[Gluetun] Switches to Wireguard config

flake.lock

@@ -7,32 +7,32 @@
         ]
       },
       "locked": {
-        "lastModified": 1756679287,
+        "lastModified": 1767910483,
-        "narHash": "sha256-Xd1vOeY9ccDf5VtVK12yM0FS6qqvfUop8UQlxEB+gTQ=",
+        "narHash": "sha256-MOU5YdVu4DVwuT5ztXgQpPuRRBjSjUGIdUzOQr9iQOY=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "07fc025fe10487dd80f2ec694f1cd790e752d0e8",
+        "rev": "82fb7dedaad83e5e279127a38ef410bcfac6d77c",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-25.05",
+        "ref": "release-25.11",
         "repo": "home-manager",
         "type": "github"
       }
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1756754095,
+        "lastModified": 1767799921,
-        "narHash": "sha256-9Rsn9XEWINExosFkKEqdp8EI6Mujr1gmQiyrEcts2ls=",
+        "narHash": "sha256-r4GVX+FToWVE2My8VVZH4V0pTIpnu2ZE8/Z4uxGEMBE=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "7c815e513adbf03c9098b2bd230c1e0525c8a7f9",
+        "rev": "d351d0653aeb7877273920cd3e823994e7579b0b",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-25.05",
+        "ref": "nixos-25.11",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -51,11 +51,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754988908,
+        "lastModified": 1767826491,
-        "narHash": "sha256-t+voe2961vCgrzPFtZxha0/kmFSHFobzF00sT8p9h0U=",
+        "narHash": "sha256-WSBENPotD2MIhZwolL6GC9npqgaS5fkM7j07V2i/Ur8=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "3223c7a92724b5d804e9988c6b447a0d09017d48",
+        "rev": "ea3adcb6d2a000d9a69d0e23cad1f2cacb3a9fbe",
         "type": "github"
       },
       "original": {

flake.nix

@@ -2,11 +2,9 @@
   description = "System Configuration";
 
   inputs = {
-    nixpkgs = {
+    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-25.11";
-      url = "github:nixos/nixpkgs?ref=nixos-25.05";
-    };
     home-manager = {
-      url = "github:nix-community/home-manager?ref=release-25.05";
+      url = "github:nix-community/home-manager?ref=release-25.11";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     sops-nix = {
@@ -16,7 +14,11 @@
   };
 
   outputs =
-    { self, nixpkgs, ... }@inputs:
+    {
+      self,
+      nixpkgs,
+      ...
+    }@inputs:
     let
       local = import ./lib;
       mkNixosConfig =
@@ -31,11 +33,13 @@
           modules = [
             home-manager.nixosModules.home-manager
             {
-              home-manager.useGlobalPkgs = true;
+              home-manager = {
-              home-manager.useUserPackages = true;
+                useGlobalPkgs = true;
-              home-manager.extraSpecialArgs = {
+                useUserPackages = true;
+                extraSpecialArgs = {
                   inherit inputs local;
                 };
+              };
             }
             path
           ];
@@ -57,7 +61,7 @@
         };
       };
       features = {
-        development = (import ./home-manager/features/development/development.nix);
+        development = import ./home-manager/features/development/development.nix;
       };
     };
 }

home-manager/features/3d-printing.nix

@@ -1,13 +1,64 @@
-{ pkgs, ... }:
+{
+  pkgs,
+  ...
+}:
+let
+  freecad-wrapped = pkgs.symlinkJoin {
+    name = "freecad-wrapped";
+    paths = [ pkgs.freecad ];
+    buildInputs = [ pkgs.makeWrapper ];
+    postBuild = ''
+      wrapProgram $out/bin/freecad \
+        --prefix MESA_LOADER_DRIVER_OVERRIDE : zink \
+        --prefix __EGL_VENDOR_LIBRARY_FILENAMES : ${pkgs.mesa}/share/glvnd/egl_vendor.d/50_mesa.json
+    '';
+  };
+
+  bambu-studio-wrapped = pkgs.symlinkJoin {
+    name = "bambu-studio-wrapped";
+    paths = [ pkgs.bambu-studio ];
+    buildInputs = [ pkgs.makeWrapper ];
+    postBuild = ''
+      wrapProgram $out/bin/bambu-studio \
+        --prefix MESA_LOADER_DRIVER_OVERRIDE : zink \
+        --prefix __EGL_VENDOR_LIBRARY_FILENAMES : ${pkgs.mesa}/share/glvnd/egl_vendor.d/50_mesa.json
+    '';
+  };
+in
 {
 
   home.packages = with pkgs; [
-    bambu-studio
+    bambu-studio-wrapped
     LycheeSlicer
     orca-slicer
+
     blender
+
+    freecad-wrapped
+    openscad
   ];
 
