = ''
+          proxy_buffering off;
+        '';
+
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:8123";
+          proxyWebsockets = true;
+        };
+      };
+    };
+
+    # Trigger reset via udev when hci0 disappears
+    udev.extraRules = ''
+      ACTION=="remove", SUBSYSTEM=="bluetooth", KERNEL=="hci0", \
+        TAG+="systemd", ENV{SYSTEMD_WANTS}+="bt-reset.service"
+    '';
+  };
+
+  systemd = {
+    services = {
+      # Trigger reset on bluetoothd failure
+      bluetooth = {
+        unitConfig.OnFailure = [ "bt-reset.service" ];
+      };
+
+      bt-reset = {
+        description = "Reset Bluetooth adapter";
+        after = [ "bluetooth.service" ];
+
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = script;
+
+          Restart = "on-failure";
+          RestartSec = "10s";
+          StartLimitIntervalSec = "120";
+          StartLimitBurst = 3;
+        };
+      };
+    };
+
+    timers.bt-reset = {
+      description = "Periodically reset Bluetooth adapter";
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnBootSec = "5min"; # first run 5 min after boot
+        OnUnitActiveSec = "4h"; # then every 4 hours
+        RandomizedDelaySec = "5min";
+      };
+    };
+
+    user = {
+      timers = {
+        "update-hetzner-dns" = {
+          unitConfig = {
+            Description = "updates Hetzner DNS records";
+          };
+
+          timerConfig = {
+            Unit = "update-hetzner-dns.service";
+            OnCalendar = "*-*-* *:00/30:00";
+            Persistent = true;
+          };
+
+          wantedBy = [ "timers.target" ];
+        };
+      };
+
+      services = {
+        "update-hetzner-dns" = {
+          unitConfig = {
+            Description = "updates Hetzner DNS records";
+          };
+
+          serviceConfig = {
+            Type = "exec";
+            EnvironmentFile = config.age.secrets.hetzner-dns.path;
+          };
+
+          path = [
+            pkgs.curl
+            pkgs.coreutils
+            pkgs.jq
+          ];
+
+          script = ''
+            SUBDOMAINS="ha komga"
+            INTERFACE="enp3s0"
+
+            CURRENT_IP=$(curl -s --fail --interface "$INTERFACE" ifconfig.me)
+
+            for SUBDOMAIN in $SUBDOMAINS; do
+              LAST_IP_FILE="/tmp/hetzner-dns-''${SUBDOMAIN}-ip"
+
+              LAST_IP=""
+              if [[ -f "$LAST_IP_FILE" ]]; then
+                  LAST_IP=$(cat "$LAST_IP_FILE")
+              fi
+
+              if [[ "$CURRENT_IP" == "$LAST_IP" ]]; then
+                  echo "$SUBDOMAIN: IP unchanged, NOOP update."
+              else
+                  echo "$SUBDOMAIN: Updating IP"
+
+                  JSON_BODY=$(jq -n --arg ip "$CURRENT_IP" '{records: [{value: $ip}]}')
+
+                  curl \
+                    --fail \
+                  	-X POST \
+                    -H "Authorization: Bearer $HETZNER_API_TOKEN" \
+                    -H "Content-Type: application/json" \
+                    -d "$JSON_BODY" \
+                    "https://api.hetzner.cloud/v1/zones/ppp.pm/rrsets/''${SUBDOMAIN}/A/actions/set_records" \
+                    && echo $CURRENT_IP > $LAST_IP_FILE
+              fi
+            done
+          '';
+        };
+      };
+    };
+  };
+
+  age = {
+    secrets = {
+      "hetzner-dns" = {
+        file = ../../../../secrets/manatee/hetzner-dns.age;
+        owner = "alex";
+        group = "users";
+      };
+    };
+  };
+}

hosts/manatee/modules/homepage/default.nix

@@ -0,0 +1,111 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  enabled = config.mod.homepage.enable;
+  nginxEnabled = config.mod.nginx.enable;
+  services = config.mod.homepage.services;
+
+  serviceToCard = svc: ''
+    <a class="card" href="http://manatee:${toString svc.port}">
+      <div class="name">${svc.name}</div>
+      <div class="desc">${svc.description}</div>
+      <div class="port">:${toString svc.port}</div>
+    </a>
+  '';
+
+  page = pkgs.writeTextDir "index.html" ''
+    <!DOCTYPE html>
+    <html lang="en">
+    <head>
+      <meta charset="UTF-8">
+      <meta name="viewport" content="width=device-width, initial-scale=1.0">
+      <title>manatee</title>
+      <style>
+        * { margin: 0; padding: 0; box-sizing: border-box; }
+        body {
+          font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+          background: #1a1b26;
+          color: #c0caf5;
+          min-height: 100vh;
+          padding: 3rem 1.5rem;
+        }
+        h1 {
+          text-align: center;
+          font-size: 1.5rem;
+          font-weight: 400;
+          color: #7aa2f7;
+          margin-bottom: 2rem;
+        }
+        .grid {
+          display: grid;
+          grid-template-columns: repeat(auto-fill, minmax(200px, 1fr));
+          gap: 1rem;
+          max-width: 900px;
+          margin: 0 auto;
+        }
+        .card {
+          display: block;
+          background: #24283b;
+          border: 1px solid #414868;
+          border-radius: 8px;
+          padding: 1.25rem;
+          text-decoration: none;
+          color: inherit;
+          transition: border-color 0.15s;
+        }
+        .card:hover { border-color: #7aa2f7; }
+        .name { font-size: 1.1rem; font-weight: 600; color: #c0caf5; }
+        .desc { font-size: 0.85rem; color: #565f89; margin-top: 0.35rem; }
+        .port { font-size: 0.8rem; color: #414868; margin-top: 0.5rem; font-family: monospace; }
+      </style>
+    </head>
+    <body>
+      <h1>manatee</h1>
+      <div class="grid">
+        ${lib.concatMapStrings serviceToCard services}
+      </div>
+    </body>
+    </html>
+  '';
+in
+{
+  options = {
+    mod.homepage = {
+      enable = lib.mkEnableOption "Enable homepage module";
+      services = lib.mkOption {
+        type = lib.types.listOf (
+          lib.types.submodule {
+            options = {
+              name = lib.mkOption { type = lib.types.str; };
+              port = lib.mkOption { type = lib.types.port; };
+              description = lib.mkOption { type = lib.types.str; };
+            };
+          }
+        );
+        default = [ ];
+        description = "Services to display on the homepage";
+      };
+    };
+  };
+
+  config = lib.mkIf (enabled && nginxEnabled) {
+    services.nginx.virtualHosts."homepage" = {
+      listen = [
+        {
+          addr = "0.0.0.0";
+          port = 9999;
+        }
+      ];
+      root = page;
+      locations."/" = {
+        index = "index.html";
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [ 9999 ];
+  };
+}

hosts/manatee/modules/immich/default.nix

@@ -0,0 +1,43 @@
+{ lib, config, ... }:
+let
+  enabled = config.mod.immich.enable;
+in
+{
+  options = {
+    mod.immich = {
+      enable = lib.mkEnableOption "Enable immich module";
+    };
+  };
+
+  config = lib.mkIf enabled {
+    mod.homepage.services = [
+      {
+        name = "Immich";
+        port = 2283;
+        description = "Photo library";
+      }
+    ];
+
+    users.users.immich = {
+      isSystemUser = true;
+      group = "storage";
+
+      extraGroups = [
+        "render"
+        "video"
+      ];
+    };
+
+    services.immich = {
+      enable = true;
+
+      user = "immich";
+      group = "storage";
+
+      host = "0.0.0.0";
+
+      mediaLocation = "/mnt/cameras/public";
+      accelerationDevices = [ "/dev/dri/renderD128" ];
+    };
+  };
+}

hosts/manatee/modules/jellyfin/default.nix

@@ -0,0 +1,68 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  enabled = config.mod.jellyfin.enable;
+in
+{
+  options = {
+    mod.jellyfin = {
+      enable = lib.mkEnableOption "Enable jellyfin module";
+    };
+  };
+
+  config = lib.mkIf enabled {
+    users.users.jellyfin = {
+      isSystemUser = true;
+      group = "storage";
+
+      extraGroups = [
+        "render"
+        "video"
+      ];
+    };
+
+    hardware = {
+      graphics = {
+        enable = true;
+        extraPackages = [
+          pkgs.intel-media-driver # Modern Intel VA-API driver (needed for N305)
+          pkgs.libvdpau-va-gl # VDPAU backend for VA-API GLX interop
+          pkgs.intel-compute-runtime # OpenCL support
+        ];
+
+      };
+    };
+
+    services = {
+      jellyfin = {
+        enable = true;
+        openFirewall = true;
+
+        user = "jellyfin";
+        group = "storage";
+      };
+    };
+
+    mod.homepage.services = [
+      {
+        name = "Jellyfin";
+        port = 8096;
+        description = "Media streaming";
+      }
+    ];
+
+    networking = {
+      firewall.allowedTCPPorts = [ 8096 ];
+    };
+
+    environment.systemPackages = [
+      pkgs.jellyfin
+      pkgs.jellyfin-web
+      pkgs.jellyfin-ffmpeg
+    ];
+  };
+}

hosts/manatee/modules/komga/default.nix

@@ -0,0 +1,157 @@
+{
+  inputs,
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  enabled = config.mod.komga.enable;
+  nginxEnabled = config.mod.nginx.enable;
+in
+{
+  options = {
+    mod.komga = {
+      enable = lib.mkEnableOption "Enable komga module";
+    };
+  };
+
+  imports = [
+    inputs.komga-comictracker.nixosModules.default
+    inputs.komga-bookmanager.nixosModules.default
+    inputs.komga-reading-stats.nixosModules.default
+  ];
+
+  config = lib.mkIf enabled {
+    mod.homepage.services = [
+      {
+        name = "Komga";
+        port = 8002;
+        description = "Comic library";
+      }
+      {
+        name = "Komga Reader";
+        port = 8888;
+        description = "Comic reader";
+      }
+      {
+        name = "Komga Book Manager";
+        port = 8686;
+        description = "Book manager";
+      }
+      {
+        name = "Komga Reading Stats";
+        port = 8787;
+        description = "Reading stats";
+      }
+    ];
+
+    users.users.komga = {
+      isSystemUser = true;
+      group = "storage";
+    };
+
+    services.komga = {
+      enable = true;
+
+      user = "komga";
+      group = "storage";
+
+      settings = {
+        server.port = 8002;
+        komga."cors.allowed-origins" = [
+          "http://manatee:8888"
+          "https://komga.ppp.pm"
+        ];
+      };
+
+      openFirewall = true;
+    };
+
+    services.nginx = lib.mkIf nginxEnabled {
+      virtualHosts."komga-reader" = {
+        listen = [
+          {
+            addr = "0.0.0.0";
+            port = 8888;
+          }
+        ];
+        root = (pkgs.writeTextDir "komga-reader.html" (builtins.readFile ./komga-reader.html));
+
+        locations."/" = {
+          index = "komga-reader.html";
+          tryFiles = "$uri $uri/ /komga-reader.html";
+        };
+      };
+
+      virtualHosts."komga.ppp.pm" = {
+        forceSSL = true;
+        useACMEHost = "komga.ppp.pm";
+
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:8002";
+          proxyWebsockets = true;
+        };
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [ 8888 ];
+
+    programs.comictracker = {
+      enable = true;
+      komgaUrl = "http://127.0.0.1:8002";
+      komgaLibraryId = "0NVZH5AK3RPE1";
+      secretsFile = config.age.secrets.komga-comicbooktracker-credentials.path;
+    };
+
+    services.komga-book-manager = {
+      enable = true;
+      port = 8686;
+      group = "storage";
+      komgaUrl = "http://127.0.0.1:8002";
+      credentialsFile = config.age.secrets.komga-bookmanager-credentials.path;
+      libraryRoot = "/mnt/media/public/books";
+      libraryId = "0PNE1NEPY6995";
+    };
+
+    services.komga-reading-stats = {
+      enable = true;
+      host = "0.0.0.0";
+      port = 8787;
+      origin = "http://manatee:8787";
+
+      anthropicApiKeyFile = config.age.secrets.komga-reading-stats-claude-api-key.path;
+      claudeModel = "claude-sonnet-4-6";
+      komga = {
+        url = "http://127.0.0.1:8002";
+        apiKeyFile = config.age.secrets.komga-reading-stats-komga-api-key.path;
+      };
+    };
+
+    age.secrets = {
+      "komga-comicbooktracker-credentials" = {
+        file = ../../../../secrets/manatee/komga-comicbooktracker-credentials.age;
+        owner = "alex";
+        group = "users";
+      };
+
+      "komga-bookmanager-credentials" = {
+        file = ../../../../secrets/manatee/komga-bookmanager-credentials.age;
+        owner = "alex";
+        group = "users";
+      };
+
+      "komga-reading-stats-claude-api-key" = {
+        file = ../../../../secrets/manatee/komga-reading-stats-claude-api-key.age;
+        owner = "komga-reading-stats";
+        group = "komga-reading-stats";
+      };
+
+      "komga-reading-stats-komga-api-key" = {
+        file = ../../../../secrets/manatee/komga-reading-stats-komga-api-key.age;
+        owner = "komga-reading-stats";
+        group = "komga-reading-stats";
+      };
+    };
+  };
+}

