manatee: Remove calibre-web module

Add a homepage module that generates a static landing page served on
port 9999 via nginx. Each service module registers itself via the shared
mod.homepage.services option, so enabling a module automatically adds
it to the page.

flake.lock

@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769428758,
-        "narHash": "sha256-0G/GzF7lkWs/yl82bXuisSqPn6sf8YGTnbEdFOXvOfU=",
+        "lastModified": 1770895474,
+        "narHash": "sha256-JBcrq1Y0uw87VZdYsByVbv+GBuT6ECaCNb9txLX9UuU=",
         "owner": "hyprwm",
         "repo": "aquamarine",
-        "rev": "def5e74c97370f15949a67c62e61f1459fcb0e15",
+        "rev": "a494d50d32b5567956b558437ceaa58a380712f7",
         "type": "github"
       },
       "original": {
@@ -106,11 +106,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1770572136,
-        "narHash": "sha256-Wd3UOebU9KWMCbynRSG1Igf94eQ+RlFpKYFMNCpOuVw=",
+        "lastModified": 1771057865,
+        "narHash": "sha256-Suny75DfQS3Mqd8ihiDZNsRs4CfRC3GiQDMmaFPj2qM=",
         "owner": "nix-community",
         "repo": "emacs-overlay",
-        "rev": "67691b5ce5e15a32cf3733c42b44ce067a0a8c72",
+        "rev": "56690eb79372e49054b0c2b87780fe3f86be7616",
         "type": "github"
       },
       "original": {
@@ -219,11 +219,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770491427,
-        "narHash": "sha256-8b+0vixdqGnIIcgsPhjdX7EGPdzcVQqYxF+ujjex654=",
+        "lastModified": 1771037579,
+        "narHash": "sha256-NX5XuhGcsmk0oEII2PEtMRgvh2KaAv3/WWQsOpxAgR4=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "cbd8a72e5fe6af19d40e2741dc440d9227836860",
+        "rev": "05e6dc0f6ed936f918cb6f0f21f1dad1e4c53150",
         "type": "github"
       },
       "original": {
@@ -277,11 +277,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769284023,
-        "narHash": "sha256-xG34vwYJ79rA2wVC8KFuM8r36urJTG6/csXx7LiiSYU=",
+        "lastModified": 1770511807,
+        "narHash": "sha256-suKmSbSk34uPOJDTg/GbPrKEJutzK08vj0VoTvAFBCA=",
         "owner": "hyprwm",
         "repo": "hyprgraphics",
-        "rev": "13c536659d46893596412d180449353a900a1d31",
+        "rev": "7c75487edd43a71b61adb01cae8326d277aab683",
         "type": "github"
       },
       "original": {
@@ -309,11 +309,11 @@
         "xdph": "xdph"
       },
       "locked": {
-        "lastModified": 1770470830,
-        "narHash": "sha256-6Nh0HrMoM7wdCpByaBDMo2fvndlrCZke2VNp69gX0G0=",
+        "lastModified": 1771026735,
+        "narHash": "sha256-vIzZ1Pb1o9xOXwGTdr09vRwGFgD/II6ZnGpnCfl8zz8=",
         "owner": "hyprwm",
         "repo": "Hyprland",
-        "rev": "f68ac7ef7589e1536d438f7fbfb3ad987538fe0f",
+        "rev": "e80f705d76d4dbe836e0f57aadea994a624ac63e",
         "type": "github"
       },
       "original": {
@@ -329,11 +329,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768426687,
-        "narHash": "sha256-CopNx3j//gZ2mE0ggEK9dZ474UcbDhpTw+KMor8mSxI=",
+        "lastModified": 1770889987,
+        "narHash": "sha256-JPbwE1Yg5t9zrMcOyDQwl1Pd8e0J1dtZf3kGnC7udwQ=",
         "owner": "hyprwm",
         "repo": "contrib",
-        "rev": "541628cebe42792ddf5063c4abd6402c2f1bd68f",
+        "rev": "8fdd69edefed16c9ab395b433a1c3323d5633f30",
         "type": "github"
       },
       "original": {
@@ -506,11 +506,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766253372,
-        "narHash": "sha256-1+p4Kw8HdtMoFSmJtfdwjxM4bPxDK9yg27SlvUMpzWA=",
+        "lastModified": 1770139857,
+        "narHash": "sha256-bCqxcXjavgz5KBJ/1CBLqnagMMf9JvU1m9HmYVASKoc=",
         "owner": "hyprwm",
         "repo": "hyprutils",
-        "rev": "51a4f93ce8572e7b12b7284eb9e6e8ebf16b4be9",
+        "rev": "9038eec033843c289b06b83557a381a2648d8fa5",
         "type": "github"
       },
       "original": {
@@ -531,11 +531,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763640274,
-        "narHash": "sha256-Uan1Nl9i4TF/kyFoHnTq1bd/rsWh4GAK/9/jDqLbY5A=",
+        "lastModified": 1770501770,
+        "narHash": "sha256-NWRM6+YxTRv+bT9yvlhhJ2iLae1B1pNH3mAL5wi2rlQ=",
         "owner": "hyprwm",
         "repo": "hyprwayland-scanner",
-        "rev": "f6cf414ca0e16a4d30198fd670ec86df3c89f671",
+        "rev": "0bd8b6cde9ec27d48aad9e5b4deefb3746909d40",
         "type": "github"
       },
       "original": {
@@ -560,11 +560,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769202094,
-        "narHash": "sha256-gdJr/vWWLRW85ucatSjoBULPB2dqBJd/53CZmQ9t91Q=",
+        "lastModified": 1770203293,
+        "narHash": "sha256-PR/KER+yiHabFC/h1Wjb+9fR2Uy0lWM3Qld7jPVaWkk=",
         "owner": "hyprwm",
         "repo": "hyprwire",
-        "rev": "a45ca05050d22629b3c7969a926d37870d7dd75c",
+        "rev": "37bc90eed02b0c8b5a77a0b00867baf3005cfb98",
         "type": "github"
       },
       "original": {
@@ -573,6 +573,48 @@
         "type": "github"
       }
     },