+  xdg.desktopEntries.orynt3d =
+    let
+      orynt3d-appimage = pkgs.fetchurl {
+        name = "orynt3d-appimage";
+        url = "https://files.orynt3d.com/client/Orynt3D-0.15.3.AppImage";
+        sha256 = "0j10myj06ff4frsd4yv7z3lb3qgw3ha70hc5hdc9idbryica801y";
+      };
+    in
+    {
+      name = "Orynt3D";
+      exec = "env __EGL_VENDOR_LIBRARY_FILENAMES=/run/opengl-driver/share/glvnd/egl_vendor.d/10_nvidia.json ${pkgs.appimage-run}/bin/appimage-run ${orynt3d-appimage}";
+      terminal = false;
+      type = "Application";
+      # icon = "";
+      comment = "3D model viewer and organizer";
+      categories = [
+        "Science"
+        "Development"
+      ];
+    };
+
   # Options to get Bambu Studio to run:
   # __GLX_VENDOR_LIBRARY_NAME=mesa __EGL_VENDOR_LIBRARY_FILENAMES=/nix/store/js9cfbjvlsls14nddk39fw74vyvlhz4l-mesa-25.0.7/share/glvnd/egl_vendor.d/50_mesa.json MESA_LOADER_DRIVER_OVERRIDE=zink GALLIUM_DRIVER=zink WEBKIT_DISABLE_DMABUF_RENDERER=1 bambu-studio
 }

home-manager/features/astronomy.nix

@@ -0,0 +1,8 @@
+{ pkgs, ... }:
+{
+  home.packages = with pkgs; [
+    stellarium
+    kstars
+    celestia
+  ];
+}

home-manager/features/audio.nix

@@ -1,7 +1,41 @@
 { pkgs, ... }:
+with pkgs;
+let
+  # A script that runs as long as media is playing.
+  isMediaPlaying = writeShellApplication {
+    name = "isMediaPlaying";
+    runtimeInputs = [
+      playerctl
+    ];
+    text = ''
+      set -e
+
+      while [ "$(playerctl status)" = "Playing" ]; do
+        echo -n "."
+        sleep 1
+      done
+    '';
+  };
+  # A script that prevents the system from going to sleep while media is playing
+  mediaCaffeine = writeShellApplication {
+    name = "media-caffeine";
+    runtimeInputs = [
+      isMediaPlaying
+      systemd
+    ];
+    text = ''
+      set -e
+
+      systemd-inhibit --what=sleep --why="Media is playing" --mode=block isMediaPlaying
+    '';
+  };
+in
 {
   home.packages = with pkgs; [
     pulseaudio # for pactl and other tools
     pavucontrol # GUI volume control with lots of options
+
+    mediaCaffeine
   ];
+
 }

home-manager/features/chat.nix

@@ -0,0 +1,11 @@
+{ pkgs, ... }:
+{
+  imports = [
+    ../apps/element.nix
+    ../apps/discord.nix
+  ];
+
+  home.packages = with pkgs; [
+    signal-desktop
+  ];
+}

home-manager/features/development/nix.nix

@@ -6,6 +6,7 @@
 
     nixfmt-rfc-style # Formatter
     nil # Language Server
+    statix # Lints and suggestions for Nix
   ];
 
   home.shellAliases = {
@@ -14,4 +15,3 @@
     rebuild-boot = "sudo nixos-rebuild boot --flake ~/system-config --show-trace --print-build-logs --verbose";
   };
 }
- 

home-manager/features/hyprland.nix

@@ -36,7 +36,7 @@
 
       "$terminal" = "foot";
       "$menu" = "rofi -show combi -combi-modes drun,ssh,run -theme ~/.config/rofi/launcher/style.rasi";
-      "$browser" = "librewolf";
+      "$browser" = "firefox --new-window";
 
       exec-once = [
         "nm-applet"
@@ -287,6 +287,7 @@
         "$mainMod, B, exec, $browser"
         "$mainMod, D, exec, $menu"
         "$mainMod + SHIFT, S, exec, hyprshot -m region --clipboard-only"
+        "$mainMod + CTRL + SHIFT, S, exec, hyprshot -m region -o ~/Pictures"
         "$mainMod, C, exec, swaync-client -t"
 
         "$mainMod + L_CONTROL, Q, exec, /home/drew/.config/rofi/powermenu/powermenu.sh"

home-manager/features/image-editing.nix

@@ -0,0 +1,7 @@
+{ pkgs, ... }:
+{
+  home.packages = with pkgs; [
+    gimp3
+    inkscape
+  ];
+}

home-manager/features/linux-desktop.nix

@@ -13,7 +13,6 @@
   home = {
     packages = with pkgs; [
       # Desktop Applications
-      signal-desktop
       gimp3
 
       # Common utilities
@@ -89,13 +88,13 @@
   xdg.mimeApps = {
     enable = true;
     defaultApplications = {
-      "text/html" = [ "librewolf.desktop" ];
+      "text/html" = [ "firefox.desktop" ];
-      "default-web-browser" = [ "librewolf.desktop" ];
+      "default-web-browser" = [ "firefox.desktop" ];
-      "x-scheme-handler/http" = [ "librewolf.desktop" ];
+      "x-scheme-handler/http" = [ "firefox.desktop" ];
-      "x-scheme-handler/https" = [ "librewolf.desktop" ];
+      "x-scheme-handler/https" = [ "firefox.desktop" ];
-      "x-scheme-handler/about" = [ "librewolf.desktop" ];
+      "x-scheme-handler/about" = [ "firefox.desktop" ];
-      "x-scheme-handler/unknown" = [ "librewolf.desktop" ];
+      "x-scheme-handler/unknown" = [ "firefox.desktop" ];
     };
   };
-  home.sessionVariables.DEFAULT_BROWSER = "${pkgs.librewolf}/bin/librewolf";
+  home.sessionVariables.DEFAULT_BROWSER = "${pkgs.firefox}/bin/firefox";
 }