hosts/manatee/modules/navidrome/default.nix

@@ -0,0 +1,41 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  navidromeEnabled = config.mod.navidrome.enable;
+in
+{
+  options = {
+    mod.navidrome = {
+      enable = lib.mkEnableOption "Enable navidrome module";
+    };
+  };
+
+  config = {
+    mod.homepage.services = lib.mkIf navidromeEnabled [
+      {
+        name = "Navidrome";
+        port = 4533;
+        description = "Music streaming";
+      }
+    ];
+
+    services = lib.mkIf navidromeEnabled {
+      navidrome = {
+        enable = true;
+        openFirewall = true;
+
+        user = "navidrome";
+        group = "storage";
+        settings = {
+          Port = 4533;
+          Address = "0.0.0.0";
+          MusicFolder = "/mnt/media/public/music";
+        };
+      };
+    };
+  };
+}

hosts/manatee/modules/network/default.nix

@@ -0,0 +1,50 @@
+{ ... }:
+let
+  hostAddress = "192.168.50.203";
+in
+{
+  networking = {
+    hostName = "manatee";
+
+    # Required for asymmetric routing (sending replies out a different interface
+    # than the default route). Without this, the kernel drops the return traffic.
+    firewall.checkReversePath = "loose";
+
+    defaultGateway = "192.168.50.1";
+    nameservers = [ "1.1.1.1" ];
+    interfaces = {
+      enp3s0 = {
+        useDHCP = false;
+        ipv4 = {
+          addresses = [
+            {
+              address = hostAddress;
+              prefixLength = 24;
+            }
+          ];
+        };
+
+        ipv4.routes = [
+          {
+            address = "0.0.0.0";
+            prefixLength = 0;
+            via = "192.168.50.1"; # Router
+            options = {
+              table = "100";
+            };
+          }
+        ];
+      };
+    };
+
+    localCommands = ''
+      # Ensure local LAN traffic uses the main table, e.g. responds to the local machine
+      ip rule list | grep -q "192.168.50.0/24 lookup main" || \
+      ip rule add to 192.168.50.0/24 lookup main priority 4999
+
+      # All other traffic from this IP uses Table 100 (e.g. responds to router and back out)
+      ip rule list | grep -q "from ${hostAddress} lookup 100" || \
+      ip rule add from ${hostAddress} lookup 100 priority 5000
+    '';
+  };
+}

hosts/manatee/modules/nginx/default.nix

@@ -0,0 +1,28 @@
+{ lib, config, ... }:
+let
+  enabled = config.mod.nginx.enable;
+in
+{
+  options = {
+    mod.nginx = {
+      enable = lib.mkEnableOption "Enable nginx module";
+    };
+  };
+
+  config = lib.mkIf enabled {
+    services = {
+      nginx = {
+        enable = true;
+
+        recommendedProxySettings = true;
+        recommendedTlsSettings = true;
+      };
+    };
+
+    networking = {
+      firewall = {
+        allowedTCPPorts = [ 443 ];
+      };
+    };
+  };
+}

hosts/manatee/modules/ssh/default.nix

@@ -0,0 +1,119 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  enabled = config.mod.ssh.enable;
+
+  authorizedKeysPath = "/home/alex/.ssh/authorized-keys";
+  rootSSHKeyPath = "/etc/ssh";
+in
+{
+  options = {
+    mod.ssh = {
+      enable = lib.mkEnableOption "enable ssh module";
+    };
+  };
+
+  config = lib.mkIf enabled {
+    home-manager.users.alex = {
+      programs.ssh = {
+        enable = true;
+
+        matchBlocks = {
+          "git.ppp.pm" = {
+            hostname = "git.ppp.pm";
+            identityFile = "/home/alex/.ssh/alex.manatee-git.ppp.pm";
+          };
+
+          "*" = {
+            forwardAgent = false;
+            addKeysToAgent = "no";
+            compression = false;
+            serverAliveInterval = 0;
+            serverAliveCountMax = 3;
+            hashKnownHosts = false;
+            userKnownHostsFile = "~/.ssh/known_hosts";
+            controlMaster = "no";
+            controlPath = "~/.ssh/master-%r@%n:%p";
+            controlPersist = "no";
+          };
+        };
+      };
+    };
+
+    environment.etc."ssh/authorized_keys_command" = {
+      mode = "0755";
+      text = ''
+        #!${pkgs.bash}/bin/bash
+        for file in ${authorizedKeysPath}/*; do
+          ${pkgs.coreutils}/bin/cat "$file"
+        done
+      '';
+    };
+
+    services = {
+      openssh = {
+        enable = true;
+        ports = [ 1122 ];
+
+        hostKeys = [
+          {
+            path = "${rootSSHKeyPath}/root.manatee";
+            type = "ed25519";
+          }
+        ];
+
+        settings = {
+          PasswordAuthentication = false;
+          KbdInteractiveAuthentication = false;
+        };
+
+        authorizedKeysCommand = "/etc/ssh/authorized_keys_command";
+        authorizedKeysCommandUser = "root";
+      };
+    };
+
+    networking = {
+      firewall = {
+        allowedTCPPorts = [ 1122 ];
+      };
+    };
+
+    age.secrets = {
+      "root.manatee" = {
+        file = ../../../../secrets/manatee/root.manatee.age;
+        path = "${rootSSHKeyPath}/root.manatee";
+      };
+      "root.manatee.pub" = {
+        file = ../../../../secrets/manatee/root.manatee.pub.age;
+        path = "${rootSSHKeyPath}/root.manatee.pub";
+      };
+
+      "alex.pinwheel-manatee.pub" = {
+        file = ../../../../secrets/pinwheel/alex.pinwheel-manatee.pub.age;
+        path = "${authorizedKeysPath}/alex.pinwheel-manatee.pub";
+      };
+
+      "alex.backwards-manatee.pub" = {
+        file = ../../../../secrets/backwards/alex.backwards-manatee.pub.age;
+        path = "${authorizedKeysPath}/alex.backwards-manatee.pub";
+      };
+
+      "alex.manatee-git.ppp.pm" = {
+        file = ../../../../secrets/manatee/alex.manatee-git.ppp.pm.age;
+        path = "/home/alex/.ssh/alex.manatee-git.ppp.pm";
+        owner = "alex";
+        group = "users";
+      };
+      "alex.manatee-git.ppp.pm.pub" = {
+        file = ../../../../secrets/manatee/alex.manatee-git.ppp.pm.pub.age;
+        path = "/home/alex/.ssh/alex.manatee-git.ppp.pm.pub";
+        owner = "alex";
+        group = "users";
+      };
+    };
+  };
+}

hosts/manatee/modules/syncthing/default.nix

@@ -0,0 +1,69 @@
+{ lib, config, ... }:
+let
+  enabled = config.mod.syncthing.enable;
+in
+{
+  options = {
+    mod.syncthing = {
+      enable = lib.mkEnableOption "Enable syncthing module";
+    };
+  };
+
+  config = lib.mkIf enabled {
+    mod.homepage.services = [
+      {
+        name = "Syncthing";
+        port = 8384;
+        description = "File sync";
+      }
+    ];
+
+    services.syncthing = {
+      enable = true;
+
+      cert = config.age.secrets.syncthing-cert.path;
+      key = config.age.secrets.syncthing-key.path;
+
+      user = "storage";
+      group = "storage";
+
+      dataDir = "/mnt/sync/public";
+
+      guiAddress = "0.0.0.0:8384";
+
+      settings = {
+        gui = {
+          user = "syncthing";
+          password = "$2a$12$YBcqhl8AXpoLmIWikuMtkOQLcrPXKKj0xY/qy4hggWnfjeVLQ3Ct6";
+          insecureSkipHostcheck = false;
+        };
+
+        devices = {
+          pinwheel.id = config.lib.syncthing.pinwheel;
+        };
+
+        folders = {
+          org = {
+            path = "/mnt/sync/public/org";
+            devices = [
+              "pinwheel"
+            ];
+            versioning = {
+              type = "staggered";
+              params = {
+                maxage = "2592000"; # 30 days
+              };
+            };
+          };
+        };
+      };
+    };
+
+    age = {
+      secrets = {
+        "syncthing-cert".file = ../../../../secrets/manatee/syncthing-cert.age;
+        "syncthing-key".file = ../../../../secrets/manatee/syncthing-key.age;
+      };
+    };
+  };
+}

hosts/manatee/modules/tailscale/default.nix

@@ -0,0 +1,11 @@
+{ ... }:
+{
+  # If an exit node is used, set:
+  # tailscale set --exit-node-allow-lan-access
+  services.tailscale.enable = true;
+
+  networking.firewall = {
+    checkReversePath = "loose";
+    allowedUDPPorts = [ 41641 ];
+  };
+}

hosts/manatee/modules/transmission/default.nix

@@ -15,31 +15,40 @@ in
   };
 
   config = lib.mkIf enabled {
+    mod.homepage.services = [
+      {
+        name = "Transmission";
+        port = 9091;
+        description = "Torrent client";
+      }
+    ];
+
     services = {
       transmission = {
         enable = true;
         package = pkgs.transmission_4;
 
         openFirewall = true;
-        openRPCPort = true;
 
-        user = "alex";
+        user = "storage";
-        group = "users";
+        group = "storage";
 
-        home = "/home/alex/media/ts-home";
+        home = "/mnt/media/public/.ts-home";
         downloadDirPermissions = "775";
 
         settings = {
-          rpc-bind-address = "0.0.0.0";
-          rpc-port = 9191;
-
           incomplete-dir-enabled = false;
-          download-dir = "/home/alex/media/downloads";
+          download-dir = "/mnt/media/public/downloads";
 
-          rpc-authentication-required = true;
+          rpc-bind-address = "0.0.0.0";
+
+          # Required to have empty user/pass to satisfy transmissionA
+          # https://github.com/transmission/transmission/discussions/1941#discussioncomment-1472352
           rpc-whitelist-enabled = false;
-          rpc-username = "transmission";
+          rpc-authentication-required = true;
-          rpc-password = "{55d884e4042db67313da49e05d7089a368eb64b3Br.3X.Xi";
+          rpc-username = "";
+          rpc-password = "";
+
         };
       };
     };

hosts/pinwheel/configuration.nix

@@ -17,7 +17,10 @@
   users.users.alex = {
     isNormalUser = true;
     description = "alex";
-    extraGroups = [ "wheel" ];
+    extraGroups = [
+      "wheel"
+      "networkmanager"
+    ];
   };
 
   environment.systemPackages = with pkgs; [

hosts/pinwheel/hardware-configuration.nix

@@ -36,7 +36,12 @@
     fsType = "vfat";
   };
 