+    "komga-bookmanager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772572455,
+        "narHash": "sha256-B4KOdV2GQogU1XL9903qFkOFf/6H7UGa+dprNGctgMY=",
+        "ref": "main",
+        "rev": "002732d4ebc5b80c2b8522896427c9f6bee9e1d1",
+        "revCount": 6,
+        "type": "git",
+        "url": "ssh://gitea@git.ppp.pm:1122/alex/komga-bookmanager.git"
+      },
+      "original": {
+        "ref": "main",
+        "type": "git",
+        "url": "ssh://gitea@git.ppp.pm:1122/alex/komga-bookmanager.git"
+      }
+    },
+    "komga-comictracker": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772884418,
+        "narHash": "sha256-2V/JnGsIhvQoAiH7iIQkOPX5OTZVwGTOEv+nFetd4I8=",
+        "ref": "main",
+        "rev": "0b91385e8906ca40cc89381bf8394ed24a116c6b",
+        "revCount": 49,
+        "type": "git",
+        "url": "ssh://gitea@git.ppp.pm:1122/alex/komga-comictracker.git"
+      },
+      "original": {
+        "ref": "main",
+        "type": "git",
+        "url": "ssh://gitea@git.ppp.pm:1122/alex/komga-comictracker.git"
+      }
+    },
     "naviterm": {
       "inputs": {
         "flake-utils": "flake-utils",
@@ -596,16 +638,14 @@
     },
     "nh": {
       "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
+        "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1770459068,
-        "narHash": "sha256-sLRCTKKt7FsxR/rKrJp5BN++3p8tfuShzIKLMNTh7DA=",
+        "lastModified": 1770930949,
+        "narHash": "sha256-ulX/6yOI9fmiiDqNjn59oLsVkABRo0M2Wkr2w8Ric64=",
         "owner": "viperML",
         "repo": "nh",
-        "rev": "347c71b43705a2efcc6e4ebb94e14894bb5d3147",
+        "rev": "b37b9a6ca31741282873dd8e335f66aad54f6326",
         "type": "github"
       },
       "original": {
@@ -638,11 +678,11 @@
         "systems": "systems_4"
       },
       "locked": {
-        "lastModified": 1769853456,
-        "narHash": "sha256-8h3p12GjiDOP7YDVS5Gx/bqjPQL4tFdDr90Ki7Qtglw=",
+        "lastModified": 1771059595,
+        "narHash": "sha256-avvMQpGX/erjzPI10bN5uHDD08er5QC+pBypQisUNHs=",
         "owner": "nix-community",
         "repo": "nix-jetbrains-plugins",
-        "rev": "1d496fa90ada916bd926228131f8ad04d7a854aa",
+        "rev": "fb4b27d169c7fbfc92c9dfec971e9c87506cb8f0",
         "type": "github"
       },
       "original": {
@@ -653,11 +693,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1769302137,
-        "narHash": "sha256-QEDtctEkOsbx8nlFh4yqPEOtr4tif6KTqWwJ37IM2ds=",
+        "lastModified": 1770882871,
+        "narHash": "sha256-nw5g+xl3veea+maxJ2/81tMEA/rPq9aF1H5XF35X+OE=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "a351494b0e35fd7c0b7a1aae82f0afddf4907aa8",
+        "rev": "af04cb78aa85b2a4d1c15fc7270347e0d0eda97b",
         "type": "github"
       },
       "original": {
@@ -669,16 +709,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1770197578,
-        "narHash": "sha256-AYqlWrX09+HvGs8zM6ebZ1pwUqjkfpnv8mewYwAo+iM=",
-        "owner": "nixos",
+        "lastModified": 1770770419,
+        "narHash": "sha256-iKZMkr6Cm9JzWlRYW/VPoL0A9jVKtZYiU4zSrVeetIs=",
+        "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "00c21e4c93d963c50d4c0c89bfa84ed6e0694df2",
+        "rev": "6c5e707c6b5339359a9a9e215c5e66d6d802fd7a",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
+        "owner": "NixOS",
+        "ref": "nixos-25.11",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -699,6 +739,22 @@
         "type": "github"
       }
     },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1771008912,
+        "narHash": "sha256-gf2AmWVTs8lEq7z/3ZAsgnZDhWIckkb+ZnAo5RzSxJg=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "a82ccc39b39b621151d6732718e3e250109076fa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "pppdotpm-site": {
       "inputs": {
         "nixpkgs": [
@@ -730,11 +786,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769069492,
-        "narHash": "sha256-Efs3VUPelRduf3PpfPP2ovEB4CXT7vHf8W+xc49RL/U=",
+        "lastModified": 1770726378,
+        "narHash": "sha256-kck+vIbGOaM/dHea7aTBxdFYpeUl/jHOy5W3eyRvVx8=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "a1ef738813b15cf8ec759bdff5761b027e3e1d23",
+        "rev": "5eaaedde414f6eb1aea8b8525c466dc37bba95ae",
         "type": "github"
       },
       "original": {
@@ -751,12 +807,14 @@
         "home-manager": "home-manager_2",
         "hyprland": "hyprland",
         "hyprland-contrib": "hyprland-contrib",
+        "komga-bookmanager": "komga-bookmanager",
+        "komga-comictracker": "komga-comictracker",
         "naviterm": "naviterm",
         "nh": "nh",
         "nix-gc-env": "nix-gc-env",
         "nix-jetbrains-plugins": "nix-jetbrains-plugins",
         "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_2",
         "pppdotpm-site": "pppdotpm-site",
         "whib-backend": "whib-backend",
         "whib-frontend": "whib-frontend"

