hosts/suwako: prevent spam on gitea

Signed-off-by: Amneesh Singh <natto@weirdnatto.in>

conf/colors.nix

@@ -1,6 +1,6 @@
 #Catpuccin Mocha
 let
-  colors = rec{
+  colors = rec {
     rosewater = "#F5E0DC";
     flamingo = "#F2CDCD";
     pink = "#F5C2E7";
@@ -37,5 +37,9 @@ in
 rec {
   default = with builtins; mapAttrs (_: color: substring 1 6 color) colors; # hex without hash
   hex = colors; # hex with hash
-  argb = { a ? "ff" }: builtins.mapAttrs (_:color: a + color) default; # ARGB
+  argb =
+    {
+      a ? "ff",
+    }:
+    builtins.mapAttrs (_: color: a + color) default; # ARGB
 }

conf/network.nix

@@ -9,10 +9,14 @@
         marisa = "${ipPrefix}.2";
         satori = "${ipPrefix}.3";
         hina = "${ipPrefix}.4";
+        okina = "${ipPrefix}.5";
+        suwako = "${ipPrefix}.6";
       };
     };
     domain = {
       natto = "weirdnatto.in";
+      amneesh = "amneesh.com";
+      chutiya = "chutiya.online";
     };
   };
 

flake.nix

@@ -1,56 +1,13 @@
 {
   description = "dotfiles";
 
-  inputs = {
-    nixpkgs.url = github:nixos/nixpkgs/nixpkgs-unstable;
-
-    stable.url = github:nixos/nixpkgs/release-24.05;
-
-    flake-parts.url = github:hercules-ci/flake-parts;
-
-    home-manager = {
-      url = github:nix-community/home-manager;
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    mailserver = {
-      url = gitlab:simple-nixos-mailserver/nixos-mailserver;
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    filehost = {
-      url = github:natto1784/simpler-filehost;
-    };
-
-    nix-gaming.url = github:fufexan/nix-gaming;
-
-    nbfc = {
-      url = github:nbfc-linux/nbfc-linux;
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    emacs-overlay.url = github:nix-community/emacs-overlay;
-
-    nvim-overlay.url = github:nix-community/neovim-nightly-overlay;
-
-    hyprland = {
-      type = "git";
-      url = "https://github.com/hyprwm/Hyprland";
-      submodules = true;
-    };
-
-    hyprland-contrib = {
-      url = github:hyprwm/contrib;
-    };
-
-    agenix.url = github:ryantm/agenix;
-
-    ags.url = github:Aylur/ags;
-  };
-
-  outputs = inputs@{ self, ... }:
+  outputs =
+    inputs@{ self, ... }:
     inputs.flake-parts.lib.mkFlake { inherit inputs; } {
-      systems = [ "x86_64-linux" "aarch64-linux" ];
+      systems = [
+        "x86_64-linux"
+        "aarch64-linux"
+      ];
 
       imports = [
         ./hosts
@@ -59,18 +16,70 @@
         ./conf
       ];
 
-      perSystem = { system, pkgs, ... }:
+      perSystem =
+        { system, pkgs, ... }:
         rec {
-          formatter = pkgs.nixpkgs-fmt;
-          devShells.default = with pkgs; mkShell {
-            packages = [
-              nixd
-              formatter
-            ];
-          };
+          formatter = pkgs.nixfmt-tree;
+          devShells.default =
+            with pkgs;
+            mkShell {
+              packages = [
+                nixd
+                formatter
+              ];
+            };
           _module.args.pkgs = import inputs.nixpkgs {
             inherit system;
           };
         };
     };
+
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+
+    stable.url = "github:nixos/nixpkgs/release-24.05";
+
+    flake-parts.url = "github:hercules-ci/flake-parts";
+
+    home-manager = {
+      url = "github:nix-community/home-manager";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    mailserver = {
+      url = "gitlab:simple-nixos-mailserver/nixos-mailserver";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    filehost = {
+      url = "github:natto1784/yamaf";
+    };
+
+    nix-gaming.url = "github:fufexan/nix-gaming";
+
+    nbfc = {
+      url = "github:nbfc-linux/nbfc-linux";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    emacs-overlay.url = "github:nix-community/emacs-overlay";
+
+    nvim-overlay.url = "github:nix-community/neovim-nightly-overlay";
+
+    hyprland = {
+      type = "git";
+      url = "https://github.com/hyprwm/Hyprland";
+      submodules = true;
+    };
+
+    hyprland-contrib = {
+      url = "github:hyprwm/contrib";
+    };
+
+    agenix.url = "github:ryantm/agenix";
+
+    ags.url = "github:Aylur/ags/v1";
+
+    nixgl.url = "github:nix-community/nixGL";
+  };
 }

home/README

@@ -0,0 +1,8 @@
+natto        : default user for okina    (desktop      - NixOS Unstable)
+natto-laptop : default user for satori   (laptop       - NixOS Unstable)
+bat          : default user for remilia  (Oracle VM    - NixOS Unstable)
+spin         : default user for hina     (Oracle VM    - NixOS Unstable)
+spark        : default user for marisa   (RPi4         - NixOS Unstable)
+kero         : default user for suwako   (ARM OracleVM - NixOS Unstable)
+amneesh      : default user for nightbug (Workplace PC - Arch Linux)
+