-  swapDevices = [ ];
+  swapDevices = [
+    {
+      device = "/swapfile";
+      size = 48 * 1024; # 48GB
+    }
+  ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's

hosts/pinwheel/home.nix

@@ -14,14 +14,21 @@
         home.homeDirectory = "/home/alex";
 
         home.packages = [
+          inputs.whib-backend.packages.${pkgs.stdenv.hostPlatform.system}.whib-import
+          # pkgs.beekeeper-studio
+          pkgs.bitwarden-desktop
           pkgs.gimp
           pkgs.zip
+          pkgs.unzip
           pkgs.unar
           pkgs.jq
           pkgs.dbeaver-bin
           pkgs.htop
-          pkgs.onlyoffice-bin
+          pkgs.onlyoffice-desktopeditors
           pkgs.wdisplays
+          pkgs.vlc
+          pkgs.claude-code
+          pkgs.opencode
         ];
 
         home.stateVersion = "23.05";

hosts/pinwheel/modules/age/default.nix

@@ -11,7 +11,7 @@
     };
 
     environment.systemPackages = [
-      inputs.agenix.packages."${pkgs.system}".default
+      inputs.agenix.packages."${pkgs.stdenv.hostPlatform.system}".default
     ];
   };
 }

hosts/pinwheel/modules/bluetooth/default.nix

@@ -30,12 +30,6 @@ in
     # Low battery notification for bluetooth devices
     systemd.user =
       let
-        trackpad = {
-          id = "battery_hid_a8o91o3doe5ofeo38_battery";
-          name = "trackpad";
-          threshold = "20";
-        };
-
         headphones = {
           id = "headset_dev_38_18_4C_18_A4_6E";
           name = "headphones";
@@ -65,7 +59,6 @@ in
           in
           builtins.listToAttrs (
             builtins.map mkTimer [
-              trackpad
               headphones
             ]
           );
@@ -119,7 +112,6 @@ in
           in
           builtins.listToAttrs (
             builtins.map mkService [
-              trackpad
               headphones
             ]
           );

hosts/pinwheel/modules/colors/default.nix

@@ -3,7 +3,7 @@
     colors = {
       foreground = "bd93f9";
       foreground-dim = "644294";
-      background = "1E2029";
+      background = "1E1E2F";
 
       gray = "3a3a3a";
       warning = "ff6969";

hosts/pinwheel/modules/default.nix

@@ -14,7 +14,7 @@ in
       nix-index.enable = false;
       greetd.enable = true;
       hyprland.enable = true;
-      swaylock.enable = true;
+      hyprlock.enable = true;
       physlock.enable = false;
 
       power.enable = true;
@@ -27,13 +27,13 @@ in
       zsh.enable = true;
 
       openvpn.enable = true;
-      mullvad.enable = true;
 
       c.enable = true;
       go.enable = true;
       rust.enable = true;
       scala.enable = true;
       python.enable = true;
+      gleam.enable = true;
 
       keyboard.enable = true;
       containers = {

hosts/pinwheel/modules/dunst/default.nix

@@ -7,8 +7,6 @@
       settings = {
         global = {
           monitor = 1;
-          width = 300;
-          height = 300;
           offset = "10x10";
           origin = "top-right";
           transparency = 10;

hosts/pinwheel/modules/emacs/config.org

@@ -479,7 +479,34 @@ Setup prefix for keybindings.
 
 * Flycheck
 #+BEGIN_SRC emacs-lisp
-  (use-package flycheck)
+  (use-package flycheck
+    :preface
+    (defun mp-flycheck-eldoc (callback &rest _ignored)
+      "Print flycheck messages at point by calling CALLBACK."
+      (when-let ((flycheck-errors (and flycheck-mode (flycheck-overlay-errors-at (point)))))
+        (mapc
+         (lambda (err)
+           (funcall callback
+             (format "%s: %s"
+                     (let ((level (flycheck-error-level err)))
+                       (pcase level
+                         ('info (propertize "I" 'face 'flycheck-error-list-info))
+                         ('error (propertize "E" 'face 'flycheck-error-list-error))
+                         ('warning (propertize "W" 'face 'flycheck-error-list-warning))
+                         (_ level)))
+                     (flycheck-error-message err))
+             :thing (or (flycheck-error-id err)
+                        (flycheck-error-group err))
+             :face 'font-lock-doc-face))
+         flycheck-errors)))
+
+    (defun mp-flycheck-prefer-eldoc ()
+      (add-hook 'eldoc-documentation-functions #'mp-flycheck-eldoc nil t)
+      (setq eldoc-documentation-strategy 'eldoc-documentation-compose-eagerly)
+      (setq flycheck-display-errors-function nil)
+      (setq flycheck-help-echo-function nil))
+
+    :hook ((flycheck-mode . mp-flycheck-prefer-eldoc)))
 
   (use-package flycheck-eglot
     :after (flycheck eglot)
@@ -503,6 +530,12 @@ Setup prefix for keybindings.
         (add-hook 'before-save-hook #'eglot-format-buffer -10 t))))
 
   (use-package eglot
+    :preface
+    (defun mp-eglot-eldoc ()
+  	(setq eldoc-echo-area-use-multiline-p nil)
+      (setq eldoc-documentation-strategy
+        'eldoc-documentation-compose-eagerly))
+
     :config
     (add-to-list 'eglot-server-programs
       '(scala-mode .
@@ -511,6 +544,9 @@ Setup prefix for keybindings.
     (add-to-list 'eglot-server-programs
        '(nix-mode . ("nixd")))
 
+    (add-to-list 'eglot-server-programs
+      '(gleam-ts-mode . ("gleam" "lsp")))
+
     (setq-default eglot-workspace-configuration
       '(
         :metals (
@@ -519,7 +555,11 @@ Setup prefix for keybindings.
       )
     )
 
+    :custom
+    (eglot-code-action-indications nil)
+
     :hook (
+           (eglot-managed-mode . mp-eglot-eldoc)
            (go-mode . eglot-ensure)
            (go-mode . alex/organize-imports-on-save)
            (go-mode . alex/format-on-save)
@@ -529,6 +569,10 @@ Setup prefix for keybindings.
            (nix-mode . eglot-ensure)
            (nix-mode . alex/format-on-save)
 
+           (gleam-ts-mode . eglot-ensure)
+           (gleam-ts-mode . alex/format-on-save)
+
+           (python-mode . eglot-ensure)
            (javascript-mode . eglot-ensure)
            (js-mode . eglot-ensure)
            (js-jsx-mode . eglot-ensure)
@@ -548,13 +592,6 @@ Setup prefix for keybindings.
     :after eglot
     :config (eglot-booster-mode))
 #+END_SRC
-** Eldoc-box
-#+BEGIN_SRC emacs-lisp
-  (use-package eldoc-box
-    :after eglot
-    :bind (:map eglot-mode-map
-              ("M-h" . eldoc-box-help-at-point)))
-#+END_SRC
 ** Go
 #+BEGIN_SRC emacs-lisp
   (use-package go-mode
@@ -572,6 +609,12 @@ Setup prefix for keybindings.
     )
   )
 #+END_SRC
+** Gleam
+#+BEGIN_SRC emacs-lisp
+  (use-package gleam-ts-mode
+    :mode "\\.gleam\\'"
+  )
+#+END_SRC
 ** YAML
 #+BEGIN_SRC emacs-lisp
   (use-package yaml-mode
@@ -603,7 +646,8 @@ Setup prefix for keybindings.
 #+BEGIN_SRC emacs-lisp
   (setq
    js-indent-level 2
-   js2-basic-offset 2)
+   js2-basic-offset 2
+   indent-tabs-mode nil)
 
   (add-to-list 'auto-mode-alist '("\\.ts\\'" . typescript-ts-mode))
 #+END_SRC

hosts/pinwheel/modules/firefox/default.nix

@@ -29,14 +29,14 @@ let
   ff = pkgs.writeShellApplication {
     name = "ff";
     text = ''
-      ${wrapped}/bin/firefox --ProfileManager
+      ${wrapped}/bin/firefox-devedition --ProfileManager
     '';
   };
 
   ff-alex = pkgs.writeShellApplication {
     name = "ff-alex";
     text = ''
-      ${wrapped}/bin/firefox -P alex --new-window "$@"
+      ${wrapped}/bin/firefox-devedition -P alex --new-window "$@"
     '';
   };
 

hosts/pinwheel/modules/fonts/default.nix

@@ -2,9 +2,9 @@
 {
   fonts.packages = [
     pkgs.noto-fonts
-    pkgs.noto-fonts-cjk
+    pkgs.noto-fonts-cjk-sans
-    pkgs.noto-fonts-emoji
+    pkgs.noto-fonts-color-emoji
-    pkgs.nerdfonts
+    pkgs.nerd-fonts.jetbrains-mono
     pkgs.liberation_ttf
   ];
 }

hosts/pinwheel/modules/fzf/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ ... }:
 {
   home-manager.users.alex = {
     programs.fzf = {

hosts/pinwheel/modules/games/default.nix

@@ -1,16 +1,6 @@
 { pkgs, ... }:
 {
   home-manager.users.alex = {
-    home.packages = [
+    home.packages = [ pkgs.brogue-ce ];
-      pkgs.brogue-ce
-
-      (pkgs.retroarch.override {
-        cores = [
-          pkgs.libretro.genesis-plus-gx
-          pkgs.libretro.snes9x
-          pkgs.libretro.dolphin
-        ];
-      })
-    ];
   };
 }

hosts/pinwheel/modules/git/default.nix

@@ -23,8 +23,16 @@ in
           { path = ./gitconfig; }
         ];
 
-        extraConfig = {
+        signing = {
+          key = config.age.secrets."alex.pinwheel-github.com-signing.pub".path;
+          signByDefault = true;
+        };
+
+        settings = {
           rerere.enable = true;
+
+          # Tells Git to use SSH instead of the default GPG
+          gpg.format = "ssh";
         };
       };
 