flake.nix

@@ -13,7 +13,6 @@
 
     nh = {
       url = "github:viperML/nh";
-      inputs.nixpkgs.follows = "nixpkgs";
     };
 
     nix-gc-env.url = "github:Julow/nix-gc-env";
@@ -60,11 +59,25 @@
 
     whib-backend = {
       url = "git+ssh://gitea@git.ppp.pm:1122/alex/whib.git?ref=master";
+      # url = "path:/home/alex/code/own/whib";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
     whib-frontend = {
       url = "git+ssh://gitea@git.ppp.pm:1122/alex/whib-react.git?ref=master";
+      # url = "path:/home/alex/code/own/whib-react";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    komga-comictracker = {
+      url = "git+ssh://gitea@git.ppp.pm:1122/alex/komga-comictracker.git?ref=main";
+      # url = "path:/home/alex/code/own/komga-comictracker";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    komga-bookmanager = {
+      url = "git+ssh://gitea@git.ppp.pm:1122/alex/komga-bookmanager.git?ref=main";
+      # url = "path:/home/alex/code/own/komga-comictracker";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };
@@ -148,7 +161,7 @@
         in
         {
           ${system}.default = pkgs.mkShell {
-            packages = [ pkgs.nixfmt-rfc-style ];
+            packages = [ pkgs.nixfmt ];
           };
         };
     };

hosts/backwards/configuration.nix

@@ -22,6 +22,13 @@
     alsa.enable = true;
     alsa.support32Bit = true;
     pulse.enable = true;
+
+    extraConfig.pipewire."90-hdmi-fix" = {
+      "context.properties" = {
+        "default.clock.rate" = 48000;
+        "default.clock.allowed-rates" = [ 48000 ];
+      };
+    };
   };
 
   hardware = {

hosts/backwards/modules/boot/default.nix

@@ -38,6 +38,11 @@ in
 
         efi.canTouchEfiVariables = true;
       };
+
+      extraModprobeConfig = ''
+        options snd-intel-dspcfg dsp_driver=1
+        options snd_hda_intel power_save=0 power_save_controller=N
+      '';
     };
   };
 }

hosts/backwards/modules/network/default.nix

@@ -3,33 +3,40 @@
   networking = {
     hostName = "backwards";
 
-    networkmanager.enable = false;
+    wireless.enable = false;
 
-    #wireless.networks are defined in the secret `wpa_supplicant.conf`
-    wireless = {
+    networkmanager = {
       enable = true;
 
-      secretsFile = config.age.secrets.wireless-network-secrets.path;
+      wifi.backend = "iwd";
 
-      networks = {
-        "w1-f1_5G" = {
-          pskRaw = "ext:w1-f1_psk";
-        };
-      };
-    };
-
-    defaultGateway = "192.168.50.1";
-    nameservers = [ "1.1.1.1" ];
-    interfaces = {
-      wlp1s0 = {
-        useDHCP = false;
-        ipv4 = {
-          addresses = [
-            {
-              address = "192.168.50.202";
-              prefixLength = 24;
-            }
+      ensureProfiles = {
+        environmentFiles = [
+          config.age.secrets.wireless-network-secrets.path
         ];
+
+        profiles = {
+          w1-f1_5G = {
+            connection = {
+              id = "w1-f1_5G";
+              type = "wifi";
+              interface-name = "wlp1s0";
+            };
+            wifi = {
+              ssid = "w1-f1_5G";
+              mode = "infrastructure";
+            };
+            wifi-security = {
+              key-mgmt = "wpa-psk";
+              psk = "$w1_f1_psk";
+            };
+            ipv4 = {
+              method = "manual";
+              addresses = "192.168.50.202/24";
+              gateway = "192.168.50.1";
+              dns = "1.1.1.1";
+            };
+          };
         };
       };
     };

hosts/manatee/modules/audiobookshelf/default.nix

@@ -10,6 +10,14 @@ in
   };
 
   config = lib.mkIf enabled {
+    mod.homepage.services = [
+      {
+        name = "Audiobookshelf";
+        port = 8000;
+        description = "Audiobooks & podcasts";
+      }
+    ];
+
     users.users.audiobookshelf = {
       isSystemUser = true;
       description = "audiobookshelf";