home-manager/features/neovim/config/lazyvim.json

@@ -0,0 +1,18 @@
+{
+  "extras": [
+    "lazyvim.plugins.extras.coding.mini-comment",
+    "lazyvim.plugins.extras.coding.mini-surround",
+    "lazyvim.plugins.extras.editor.snacks_picker",
+    "lazyvim.plugins.extras.lang.astro",
+    "lazyvim.plugins.extras.lang.haskell",
+    "lazyvim.plugins.extras.lang.json",
+    "lazyvim.plugins.extras.lang.markdown",
+    "lazyvim.plugins.extras.lang.nix",
+    "lazyvim.plugins.extras.lang.rust",
+    "lazyvim.plugins.extras.lang.tailwind",
+    "lazyvim.plugins.extras.lang.toml",
+    "lazyvim.plugins.extras.lang.typescript"
+  ],
+  "install_version": 8,
+  "version": 8
+}

home-manager/features/neovim/config/lua/plugins/blink.lua

@@ -31,7 +31,7 @@ return {
           cmp.show()
         end,
       },
-      ["<C-enter>"] = { "select_and_accept" },
+      ["<Tab>"] = { "select_and_accept", "snippet_forward", "fallback" },
     },
   },
 }

home-manager/features/neovim/config/lua/plugins/copilot.lua

@@ -1,14 +0,0 @@
-return {
-  {
-    "zbirenbaum/copilot.lua",
-    opts = {
-      filetypes = {
-        markdown = false,
-        help = false,
-      },
-      suggestion = {
-        enabled = false,
-      },
-    },
-  },
-}

home-manager/features/neovim/config/lua/plugins/disabled.lua

@@ -1,5 +1,5 @@
 return {
   -- Maeson installs it's own binaries that are incompatible with NixOS.
-  { "williamboman/mason.nvim", enabled = false },
+  { "mason-org/mason.nvim", enabled = false },
-  { "williamboman/mason-lspconfig.nvim", enabled = false },
+  { "mason-org/mason-lspconfig.nvim", enabled = false },
 }

home-manager/features/neovim/config/lua/plugins/lsp.lua

@@ -3,9 +3,14 @@ return {
     "neovim/nvim-lspconfig",
     opts = {
       servers = {
+        -- Lua
         lua_ls = {},
+        -- Nix
         nil_ls = {},
+        -- Typescript
         vtsls = {},
+        -- Haskell
+        hls = {},
       },
       codelens = {
         enable = true,

home-manager/features/neovim/config/lua/plugins/markdown.lua

@@ -1,3 +1,4 @@
+-- https://github.com/MeanderingProgrammer/render-markdown.nvim?tab=readme-ov-file#setup
 return {
   "MeanderingProgrammer/render-markdown.nvim",
   opts = {

home-manager/features/neovim/config/lua/plugins/mini.lua

@@ -1,10 +1,38 @@
 return {
   {
-    "echasnovski/mini.surround",
+    "nvim-mini/mini.surround",
     enable = true,
+    keys = function(_, keys)
+      -- Populate the keys based on the user's options
+      local opts = LazyVim.opts("mini.surround")
+      local mappings = {
+        { opts.mappings.add, desc = "Add Surrounding", mode = { "n", "v" } },
+        { opts.mappings.delete, desc = "Delete Surrounding" },
+        { opts.mappings.find, desc = "Find Right Surrounding" },
+        { opts.mappings.find_left, desc = "Find Left Surrounding" },
+        { opts.mappings.highlight, desc = "Highlight Surrounding" },
+        { opts.mappings.replace, desc = "Replace Surrounding" },
+        { opts.mappings.update_n_lines, desc = "Update `MiniSurround.config.n_lines`" },
+      }
+      mappings = vim.tbl_filter(function(m)
+        return m[1] and #m[1] > 0
+      end, mappings)
+      return vim.list_extend(mappings, keys)
+    end,
+    opts = {
+      mappings = {
+        add = "gsa", -- Add surrounding in Normal and Visual modes
+        delete = "gsd", -- Delete surrounding
+        find = "gsf", -- Find surrounding (to the right)
+        find_left = "gsF", -- Find surrounding (to the left)
+        highlight = "gsh", -- Highlight surrounding
+        replace = "gsr", -- Replace surrounding
+        update_n_lines = "gsn", -- Update `n_lines`
+      },
+    },
   },
   {
-    "echasnovski/mini.comment",
+    "nvim-mini/mini.comment",
     enable = true,
   },
 }

home-manager/features/neovim/config/lua/plugins/obsidian.lua

@@ -1,22 +1,7 @@
 return {
-  "epwalsh/obsidian.nvim",
+  "obsidian-nvim/obsidian.nvim",
   version = "*", -- recommended, use latest release instead of latest commit
-  lazy = true,
   ft = "markdown",
-  -- Replace the above line with this if you only want to load obsidian.nvim for markdown files in your vault:
-  -- event = {
-  --   -- If you want to use the home shortcut '~' here you need to call 'vim.fn.expand'.
-  --   -- E.g. "BufReadPre " .. vim.fn.expand "~" .. "/my-vault/*.md"
-  --   -- refer to `:h file-pattern` for more examples
-  --   "BufReadPre path/to/my-vault/*.md",
-  --   "BufNewFile path/to/my-vault/*.md",
-  -- },
-  dependencies = {
-    -- Required.
-    "nvim-lua/plenary.nvim",
-    -- For the picker
-    "nvim-telescope/telescope.nvim",
-  },
   opts = {
     workspaces = {
       {