@@ -35,5 +43,20 @@ in
         set main-view-line-number-interval = 1
       '';
     };
+
+    age.secrets = {
+      "alex.pinwheel-github.com-signing" = {
+        file = ../../../../secrets/pinwheel/alex.pinwheel-github.com-signing.age;
+        path = "/home/alex/.ssh/alex.pinwheel-github.com-signing";
+        owner = "alex";
+        group = "users";
+      };
+      "alex.pinwheel-github.com-signing.pub" = {
+        file = ../../../../secrets/pinwheel/alex.pinwheel-github.com-signing.pub.age;
+        path = "/home/alex/.ssh/alex.pinwheel-github.com-signing.pub";
+        owner = "alex";
+        group = "users";
+      };
+    };
   };
 }

hosts/pinwheel/modules/git/gitconfig

@@ -5,11 +5,5 @@
 [url "git@github.com:"]
     insteadOf = https://github.com/
 
-[url "git@gitlab.com:"]
-    insteadOf = https://gitlab.com/
-
-[url "git@codeberg.org:"]
-    insteadOf = https://codeberg.org/
-
 [url "gitea@git.ppp.pm:"]
     insteadOf = https://git.ppp.pm/

hosts/pinwheel/modules/gleam/default.nix

@@ -0,0 +1,25 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  enabled = config.mod.gleam.enable;
+in
+{
+  options = {
+    mod.gleam = {
+      enable = lib.mkEnableOption "enable gleam module";
+    };
+  };
+
+  config = lib.mkIf enabled {
+    home-manager.users.alex = {
+      home.packages = [
+        pkgs.gleam
+        pkgs.erlang
+      ];
+    };
+  };
+}

hosts/pinwheel/modules/go/default.nix

@@ -15,26 +15,14 @@ in
   };
 
   config = lib.mkIf enabled {
-    nixpkgs.overlays =
-      let
-        buildGo122 = pkgs: pkg: pkg.override { buildGoModule = pkgs.buildGo122Module; };
-      in
-      [
-        (final: prev: {
-          go = prev.go_1_22;
-          gopls = buildGo122 prev prev.gopls;
-          go-tools = buildGo122 prev prev.go-tools;
-          govulncheck = buildGo122 prev prev.govulncheck;
-          gotestsum = buildGo122 prev prev.gotestsum;
-        })
-      ];
-
     home-manager.users.alex = {
       programs.go = {
         enable = true;
 
         package = pkgs.go;
-        goPath = "code/go";
+        env = {
+          GOPATH = "/home/alex/code/go";
+        };
       };
 
       home.packages = [

hosts/pinwheel/modules/greetd/default.nix

@@ -22,7 +22,7 @@ in
         let
           session = {
             user = "alex";
-            command = "${pkgs.hyprland}/bin/Hyprland";
+            command = "uwsm start hyprland-uwsm.desktop";
           };
         in
         {

hosts/pinwheel/modules/hyprland/default.nix

@@ -1,4 +1,5 @@
 {
+  inputs,
   pkgs,
   lib,
   config,
@@ -6,6 +7,61 @@
 }:
 let
   enabled = config.mod.hyprland.enable;
+
+  monitorScript = pkgs.writeShellScript "hyprland-monitor-handler" ''
+    INTERNAL="eDP-1"
+    EXTERNAL_MONITORS="HDMI-A-1 DP-3"
+    HYPRCTL="${pkgs.hyprland}/bin/hyprctl"
+    JQ="${pkgs.jq}/bin/jq"
+
+    get_active_external() {
+      # Return the first connected external monitor
+      for mon in $EXTERNAL_MONITORS; do
+        if $HYPRCTL monitors -j | $JQ -e ".[] | select(.name == \"$mon\")" > /dev/null 2>&1; then
+          echo "$mon"
+          return 0
+        fi
+      done
+      return 1
+    }
+
+    bind_workspaces() {
+      local external batch=""
+
+      if external=$(get_active_external); then
+        # External monitor connected: move workspaces 1-5 to external, 6-10 to internal
+        for ws in 1 2 3 4 5; do
+          batch="$batch dispatch moveworkspacetomonitor $ws $external;"
+        done
+        for ws in 6 7 8 9 10; do
+          batch="$batch dispatch moveworkspacetomonitor $ws $INTERNAL;"
+        done
+      else
+        # No external monitor: move all workspaces to internal
+        for ws in 1 2 3 4 5 6 7 8 9 10; do
+          batch="$batch dispatch moveworkspacetomonitor $ws $INTERNAL;"
+        done
+      fi
+
+      $HYPRCTL --batch "$batch"
+    }
+
+    handle_event() {
+      case $1 in
+        monitoradded*|monitorremoved*)
+          sleep 0.5
+          bind_workspaces
+          ;;
+      esac
+    }
+
+    # Bind workspaces on startup
+    bind_workspaces
+
+    ${pkgs.socat}/bin/socat -U - UNIX-CONNECT:"$XDG_RUNTIME_DIR/hypr/$HYPRLAND_INSTANCE_SIGNATURE/.socket2.sock" | while read -r line; do
+      handle_event "$line"
+    done
+  '';
 in
 {
   options = {
@@ -15,34 +71,64 @@ in
   };
 
   config = lib.mkIf enabled {
-    home-manager.users.alex = {
+    programs.hyprland = {
-      wayland.windowManager.hyprland = {
       enable = true;
+      withUWSM = true;
+      package = inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.hyprland;
+      portalPackage =
+        inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.xdg-desktop-portal-hyprland;
 
       xwayland = {
         enable = true;
       };
+    };
+
+    home-manager.users.alex = {
+      wayland.windowManager.hyprland = {
+        enable = true;
+        systemd.enable = false;
 
         extraConfig = ''
-          exec-once=waybar
+          exec-once = uwsm app -- waybar
+          exec-once = uwsm app -- hyprctl setcursor Adwaita 24
 
           env = GDK_DPI_SCALE,1.5
-          env = XCURSOR_SIZE,64
+          env = HYPRCURSOR_THEME,Adwaita
+          env = HYPRCURSOR_SIZE,24
 
-          monitor=eDP-1, 1920x1200, 0x0, 1
+          monitor=eDP-1, 1920x1200, auto-center-down, 1
+          monitor=HDMI-A-1, 2560x1440@100, auto-center-up, 1
+          monitor=DP-3, 2560x1440@60, auto-center-up, 1
 
-          workspace = 1, monitor:HDMI-A-1
+          # Workspaces 1-5 on external monitors (HDMI-A-1 or DP-3)
+          workspace = 1, monitor:HDMI-A-1, default:true
           workspace = 2, monitor:HDMI-A-1
           workspace = 3, monitor:HDMI-A-1
           workspace = 4, monitor:HDMI-A-1
           workspace = 5, monitor:HDMI-A-1
-          workspace = 6, monitor:eDP-1
+          workspace = 1, monitor:DP-3, default:true
+          workspace = 2, monitor:DP-3
+          workspace = 3, monitor:DP-3
+          workspace = 4, monitor:DP-3
+          workspace = 5, monitor:DP-3
+
+          # Workspaces 6-10 on internal monitor
+          workspace = 6, monitor:eDP-1, default:true
           workspace = 7, monitor:eDP-1
           workspace = 8, monitor:eDP-1
           workspace = 9, monitor:eDP-1
           workspace = 10, monitor:eDP-1
 
-          exec-once=dbus-update-activation-environment --systemd WAYLAND_DISPLAY XDG_CURRENT_DESKTOP
+          workspace = w[tv1], gapsout:0, gapsin:0
+          workspace = f[1], gapsout:0, gapsin:0
+          windowrule = border_size 0, match:float 0, match:workspace w[tv1]
+          windowrule = rounding 0, match:float 0, match:workspace w[tv1]
+          windowrule = border_size 0, match:float 0, match:workspace f[1]
+          windowrule = rounding 0, match:float 0, match:workspace f[1]
+
+          # https://wiki.archlinux.org/title/Hyprland#Jetbrains_apps_focus_issues
+          windowrule = match:xwayland true, no_initial_focus on
+
         '';
 
         settings = {
@@ -61,6 +147,7 @@ in
             follow_mouse = 2;
 
             sensitivity = 0.3;
+            accel_profile = "flat";
             touchpad = {
               natural_scroll = false;
               tap-and-drag = false;
@@ -84,7 +171,6 @@ in
 
           dwindle = {
             force_split = 2;
-            no_gaps_when_only = 1;
           };
 
           bind =
@@ -154,6 +240,23 @@ in
         pkgs.wdisplays
         pkgs.bc
       ];
+
+      systemd.user.services.hyprland-monitors = {
+        Unit = {
+          Description = "Hyprland monitor hotplug handler";
+          PartOf = [ "graphical-session.target" ];
+          After = [ "graphical-session.target" ];
+        };
+        Service = {
+          Type = "simple";
+          ExecStart = "${monitorScript}";
+          Restart = "on-failure";
+          RestartSec = 5;
+        };
+        Install = {
+          WantedBy = [ "graphical-session.target" ];
+        };
+      };
     };
 
     # To start electron apps like `chromium` with wayland support
@@ -172,87 +275,6 @@ in
     # openGL is needed for wayland/hyprland
     hardware.graphics.enable = true;
 
-    systemd.user.services.hyprland-monitors = {
+    boot.kernelParams = [ "i915.enable_psr=0" ];
-      # systemctl --user restart hyprland-monitors.service
-      # journalctl --user -u hyprland-monitors.service -e -f
-      unitConfig = {
-        Description = "handles hyprland monitor connect/disconnect";
-      };
-
-      wantedBy = [ "graphical-session.target" ];
-      requires = [ "graphical-session.target" ];
-      after = [ "graphical-session.target" ];
-
-      path = [
-        pkgs.coreutils # to include `cat`
-        pkgs.waybar
-        pkgs.hyprland
-        pkgs.socat
-        pkgs.jq
-        pkgs.bc
-        pkgs.libnotify
-      ];
-
-      script =
-        let
-          moveWSToMonitor =
-            monitor: first: last:
-            if last < first then
-              throw "'first' has to be less than or equal to 'last'"
-            else
-              builtins.genList (
-                n: "dispatch moveworkspacetomonitor ${builtins.toString (first + n)} ${monitor}"
-              ) (last - first + 1);
-
-          external = moveWSToMonitor "HDMI-A-1" 1 5;
-          internal = moveWSToMonitor "eDPI-1" 6 10;
-          onlyInternal = moveWSToMonitor "eDPI-1" 1 10;
-        in
-        ''
-          update() {
-            HDMI_STATUS=$(cat /sys/class/drm/card1-HDMI-A-1/status)
-
-            INTERNAL_WIDTH=1920
-            INTERNAL_HEIGHT=1200
-
-            if [ $HDMI_STATUS = "connected" ]; then
-              notify-send "Using external and laptop monitor"
-
-              hyprctl keyword monitor HDMI-A-1,preferred,0x0,1
-
-              HDMI=$(hyprctl monitors -j | jq '.[] | select(.name=="HDMI-A-1")')
-              HDMI_WIDTH=$(echo $HDMI | jq .width)
-              HDMI_HEIGHT=$(echo $HDMI | jq .height)
-
-              INTERNAL_POS_X=$(echo "($HDMI_WIDTH - $INTERNAL_WIDTH) / 2" | bc)
-              if (( $(echo "$INTERNAL_POS_X < 0" | bc) )); then INTERNAL_POS_X=0; fi
-              INTERNAL_POS_Y=$HDMI_HEIGHT
-
-              hyprctl keyword monitor eDP-1,$INTERNAL_WIDTH"x"$INTERNAL_HEIGHT,$INTERNAL_POS_X"x"$INTERNAL_POS_Y,1
-              hyprctl --batch "${lib.strings.concatStringsSep ";" (external ++ internal)}"
-            else
-              notify-send "Using only laptop monitor"
-
-              hyprctl --batch "keyword monitor HDMI-A,disable; keyword monitor eDP-1,$INTERNAL_WIDTH"x"$INTERNAL_HEIGHT,0x0,1"
-              hyprctl --batch "${lib.strings.concatStringsSep ";" onlyInternal}"
-            fi
-          }
-
-          handle() {
-            case $1 in
-              monitoradded\>\>*|monitorremoved\>\>*)
-                echo "handling event: \"$1\""
-                update ;;
-            esac
-          }
-
-          echo "Starting service with instance \"$HYPRLAND_INSTANCE_SIGNATURE\""
-
-          # Do initial configuration
-          update
-
-          socat -U - UNIX-CONNECT:$XDG_RUNTIME_DIR/hypr/$HYPRLAND_INSTANCE_SIGNATURE/.socket2.sock | while read -r line; do handle "$line"; done
-        '';
-    };
   };
 }

hosts/pinwheel/modules/hyprlock/default.nix

@@ -5,13 +5,13 @@
   ...
 }:
 let
-  enabled = config.mod.swaylock.enable;
+  enabled = config.mod.hyprlock.enable;
   hyprlandEnabled = config.mod.hyprland.enable;
 in
 {
   options = {
-    mod.swaylock = {
+    mod.hyprlock = {
-      enable = lib.mkEnableOption "enable swaylock module";
+      enable = lib.mkEnableOption "enable hyprlock module";
 
       dpmsTimeout = lib.mkOption {
         description = "timeout in seconds before DPMS is turned on";
@@ -23,13 +23,32 @@ in
 
   config = lib.mkIf enabled {
     home-manager.users.alex = {
-      programs.swaylock = {
+      programs.hyprlock = {
         enable = true;
 
         settings = {
-          color = "000000";
+          general = {
-          indicator-idle-visible = false;
+            hide_cursor = true;
-          show-failed-attempts = true;
+          };
+
+          background = [
+            {
+              color = "rgb(000000)";
+            }
+          ];
+
+          input-field = [
+            {
+              size = "250, 50";
+              position = "0, 0";
+              halign = "center";
+              valign = "center";
+              outline_thickness = 2;
+              dots_center = true;
+              fade_on_empty = true;
+              placeholder_text = "";
+            }
+          ];
         };
       };
 