home/amneesh/default.nix

@@ -0,0 +1,37 @@
+{
+  config,
+  pkgs,
+  inputs,
+  ...
+}:
+{
+  home = {
+    homeDirectory = "/home/amneesh";
+    username = "amneesh";
+    stateVersion = "24.05";
+  };
+
+  targets.genericLinux.enable = true;
+
+  imports = [
+    ./pkgs.nix
+    ./nixgl.nix
+    ./screen.nix
+    ./wayvnc.nix
+
+    # From personal
+    ../natto/ags
+    ../natto/emacs.nix
+    ../natto/browser.nix
+    ../natto/dunst.nix
+    ../natto/gtk.nix
+    ../natto/cursor.nix
+    ../natto/wayland.nix
+    ../natto/hypridle.nix
+    ../natto/hyprlock.nix
+    ../natto/hyprpaper.nix
+    ../natto/hyprland.nix
+    ../natto/tofi.nix
+    ../natto/foot.nix
+  ];
+}

home/amneesh/nixgl.nix

@@ -0,0 +1,29 @@
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  ...
+}:
+let
+  inherit (inputs) nixgl;
+  inherit (inputs.hyprland.packages.${pkgs.system}) hyprland;
+  inherit (config.lib.nixGL) wrap;
+in
+{
+  nixGL = {
+    packages = nixgl.packages;
+    defaultWrapper = "mesa";
+    offloadWrapper = "nvidiaPrime";
+    installScripts = [
+      "mesa"
+      "nvidiaPrime"
+    ];
+  };
+
+  # hyprland
+  wayland.windowManager.hyprland.package = lib.mkForce (wrap hyprland);
+
+  # hypridle
+  services.hypridle.package = lib.mkForce (wrap pkgs.hypridle);
+}

home/amneesh/pkgs.nix

@@ -0,0 +1,29 @@
+{
+  pkgs,
+  inputs,
+  ...
+}:
+{
+
+  xdg.mime.enable = true;
+  programs = {
+    bash.enable = true;
+  };
+
+  home.packages = with pkgs; [
+    cmake
+    corkscrew
+    dtc
+    file
+    htop
+    llvmPackages.clang
+    (nattovim.override { nvimPackage = inputs.nvim-overlay.packages.${pkgs.system}.neovim; })
+    meson
+    ninja
+    thunderbird
+    wget
+    xfce.thunar
+    libreoffice
+    git-repo
+  ];
+}

home/amneesh/screen.nix

@@ -0,0 +1,12 @@
+{ pkgs, ... }:
+{
+  home = {
+    packages = [ pkgs.screen ];
+
+    file = {
+      ".screenrc".text = ''
+        defscrollback 10000
+      '';
+    };
+  };
+}

home/amneesh/wayvnc.nix

@@ -0,0 +1,13 @@
+{
+  ...
+}:
+{
+  services.wayvnc = rec {
+    enable = true;
+    autoStart = enable;
+    settings = {
+      address = "0.0.0.0";
+      port = 5900;
+    };
+  };
+}

home/common/direnv/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  programs.direnv.enable = true;
+}

home/common/fonts/default.nix

@@ -0,0 +1,20 @@
+{ pkgs, ... }:
+{
+  home.packages = with pkgs; [
+    fira-code
+    fira-mono
+    monoid
+    font-awesome
+    material-icons
+    material-design-icons
+    lohit-fonts.devanagari
+    lohit-fonts.gurmukhi
+    office-code-pro
+    eb-garamond
+    noto-fonts-cjk-sans
+    takao
+    liberation_ttf
+  ];
+
+  fonts.fontconfig.enable = true;
+}

home/common/programs.nix

@@ -1,8 +0,0 @@
-{ config, ... }:
-{
-  programs = {
-    home-manager.enable = true;
-    password-store.enable = true;
-    direnv.enable = true;
-  };
-}

home/common/zsh/default.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ lib, ... }:
 {
   programs.zsh = {
     enable = true;
@@ -16,9 +16,13 @@
       prompt.theme = "pure";
       autosuggestions.color = "fg=yellow,bold";
       utility.safeOps = false;
+      extraConfig = lib.mkBefore ''
+        export GREP_COLORS="mt=01;31"
+      '';
     };
-    initExtra = ''
+    initContent = lib.mkAfter ''
       unsetopt extendedGlob
+      [[ -f ~/.zsh_custom ]] && source ~/.zsh_custom
     '';
   };
 }

home/default.nix

@@ -1,84 +1,122 @@
-{ self, inputs, globalArgs, ... }:
+{
+  self,
+  inputs,
+  globalArgs,
+  ...
+}:
 let
   common = [
-    ./common/zsh.nix
-    ./common/programs.nix
+    { programs.home-manager.enable = true; }
+    ./common/zsh
+    ./common/direnv
+    ./common/laptop.nix
+    inputs.agenix.homeManagerModules.default
   ];
 