home-manager/features/neovim/config/lua/plugins/snacks.lua

@@ -24,6 +24,17 @@ return {
             layout = { layout = { position = "right" } },
           },
         },
+        -- This only supports the Kitty graphics protocol.
+        -- See
+        -- https://github.com/folke/snacks.nvim/blob/main/docs/image.md
+        -- https://github.com/obsidian-nvim/obsidian.nvim/wiki/Images
+        -- image = {
+        --   resolve = function(path, src)
+        --     if require("obsidian.api").path_is_note(path) then
+        --       return require("obsidian.api").resolve_image_path(src)
+        --     end
+        --   end,
+        -- },
       },
     })
     Snacks.toggle({

home-manager/features/neovim/config/lua/plugins/surround.lua

@@ -1,32 +0,0 @@
--- https://www.lazyvim.org/extras/coding/mini-surround#minisurround
-return {
-  "echasnovski/mini.surround",
-  keys = function(_, keys)
-    -- Populate the keys based on the user's options
-    local opts = LazyVim.opts("mini.surround")
-    local mappings = {
-      { opts.mappings.add, desc = "Add Surrounding", mode = { "n", "v" } },
-      { opts.mappings.delete, desc = "Delete Surrounding" },
-      { opts.mappings.find, desc = "Find Right Surrounding" },
-      { opts.mappings.find_left, desc = "Find Left Surrounding" },
-      { opts.mappings.highlight, desc = "Highlight Surrounding" },
-      { opts.mappings.replace, desc = "Replace Surrounding" },
-      { opts.mappings.update_n_lines, desc = "Update `MiniSurround.config.n_lines`" },
-    }
-    mappings = vim.tbl_filter(function(m)
-      return m[1] and #m[1] > 0
-    end, mappings)
-    return vim.list_extend(mappings, keys)
-  end,
-  opts = {
-    mappings = {
-      add = "gsa", -- Add surrounding in Normal and Visual modes
-      delete = "gsd", -- Delete surrounding
-      find = "gsf", -- Find surrounding (to the right)
-      find_left = "gsF", -- Find surrounding (to the left)
-      highlight = "gsh", -- Highlight surrounding
-      replace = "gsr", -- Replace surrounding
-      update_n_lines = "gsn", -- Update `n_lines`
-    },
-  },
-}

home-manager/features/neovim/default.nix

@@ -9,6 +9,7 @@
 
     extraPackages = with pkgs; [
       gcc # For treesitter complation
+      tree-sitter # For treesitter binaries
       ripgrep # Search support
       wayclip # Clipboard support
       fd # finder for telescope

home-manager/features/notes.nix

@@ -25,6 +25,7 @@
             "altair"
             "mcp"
             "vega"
+            "proxima"
           ];
         };
       };
@@ -56,6 +57,14 @@
           ];
           compression = "always";
         };
+        proxima = {
+          id = "NWZL6LY-ULJQMZE-EWY3MQU-XPDAFQB-LTIBZV7-GPKIABJ-WBJE36F-SK6LVAY";
+          name = "Proxima";
+          addresses = [
+            "relay://syncthing.blazestar.net:22067"
+          ];
+          compression = "always";
+        };
       };
       options = {
         localAnnounceEnabled = false;