@@ -37,20 +56,20 @@ in
         settings = {
           bind =
             let
-              pause-music = "${pkgs.playerctl}/bin/playerctl -p spotify pause";
+              pause-music = "${pkgs.playerctl}/bin/playerctl -a pause";
 
-              dpmsTimeout = config.mod.swaylock.dpmsTimeout;
+              dpmsTimeout = config.mod.hyprlock.dpmsTimeout;
               dpms-lock = pkgs.writeShellScript "dpms-lock" ''
                 ${pkgs.swayidle}/bin/swayidle \
                   timeout ${dpmsTimeout} "${pkgs.hyprland}/bin/hyprctl dispatch dpms off" \
                   resume "${pkgs.hyprland}/bin/hyprctl dispatch dpms on" &
 
-                ${pkgs.swaylock}/bin/swaylock && ${pkgs.procps}/bin/pkill swayidle
+                ${pkgs.hyprlock}/bin/hyprlock; ${pkgs.procps}/bin/pkill swayidle
               '';
             in
             [
               "$mod, x, exec, ${pause-music}; ${dpms-lock}"
-              "$mod SHIFT, x, exec, ${pause-music}; ${pkgs.swaylock}/bin/swaylock -f; systemctl suspend"
+              "$mod SHIFT, x, exec, ${pause-music}; ${pkgs.hyprlock}/bin/hyprlock & sleep 0.5; systemctl suspend"
             ];
         };
       };
@@ -59,11 +78,7 @@ in
     security = {
       polkit.enable = true;
 
-      pam.services.swaylock.text = ''
+      pam.services.hyprlock = {};
-        # PAM configuration file for the swaylock screen locker. By default, it includes
-        # the 'login' configuration file (see /etc/pam.d/login)
-        auth include login
-      '';
     };
   };
 }

hosts/pinwheel/modules/light/default.nix

@@ -9,14 +9,13 @@ let
 in
 {
   users.users.alex.extraGroups = [ "video" ];
-  programs.light.enable = true;
 
   home-manager.users.alex = {
     wayland.windowManager.hyprland = lib.mkIf hyprlandEnabled {
       settings = {
         bind = [
-          ", XF86MonBrightnessUp, exec, ${pkgs.light}/bin/light -A 5"
+          ", XF86MonBrightnessUp, exec, ${pkgs.brightnessctl}/bin/brightnessctl set +5%"
-          ", XF86MonBrightnessDown, exec, ${pkgs.light}/bin/light -U 5"
+          ", XF86MonBrightnessDown, exec, ${pkgs.brightnessctl}/bin/brightnessctl set 5%-"
         ];
       };
     };

hosts/pinwheel/modules/mullvad/default.nix

@@ -1,35 +0,0 @@
-{
-  pkgs,
-  lib,
-  config,
-  ...
-}:
-let
-  enabled = config.mod.mullvad.enable;
-in
-{
-  options = {
-    mod.mullvad = {
-      enable = lib.mkEnableOption "enable mullvad module";
-    };
-  };
-
-  config = lib.mkIf enabled {
-    services.mullvad-vpn = {
-      enable = true;
-      package = pkgs.mullvad-vpn;
-    };
-
-    age.secrets = {
-      "mullvad-device" = {
-        file = ../../../../secrets/pinwheel/mullvad-device.age;
-        path = "/etc/mullvad-vpn/device.json";
-      };
-
-      "mullvad-account-history" = {
-        file = ../../../../secrets/pinwheel/mullvad-account-history.age;
-        path = "/etc/mullvad-vpn/account-history.json";
-      };
-    };
-  };
-}

hosts/pinwheel/modules/music/default.nix

@@ -1,4 +1,5 @@
 {
+  inputs,
   pkgs,
   lib,
   config,
@@ -13,18 +14,18 @@ in
       settings = {
         bind =
           let
-            prev = "${pkgs.playerctl}/bin/playerctl -p spotify previous";
+            prev = "${pkgs.playerctl}/bin/playerctl -p naviterm,spotify previous";
-            next = "${pkgs.playerctl}/bin/playerctl -p spotify next";
+            next = "${pkgs.playerctl}/bin/playerctl -p naviterm,spotify next";
           in
           [
             ", XF86AudioPrev, exec, ${prev}"
             ", XF86AudioNext, exec, ${next}"
-            ", XF86AudioPlay, exec, ${pkgs.playerctl}/bin/playerctl -p spotify play-pause"
+            ", XF86AudioPlay, exec, ${pkgs.playerctl}/bin/playerctl -p naviterm,spotify play-pause"
-            ", XF86AudioPause, exec, ${pkgs.playerctl}/bin/playerctl -p spoitfy play-pause"
+            ", XF86AudioPause, exec, ${pkgs.playerctl}/bin/playerctl -p naviterm,spoitfy play-pause"
 
             "$mod ALT, LEFT, exec, ${prev}"
             "$mod ALT, RIGHT, exec, ${next}"
-            "$mod ALT, DOWN, exec, ${pkgs.playerctl}/bin/playerctl -p spotify play-pause"
+            "$mod ALT, DOWN, exec, ${pkgs.playerctl}/bin/playerctl -p naviterm,spotify play-pause"
           ];
       };
     };
@@ -32,6 +33,7 @@ in
     home.packages = [
       pkgs.playerctl
       pkgs.spotify
+      inputs.naviterm.packages.${pkgs.stdenv.hostPlatform.system}.default
     ];
   };
 

hosts/pinwheel/modules/network/default.nix

@@ -1,21 +1,22 @@
+{ pkgs, ... }:
 {
-  services.connman = {
+  home-manager = {
+    users.alex = {
+      home.packages = [ pkgs.networkmanager ];
+    };
+  };
+
+  networking = {
+    wireless.enable = false; # Wireless is managed by networkmanager
+
+    networkmanager = {
       enable = true;
 
       wifi = {
         backend = "iwd";
       };
+    };
 
-    networkInterfaceBlacklist = [
-      "vmnet"
-      "vboxnet"
-      "virbr"
-      "ifb"
-      "ve"
-      "docker"
-      "br-"
-      "wg-"
-    ];
   };
 
   networking = {

hosts/pinwheel/modules/nix/default.nix

@@ -2,7 +2,7 @@
 {
   home-manager.users.alex = {
     home.packages = [
-      pkgs.nixfmt-rfc-style
+      pkgs.nixfmt
       pkgs.nix-tree
     ];
   };

hosts/pinwheel/modules/openvpn/default.nix

@@ -18,21 +18,19 @@ in
     home-manager.users.alex = {
       home.packages = [
         pkgs.openvpn
-        pkgs.update-systemd-resolved
       ];
     };
 
     services.resolved = {
-      enable = false;
+      enable = true;
-      dnssec = "true";
+      settings = {
-      domains = [ "~." ];
+        Resolve = {
-      fallbackDns = [
+          Domains = [ "~." ];
-        "1.1.1.1#one.one.one.one"
+          DNSSEC = false;
-        "1.0.0.1#one.one.one.one"
+          DNSOverTLS = true;
-      ];
+        };
-      extraConfig = ''
+      };
-        DNSOverTLS=yes
+
-      '';
     };
   };
 }

hosts/pinwheel/modules/power/default.nix

@@ -80,12 +80,12 @@ in
           path = [
             pkgs.coreutils # For `cat`
             pkgs.libnotify
-            pkgs.swaylock
+            pkgs.hyprlock
           ];
 
           script =
             let
-              pause-music = "${pkgs.playerctl}/bin/playerctl -p spotify pause";
+              pause-music = "${pkgs.playerctl}/bin/playerctl -a pause";
             in
             ''
                BATTERY_CAPACITY=$(cat /sys/class/power_supply/${lowbat.battery}/capacity)
@@ -103,7 +103,7 @@ in
 
                  BATTERY_STATUS=$(cat /sys/class/power_supply/${lowbat.battery}/status)
                  if [[ $BATTERY_STATUS = "Discharging" ]]; then
-                   ${pause-music}; ${pkgs.swaylock}/bin/swaylock -f; systemctl suspend
+                   ${pause-music}; ${pkgs.hyprlock}/bin/hyprlock & sleep 0.5; systemctl suspend
                  fi
               fi
             '';

hosts/pinwheel/modules/screenshot/default.nix

@@ -8,7 +8,7 @@
 let
   hyprlandEnabled = config.mod.hyprland.enable;
 
-  grimblast = inputs.hyprland-contrib.packages.${pkgs.system}.grimblast;
+  grimblast = inputs.hyprland-contrib.packages.${pkgs.stdenv.hostPlatform.system}.grimblast;
   area = "${pkgs.libnotify}/bin/notify-send 'ps: selected area' && ${grimblast}/bin/grimblast copy area";
   screen = "${pkgs.libnotify}/bin/notify-send 'ps: selected screen' &&${grimblast}/bin/grimblast copy output";
 in

hosts/pinwheel/modules/sound/default.nix

@@ -10,7 +10,7 @@ in
 {
   users.users.alex.extraGroups = [ "audio" ];
 
-  hardware.pulseaudio.enable = false;
+  services.pulseaudio.enable = false;
   security.rtkit.enable = true;
 
   services.pipewire = {

hosts/pinwheel/modules/ssh/default.nix

@@ -1,10 +1,26 @@
 { pkgs, ... }:
 {
+  # Enable gnome-keyring at system level for PAM integration
+  services.gnome.gnome-keyring.enable = true;
+
   home-manager.users.alex = {
+    services.gnome-keyring = {
+      enable = true;
+      components = [ "secrets" "ssh" ];
+    };
+
     programs.ssh = {
       enable = true;
+      enableDefaultConfig = false;
 
       matchBlocks = {
+        "manatee" = {
+          hostname = "manatee";
+          user = "alex";
+          identityFile = "/home/alex/.ssh/alex.pinwheel-manatee";
+          port = 1122;
+        };
+
         "backwards" = {
           hostname = "backwards";
           user = "alex";
@@ -12,12 +28,6 @@
           port = 1122;
         };
 
-        "andromeda" = {
-          hostname = "andromeda.a2x.se";
-          user = "alex";
-          identityFile = "/home/alex/.ssh/alex.pinwheel-andromeda";
-        };
-
         "tadpole" = {
           hostname = "65.21.106.222";
           user = "alex";
@@ -30,22 +40,46 @@
           identityFile = "/home/alex/.ssh/alex.pinwheel-github.com";
         };
 
-        "codeberg.org" = {
-          hostname = "codeberg.org";
-          identityFile = "/home/alex/.ssh/alex.pinwheel-codeberg.org";
-        };
-
         "git.ppp.pm" = {
           hostname = "git.ppp.pm";
           identityFile = "/home/alex/.ssh/alex.pinwheel-git.ppp.pm";
         };
+
+        "*" = {
+          forwardAgent = false;
+          addKeysToAgent = "yes";
+          compression = false;
+          serverAliveInterval = 0;
+          serverAliveCountMax = 3;
+          hashKnownHosts = false;
+          userKnownHostsFile = "~/.ssh/known_hosts";
+          controlMaster = "no";
+          controlPath = "~/.ssh/master-%r@%n:%p";
+          controlPersist = "no";
+        };
       };
     };
 