-  mkPkgs = system: import inputs.nixpkgs {
-    inherit system;
-    config = {
-      allowUnfree = true;
-      allowBroken = true;
-      allowInsecure = true;
+  mkPkgs =
+    system: overlays:
+    import inputs.nixpkgs {
+      inherit system;
+      config = {
+        allowUnfree = true;
+        allowBroken = true;
+        allowInsecure = true;
+      };
+      overlays = overlays ++ [ self.overlays.default ];
     };
-    overlays = [ self.overlays.default ];
-  };
 
   extraSpecialArgs = globalArgs;
 in
 {
-  flake.homeConfigurations =
-    let
-
-      nattoModules = [
+  flake.homeConfigurations = {
+    natto-laptop = inputs.home-manager.lib.homeManagerConfiguration {
+      inherit extraSpecialArgs;
+      modules = [
         ./natto
-        ./common/laptop.nix
-        inputs.agenix.homeManagerModules.default
-      ] ++ common;
-    in
-    {
-      natto-laptop = inputs.home-manager.lib.homeManagerConfiguration {
-        inherit extraSpecialArgs;
-        modules = nattoModules ++ [
-          { isLaptop = true; }
-        ];
-        pkgs = mkPkgs "x86_64-linux";
-      };
+        ./common/fonts
+        { isLaptop = true; }
+      ]
+      ++ common;
+      pkgs = mkPkgs "x86_64-linux" [ ];
+    };
 
-      natto = inputs.home-manager.lib.homeManagerConfiguration {
-        inherit extraSpecialArgs;
-        modules = nattoModules;
-        pkgs = mkPkgs "x86_64-linux";
-      };
+    natto = inputs.home-manager.lib.homeManagerConfiguration {
+      inherit extraSpecialArgs;
+      modules = [
+        ./natto
+        ./common/fonts
+      ]
+      ++ common;
+      pkgs = mkPkgs "x86_64-linux" [ ];
+    };
 
-    }
-
-    // {
-      spark = inputs.home-manager.lib.homeManagerConfiguration {
-        inherit extraSpecialArgs;
-        modules = [{
+    spark = inputs.home-manager.lib.homeManagerConfiguration {
+      inherit extraSpecialArgs;
+      modules = [
+        {
           home = {
             homeDirectory = "/home/spark";
             username = "spark";
             stateVersion = "23.05";
           };
-        }] ++ common;
-        pkgs = mkPkgs "aarch64-linux";
-      };
+        }
+      ]
+      ++ common;
+      pkgs = mkPkgs "aarch64-linux" [ ];
+    };
 
-      bat = inputs.home-manager.lib.homeManagerConfiguration {
-        inherit extraSpecialArgs;
-        modules = [{
+    bat = inputs.home-manager.lib.homeManagerConfiguration {
+      inherit extraSpecialArgs;
+      modules = [
+        {
           home = {
             homeDirectory = "/home/bat";
             username = "bat";
             stateVersion = "23.05";
           };
-        }] ++ common;
-        pkgs = mkPkgs "x86_64-linux";
-      };
+        }
+      ]
+      ++ common;
+      pkgs = mkPkgs "x86_64-linux" [ ];
+    };
 
-      spin = inputs.home-manager.lib.homeManagerConfiguration {
-        inherit extraSpecialArgs;
-        modules = [{
+    spin = inputs.home-manager.lib.homeManagerConfiguration {
+      inherit extraSpecialArgs;
+      modules = [
+        {
           home = {
             homeDirectory = "/home/spin";
             username = "spin";
             stateVersion = "23.05";
           };
-        }] ++ common;
-        pkgs = mkPkgs "x86_64-linux";
-      };
+        }
+      ]
+      ++ common;
+      pkgs = mkPkgs "x86_64-linux" [ ];
     };
+
+    kero = inputs.home-manager.lib.homeManagerConfiguration {
+      inherit extraSpecialArgs;
+      modules = [
+        {
+          home = {
+            homeDirectory = "/home/kero";
+            username = "kero";
+            stateVersion = "24.05";
+          };
+        }
+      ]
+      ++ common;
+      pkgs = mkPkgs "aarch64-linux" [ ];
+    };
+
+    amneesh = inputs.home-manager.lib.homeManagerConfiguration {
+      inherit extraSpecialArgs;
+      modules = [
+        ./amneesh
+      ]
+      ++ common;
+      pkgs = mkPkgs "x86_64-linux" [ (import ./overlays/standalone.nix) ];
+    };
+  };
 }

home/natto/ags/default.nix

@@ -1,26 +1,35 @@
-{ pkgs, lib, config, inputs, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
   cfg = config.programs.ags;
 