secrets/mcp.yaml

@@ -14,6 +14,8 @@ offen:
 traefik:
     oauth2-client-secret: ENC[AES256_GCM,data:p7/6OsN2ytBj8mQiK0YL7J6NYLtMHOXIIs/6+bIDpsU=,iv:k6jLZifJEFLYKSFMkyn/kA7iBE+EFB8O/3/3fyTh1SY=,tag:6s49O2+tdlZoXyAGEamuMQ==,type:str]
     oauth2-plugin-secret: ENC[AES256_GCM,data:sArqwKHAdW35o5kD7DGfXSYCXFUXqvKQdoVnXutsNLw=,iv:qWf597QS3BqkVQkeAb99HbpDB0kUhdD+qKdpUPZEB0o=,tag:vXnb93npaklItWkMZ+/M9Q==,type:str]
+protonvpn:
+    private_key: ENC[AES256_GCM,data:41pfbR1klj1F24v3HlCCA4ofW2sCEnyE5TH8iX4Ug8D+kmwstTaj5RG2Zz8=,iv:P6XyQnDVoOmdkP8ilBR9DyfqPZA6GsQ6VUwY/tSGhx4=,tag:Bzgdv29lbk/gYlADPZMGVA==,type:str]
 deploy-key:
     mcp: ENC[AES256_GCM,data:eQcX8xdz5qZ6nU8ISOvZo+ZtP4Z/ePd+/ZZReX1BKvTUqGQPPFxConbLMwFzvzpD6xAUbA1MLkcR/bT98QbNx6LJYlhbofuDUg2DI79RB0fcrAcj/wUV0YPhmgofUdYYDaimH5A2PSvtmKfB3CtKKuA5HNeLymoXeLEpFzbckkGhzPee/CHiUmxayogp6za6btsDJsiT8hdHbrzyD2S6fhMJrzX+PlRzT32M/6eaFuFWE8EUO1gbkRlNfKPXw/EM2GXWJfR4qXfN2YKIKigqrtlAAoxnrUbp5EBrn/hGHS2ZYZXeRUFr3avFjcI0bLX423PWRHAylfQCPxgYVEtbcRv11CAFmq4rfFl0ZdvnAKbTLNmWcrQNijBATZPaAdQzgKPDHs8pwPUFR9Tcg8pZNbzw0mK9kPolniAOL2PBKUHv6LP/uEkB1E6Pxc7yms0kGpeJyo7hrFVOiVAckCey+SI9dpbJMSB3md070I1xk6Ik7PywrWh2QDeUtOU1U28UkYgnJ/9MJelWsNlUX9SR,iv:oCNeanaV/7UZ3dhmq4ZmJUZ5hb61AnHpHCfskM2Jsm8=,tag:F2uJKN5beM/rfiBMSyUP7w==,type:str]
 matrix:
@@ -23,6 +25,8 @@ matrix:
     blazestar-registration-token: ENC[AES256_GCM,data:TB3bR+E4H4c2l9pRcEOAZr35+vBVaJUcuCs9K0Pjd0aW+M35x5LgZ8+F99Y=,iv:e28sie6LSI5UX41BPb+yN+3n+Yw9Ssfsqe4zppwbPkU=,tag:cQPgZcRFbYSiZnmPVtZxHg==,type:str]
 tandoor:
     secret_key: ENC[AES256_GCM,data:nl7S2fS1wENrT5k2iZfLEAGc99lCUktgwR5L5KklF69BNVKQkW1rUgb3aIv50VpXZa+3OxV/vdPmG9NhKMy96I5+Dno=,iv:FFyGQBARz0B5zrONZELzUMsOIn8TWrDNTKGsAHPlS7w=,tag:/c4MnDfLXQpBZDqVxZ0DTg==,type:str]
+immich:
+    database: ENC[AES256_GCM,data:1fjOQsLZcq/T+r+AkzomWwCQWw==,iv:c4pn2rC+3xkxLJ7uAdhnTE6zVTRQkfuKK3tjUyDhfAw=,tag:kvk7DOv6X/+RDxfPxVak7w==,type:str]
 sops:
     age:
         - recipient: age1yvdzvuvu5wqztcx6ll2xk6x547uuyqy735tjjdd7zftkz53jsf9qf5ahue
@@ -43,7 +47,7 @@ sops:
             by9aNFY4dXNxaWxnTXFTQS9reHhuQWMKh5rZ93nFtBV9EpFVRp+E+GXZ6xzVy2Jw
             vFh4deGcAb60q4odSaeWfk1Dr7L9Ua69oK9omjbCNUt+P7Kwlfca7Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-08-07T19:03:58Z"
+    lastmodified: "2026-02-25T00:28:13Z"
-    mac: ENC[AES256_GCM,data:Rjb4uTow01fHFOcjKFBCvqpow+yAeSY0RymCoSFUNhavsE4HBqhw2acWsNkXqTQA1FxczJP5mtesYNzg7tQR2fN+a/T5jG7q5sC+RYQkDZPy5ECVxEv3J+BtXmMuKJS3YadiIy0iQTXiiwmYBo8cnKIDxQ75AQLoGCGxSr42NU8=,iv:aSevCC9kbYnTy9KuXcxjaeFmERa+qCn9E3ANCJ2CqoU=,tag:RC0H+lRWfBfOGX2VJoAfyg==,type:str]
+    mac: ENC[AES256_GCM,data:hDmqObrtfoVkQqz8JPkqlyXMbiuyBophjdZNLvTFrZw3pAVNCuzsH4zxFBOaxJttkzLc65DWDHDeEIBY5YZam1GLFFXUQ5E3Dxno7hnyzOoM2ipgDTOacI0gbKJAWgGUF3LNDdqVoREA9LC91LoNUJoNmzpTSFtuLb7ORuwCrH4=,iv:8+W3n1Cr6woEiPU9ECaMYM64HNmFHr2AIw6UohCJi00=,tag:7drkZiPAUHaEx5PagXA9JQ==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.11.0

system/features/container-dev.nix

@@ -3,13 +3,18 @@
   virtualisation = {
     docker = {
       enable = true;
-      rootless = {
+      # rootless = {
-        enable = true;
+      #   enable = true;
-        setSocketVariable = true;
+      #   setSocketVariable = true;
-      };
+      # };
     };
+
+    # Do not use Podman in Wayland/Hyperland.  It will crash the session.  Very annoying.
+    # podman.enable = true;
   };
 
+  hardware.nvidia-container-toolkit.enable = true;
+
   home-manager.users.drew =
     { ... }:
     {

system/features/printing.nix

@@ -0,0 +1,21 @@
+{ pkgs, ... }:
+{
+  services.printing = {
+    enable = true;
+    drivers = [ pkgs.brlaser ];
+  };
+  hardware.printers = {
+    ensurePrinters = [
+      {
+        name = "Brother_HL-L2370DW_series";
+        location = "Home";
+        deviceUri = "dnssd://Brother%20HL-L2370DW%20series._ipp._tcp.local/?uuid=e3248000-80ce-11db-8000-3c2af4f28c38";
+        model = "drv:///brlaser.drv/brl2370d.ppd";
+        ppdOptions = {
+          PageSize = "Letter";
+        };
+      }
+    ];
+    ensureDefaultPrinter = "Brother_HL-L2370DW_series";
+  };
+}