-    home.packages = [ pkgs.sshfs ];
+    home.packages = [
+      pkgs.sshfs
+      pkgs.seahorse # GUI for managing gnome-keyring
+    ];
   };
 
   age.secrets = {
+    "alex.pinwheel-manatee" = {
+      file = ../../../../secrets/pinwheel/alex.pinwheel-manatee.age;
+      path = "/home/alex/.ssh/alex.pinwheel-manatee";
+      owner = "alex";
+      group = "users";
+    };
+    "alex.pinwheel-manatee.pub" = {
+      file = ../../../../secrets/pinwheel/alex.pinwheel-manatee.pub.age;
+      path = "/home/alex/.ssh/alex.pinwheel-manatee.pub";
+      owner = "alex";
+      group = "users";
+    };
+
     "alex.pinwheel-backwards" = {
       file = ../../../../secrets/pinwheel/alex.pinwheel-backwards.age;
       path = "/home/alex/.ssh/alex.pinwheel-backwards";
@@ -72,19 +106,6 @@
       group = "users";
     };
 
-    "alex.pinwheel-codeberg.org" = {
-      file = ../../../../secrets/pinwheel/alex.pinwheel-codeberg.org.age;
-      path = "/home/alex/.ssh/alex.pinwheel-codeberg.org";
-      owner = "alex";
-      group = "users";
-    };
-    "alex.pinwheel-codeberg.org.pub" = {
-      file = ../../../../secrets/pinwheel/alex.pinwheel-codeberg.org.pub.age;
-      path = "/home/alex/.ssh/alex.pinwheel-codeberg.org.pub";
-      owner = "alex";
-      group = "users";
-    };
-
     "alex.pinwheel-git.ppp.pm" = {
       file = ../../../../secrets/pinwheel/alex.pinwheel-git.ppp.pm.age;
       path = "/home/alex/.ssh/alex.pinwheel-git.ppp.pm";
@@ -98,19 +119,6 @@
       group = "users";
     };
 
-    "alex.pinwheel-andromeda" = {
-      file = ../../../../secrets/pinwheel/alex.pinwheel-andromeda.age;
-      path = "/home/alex/.ssh/alex.pinwheel-andromeda";
-      owner = "alex";
-      group = "users";
-    };
-    "alex.pinwheel-andromeda.pub" = {
-      file = ../../../../secrets/pinwheel/alex.pinwheel-andromeda.pub.age;
-      path = "/home/alex/.ssh/alex.pinwheel-andromeda.pub";
-      owner = "alex";
-      group = "users";
-    };
-
     "alex.pinwheel-tadpole" = {
       file = ../../../../secrets/pinwheel/alex.pinwheel-tadpole.age;
       path = "/home/alex/.ssh/alex.pinwheel-tadpole";

hosts/pinwheel/modules/syncthing/default.nix

@@ -16,6 +16,7 @@
       devices = {
         phone.id = config.lib.syncthing.phone;
         backwards.id = config.lib.syncthing.backwards;
+        manatee.id = config.lib.syncthing.manatee;
       };
 
       folders = {
@@ -24,6 +25,7 @@
           devices = [
             "phone"
             "backwards"
+            "manatee"
           ];
           versioning = {
             type = "staggered";
@@ -56,7 +58,7 @@
         };
 
         books = {
-          path = "/home/alex/sync/books";
+          path = "/home/alex/sync/reading-material/books";
           devices = [ "backwards" ];
           versioning = {
             type = "staggered";

hosts/pinwheel/modules/tmux/default.nix

@@ -18,7 +18,7 @@
         # https://old.reddit.com/r/tmux/comments/mesrci/tmux_2_doesnt_seem_to_use_256_colors/
         set -g default-terminal "xterm-256color"
         set -ga terminal-overrides ",*256col*:Tc"
-        set -ga terminal-overrides "*:Ss=\E[%p1%d q:Se=\E[ q"
+        set -ga terminal-overrides ',*:Ss=\E[%p1%d q:Se=\E[ q'
         set-environment -g COLORTERM "truecolor"
 
         set-option -g allow-rename off

hosts/pinwheel/modules/vim/default.nix

@@ -18,7 +18,7 @@ in
     };
 
     programs.git = lib.mkIf gitEnabled {
-      extraConfig = {
+      settings = {
         core = {
           editor = "vim";
         };

hosts/pinwheel/modules/vm/default.nix

@@ -17,7 +17,10 @@ in
   config = lib.mkIf enabled {
     virtualisation = {
       spiceUSBRedirection.enable = true; # Allow redirecting USB to the VM
-      libvirtd.enable = true;
+      libvirtd = {
+        enable = true;
+        qemu.vhostUserPackages = [ pkgs.virtiofsd ];
+      };
     };
 
     users.users.alex = {

hosts/pinwheel/modules/waybar/default.nix

@@ -7,14 +7,14 @@
 let
   hyprlandEnabled = config.mod.hyprland.enable;
 
-  spotify-status = pkgs.writeShellScript "spotify-status" ''
+  music-status = pkgs.writeShellScript "music-status" ''
-    STATUS=$(${pkgs.playerctl}/bin/playerctl -p spotify status 2>&1)
+    STATUS=$(${pkgs.playerctl}/bin/playerctl -p naviterm,spotify status 2>&1)
 
     if [ "$STATUS" = "No players found" ]; then
       echo ""
     else
       FORMAT="{{markup_escape(xesam:title)}} - {{markup_escape(xesam:artist)}}"
-      OUTPUT=$(${pkgs.playerctl}/bin/playerctl -p spotify metadata --format "$FORMAT")
+      OUTPUT=$(${pkgs.playerctl}/bin/playerctl -p naviterm,spotify metadata --format "$FORMAT")
       case "$STATUS" in
         "Playing")
           echo "<span font='14' rise='-3000'></span> $OUTPUT"
@@ -40,58 +40,70 @@ let
     fi
   '';
 
-  mullvad = pkgs.writeShellScript "mullvad" ''
+  tailscale = pkgs.writeShellScript "tailscale" ''
-    STATUS_DISCONNECTING="Disconnecting"
+    STATUS_STOPPED="Tailscale is stopped."
-    STATUS_DISCONNECTED="Disconnected"
-    STATUS_CONNECTING="Connecting"
-    STATUS_CONNECTED="Connected"
-
-    status() {
-      STATUS=$(${pkgs.mullvad}/bin/mullvad status | ${pkgs.gawk}/bin/awk 'NR==1{print $1}')
-      echo $STATUS
-    }
 
     output() {
-      case $(status) in
+      STATUS=$(tailscale status)
-        $STATUS_DISCONNECTED)
+
-          echo '{ "text": "", "class": "disconnected" }' ;;
+      case $STATUS in
-        $STATUS_CONNECTING)
+        $STATUS_STOPPED)
-          echo '{ "text": "", "tooltip": "Connecting", "class": "disconnected" }' ;;
+          echo '{ "text": "", "class": "disconnected" }' ;;
-        $STATUS_CONNECTED)
-          TOOLTIP=$(${pkgs.mullvad}/bin/mullvad status | ${pkgs.gawk}/bin/awk 'NR==1')
-          echo "{ \"text\": \"\", \"tooltip\":\"$TOOLTIP\" }" ;;
-        $STATUS_DISCONNECTING)
-          echo '{ "text": "", "tooltip": "Disconnecting", "class": "disconnected" }' ;;
         *)
-          echo '{ "text": "", "tooltip": "Status unknown", "class": "disconnected" }' ;;
+          EXIT_NODE=$(tailscale status --json | ${pkgs.jq}/bin/jq .ExitNodeStatus)
+
+          EXIT_NODE_ONLINE=$(echo $EXIT_NODE | ${pkgs.jq}/bin/jq .Online)
+          if [ "$EXIT_NODE_ONLINE" == "null" ]; then
+            echo '{ "text": "", "class": "disconnected" }'
+            exit 0
+          fi
+
+          EXIT_NODE_ID=$(echo $EXIT_NODE | ${pkgs.jq}/bin/jq .ID)
+          EXIT_NODE_NAME=$(tailscale status --json | ${pkgs.jq}/bin/jq ".Peer.[] | select(.ID == $EXIT_NODE_ID) | .HostName")
+          echo "{ \"text\": \"\", \"tooltip\": $EXIT_NODE_NAME }"
+          ;;
       esac
     }
 
-    toggle() {
+    toggle-exit-node() {
-      CURRENT_STATUS=$(status)
+      PREFERRED_EXIT_NODE=$(${pkgs.coreutils}/bin/cat ${config.age.secrets.tailscale-preferred-exit-node.path})
 
-      case "$CURRENT_STATUS" in
+      EXIT_NODE_ONLINE=$(tailscale status --json | ${pkgs.jq}/bin/jq .ExitNodeStatus.Online)
-        $STATUS_DISCONNECTED)
+      if [ "$EXIT_NODE_ONLINE" == "true" ]; then
-          ${pkgs.mullvad}/bin/mullvad connect --wait > /dev/null && ${pkgs.libnotify}/bin/notify-send "Connected to VPN";;
+        tailscale set --exit-node="" && ${pkgs.libnotify}/bin/notify-send "Disconnected from Exit Node"
-        $STATUS_CONNECTED)
+      else
-          ${pkgs.mullvad}/bin/mullvad disconnect --wait > /dev/null && ${pkgs.libnotify}/bin/notify-send "Disconnected from VPN";;
+        tailscale set --exit-node=$PREFERRED_EXIT_NODE && ${pkgs.libnotify}/bin/notify-send "Connected to Exit Node"
-      esac
+      fi
     }
 
     case $1 in
-      --toggle)
+      --toggle-exit-node)
-          toggle ;;
+        toggle-exit-node ;;
       --output)
         output ;;
     esac
   '';
 
   work-vpn-status = pkgs.writeShellScript "work-vpn-status" ''
-    STAGING=$(systemctl is-active openvpn-work-staging.service)
+    ACTIVE_ENVS=""
-    [ "$STAGING" == "active" ] && echo "WORK-VPN STAGING ON" && exit 0
 
-    PRODUCTION=$(systemctl is-active openvpn-work-production.service)
+    STAGING_STATUS=$(systemctl is-active openvpn-work-staging.service)
-    [ "$PRODUCTION" == "active" ] && echo "WORK-VPN PRODUCTION ON" && exit 0
+    if [ "$STAGING_STATUS" == "active" ]; then
+        ACTIVE_ENVS="S"
+    fi
+
+    PRODUCTION_STATUS=$(systemctl is-active openvpn-work-production.service)
+    if [ "$PRODUCTION_STATUS" == "active" ]; then
+        if [ -n "$ACTIVE_ENVS" ]; then
+            ACTIVE_ENVS="$ACTIVE_ENVS&amp;P"
+        else
+            ACTIVE_ENVS="P"
+        fi
+    fi
+
+    if [ -n "$ACTIVE_ENVS" ]; then
+        echo "WORK-VPN $ACTIVE_ENVS ON"
+    fi
   '';
 
   toggle-bt-power = pkgs.writeShellScript "toggle-bt-power" ''
@@ -128,12 +140,12 @@ in
           modules-left = lib.mkIf hyprlandEnabled [ "hyprland/workspaces" ];
           modules-right = [
             "custom/work-vpn-status"
-            "custom/spotify"
+            "custom/music"
             "custom/container-status"
             "custom/dunst"
-            "custom/mullvad"
             "bluetooth"
             "wireplumber"
+            "custom/tailscale"
             "network"
             "battery"
             "clock"
@@ -141,12 +153,12 @@ in
 
           "custom/work-vpn-status" = {
             exec = "${work-vpn-status}";
-            interval = 1;
+            interval = 2;
           };
 