hosts/manatee/modules/calibre-web/default.nix

@@ -1,34 +0,0 @@
-{ lib, config, ... }:
-let
-  enabled = config.mod.calibre-web.enable;
-in
-{
-  options = {
-    mod.calibre-web = {
-      enable = lib.mkEnableOption "add calibre-web module";
-    };
-  };
-
-  config = lib.mkIf enabled {
-    services = {
-      calibre-web = {
-        enable = true;
-
-        user = "storage";
-        group = "storage";
-
-        listen = {
-          ip = "0.0.0.0";
-          port = 8083;
-        };
-
-        dataDir = "/mnt/media/public/books";
-
-        options = {
-          calibreLibrary = "/mnt/media/public/books";
-          enableBookUploading = true;
-        };
-      };
-    };
-  };
-}

hosts/manatee/modules/certs/default.nix

@@ -20,6 +20,19 @@
           "--http-timeout=60"
         ];
       };
+
+      "komga.ppp.pm" = {
+        dnsProvider = "hetzner";
+        environmentFile = config.age.secrets.hetzner-dns.path;
+        group = "nginx";
+
+        extraLegoFlags = [
+          "--dns.resolvers=1.1.1.1:53,8.8.8.8:53"
+          "--dns.propagation-wait=60s"
+          "--dns-timeout=60"
+          "--http-timeout=60"
+        ];
+      };
     };
   };
 

hosts/manatee/modules/default.nix

@@ -16,12 +16,12 @@ in
       nginx.enable = true;
       syncthing.enable = true;
       transmission.enable = true;
-      calibre-web.enable = true;
       audiobookshelf.enable = true;
       jellyfin.enable = true;
       immich.enable = true;
       navidrome.enable = true;
       komga.enable = true;
+      homepage.enable = true;
     };
   };
 }

hosts/manatee/modules/home-assistant/default.nix

@@ -6,8 +6,70 @@
 }:
 let
   nginxEnabled = config.mod.nginx.enable;
+
+  script = pkgs.writeShellScript "bt-reset" ''
+    set -euo pipefail
+    export PATH="${
+      lib.makeBinPath [
+        pkgs.bluez
+        pkgs.util-linux
+        pkgs.kmod
+        pkgs.gnugrep
+        pkgs.coreutils
+      ]
+    }"
+
+    logger -t bt-reset "Starting Bluetooth adapter reset..."
+
+    # Exit early if the adapter is already present and running
+    if hciconfig hci0 2>/dev/null | grep -q "UP RUNNING"; then
+      logger -t bt-reset "hci0 is already UP RUNNING — nothing to do"
+      exit 0
+    fi
+
+    # If hci0 exists but isn't UP, try bringing it up
+    if hciconfig hci0 2>/dev/null; then
+      logger -t bt-reset "hci0 exists but not running — bringing it up"
+      hciconfig hci0 up || true
+      sleep 2
+
+      if hciconfig hci0 2>/dev/null | grep -q "UP RUNNING"; then
+        logger -t bt-reset "hci0 is UP now"
+        systemctl restart bluetooth.service
+        logger -t bt-reset "bluetooth.service restarted — done"
+        exit 0
+      fi
+    fi
+
+    # Hard reset: reload the btusb kernel module (works for USB adapters)
+    logger -t bt-reset "hci0 missing — reloading btusb module..."
+    modprobe -r btusb 2>/dev/null || true
+    sleep 3
+    modprobe btusb
+    sleep 3
+
+    if hciconfig hci0 2>/dev/null; then
+      hciconfig hci0 up
+      logger -t bt-reset "hci0 restored after module reload"
+    else
+      logger -t bt-reset "ERROR: hci0 not found after module reload"
+      exit 1
+    fi
+
+    # Restart the bluetooth systemd service so bluetoothd picks up the adapter
+    systemctl restart bluetooth.service
+    logger -t bt-reset "bluetooth.service restarted — done"
+  '';
 in
 {
+  mod.homepage.services = [
+    {
+      name = "Home Assistant";
+      port = 8123;
+      description = "Home automation";
+    }
+  ];
+
   hardware.bluetooth.enable = true;
 
   virtualisation.oci-containers = {
@@ -57,17 +119,56 @@ in
         };
       };
     };
+
+    # Trigger reset via udev when hci0 disappears
+    udev.extraRules = ''
+      ACTION=="remove", SUBSYSTEM=="bluetooth", KERNEL=="hci0", \
+        TAG+="systemd", ENV{SYSTEMD_WANTS}+="bt-reset.service"
+    '';
   };
 