system/features/web-containers.nix

@@ -79,7 +79,7 @@
           }:
           let
             fqn = "${hostname}.${domain}";
-            serviceName = lib.strings.replaceChars [ "." ] [ "-" ] fqn;
+            serviceName = builtins.replaceStrings [ "." ] [ "-" ] fqn;
             routerRule = if public then hostRule hostname domain else localHostRule hostname domain;
             homepageLabels =
               if homepageOpts == { } then
@@ -109,8 +109,7 @@
               extraOptions
               ;
             autoStart = true;
-            labels =
+            labels = {
-              {
               "traefik.enable" = "true";
               "traefik.http.routers.${serviceName}.rule" = "${routerRule}";
               "traefik.http.routers.${serviceName}.service" = "${serviceName}";

system/hosts/altair/drew.nix

@@ -8,6 +8,8 @@ in
 {
   imports =
     map (x: ../../../home-manager + x) [
+      "/features/astronomy.nix"
+      "/features/chat.nix"
       "/features/development/development.nix"
       "/features/development/docker.nix"
       "/features/development/haskell.nix"
@@ -16,6 +18,7 @@ in
       "/features/development/vscode.nix"
       "/features/eww"
       "/features/gaming.nix"
+      "/features/image-editing.nix"
       "/features/linux-desktop.nix"
       "/features/notes.nix"
       "/features/3d-printing.nix"

system/hosts/altair/hardware-configuration.nix

@@ -13,10 +13,14 @@
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
   # Bootloader.
-  boot.loader.systemd-boot.enable = true;
+  boot = {
-  boot.loader.efi.canTouchEfiVariables = true;
+    loader = {
+      systemd-boot.enable = true;
+      efi.canTouchEfiVariables = true;
+    };
 
-  boot.initrd.availableKernelModules = [
+    initrd = {
+      availableKernelModules = [
         "xhci_pci"
         "ahci"
         "nvme"
@@ -24,16 +28,19 @@
         "usb_storage"
         "sd_mod"
       ];
-  boot.initrd.kernelModules = [ ];
+      kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
+    };
-  boot.extraModulePackages = [ ];
+    kernelModules = [ "kvm-intel" ];
+    extraModulePackages = [ ];
+  };
 
-  fileSystems."/" = {
+  fileSystems = {
+    "/" = {
       device = "/dev/disk/by-uuid/343c0ac5-3973-49b3-964a-6ad90c36b89c";
       fsType = "ext4";
     };
 
-  fileSystems."/boot" = {
+    "/boot" = {
       device = "/dev/disk/by-uuid/5F99-043D";
       fsType = "vfat";
       options = [
@@ -42,10 +49,11 @@
       ];
     };
 
-  fileSystems."/home" = {
+    "/home" = {
       device = "/dev/disk/by-uuid/28f4fb41-9414-4504-a767-c2e8bf5eb2c8";
       fsType = "ext4";
     };
+  };
 
   swapDevices = [ ];
 
@@ -58,17 +66,16 @@
   # networking.interfaces.wlo1.useDHCP = lib.mkDefault true;
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-
-  # Graphics settings
-  hardware.graphics = {
-    enable = true;
-    enable32Bit = true;
-  };
 
   services.xserver.videoDrivers = [ "nvidia" ];
 
-  hardware.nvidia = {
+  hardware = {
+    cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+    graphics = {
+      enable = true;
+      enable32Bit = true;
+    };
+    nvidia = {
       # Other options include:
       # stable - Current stable
       # production - Same as stable
@@ -79,7 +86,7 @@
       #
       # Current versions can be found in https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/os-specific/linux/nvidia-x11/default.nix
       #
-    package = config.boot.kernelPackages.nvidiaPackages.production;
+      package = config.boot.kernelPackages.nvidiaPackages.beta;
 
       modesetting.enable = true;
 
@@ -100,6 +107,7 @@
       # Enable the nvidia-settings menu?
       nvidiaSettings = true;
     };
+  };
 
   # Add a udev rule to prevent the mouse from waking the system.  Note that it
   # has two entries depending on whether it's plugged in or not.

system/hosts/mcp/containers.nix

@@ -160,10 +160,10 @@
             "-l=homepage.widget.type=scrutiny"
             "-l=homepage.widget.url=http://scrutiny:8080"
             "--cap-add=SYS_RAWIO"
-            "--device=/dev/sda:/dev/sda"
+            "--device=/dev/disk/by-id/wwn-0x5000cca26fca1aed:/dev/disk/by-id/wwn-0x5000cca26fca1aed"
-            "--device=/dev/sdb:/dev/sdb"
+            "--device=/dev/disk/by-id/wwn-0x5000cca26fef696c:/dev/disk/by-id/wwm-0x5000cca26fef696c"
-            "--device=/dev/sdc:/dev/sdc"
+            "--device=/dev/disk/by-id/wwn-0x5000cca270db1d0e:/dev/disk/by-id/wwn-0x5000cca270db1d0e"
-            "--device=/dev/sdd:/dev/sdd"
+            # "--device=/dev/sdd:/dev/sdd" Removing this one while the disk is down
           ];
           volumes = [
             "/run/udev:/run/udev:ro"

system/hosts/mcp/containers/dm-companion.nix

@@ -100,7 +100,7 @@ in
         "dm-companion-pocketbase"
       ];
       volumes = [
-        "/tank/web/dm.terakoda.com/dist:/usr/share/nginx/html:ro"
+        "/tank/web/dm.terakoda.com/deployed:/usr/share/nginx/html:ro"
         "${nginxConf}:/etc/nginx/nginx.conf:ro"
       ];
     };