-          "custom/spotify" = {
+          "custom/music" = {
-            exec = spotify-status;
+            exec = music-status;
-            interval = 1;
+            interval = 2;
             max-length = 70;
             tooltip = false;
           };
@@ -154,21 +166,21 @@ in
           "custom/container-status" = {
             exec = "${container-status}";
             return-type = "json";
-            interval = 1;
+            interval = 2;
           };
 
           "custom/dunst" = {
             exec = notifications-status;
             on-click-right = "${pkgs.dunst}/bin/dunstctl set-paused toggle";
-            interval = 1;
+            interval = 2;
             tooltip = false;
           };
 
-          "custom/mullvad" = {
+          "custom/tailscale" = {
-            exec = "${mullvad} --output";
+            exec = "${tailscale} --output";
             return-type = "json";
-            on-click-right = "${mullvad} --toggle";
+            on-click-right = "${tailscale} --toggle-exit-node";
-            interval = 1;
+            interval = 2;
           };
 
           bluetooth = {
@@ -224,7 +236,10 @@ in
           height = 30;
           spacing = 20;
           fixed-center = false;
-          output = [ "HDMI-A-1" ];
+          output = [
+            "HDMI-A-1"
+            "DP-3"
+          ];
 
           modules-left = lib.mkIf hyprlandEnabled [ "hyprland/workspaces" ];
           modules-right = [
@@ -234,7 +249,7 @@ in
 
           "custom/work-vpn-status" = {
             exec = "${work-vpn-status}";
-            interval = 1;
+            interval = 2;
           };
 
           "clock" = {
@@ -279,7 +294,11 @@ in
           color: #${config.lib.colors.warning};
         }
 
-        #custom-mullvad.disconnected {
+        #custom-tailscale {
+          font-size: 30px;
+        }
+
+        #custom-tailscale.disconnected {
           color: #${config.lib.colors.warning};
         }
 
@@ -298,4 +317,12 @@ in
       '';
     };
   };
+
+  age.secrets = {
+    "tailscale-preferred-exit-node" = {
+      file = ../../../../secrets/pinwheel/tailscale-preferred-exit-node.age;
+      owner = "alex";
+      group = "users";
+    };
+  };
 }

hosts/pinwheel/modules/work/default.nix

@@ -1,4 +1,5 @@
 {
+  inputs,
   pkgs,
   lib,
   config,
@@ -11,33 +12,80 @@ let
 in
 {
   home-manager.users.alex = {
+    # Ensure bashInteractive is first in PATH inside nix devshells.
+    # stdenv provides a non-interactive bash that breaks Copilot shell commands.
+    # Adding bashInteractive to home.packages alone isn't enough because devshell
+    # packages are prepended to PATH. This precmd hook runs after direnv's hook
+    # and re-prepends bashInteractive so it takes priority.
+    programs.zsh.initContent = ''
+      _ensure_bash_interactive() {
+        [[ "$PATH" == "${pkgs.bashInteractive}/bin:"* ]] || export PATH="${pkgs.bashInteractive}/bin:$PATH"
+      }
+      precmd_functions+=(_ensure_bash_interactive)
+    '';
+
+    # Configure IntelliJ to exclude .direnv from indexing
+    home.activation.intellijIgnoreDirenv = ''
+      for idea_config in $HOME/.config/JetBrains/IntelliJIdea*; do
+        if [ -d "$idea_config" ]; then
+          $DRY_RUN_CMD mkdir -p "$idea_config/options"
+          $DRY_RUN_CMD tee "$idea_config/options/filetypes.xml" > /dev/null <<'EOF'
+<application>
+  <component name="FileTypeManager" version="18">
+    <ignoreFiles list="*.pyc;*.pyo;*.rbc;*.yarb;*~;.DS_Store;.git;.hg;.svn;CVS;__pycache__;_svn;vssver.scc;vssver2.scc;.direnv" />
+  </component>
+</application>
+EOF
+        fi
+      done
+    '';
+
     home.sessionVariables = {
       GITHUB_ACTOR = "Alexander Heldt";
       GITHUB_TOKEN = "$(${pkgs.coreutils}/bin/cat ${config.age.secrets.work-github-token.path})";
     };
 
     home.packages = [
-      (pkgs.callPackage ./syb-cli.nix { })
+      # (pkgs.callPackage ./pants.nix { inherit (pkgs) stdenv.hostPlatform.system; })
+      # (pkgs.callPackage ./syb-cli.nix { })
+
+      (inputs.nix-jetbrains-plugins.lib.buildIdeWithPlugins pkgs "idea" [
+        "IdeaVIM"
+        "com.github.copilot"
+      ])
+      pkgs.bashInteractive
 
-      (pkgs.jetbrains.plugins.addPlugins pkgs.jetbrains.idea-ultimate [ "ideavim" ])
       (pkgs.google-cloud-sdk.withExtraComponents [
         pkgs.google-cloud-sdk.components.gke-gcloud-auth-plugin
       ])
-      (pkgs.graphite-cli.overrideAttrs (_: {
+
-        version = "1.4.3";
+      pkgs.graphite-cli
-      }))
-      pkgs.xdg-utils # needed by graphite-cli
 
       pkgs.postman
       pkgs.grpcurl
 
+      pkgs.slack
+
       # for `radio`
       pkgs.go-mockery
       pkgs.golangci-lint
+
+      (pkgs.writeShellScriptBin "work-vpn" ''
+        case $1 in
+          up)
+            sudo sh -c "systemctl start openvpn-work-staging.service; systemctl start openvpn-work-production.service"
+            ;;
+          down)
+            sudo sh -c "systemctl stop openvpn-work-staging.service; systemctl stop openvpn-work-production.service"
+            ;;
+        esac
+      '')
     ];
 
     programs.go = lib.mkIf goEnabled {
-      goPrivate = [ "$(${pkgs.coreutils}/bin/cat ${config.age.secrets.work-go-private.path})" ];
+      env = {
+        GOPRIVATE = [ "$(${pkgs.coreutils}/bin/cat ${config.age.secrets.work-go-private.path})" ];
+      };
     };
 
     programs.git = lib.mkIf gitEnabled {
@@ -50,6 +98,13 @@ in
     };
   };
 
+  # Needed for `copilot`
+  programs.nix-ld.enable = true;
+  programs.nix-ld.libraries = [
+    pkgs.stdenv.cc.cc.lib
+    pkgs.zlib
+  ];
+
   services.openvpn.servers = lib.mkIf openvpnEnabled {
     work-staging = {
       config = "config ${config.age.secrets.work-staging-ovpn.path}";

hosts/pinwheel/modules/work/pants.nix

@@ -0,0 +1,68 @@
+{
+  pkgs,
+  lib,
+  ...
+}:
+let
+  version = "0.12.0";
+
+  if_let = v: p: if lib.attrsets.matchAttrs p v then v else null;
+  match =
+    v: l: builtins.elemAt (lib.lists.findFirst (x: (if_let v (builtins.elemAt x 0)) != null) null l) 1;
+
+  package = match { platform = pkgs.stdenv.hostPlatform.system; } [
+    [
+      { platform = "aarch64-linux"; }
+      {
+        url = "https://github.com/pantsbuild/scie-pants/releases/download/v${version}/scie-pants-linux-aarch64";
+        hash = lib.fakeSha256;
+      }
+    ]
+    [
+      { platform = "x86_64-linux"; }
+      {
+        url = "https://github.com/pantsbuild/scie-pants/releases/download/v${version}/scie-pants-linux-x86_64";
+        hash = "sha256-9PjgobndxVqDTYGtw1HESrtzwzH2qE9zFwR26xtwZrM=";
+      }
+    ]
+    [
+      { platform = "aarch64-darwin"; }
+      {
+        url = "https://github.com/pantsbuild/scie-pants/releases/download/v${version}/scie-pants-macos-aarch64";
+        hash = "sha256-1Ha8GAOl7mWVunGKf7INMjar+jnLXaDEPStqE+kK3D4=";
+      }
+    ]
+  ];
+
+  unpatched = pkgs.stdenv.mkDerivation {
+    name = "scie-pants";
+    version = version;
+    sourceRoot = ".";
+    phases = [
+      "installPhase"
+      "patchPhase"
+    ];
+
+    src = pkgs.fetchurl package;
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/bin
+      cp $src $out/bin/pants
+      chmod +x $out/bin/pants
+
+      runHook postInstall
+    '';
+  };
+
+  patched = pkgs.buildFHSEnv {
+    name = "pants";
+    targetPackages = [ pkgs.python39 ];
+    runScript = "${unpatched}/bin/pants";
+    profile = ''
+      export NIX_SSL_CERT_FILE="/etc/ssl/certs/ca-certificates.crt"
+      export SSL_CERT_FILE="/etc/ssl/certs/ca-bundle.crt"
+    '';
+  };
+in
+if pkgs.stdenv.isDarwin then unpatched else patched

hosts/pinwheel/modules/zsh/default.nix

@@ -54,7 +54,7 @@ in
           }
         ];
 
-        initExtra = lib.strings.concatStringsSep "\n" [
+        initContent = lib.strings.concatStringsSep "\n" [
           "export KEYTIMEOUT=1"
           "bindkey -v '^?' backward-delete-char"
           "bindkey '^a' beginning-of-line"

hosts/tadpole/modules/age/default.nix

@@ -8,7 +8,7 @@
     };
 
     environment.systemPackages = [
-      inputs.agenix.packages."${pkgs.system}".default
+      inputs.agenix.packages."${pkgs.stdenv.hostPlatform.system}".default
     ];
   };
 }

hosts/tadpole/modules/certs/default.nix

@@ -1,16 +1,35 @@
 { ... }:
 {
   security.acme = {
+    acceptTerms = true;
+
+    defaults = {
+      email = "acme@ppp.pm";
+    };
+
     certs = {
       "ppp.pm" = {
         webroot = "/var/lib/acme/acme-challenge/";
-        email = "p@ppp.pm";
         group = "nginx";
       };
 
       "git.ppp.pm" = {
         webroot = "/var/lib/acme/acme-challenge/";
-        email = "p@ppp.pm";
+        group = "nginx";
+      };
+
+      "whib.ppp.pm" = {
+        webroot = "/var/lib/acme/acme-challenge/";
+        group = "nginx";
+      };
+
+      "api.whib.ppp.pm" = {
+        webroot = "/var/lib/acme/acme-challenge/";
+        group = "nginx";
+      };
+
+      "grafana.whib.ppp.pm" = {
+        webroot = "/var/lib/acme/acme-challenge/";
         group = "nginx";
       };
     };

hosts/tadpole/modules/default.nix

@@ -22,6 +22,8 @@ in
       };
 
       pppdotpm-site.enable = true;
+      whib-backend.enable = true;
+      whib-frontend.enable = true;
     };
   };
 }

hosts/tadpole/modules/gitea/default.nix

@@ -7,8 +7,6 @@
 let
   conf = config.mod.gitea;
   gitDomain = "git.${conf.baseDomain}";
-
-  nginxEnable = config.mod.nginx.enable;
 in
 {
   options = {
@@ -37,20 +35,16 @@ in
     };
   };
 
-  config = lib.mkIf (conf.enable && nginxEnable) {
+  config = lib.mkIf conf.enable {
     assertions = [
+      {
+        assertion = config.services.nginx.enable;
+        message = "Option 'config.services.nginx' must be enabled";
+      }
       {
         assertion = conf.baseDomain != "";
         message = "Option 'mod.gitea.baseDomain' cannot be empty";
       }
-      {
-        assertion = builtins.hasAttr gitDomain config.security.acme.certs;
-        message = "There is no cert configured for ${gitDomain} used by gitea";
-      }
-      {
-        assertion = conf.webfingerEnable && builtins.hasAttr conf.baseDomain config.security.acme.certs;
-        message = "There is no cert configured for ${conf.baseDomain} used by webfinger";
-      }
       {
         assertion = conf.webfingerEnable && conf.webfingerAccounts != [ ];
         message = "Option 'mod.gitea.webfingerAccounts' cannot be empty";
@@ -70,6 +64,11 @@ in
           ROOT_URL = "https://${gitDomain}";
 