-  systemd.user = {
+  systemd = {
+    services = {
+      # Trigger reset on bluetoothd failure
+      bluetooth = {
+        unitConfig.OnFailure = [ "bt-reset.service" ];
+      };
+
+      bt-reset = {
+        description = "Reset Bluetooth adapter";
+        after = [ "bluetooth.service" ];
+
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = script;
+
+          Restart = "on-failure";
+          RestartSec = "10s";
+          StartLimitIntervalSec = "120";
+          StartLimitBurst = 3;
+        };
+      };
+    };
+
+    timers.bt-reset = {
+      description = "Periodically reset Bluetooth adapter";
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnBootSec = "5min"; # first run 5 min after boot
+        OnUnitActiveSec = "4h"; # then every 4 hours
+        RandomizedDelaySec = "5min";
+      };
+    };
+
+    user = {
       timers = {
-      "update-hetzner-ha-dns" = {
+        "update-hetzner-dns" = {
           unitConfig = {
-          Description = "updates Hetzner DNS for home-assistant";
+            Description = "updates Hetzner DNS records";
           };
 
           timerConfig = {
-          Unit = "update-hetzner-ha-dns.service";
+            Unit = "update-hetzner-dns.service";
             OnCalendar = "*-*-* *:00/30:00";
             Persistent = true;
           };
@@ -77,9 +178,9 @@ in
       };
 
       services = {
-      "update-hetzner-ha-dns" = {
+        "update-hetzner-dns" = {
           unitConfig = {
-          Description = "updates Hetzner DNS for home-assistant";
+            Description = "updates Hetzner DNS records";
           };
 
           serviceConfig = {
@@ -89,26 +190,28 @@ in
 
           path = [
             pkgs.curl
-          pkgs.coreutils # For `cat`
+            pkgs.coreutils
             pkgs.jq
           ];
 
           script = ''
-          LAST_IP_FILE="/tmp/hetzner-dns-ha-ip"
+            SUBDOMAINS="ha komga"
             INTERFACE="enp3s0"
 
             CURRENT_IP=$(curl -s --fail --interface "$INTERFACE" ifconfig.me)
 
+            for SUBDOMAIN in $SUBDOMAINS; do
+              LAST_IP_FILE="/tmp/hetzner-dns-''${SUBDOMAIN}-ip"
+
               LAST_IP=""
               if [[ -f "$LAST_IP_FILE" ]]; then
                   LAST_IP=$(cat "$LAST_IP_FILE")
               fi
 
               if [[ "$CURRENT_IP" == "$LAST_IP" ]]; then
-              echo "IP unchanged, NOOP update."
-              exit 0
+                  echo "$SUBDOMAIN: IP unchanged, NOOP update."
               else
-              echo "Updating IP"
+                  echo "$SUBDOMAIN: Updating IP"
 
                   JSON_BODY=$(jq -n --arg ip "$CURRENT_IP" '{records: [{value: $ip}]}')
 
@@ -118,13 +221,15 @@ in
                     -H "Authorization: Bearer $HETZNER_API_TOKEN" \
                     -H "Content-Type: application/json" \
                     -d "$JSON_BODY" \
-                "https://api.hetzner.cloud/v1/zones/ppp.pm/rrsets/ha/A/actions/set_records" \
+                    "https://api.hetzner.cloud/v1/zones/ppp.pm/rrsets/''${SUBDOMAIN}/A/actions/set_records" \
                     && echo $CURRENT_IP > $LAST_IP_FILE
               fi
+            done
           '';
         };
       };
     };
+  };
 
   age = {
     secrets = {

hosts/manatee/modules/homepage/default.nix

@@ -0,0 +1,111 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  enabled = config.mod.homepage.enable;
+  nginxEnabled = config.mod.nginx.enable;
+  services = config.mod.homepage.services;
+
+  serviceToCard = svc: ''
+    <a class="card" href="http://manatee:${toString svc.port}">
+      <div class="name">${svc.name}</div>
+      <div class="desc">${svc.description}</div>
+      <div class="port">:${toString svc.port}</div>
+    </a>
+  '';
+
+  page = pkgs.writeTextDir "index.html" ''
+    <!DOCTYPE html>
+    <html lang="en">
+    <head>
+      <meta charset="UTF-8">
+      <meta name="viewport" content="width=device-width, initial-scale=1.0">
+      <title>manatee</title>
+      <style>
+        * { margin: 0; padding: 0; box-sizing: border-box; }
+        body {
+          font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+          background: #1a1b26;
+          color: #c0caf5;
+          min-height: 100vh;
+          padding: 3rem 1.5rem;
+        }
+        h1 {
+          text-align: center;
+          font-size: 1.5rem;
+          font-weight: 400;
+          color: #7aa2f7;
+          margin-bottom: 2rem;
+        }
+        .grid {
+          display: grid;
+          grid-template-columns: repeat(auto-fill, minmax(200px, 1fr));
+          gap: 1rem;
+          max-width: 900px;
+          margin: 0 auto;
+        }
+        .card {
+          display: block;
+          background: #24283b;
+          border: 1px solid #414868;
+          border-radius: 8px;
+          padding: 1.25rem;
+          text-decoration: none;
+          color: inherit;
+          transition: border-color 0.15s;
+        }
+        .card:hover { border-color: #7aa2f7; }
+        .name { font-size: 1.1rem; font-weight: 600; color: #c0caf5; }
+        .desc { font-size: 0.85rem; color: #565f89; margin-top: 0.35rem; }
+        .port { font-size: 0.8rem; color: #414868; margin-top: 0.5rem; font-family: monospace; }
+      </style>
+    </head>
+    <body>
+      <h1>manatee</h1>
+      <div class="grid">
+        ${lib.concatMapStrings serviceToCard services}
+      </div>
+    </body>
+    </html>
+  '';
+in
+{
+  options = {
+    mod.homepage = {
+      enable = lib.mkEnableOption "Enable homepage module";
+      services = lib.mkOption {
+        type = lib.types.listOf (
+          lib.types.submodule {
+            options = {
+              name = lib.mkOption { type = lib.types.str; };
+              port = lib.mkOption { type = lib.types.port; };
+              description = lib.mkOption { type = lib.types.str; };
+            };
+          }
+        );
+        default = [ ];
+        description = "Services to display on the homepage";
+      };
+    };
+  };
+
+  config = lib.mkIf (enabled && nginxEnabled) {
+    services.nginx.virtualHosts."homepage" = {
+      listen = [
+        {
+          addr = "0.0.0.0";
+          port = 9999;
+        }
+      ];
+      root = page;
+      locations."/" = {
+        index = "index.html";
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [ 9999 ];
+  };
+}