system/hosts/mcp/containers/havenisms.com/default.nix

@@ -2,7 +2,10 @@
 {
   imports = [
     ./chat.nix
+    # Currently disabled because it doesn't start up properly
+    # ./immich.nix
     ./storyden.nix
     ./tandoor.nix
+    ./wallabag.nix
   ];
 }

system/hosts/mcp/containers/havenisms.com/immich.nix

@@ -0,0 +1,73 @@
+{ config, ... }:
+let
+  inherit (import ../lib.nix config) havenisms mkPostgresContainer;
+in
+{
+  imports = [
+    (mkPostgresContainer {
+      # Immich wants a custom build of postgres with the vectors extensions.
+      image = "ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:c44be5f2871c59362966d71eab4268170eb6f5653c0e6170184e72b38ffdf107";
+      name = "immich";
+      directory = "/tank/immich/db";
+      uid = config.users.users.immich.uid;
+      gid = config.users.groups.immich.gid;
+      passwordSecret = "immich/database";
+    })
+  ];
+
+  sops.secrets = {
+    "immich/database" = {
+      restartUnits = [
+        "${config.local.container-backend}-immich-db.service"
+      ];
+      mode = "0400";
+      owner = config.users.users.immich.name;
+    };
+  };
+
+  sops.templates."immich.env" = {
+    restartUnits = [ "${config.local.container-backend}-immich.service" ];
+    owner = config.users.users.immich.name;
+    content = ''
+      DB_HOSTNAME=immich-postgres
+      DB_PASSWORD=${config.sops.placeholder."immich/database"}
+      DB_USERNAME=immich
+      DB_DATABASE_NAME=immich
+      REDIS_HOSTNAME=immich-redis
+      IMMICH_LOG_LEVEL=verbose
+    '';
+  };
+
+  virtualisation.web-containers.containers.immich = {
+    image = "ghcr.io/immich-app/immich-server:release";
+    hostname = "immich";
+    domain = havenisms;
+    port = 2283;
+    volumes = [
+      "/tank/photos/immich:/data"
+      "/etc/localtime:/etc/localtime:ro"
+    ];
+    dependsOn = [
+      "immich-redis"
+      "immich-postgres"
+    ];
+    environmentFiles = [
+      "${config.sops.templates."immich.env".path}"
+    ];
+  };
+
+  virtualisation.oci-containers.containers = {
+    "immich-redis" = {
+      image = "docker.io/valkey/valkey";
+    };
+    "immich-machine-learning" = {
+      image = "ghcr.io/immich-app/immich-machine-learning:release";
+      volumes = [
+        "model-cache:/cache"
+      ];
+      environmentFiles = [
+        "${config.sops.templates."immich.env".path}"
+      ];
+    };
+  };
+}

system/hosts/mcp/containers/havenisms.com/wallabag.nix

@@ -0,0 +1,19 @@
+{ config, ... }:
+let
+  inherit (import ../lib.nix config) havenisms;
+in
+{
+  virtualisation.web-containers.containers.wallabag = {
+    image = "wallabag/wallabag";
+    hostname = "wallabag";
+    domain = havenisms;
+    port = 80;
+    volumes = [
+      "wallabag-data:/var/www/wallabag/data"
+      "wallabag-images:/var/www/wallabag/web/assets/images"
+    ];
+    environment = {
+      SYMFONY__ENV__DOMAIN_NAME = "https://wallabag.${havenisms}";
+    };
+  };
+}

system/hosts/mcp/containers/lib.nix

@@ -70,8 +70,7 @@ in
         extraOptions
         ;
       autoStart = true;
-      labels =
+      labels = {
-        {
         "traefik.enable" = "true";
         "traefik.http.routers.${hostName}.rule" = "${routerRule}";
         "traefik.http.services.${hostName}.loadbalancer.server.port" = "${toString port}";
@@ -127,11 +126,12 @@ in
       containerName ? "${name}-postgres",
       databaseName ? name,
       username ? name,
+      image ? "postgres",
     }:
     { config, ... }:
     {
       virtualisation.oci-containers.containers."${containerName}" = {
-        image = "postgres";
+        inherit image;
         autoStart = true;
         volumes = [
           # Note that data must be mounted at this location to persist.

system/hosts/mcp/containers/media-system.nix

@@ -6,12 +6,45 @@ let
     havenisms
     mkContainer
     ;
+  gluetun_env = "gluetun-proton-vpn-wireguard.env";
 in
 {
 