-  deps = with pkgs; [
-    sass
-    gawk
-    bash
-    procps
-    coreutils
-    imagemagick
-    systemd
-    config.wayland.windowManager.hyprland.package
-  ] ++ lib.optional config.isLaptop brightnessctl;
-
+  deps =
+    with pkgs;
+    [
+      sass
+      gawk
+      bash
+      procps
+      coreutils
+      imagemagick
+      systemd
+      config.wayland.windowManager.hyprland.package
+    ]
+    ++ lib.optional config.isLaptop brightnessctl;
 
   configDir = lib.cleanSourceWith {
     src = ./.;
-    filter = name: _:
+    filter =
+      name: _:
       let
         baseName = baseNameOf (toString name);
       in
-        !(lib.hasSuffix ".nix" baseName);
+      !(lib.hasSuffix ".nix" baseName);
   };
 in
 {
@@ -28,7 +37,10 @@ in
     inputs.ags.homeManagerModules.default
   ];
 
-  programs.ags.enable = true;
+  programs.ags = {
+    enable = true;
+    #   package = pkgs.ags_1;
+  };
 
   xdg.configFile."ags" = {
     source = configDir;
@@ -47,6 +59,7 @@ in
       Environment = "PATH=${lib.makeBinPath deps}";
       ExecStart = "${cfg.package}/bin/ags";
       Restart = "on-failure";
+      RestartSec = 10;
     };
     Install.WantedBy = [ "graphical-session.target" ];
   };

home/natto/browser.nix

@@ -0,0 +1,18 @@
+{ pkgs, ... }:
+{
+  programs = {
+    firefox = {
+      enable = true;
+      profiles.natto = {
+        name = "natto";
+      };
+    };
+    chromium = {
+      enable = true;
+      package = pkgs.ungoogled-chromium;
+    };
+  };
+  home.sessionVariables = {
+    BROWSER = "firefox";
+  };
+}

home/natto/config/emacs/config.org

@@ -1,5 +1,5 @@
 #+TITLE: My Emacs Configuration
-#+AUTHOR: Amneesh Singh
+#+AUTHOR: natto1784
 #+PROPERTY: header-args :emacs-lisp :tangle yes
 
 * Settings
@@ -20,6 +20,7 @@
 (fringe-mode 0)
 (global-display-line-numbers-mode 1)
 (xterm-mouse-mode 1)
+(electric-pair-mode)
 (setq ring-bell-function 'ignore
       gc-cons-threshold most-positive-fixnum
       initial-major-mode 'fundamental-mode)
@@ -33,7 +34,9 @@
       scroll-step 1
       display-line-numbers-type 'relative
       confirm-kill-processes nil
-      inhibit-startup-screen t)
+      inhibit-startup-screen t
+      isearch-lazy-count t
+      lazy-count-prefix-format "[%s/%s] ")
 (setq-default tab-width 2
               indent-tabs-mode nil)
 #+end_src
@@ -57,8 +60,7 @@
 #+begin_src emacs-lisp
 (use-package benchmark-init
   :config
-  ;; To disable collection of benchmark data after init is done.
-  :init (benchmark-init/deactivate))
+  (add-hook 'after-init-hook 'benchmark-init/deactivate) )
 #+end_src
 
 ** Visual packages
@@ -78,32 +80,55 @@
   (dark-theme t))
 #+end_src
 
-** Configure Selectrum
-Enable selectrum
+*** Indent guides
 #+begin_src emacs-lisp
-(use-package selectrum
-  :defer t
+(use-package highlight-indent-guides
   :config
-  (selectrum-mode +1))
+  (setq highlight-indent-guides-method 'column)
+  :hook
+  (prog-mode . highlight-indent-guides-mode))
 #+end_src
 
-Add selectrum-prescient
+** Minibuffer
+Enable vertico
 #+begin_src emacs-lisp
-(use-package selectrum-prescient
-  :config
-  (selectrum-prescient-mode +1)
-  (prescient-persist-mode +1))
+(use-package vertico
+  :init
+  (vertico-mode)
+  :bind (:map vertico-map
+              ("C-j" . vertico-next)
+              ("C-k" . vertico-previous)))
 #+end_src
 
+Save history over restarts
 #+begin_src emacs-lisp
+(use-package savehist
+  :init
+  (savehist-mode))
+#+end_src
 
+Marginalia for description
+#+begin_src emacs-lisp
+(use-package marginalia
+  :after vertico
+  :config
+  (marginalia-mode 1))
+#+end_src
+
+Orderless
+#+begin_src emacs-lisp
 (use-package orderless
-  :after selectrum
+  :after vertico
   :config
-  (setq completion-styles '(orderless basic))
-  (savehist-mode)
-  (setq orderless-skip-highlighting (lambda () selectrum-is-active)
-        selectrum-highlight-candidates-function #'orderless-highlight-matches))
+  (setq completion-styles '(orderless basic)))
+#+end_src
+
+Consult
+#+begin_src emacs-lisp
+(use-package consult
+  :bind (("M-s M-g" . consult-grep)
+         ("M-s M-f" . consult-find)
+         ("M-s M-b" . consult-buffer)))
 #+end_src
 
 ** Evil
@@ -124,6 +149,7 @@ Add selectrum-prescient
 (use-package evil
   :init
   (setq-default evil-shift-width 2)
+  (setq evil-want-keybinding nil)
   :config
   (evil-set-initial-state 'vterm-mode 'insert)
   (evil-set-undo-system 'undo-tree)
@@ -132,6 +158,22 @@ Add selectrum-prescient
   (evil-mode 1))
 #+end_src
 