hosts/manatee/modules/immich/default.nix

@@ -10,6 +10,14 @@ in
   };
 
   config = lib.mkIf enabled {
+    mod.homepage.services = [
+      {
+        name = "Immich";
+        port = 2283;
+        description = "Photo library";
+      }
+    ];
+
     users.users.immich = {
       isSystemUser = true;
       group = "storage";

hosts/manatee/modules/jellyfin/default.nix

@@ -47,6 +47,14 @@ in
       };
     };
 
+    mod.homepage.services = [
+      {
+        name = "Jellyfin";
+        port = 8096;
+        description = "Media streaming";
+      }
+    ];
+
     networking = {
       firewall.allowedTCPPorts = [ 8096 ];
     };

hosts/manatee/modules/komga/default.nix

@@ -1,6 +1,13 @@
-{ lib, config, ... }:
+{
+  inputs,
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 let
   enabled = config.mod.komga.enable;
+  nginxEnabled = config.mod.nginx.enable;
 in
 {
   options = {
@@ -9,7 +16,30 @@ in
     };
   };
 
+  imports = [
+    inputs.komga-comictracker.nixosModules.default
+    inputs.komga-bookmanager.nixosModules.default
+  ];
+
   config = lib.mkIf enabled {
+    mod.homepage.services = [
+      {
+        name = "Komga";
+        port = 8002;
+        description = "Comic library";
+      }
+      {
+        name = "Komga Reader";
+        port = 8888;
+        description = "Comic reader";
+      }
+      {
+        name = "Komga Book Manager";
+        port = 8686;
+        description = "Book manager";
+      }
+    ];
+
     users.users.komga = {
       isSystemUser = true;
       group = "storage";
@@ -21,8 +51,75 @@ in
       user = "komga";
       group = "storage";
 
-      settings.server.port = 8002;
+      settings = {
+        server.port = 8002;
+        komga."cors.allowed-origins" = [
+          "http://manatee:8888"
+          "https://komga.ppp.pm"
+        ];
+      };
+
       openFirewall = true;
     };
+
+    services.nginx = lib.mkIf nginxEnabled {
+      virtualHosts."komga-reader" = {
+        listen = [
+          {
+            addr = "0.0.0.0";
+            port = 8888;
+          }
+        ];
+        root = (pkgs.writeTextDir "komga-reader.html" (builtins.readFile ./komga-reader.html));
+
+        locations."/" = {
+          index = "komga-reader.html";
+          tryFiles = "$uri $uri/ /komga-reader.html";
+        };
+      };
+
+      virtualHosts."komga.ppp.pm" = {
+        forceSSL = true;
+        useACMEHost = "komga.ppp.pm";
+
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:8002";
+          proxyWebsockets = true;
+        };
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [ 8888 ];
+
+    programs.comictracker = {
+      enable = true;
+      komgaUrl = "http://127.0.0.1:8002";
+      komgaLibraryId = "0NVZH5AK3RPE1";
+      secretsFile = config.age.secrets.komga-comicbooktracker-credentials.path;
+    };
+
+    services.komga-book-manager = {
+      enable = true;
+      port = 8686;
+      group = "storage";
+      komgaUrl = "http://127.0.0.1:8002";
+      credentialsFile = config.age.secrets.komga-bookmanager-credentials.path;
+      libraryRoot = "/mnt/media/public/books";
+      libraryId = "0PNE1NEPY6995";
+    };
+
+    age.secrets = {
+      "komga-comicbooktracker-credentials" = {
+        file = ../../../../secrets/manatee/komga-comicbooktracker-credentials.age;
+        owner = "alex";
+        group = "users";
+      };
+
+      "komga-bookmanager-credentials" = {
+        file = ../../../../secrets/manatee/komga-bookmanager-credentials.age;
+        owner = "alex";
+        group = "users";
+      };
+    };
   };
 }

hosts/manatee/modules/navidrome/default.nix

@@ -15,6 +15,14 @@ in
   };
 
   config = {
+    mod.homepage.services = lib.mkIf navidromeEnabled [
+      {
+        name = "Navidrome";
+        port = 4533;
+        description = "Music streaming";
+      }
+    ];
+
     services = lib.mkIf navidromeEnabled {
       navidrome = {
         enable = true;

hosts/manatee/modules/syncthing/default.nix

@@ -10,6 +10,14 @@ in
   };
 
   config = lib.mkIf enabled {
+    mod.homepage.services = [
+      {
+        name = "Syncthing";
+        port = 8384;
+        description = "File sync";
+      }
+    ];
+
     services.syncthing = {
       enable = true;
 

hosts/manatee/modules/transmission/default.nix

@@ -15,6 +15,14 @@ in
   };
 