+  sops.secrets = {
+    "protonvpn/private_key" = {
+      restartUnits = [ "${config.local.container-backend}-gluetun.service" ];
+    };
+  };
+
+  # Example Wireguard config file:
+  # # Key for MCP Wireguard
+  # # Bouncing = 13
+  # # NetShield = 1
+  # # Moderate NAT = off
+  # # NAT-PMP (Port Forwarding) = on
+  # # VPN Accelerator = on
+  # PrivateKey = ${config.sops.placeholder."protonvpn/private_key"}
+  # Address = 10.2.0.2/32
+  # DNS = 10.2.0.1
+  #
+  # [Peer]
+  # # US-CA#906
+  # PublicKey = 2xvxhMK0AalXOMq6Dh0QMVJ0Cl3WQTmWT5tdeb8SpR0=
+  # AllowedIPs = 0.0.0.0/0, ::/0
+  # Endpoint = 79.127.185.166:51820
+  #
+  # PersistentKeepalive = 25
+  sops.templates.${gluetun_env}.content = ''
+    VPN_SERVICE_PROVIDER=protonvpn
+    VPN_TYPE=wireguard
+    WIREGUARD_PRIVATE_KEY="${config.sops.placeholder."protonvpn/private_key"}"
+    SERVER_COUNTRIES="United States,United Kingdom,Netherlands,Switzerland,Sweden"
+    VPN_PORT_FORWARDING=on
+  '';
+
   virtualisation.oci-containers.containers = {
     jellyfin = {
-      image = "lscr.io/linuxserver/jellyfin";
+      image = "lscr.io/linuxserver/jellyfin:10.11.6";
       autoStart = true;
       extraOptions = [
         "--device=/dev/dri:/dev/dri"
@@ -110,12 +143,8 @@ in
         "127.0.0.1:8083:8000"
       ];
       environmentFiles = [
-        "/tank/config/gluetun/vpn.env"
+        config.sops.templates.${gluetun_env}.path
       ];
-      environment = {
-        VPN_SERVICE_PROVIDER = "protonvpn";
-        UMASK = "002";
-      };
     };
     prowlarr = {
       image = "lscr.io/linuxserver/prowlarr";

system/hosts/mcp/containers/users.nix

@@ -1,4 +1,5 @@
-{ pkgs, ... }: let
+{ pkgs, ... }:
+let
   systemUsers = {
     gitea = {
       uid = 2001;
@@ -19,6 +20,7 @@
       home = "/tank/web";
       packages = [ pkgs.git ];
     };
+    immich = 2009;
   };
 
   mkUser = name: value: {
@@ -32,20 +34,25 @@
     home = value.home or "/var/empty";
     packages = value.packages or [ ];
   };
-  mkGroup = name: value: let
+  mkGroup =
+    name: value:
+    let
       # 1. Value if int
       # 2. "gid" if present
       # 3. "uid"
       gid =
-      if builtins.isInt value
+        if builtins.isInt value then
-      then value
+          value
-      else if builtins.hasAttr "gid" value
+        else if builtins.hasAttr "gid" value then
-        then value.gid
+          value.gid
-        else value.uid;
+        else
-  in {
+          value.uid;
+    in
+    {
       inherit gid;
     };
-in {
+in
+{
   users.users = builtins.mapAttrs mkUser systemUsers;
   users.groups = (builtins.mapAttrs mkGroup systemUsers) // {
     # Legacy groups.

system/hosts/mcp/default.nix

@@ -6,6 +6,7 @@
     ../../authorized-keys.nix
     inputs.sops-nix.nixosModules.sops
     ../../features/gc.nix
+    ../../features/printing.nix
   ];
 
   nixpkgs.config.allowUnfree = true;

system/hosts/mcp/static-site-hooks.nix

@@ -8,10 +8,11 @@ let
     writeShellScript "migrate-pocketbase" ''
       set -e
 
-      id
+      echo "Migrating in $(pwd) as $(id)"
-      pwd
 
       ${pkgs.pocketbase}/bin/pocketbase migrate up
+
+      echo "Migration complete"
     '';
   deployNpmApp =
     with pkgs;
@@ -26,10 +27,12 @@ let
       ];
       text = ''
         set -e
-        id
-        pwd
 
-        output_dir="./$(date --utc --iso-8601=seconds)"
+        echo "Deploying in $(pwd) as $(id)"
+
+        OUTPUT_DIR="./$(date --utc --iso-8601=seconds)"
+
+        echo "Deploying into $OUTPUT_DIR"
 
         export GIT_SSH_COMMAND='ssh -v -o "UserKnownHostsFile ${gitKnownHosts}" -i "${
           config.sops.secrets."deploy-key/mcp".path
@@ -46,9 +49,12 @@ let
 
         # Use a local cache with --cache .npm
         npm ci --cache .npm
-        npm run build -- --outDir "$output_dir"
+        npm run build -- --outDir "$OUTPUT_DIR"
+
+        echo "Activating $OUTPUT_DIR"
         # Trailing slash on source to only copy contents, not the directory itself
-        rsync --archive --delete "$output_dir"/ deployed
+        rsync --archive --delete "$OUTPUT_DIR"/ deployed
+        echo "Deployment complete"
       '';
     };
 in

system/hosts/vega/configuration.nix

@@ -107,10 +107,16 @@
   };
 
   # Enable flakes
-  nix.settings.experimental-features = [
+  nix = {
+    # Binary caches for Reflex FRP
+    binaryCaches = [ "https://nixcache.reflex-frp.org" ];
+    binaryCachePublicKeys = [ "ryantrinkle.com-1:JJiAKaRv9mWgpVAz8dwewnZe0AzzEAzPkagE9SP5NWI=" ];
+
+    settings.experimental-features = [
       "nix-command"
       "flakes"
     ];
+  };
 
   services.openssh.enable = true;
 

system/hosts/vega/drew.nix

@@ -1,7 +1,8 @@
-{ pkgs, lib, ... }:
+{ pkgs, ... }:
 {
   imports =
     map (x: ../../../home-manager + x) [
+      "/features/chat.nix"
       "/features/development/development.nix"
       "/features/development/docker.nix"
       "/features/development/haskell.nix"
@@ -9,6 +10,7 @@
       "/features/development/typescript.nix"
       "/features/development/vscode.nix"
       "/features/eww"
+      "/features/image-editing.nix"
       "/features/linux-desktop.nix"
       "/features/notes.nix"
     ]