+*** Evil related packages
+#+begin_src emacs-lisp
+(use-package evil-collection
+  :after evil
+  :ensure t
+  :config
+  (evil-collection-init))
+
+(use-package evil-terminal-cursor-changer
+  :after evil
+  :if (not (display-graphic-p))
+  :config
+  (evil-terminal-cursor-changer-activate))
+(use-package evil-anzu :after evil)
+#+end_src
+
 *** Configure undo tree
 To undo and redo easily like vi
 #+begin_src emacs-lisp
@@ -142,15 +184,6 @@ To undo and redo easily like vi
   (global-undo-tree-mode 1))
 #+end_src
   
-*** Miscellaneous evil related packages
-#+begin_src emacs-lisp
-(use-package evil-terminal-cursor-changer
-  :if (not (display-graphic-p))
-  :config
-  (evil-terminal-cursor-changer-activate))
-(use-package evil-anzu :after evil)
-#+end_src
-
 ** Treemacs
 *** Configure treemacs
 #+begin_src emacs-lisp
@@ -169,7 +202,9 @@ To undo and redo easily like vi
 #+begin_src emacs-lisp
 (use-package lsp-mode
   :defer t
-  :commands lsp)
+  :commands lsp
+  :init (setq lsp-enable-on-type-formatting nil)
+  :hook (prog-mode . lsp-deferred))
 #+end_src
 
 *** Configure lsp-ui
@@ -211,7 +246,6 @@ For autocomplete
   (add-to-list 'company-backends 'company-dabbrev)
   (setq company-backends (append '(company-files) (remove 'company-files company-backends)))
   :hook (after-init . global-company-mode))
-
 #+end_src
 
 *** Configure company-quickhelp
@@ -242,6 +276,8 @@ For autocomplete
 
 ** Languages
 #+begin_src emacs-lisp
+(use-package dts-mode
+  :mode ("\\.dts\\'" "\\.dtsi\\'" "\\.overlay\\'"))
 (use-package lsp-haskell
   :mode "\\.hs\\'")
 (use-package lsp-latex
@@ -262,11 +298,26 @@ For autocomplete
   :mode "\\.go\\'")
 #+end_src
 
-** Magit
+** Git
+magit for git operations
 #+begin_src emacs-lisp
 (use-package magit :defer t)
 #+end_src
 
+blamer for git blame
+#+begin_src emacs-lisp
+(use-package blamer
+  :defer 20
+  :custom
+  (blamer-idle-time 0.3)
+  (blamer-min-offset 70)
+  :config
+  (global-blamer-mode 1)
+  :init
+  (setq blamer-show-avatar-p nil
+        blamer-max-commit-message-length 72))
+#+end_src
+
 ** VTerm
 *** Configure vterm
 #+begin_src emacs-lisp
@@ -317,26 +368,64 @@ Do not use centaur tabs for now
 #+end_src
 
 ** Misc packages
+*** Icons
+For installing icons
 #+begin_src emacs-lisp
 (use-package all-the-icons
+  :defer t
   :if (display-graphic-p))
+#+end_src
 
-(use-package elcord :defer t)
-
+*** Projectile
+For tracking project root
+#+begin_src emacs-lisp
 (use-package projectile
   :defer t
   :config
   (define-key projectile-mode-map (kbd "C-x p") 'projectile-command-map)
   (projectile-mode +1))
+#+end_src
 
+*** Rainbow
+For highlighting colors
+#+begin_src emacs-lisp
 (use-package rainbow-mode :defer t)
+#+end_src
 
+*** Rainbow delimiters
+To make distinguishing parens easier
+#+begin_src emacs-lisp
 (use-package rainbow-delimiters
   :hook (prog-mode . rainbow-delimiters-mode))
-
-(use-package flex-autopair)
 #+end_src
 
+*** Olivetti
+When you want write prose or something similar
+#+begin_src emacs-lisp
+(use-package olivetti
+  :defer t
+  :diminish olivetti-mode
+  :custom
+  (olivetti-body-width 100)
+  (olivetti-minimum-body-width 50)
+  (olivetti-style 'fancy)
+  (olivetti-recall-visual-line-mode-entry-state t)
+  :config
+  (defvar-local my/olivetti--saved-line-numbers nil
+    "Stores the previous value of `display-line-numbers` before enabling Olivetti.")
+
+  (defun my/olivetti-toggle-line-numbers ()
+    "Hide line numbers when entering Olivetti, restore when exiting."
+    (if olivetti-mode
+        (progn
+          (setq my/olivetti--saved-line-numbers display-line-numbers)
+          (setq display-line-numbers nil))
+      (setq display-line-numbers my/olivetti--saved-line-numbers)))
+
+  (add-hook 'olivetti-mode-hook #'my/olivetti-toggle-line-numbers))
+#+end_src
+
+
 ** Org
 ** Add org-mode
 #+begin_src emacs-lisp
@@ -384,22 +473,31 @@ Do not use centaur tabs for now
    (latex . t)))
 #+end_src
 