           SSH_PORT = 1122; # see `ssh` module
+          HTTP_PORT = 3001;
+        };
+
+        oauth2 = {
+          JWT_CLAIM_ISSUER = "https://${gitDomain}/";
         };
 
         database = {
@@ -129,7 +128,7 @@ in
         useACMEHost = gitDomain;
 
         locations."/" = {
-          proxyPass = "http://0.0.0:3000";
+          proxyPass = "http://0.0.0.0:3001";
           proxyWebsockets = true;
         };
       };

hosts/tadpole/modules/nginx/default.nix

@@ -10,16 +10,6 @@ in
   };
 
   config = lib.mkIf enabled {
-    security = {
-      acme = {
-        acceptTerms = true;
-
-        defaults = {
-          email = "p@ppp.pm";
-        };
-      };
-    };
-
     services = {
       nginx = {
         enable = true;

hosts/tadpole/modules/ppp.pm-site/default.nix

@@ -6,8 +6,6 @@
 }:
 let
   enabled = config.mod.pppdotpm-site.enable;
-
-  nginxEnabled = config.mod.nginx.enable;
 in
 {
   imports = [ inputs.pppdotpm-site.nixosModules.default ];
@@ -18,7 +16,14 @@ in
     };
   };
 
-  config = lib.mkIf (enabled && nginxEnabled) {
+  config = lib.mkIf enabled {
+    assertions = [
+      {
+        assertion = config.services.nginx.enable;
+        message = "Option 'config.services.nginx' must be enabled";
+      }
+    ];
+
     services.pppdotpm-site = {
       enable = true;
       domain = "ppp.pm";

hosts/tadpole/modules/ssh/default.nix

@@ -28,9 +28,17 @@ in
             identityFile = "/home/alex/.ssh/alex.tadpole-git.ppp.pm";
           };
 
-          "codeberg.org" = {
+          "*" = {
-            hostname = "codeberg.org";
+            forwardAgent = false;
-            identityFile = "/home/alex/.ssh/alex.tadpole-codeberg.org";
+            addKeysToAgent = "no";
+            compression = false;
+            serverAliveInterval = 0;
+            serverAliveCountMax = 3;
+            hashKnownHosts = false;
+            userKnownHostsFile = "~/.ssh/known_hosts";
+            controlMaster = "no";
+            controlPath = "~/.ssh/master-%r@%n:%p";
+            controlPersist = "no";
           };
         };
       };
@@ -101,19 +109,6 @@ in
         owner = "alex";
         group = "users";
       };
-
-      "alex.tadpole-codeberg.org" = {
-        file = ../../../../secrets/tadpole/alex.tadpole-codeberg.org.age;
-        path = "/home/alex/.ssh/alex.tadpole-codeberg.org";
-        owner = "alex";
-        group = "users";
-      };
-      "alex.tadpole-codeberg.org.pub" = {
-        file = ../../../../secrets/tadpole/alex.tadpole-codeberg.org.pub.age;
-        path = "/home/alex/.ssh/alex.tadpole-codeberg.org.pub";
-        owner = "alex";
-        group = "users";
-      };
     };
   };
 }

hosts/tadpole/modules/whib/default.nix

@@ -0,0 +1,79 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  backendEnabled = config.mod.whib-backend.enable;
+  frontendEnabled = config.mod.whib-frontend.enable;
+in
+{
+  options = {
+    mod.whib-backend = {
+      enable = lib.mkEnableOption "enable WHIB backend";
+    };
+
+    mod.whib-frontend = {
+      enable = lib.mkEnableOption "enable WHIB frontend";
+    };
+  };
+
+  config = {
+    assertions = [
+      {
+        assertion = backendEnabled && config.services.nginx.enable;
+        message = "Option 'config.services.nginx' must be enabled";
+      }
+    ];
+
+    services = {
+      whib-backend = lib.mkIf backendEnabled {
+        enable = true;
+
+        backend = {
+          domain = "api.whib.ppp.pm";
+          useACMEHost = "api.whib.ppp.pm";
+
+          environmentFile = config.age.secrets.whib-backend-env-vars.path;
+        };
+
+        postgres = {
+          environmentFile = config.age.secrets.whib-postgres-env-vars.path;
+
+          backup = {
+            interval = "*-*-* 00:00:00 UTC";
+
+            environmentFile = config.age.secrets.whib-postgres-backup-env-vars.path;
+            gpgPassphraseFile = config.age.secrets.whib-gpg-key.path;
+          };
+        };
+
+        grafana = {
+          domain = "grafana.whib.ppp.pm";
+          useACMEHost = "grafana.whib.ppp.pm";
+
+          environmentFile = config.age.secrets.whib-grafana-env-vars.path;
+        };
+      };
+
+      whib-frontend = lib.mkIf frontendEnabled {
+        enable = true;
+
+        domain = "whib.ppp.pm";
+        useACMEHost = "whib.ppp.pm";
+        backendHost = "https://api.whib.ppp.pm";
+      };
+    };
+
+    age.secrets = {
+      "whib-backend-env-vars".file = ../../../../secrets/tadpole/whib-backend-env-vars.age;
+      "whib-postgres-env-vars".file = ../../../../secrets/tadpole/whib-postgres-env-vars.age;
+
+      "whib-postgres-backup-env-vars".file =
+        ../../../../secrets/tadpole/whib-postgres-backup-env-vars.age;
+      "whib-gpg-key".file = ../../../../secrets/tadpole/whib-gpg-key.age;
+
+      "whib-grafana-env-vars".file = ../../../../secrets/tadpole/whib-grafana-env-vars.age;
+    };
+  };
+}

hosts/test-vm/configuration.nix

@@ -2,6 +2,8 @@
 {
   imports = [
     ./ppp.pm-site.nix
+    ./whib-backend.nix
+    ./whib-frontend.nix
   ];
 
   config = {
@@ -10,7 +12,9 @@
     networking.hostName = "test-vm";
 
     mod = {
-      pppdotpm-site.enable = true;
+      pppdotpm-site.enable = false;
+      whib-backend.enable = true;
+      whib-frontend.enable = true;
     };
 
     users.users.a = {
@@ -18,16 +22,30 @@
       extraGroups = [ "wheel" ];
       password = "a";
     };
+    services.getty.autologinUser = "a";
+    security.sudo.wheelNeedsPassword = false;
 
     virtualisation.vmVariant = {
-      # following configuration is added only when building VM with build-vm
+      # following configuration is added only when building VM the *first* time with `build-vm`
       virtualisation = {
+        diskSize = 8192;
         memorySize = 2048;
         cores = 3;
         graphics = false;
       };
     };
 
+    # Resize terminal to host terminal size
+    environment.loginShellInit = ''
+      ${pkgs.xterm}/bin/resize
+
+      echo alias 'sd' can be used to shutdown the VM
+    '';
+
+    environment.interactiveShellInit = ''
+      alias sd='sudo shutdown now'
+    '';
+
     environment.systemPackages = [ ];
 
     system.stateVersion = "24.05";

hosts/test-vm/whib-backend.nix

@@ -0,0 +1,124 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  enabled = config.mod.whib-backend.enable;
+in
+{
+  options = {
+    mod.whib-backend = {
+      enable = lib.mkEnableOption "enable WHIB backend";
+    };
+  };
+
+  config = lib.mkIf enabled {
+    services.whib-backend =
+      let
+        backendEnvVars = pkgs.writeText "backend-env-vars" ''
+          SIGNING_KEY=signingkey
+          POSTGRES_DB=whib
+          POSTGRES_USER=whib
+          POSTGRES_PASSWORD=pgpassword
+        '';
+
+        postgresEnvVars = pkgs.writeText "postgres-env-vars" ''
+          POSTGRES_DB=whib
+          POSTGRES_USER=whib
+          POSTGRES_PASSWORD=pgpassword
+        '';
+
+        postgresBackupEnvVars = pkgs.writeText "postgres-backup-env-vars" ''
+          PGDATABASE=whib
+          PGUSER=whib
+          PGPASSWORD=pgpassword
+          B2_BUCKET=a
+          B2_APPLICATION_KEY_ID=b
+          B2_APPLICATION_KEY=c
+        '';
+
+        gpgPassphraseFile = pkgs.writeText "gpg-passphrase" ''
+          foobar
+        '';
+
+        grafanaEnvVars = pkgs.writeText "grafana-env-vars" ''
+          GF_SECURITY_ADMIN_PASSWORD=grafanapassword
+          GF_USERS_ALLOW_SIGN_UP=false
+        '';
+
+      in
+      {
+        enable = true;
+
+        backend = {
+          domain = "whib-backend.local";
+
+          environmentFile = backendEnvVars;
+        };
+
+        postgres = {
+          environmentFile = postgresEnvVars;
+
+          backup = {
+            interval = "*-*-* *:*:00 UTC"; # Every minute, for testing
+
+            environmentFile = postgresBackupEnvVars;
+            gpgPassphraseFile = gpgPassphraseFile;
+
+          };
+        };
+
+        grafana = {
+          domain = "grafana.local";
+
+          environmentFile = grafanaEnvVars;
+        };
+      };
+
+    virtualisation.vmVariant = {
+      virtualisation = {
+        sharedDirectories = {
+          my-shared = {
+            source = "/home/alex/whib-backup";
+            target = "/mnt/shared";
+          };
+        };
+
+        forwardPorts = [
+          {
+            # Service API
+            from = "host";
+            host.port = 8080;
+            guest.port = 8080;
+          }
+          {
+            # Service Metrics
+            from = "host";
+            host.port = 8181;
+            guest.port = 8181;
+          }
+          {
+            # Postgres
+            from = "host";
+            host.port = 5432;
+            guest.port = 5432;
+          }
+          {
+            # Grafana
+            from = "host";
+            host.port = 3000;
+            guest.port = 3000;
+          }
+          {
+            # Prometheus
+            from = "host";
+            host.port = 9090;
+            guest.port = 9090;
+          }
+        ];
+      };
+    };
+  };
+}

hosts/test-vm/whib-frontend.nix

@@ -0,0 +1,35 @@
+{ lib, config, ... }:
+let
+  enabled = config.mod.whib-frontend.enable;
+in
+{
+  options = {
+    mod.whib-frontend = {
+      enable = lib.mkEnableOption "enable WHIB backend";
+    };
+  };
+
+  config = lib.mkIf enabled {
+    services.whib-frontend = {
+      enable = true;
+
+      domain = "whib-frontend.local";
+      port = "8081";
+      # backendHost = "https://api.whib.ppp.pm/";
+      backendHost = "http://localhost:8080";
+    };
+
+    virtualisation.vmVariant = {
+      virtualisation = {
+        forwardPorts = [
+          {
+            # Service API
+            from = "host";
+            host.port = 8081;
+            guest.port = 8081;
+          }
+        ];
+      };
+    };
+  };
+}

secrets/backwards/alex.backwards-codeberg.org.pub.age

@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 Pu0HWg eK/pdhmsF334C7rSuYsRnXCtenmlT2hOXpfW5CQEARY
-odooTLu8ZQUZjCeVPZYOA6Vgb470cosE1Q1iBkE9Kc0
--> ssh-ed25519 +oNaHQ nJU52SSZ9v3+8NuXR6coSHosEYrs7T8GeZYzV/quOU4
-IV5YduRGdJLy93gVwfYmwvldRXoXXX3QvAsH3ljBadw
---- 3gJg9NFmqHCrgcvgnYOeSY1H4klPEyzI+07IlKCOItc
- ¦Ì\5çܤ‰}õyñÐáAý_J§