   config = lib.mkIf enabled {
+    mod.homepage.services = [
+      {
+        name = "Transmission";
+        port = 9091;
+        description = "Torrent client";
+      }
+    ];
+
     services = {
       transmission = {
         enable = true;

hosts/pinwheel/modules/bluetooth/default.nix

@@ -30,12 +30,6 @@ in
     # Low battery notification for bluetooth devices
     systemd.user =
       let
-        trackpad = {
-          id = "battery_hid_a8o91o3doe5ofeo38_battery";
-          name = "trackpad";
-          threshold = "20";
-        };
-
         headphones = {
           id = "headset_dev_38_18_4C_18_A4_6E";
           name = "headphones";
@@ -65,7 +59,6 @@ in
           in
           builtins.listToAttrs (
             builtins.map mkTimer [
-              trackpad
               headphones
             ]
           );
@@ -119,7 +112,6 @@ in
           in
           builtins.listToAttrs (
             builtins.map mkService [
-              trackpad
               headphones
             ]
           );

hosts/pinwheel/modules/emacs/config.org

@@ -555,6 +555,9 @@ Setup prefix for keybindings.
       )
     )
 
+    :custom
+    (eglot-code-action-indications nil)
+
     :hook (
            (eglot-managed-mode . mp-eglot-eldoc)
            (go-mode . eglot-ensure)

hosts/pinwheel/modules/hyprland/default.nix

@@ -7,6 +7,59 @@
 }:
 let
   enabled = config.mod.hyprland.enable;
+
+  monitorScript = pkgs.writeShellScript "hyprland-monitor-handler" ''
+    INTERNAL="eDP-1"
+    EXTERNAL_MONITORS="HDMI-A-1 DP-3"
+    HYPRCTL="${pkgs.hyprland}/bin/hyprctl"
+    JQ="${pkgs.jq}/bin/jq"
+
+    get_active_external() {
+      # Return the first connected external monitor
+      for mon in $EXTERNAL_MONITORS; do
+        if $HYPRCTL monitors -j | $JQ -e ".[] | select(.name == \"$mon\")" > /dev/null 2>&1; then
+          echo "$mon"
+          return 0
+        fi
+      done
+      return 1
+    }
+
+    bind_workspaces() {
+      local external
+
+      if external=$(get_active_external); then
+        # External monitor connected: 1-5 on external, 6-10 on internal
+        for ws in 1 2 3 4 5; do
+          $HYPRCTL keyword workspace "$ws, monitor:$external, default:true"
+        done
+        for ws in 6 7 8 9 10; do
+          $HYPRCTL keyword workspace "$ws, monitor:$INTERNAL, default:true"
+        done
+      else
+        # No external monitor: all workspaces on internal
+        for ws in 1 2 3 4 5 6 7 8 9 10; do
+          $HYPRCTL keyword workspace "$ws, monitor:$INTERNAL, default:true"
+        done
+      fi
+    }
+
+    handle_event() {
+      case $1 in
+        monitoradded*|monitorremoved*)
+          sleep 0.5  # Give monitor time to initialize
+          bind_workspaces
+          ;;
+      esac
+    }
+
+    # Bind workspaces on startup
+    bind_workspaces
+
+    ${pkgs.socat}/bin/socat -U - UNIX-CONNECT:"$XDG_RUNTIME_DIR/hypr/$HYPRLAND_INSTANCE_SIGNATURE/.socket2.sock" | while read -r line; do
+      handle_event "$line"
+    done
+  '';
 in
 {
   options = {
@@ -41,17 +94,7 @@ in
 
           monitor=eDP-1, 1920x1200, auto-center-down, 1
           monitor=HDMI-A-1, 2560x1440@100, auto-center-up, 1
-
-          workspace = 1, monitor:HDMI-A-1
-          workspace = 2, monitor:HDMI-A-1
-          workspace = 3, monitor:HDMI-A-1
-          workspace = 4, monitor:HDMI-A-1
-          workspace = 5, monitor:HDMI-A-1
-          workspace = 6, monitor:eDP-1
-          workspace = 7, monitor:eDP-1
-          workspace = 8, monitor:eDP-1
-          workspace = 9, monitor:eDP-1
-          workspace = 10, monitor:eDP-1
+          monitor=DP-3, 2560x1440@60, auto-center-up, 1
 
           workspace = w[tv1], gapsout:0, gapsin:0
           workspace = f[1], gapsout:0, gapsin:0
@@ -60,6 +103,9 @@ in
           windowrule = border_size 0, match:float 0, match:workspace f[1]
           windowrule = rounding 0, match:float 0, match:workspace f[1]
 
+          # https://wiki.archlinux.org/title/Hyprland#Jetbrains_apps_focus_issues
+          windowrule = match:xwayland true, no_initial_focus on
+
           exec-once=dbus-update-activation-environment --systemd WAYLAND_DISPLAY XDG_CURRENT_DESKTOP
         '';
 
@@ -79,6 +125,7 @@ in
             follow_mouse = 2;
 
             sensitivity = 0.3;
+            accel_profile = "flat";
             touchpad = {
               natural_scroll = false;
               tap-and-drag = false;
@@ -171,6 +218,23 @@ in
         pkgs.wdisplays
         pkgs.bc
       ];
+
+      systemd.user.services.hyprland-monitors = {
+        Unit = {
+          Description = "Hyprland monitor hotplug handler";
+          PartOf = [ "graphical-session.target" ];
+          After = [ "graphical-session.target" ];
+        };
+        Service = {
+          Type = "simple";
+          ExecStart = "${monitorScript}";
+          Restart = "on-failure";
+          RestartSec = 5;
+        };
+        Install = {
+          WantedBy = [ "graphical-session.target" ];
+        };
+      };
     };
 