-* Mode specific hooks
-#+begin_src emacs-lisp
-(add-hook 'c-mode-hook 'lsp)
-(add-hook 'c++-mode-hook 'lsp)
-(add-hook 'haskell-mode-hook #'lsp)
-(add-hook 'haskell-literate-mode-hook #'lsp)
-#+end_src
-
 * Random eye candy stuff
-
-* Custom mode line
-switched to doom modeline after using my own modeline for a while
+* Mode line
+** Doom modeline
+Switched to doom modeline after using my own modeline for a while
 #+begin_src emacs-lisp
 (use-package doom-modeline
   :init (doom-modeline-mode 1))
 #+end_src
+Also show columns
+#+begin_src emacs-lisp
+(column-number-mode 1)
+#+end_src
+
+** Nyan Mode
+#+begin_src emacs-lisp
+(use-package nyan-mode
+  :ensure t
+  :init
+  (when (display-graphic-p)
+    (nyan-mode 1))
+  :custom
+  (nyan-animate-nyancat t)
+  :config
+  (nyan-start-animation))
+#+end_src
 
 * Pop-up terminal
 Stolen from [[https://www.reddit.com/r/emacs/comments/ft84xy/run_shell_command_in_new_vterm/][this]] reddit post
@@ -427,33 +525,35 @@ Stolen from [[https://www.reddit.com/r/emacs/comments/ft84xy/run_shell_command_i
     (vterm-send-return)))
 #+end_src
 
-Compilation shortcuts for standalone files
+* LLMs
+** gptel
 #+begin_src emacs-lisp
-(defun candrun ()
-  (let ((full buffer-file-name)
-        (file (file-name-sans-extension buffer-file-name)))
-    (pcase (file-name-extension full)
-           ("c" (concat "gcc " full " -lm -pthread -o " file " && " file " && rm " file))
-           ("java" (concat "java " full))
-           ("py" (concat "python " full))
-           ("cpp" (concat "g++ " full " -o " file " && " file " && rm " file))
-           ("cc" (concat "g++ " full " -o " file " && " file " && rm " file))
-           ("hs" (concat "runhaskell " full))
-           ("sh" (concat "sh " full))
-           ("js" (concat "node " full))
-           ("ts" (concat "tsc " full " && node " file ".js && rm " file ".js" ))
-           ("rs" (concat "rustc " full " -o " file " && " file " && rm " file)))))
+(use-package gptel
+  :defer t
+  :config
+  (setq  gptel-model 'claude-sonnet-4-20250514
+         gptel-backend (gptel-make-anthropic "Claude"
+                        :stream t
+                        :protocol "https"
+                        :key (getenv "ANTHROPIC_API_KEY")
+                        :host (getenv "ANTHROPIC_API_BASE_DOMAIN")))
+  (setq gptel-default-mode 'org-mode)
+  :bind (("C-c g" . gptel)))
+
 #+end_src
 
-* Custom Functions
+** Aidermacs
 #+begin_src emacs-lisp
-(defun detach-process ()
-  "Run processes but detached from the parent"
-  (interactive)
-  (let ((command (read-string "Enter command:")))
-    (call-process-shell-command (concat command " &") nil 0)))
+(use-package aidermacs
+  :defer t
+  :bind (("C-c a" . aidermacs-transient-menu))
+  :custom
+  ; See the Configuration section below
+  (aidermacs-default-chat-mode 'architect)
+  (aidermacs-default-model "sonnet"))
 #+end_src
 
+
 * Keybinds
 ** General
 *** Colemak translations
@@ -501,7 +601,7 @@ not using this anymore
     "M-C-k" 'enlarge-window
     "C-q"  'delete-window
     "M-C-S-q"  'kill-buffer-and-window
-    "M-w"  'centaur-tabs--kill-this-buffer-dont-ask
+    "M-w"  (lambda () (interactive) (kill-buffer (current-buffer)))
     "M-S-w"  'kill-window)
 #+end_src
 
@@ -514,8 +614,7 @@ not using this anymore
       "<f4>"  (lambda () (interactive) (vterm t))
       "C-S-t" 'vterm-toggle-cd
       "C-t" 'vterm-toggle
-      "<f1>" 'vterm-toggle
-      "<f5>" (lambda () (interactive) (run-in-vterm (candrun))))
+      "<f1>" 'vterm-toggle)
     (general-define-key
       :keymaps 'vterm-mode-map
       "<f3>" 'vterm-toggle-forward

home/natto/config/hypr/hyprland.conf

@@ -1,173 +0,0 @@
-monitor=, highrr, auto, 1, bitdepth, 10
-
-input {
-    kb_layout = us
-    kb_variant = colemak_dh
-    kb_model =
-    kb_options =
-    kb_rules =
-
-    follow_mouse = 1
-
-    touchpad {
-        natural_scroll = yes
-        scroll_factor = 0.4
-    }
-
-    repeat_delay = 300
-    accel_profile = flat
-}
-
-general {
-    gaps_in = 5
-    gaps_out = 10
-    border_size = 2
-
-    # home-manager is going to override these
-    col.active_border = rgba(b4befeee) rgba(f5c2e7ff) 135deg
-    col.inactive_border = rgba(595959ff)
-
-    layout = dwindle
-}
-
-decoration {
-    rounding = 1
-    inactive_opacity = 0.8
-    drop_shadow = true
-
-    blur {
-        enabled = true
-        size = 8
-        new_optimizations = true
-        xray = true
-    }
-}
-
-animations {
-    enabled = yes
-
-    bezier =overshot,0.01, 0.9, 0.1, 1.05
-    bezier =easeoutexpo,0.16, 1, 0.3, 1
-
-    animation = windows, 1, 7, overshot, popin 50%
-    animation = windowsOut, 1, 7, easeoutexpo, popin 50%
-    animation = border, 1, 10, default
-    animation = fade, 1, 7, default
-    animation = workspaces, 1, 6, overshot
-}
-
-dwindle {
-    pseudotile = yes
-    preserve_split = yes
-}
-
-master {
-    new_is_master = false
-}
-
-gestures {
-    workspace_swipe = off
-}
-
-misc {
-    no_direct_scanout = true
-    disable_hyprland_logo = true
-}
-
-windowrule=float, ^.*(iwgtk)$
-
-$mainMod=SUPER
-
-binde=$mainMod, RETURN, exec, foot
-bindr=SUPER, D, exec, pkill tofi || tofi-drun | xargs hyprctl dispatch exec --
-bindr=SUPER SHIFT, D, exec, pkill tofi || tofi-run --require-match=false | xargs hyprctl dispatch exec --
-
-$playerctl=playerctl -p 'playerctld,%any'
-
-bind=$mainMod, P, exec, $playerctl play-pause
-bind=, XF86AudioPlay, exec, $playerctl play-pause
-bind=, XF86AudioNext, exec, $playerctl position 5+
-bind=, XF86AudioPrev, exec, $playerctl position 5-
-bind=$mainMod, XF86AudioNext, exec, $playerctl next
-bind=$mainMod, XF86AudioPrev, exec, $playerctl previous
-binde=, XF86AudioRaiseVolume, exec, wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%+
-binde=, XF86AudioLowerVolume, exec, wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-
-bind=, XF86AudioMute, exec, wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle
-
-binde=, XF86MonBrightnessUp, exec, light -A 5
-binde=, XF86MonBrightnessDown, exec, light -U 5
-
-bind=$mainMod SHIFT, F1, exec, setxkbmap us colemak_dh
-bind=$mainMod SHIFT, F2, exec, setxkbmap us basic
-bind=$mainMod SHIFT, F3, exec, setxkbmap in deva
-bind=$mainMod SHIFT, F4, exec, setxkbmap in guru
-bind=$mainMod SHIFT, F5, exec, setxkbmap colemak dhz
-
-bind=, PRINT, exec, grimblast --notify copysave screen
-bind=SHIFT, PRINT, exec, grimblast --notify copysave area
-
-binde=$mainMod SHIFT, Q, killactive,
-bind=$mainMod ALT, f, exit,
-bind=$mainMod SHIFT, t, pseudo,
-bind=$mainMod, f, fullscreen,
-bind=$mainMod, t, togglefloating,
-
-bindm=SUPER, mouse:272, movewindow
-bindm=SUPER, mouse:273, resizewindow
-
-bind=$mainMod, left, movefocus, l
-bind=$mainMod, h, movefocus, l
-bind=$mainMod, right, movefocus, r
-bind=$mainMod, l, movefocus, r
-bind=$mainMod, up, movefocus, u
-bind=$mainMod, k, movefocus, u
-bind=$mainMod, down, movefocus, d
-bind=$mainMod, j, movefocus, d
-
-binde=$mainMod SHIFT, left, movewindow, l
-binde=$mainMod SHIFT, h, movewindow, l
-binde=$mainMod SHIFT, right, movewindow, r
-binde=$mainMod SHIFT, l, movewindow, r
-binde=$mainMod SHIFT, up, movewindow, u
-binde=$mainMod SHIFT, k, movewindow, u
-binde=$mainMod SHIFT, down, movewindow, d
-binde=$mainMod SHIFT, j, movewindow, d
-
-binde=SHIFT ALT, left, resizeactive, -10 0
-binde=SHIFT ALT, h, resizeactive, -10 0
-binde=SHIFT ALT, right, resizeactive, 10 0
-binde=SHIFT ALT, l, resizeactive, 10 0
-binde=SHIFT ALT, up, resizeactive, 0 -10
-binde=SHIFT ALT, k, resizeactive, 0 -10
-binde=SHIFT ALT, down, resizeactive, 0 10
-binde=SHIFT ALT, j, resizeactive, 0 10
-
-bind=$mainMod, 1, workspace, 1
-bind=$mainMod, 2, workspace, 2
-bind=$mainMod, 3, workspace, 3
-bind=$mainMod, 4, workspace, 4
-bind=$mainMod, 5, workspace, 5
-bind=$mainMod, 6, workspace, 6
-bind=$mainMod, 7, workspace, 7
-bind=$mainMod, 8, workspace, 8
-bind=$mainMod, 9, workspace, 9
-bind=$mainMod, 0, workspace, 10
-
-bind=$mainMod SHIFT, 1, movetoworkspacesilent, 1
-bind=$mainMod SHIFT, 2, movetoworkspacesilent, 2
-bind=$mainMod SHIFT, 3, movetoworkspacesilent, 3
-bind=$mainMod SHIFT, 4, movetoworkspacesilent, 4
-bind=$mainMod SHIFT, 5, movetoworkspacesilent, 5
-bind=$mainMod SHIFT, 6, movetoworkspacesilent, 6
-bind=$mainMod SHIFT, 7, movetoworkspacesilent, 7
-bind=$mainMod SHIFT, 8, movetoworkspacesilent, 8
-bind=$mainMod SHIFT, 9, movetoworkspacesilent, 9
-bind=$mainMod SHIFT, 0, movetoworkspacesilent, 10
-
-bind=$mainMod SHIFT, comma, focusmonitor, -1
-bind=$mainMod SHIFT, period, focusmonitor, +1
-
-bind=CTRL ALT, r, pass, ^(com\.obsproject\.Studio)$
-
-exec-once=eww open bar
-exec-once=swaybg -i ~/Wallpapers/current.*