     # To start electron apps like `chromium` with wayland support

hosts/pinwheel/modules/nix/default.nix

@@ -2,7 +2,7 @@
 {
   home-manager.users.alex = {
     home.packages = [
-      pkgs.nixfmt-rfc-style
+      pkgs.nixfmt
       pkgs.nix-tree
     ];
   };

hosts/pinwheel/modules/openvpn/default.nix

@@ -23,15 +23,14 @@ in
 
     services.resolved = {
       enable = true;
-      dnssec = "false";
-      domains = [ "~." ];
-      fallbackDns = [
-        "1.1.1.1#one.one.one.one"
-        "1.0.0.1#one.one.one.one"
-      ];
-      extraConfig = ''
-        DNSOverTLS=yes
-      '';
+      settings = {
+        Resolve = {
+          Domains = [ "~." ];
+          DNSSEC = false;
+          DNSOverTLS = true;
+        };
+      };
+
     };
   };
 }

hosts/pinwheel/modules/ssh/default.nix

@@ -3,6 +3,7 @@
   home-manager.users.alex = {
     programs.ssh = {
       enable = true;
+      enableDefaultConfig = false;
 
       matchBlocks = {
         "manatee" = {

hosts/pinwheel/modules/work/default.nix

@@ -21,11 +21,10 @@ in
       # (pkgs.callPackage ./pants.nix { inherit (pkgs) stdenv.hostPlatform.system; })
       # (pkgs.callPackage ./syb-cli.nix { })
 
-      (inputs.nix-jetbrains-plugins.lib."${pkgs.stdenv.hostPlatform.system}".buildIdeWithPlugins
-        pkgs.jetbrains
-        "idea"
-        [ "IdeaVIM" ]
-      )
+      (inputs.nix-jetbrains-plugins.lib.buildIdeWithPlugins pkgs "idea" [
+        "IdeaVIM"
+        "com.github.copilot"
+      ])
 
       (pkgs.google-cloud-sdk.withExtraComponents [
         pkgs.google-cloud-sdk.components.gke-gcloud-auth-plugin
@@ -68,6 +67,13 @@ in
     };
   };
 
+  # Needed for `copilot`
+  programs.nix-ld.enable = true;
+  programs.nix-ld.libraries = [
+    pkgs.stdenv.cc.cc.lib
+    pkgs.zlib
+  ];
+
   services.openvpn.servers = lib.mkIf openvpnEnabled {
     work-staging = {
       config = "config ${config.age.secrets.work-staging-ovpn.path}";

hosts/pinwheel/modules/work/pants.nix

@@ -1,5 +1,4 @@
 {
-  system,
   pkgs,
   lib,
   ...
@@ -11,7 +10,7 @@ let
   match =
     v: l: builtins.elemAt (lib.lists.findFirst (x: (if_let v (builtins.elemAt x 0)) != null) null l) 1;
 
-  package = match { platform = system; } [
+  package = match { platform = pkgs.stdenv.hostPlatform.system; } [
     [
       { platform = "aarch64-linux"; }
       {

hosts/test-vm/whib-frontend.nix

@@ -15,7 +15,8 @@ in
 
       domain = "whib-frontend.local";
       port = "8081";
-      backendHost = "https://api.whib.ppp.pm/"; # "whib-backend.local";
+      # backendHost = "https://api.whib.ppp.pm/";
+      backendHost = "http://localhost:8080";
     };
 
     virtualisation.vmVariant = {

secrets/manatee/komga-bookmanager-credentials.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 wkRvNA GW8mvnaXpspxr78xV0fKhXwHVvReyjvDc0v7uPwhuBI
+Rne8JZYVhrTTesSFpRQ/IOZlFIMoX9Wmv5n1Ed7Ehv8
+-> ssh-ed25519 +oNaHQ d7utzodGQ7LsD2Uht1rbT8Qq9BZp3PkJS9EDhajCjnk
+qd2Vj+1TQrjEKkSVAf0cXcCdkgeN/Jbp4UrBSp3cKYQ
+--- JQr5UQlutONqnTeoT/mIVZL8ME7ipUDK8zDfNcN3uhU
+ø5-VŸÌ²ÂòÀ-®ªÁÅ'^žô5kú.t(d1‡)É'<u%

secrets/secrets.nix

@@ -33,6 +33,8 @@ in {
   "manatee/syncthing-cert.age".publicKeys = [ manatee alex ];
   "manatee/syncthing-key.age".publicKeys = [ manatee alex ];
   "manatee/hetzner-dns.age".publicKeys = [ manatee alex ];
+  "manatee/komga-comicbooktracker-credentials.age".publicKeys = [ manatee alex];
+  "manatee/komga-bookmanager-credentials.age".publicKeys = [ manatee alex];
 
   "backwards/root.backwards.age".publicKeys = [ backwards alex ];
   "backwards/root.backwards.pub.age".publicKeys = [ backwards alex ];