home/natto/cursor.nix

@@ -0,0 +1,13 @@
+{ pkgs, ... }:
+{
+  home.pointerCursor = {
+    package = pkgs.catppuccin-cursors.mochaFlamingo;
+    name = "catppuccin-mocha-flamingo-cursors";
+    size = 32;
+    x11 = {
+      enable = true;
+      defaultCursor = "crosshair";
+    };
+    gtk.enable = true;
+  };
+}

home/natto/default.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ ... }:
 {
   home = {
     homeDirectory = "/home/natto";
@@ -8,17 +8,32 @@
 
   imports = [
     ./email.nix
-    ./programs.nix
-    # ./xsession.nix
-    ./wayland.nix
+    ./pass.nix
+    ./browser.nix
+    ./pdf.nix
+    ./mpv.nix
     ./pkgs.nix
     ./stuff.nix
-    ./emacs.nix
     ./gtk.nix
     ./dunst.nix
     ./git.nix
     ./music.nix
     ./zsh.nix
     ./games.nix
+    ./cursor.nix
+    ./emacs.nix
+
+    # when xserver
+    # ./xsession.nix
+
+    # when wayland
+    ./wayland.nix
+    ./hyprpaper.nix
+    ./hyprlock.nix
+    ./hypridle.nix
+    ./hyprland.nix
+    ./foot.nix
+    ./tofi.nix
+    ./ags
   ];
 }

home/natto/dunst.nix

@@ -3,7 +3,9 @@
   services = {
     dunst = {
       enable = true;
-      iconTheme = with config.gtk.iconTheme; { inherit name package; };
+      iconTheme = with config.gtk.iconTheme; {
+        inherit name package;
+      };
       settings = with conf.colors.hex; {
         global = {
           mouse_left_click = "close_current";

home/natto/emacs.nix

@@ -1,6 +1,6 @@
-{ config, pkgs, inputs, lib, ... }:
+{ pkgs, inputs, ... }:
 let
-  emacs = pkgs.emacs-pgtk;
+  emacs = pkgs.emacs-git-pgtk;
   configFile = ./config/emacs/config.org;
   enable = true;
 in
@@ -25,9 +25,20 @@ in
       alwaysTangle = true;
       defaultInitFile = true;
       extraEmacsPackages = epkgs: with epkgs; [
-        use-package
-        (tree-sitter-langs.withPlugins (_: tree-sitter-langs.plugins))
-      ];
+          use-package
+          (tree-sitter-langs.withPlugins (_: tree-sitter-langs.plugins))
+        ];
+
+      override = final: prev: {
+        evil = prev.melpaPackages.evil.overrideAttrs(_: {
+          src = pkgs.fetchFromGitHub {
+            owner = "natto1784";
+            repo = "evil";
+            rev = "isearch-lazy-count";
+            sha256 = "sha256-YqXoqPqOWRvszzktb0MYHMe590mzTQxCMgBloy3MHkQ=";
+          };
+        });
+      };
     };
   };
   services.emacs = {

home/natto/email.nix

@@ -1,45 +1,94 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  conf,
+  ...
+}:
 let
-  key = "53EC089EF230E47A83BA8F8195949BD4B853F559";
-  host = "mail.weirdnatto.in";
   realName = "Amneesh Singh";
-  address = "natto@weirdnatto.in";
 in
 {
   accounts.email = {
     accounts = {
-      natto = rec {
-        inherit address realName;
-        primary = true;
-        userName = address;
-        gpg = {
-          inherit key;
-          signByDefault = true;
+      natto =
+        let
+          domain = conf.network.addresses.domain.natto;
+          address = "natto@${domain}";
+          host = "mail.${domain}";
+        in
+        {
+          inherit realName address;
+          primary = true;
+          userName = address;
+          gpg = {
+            key = "3C4BDBE7BBF45B52C14EA193007257B05FCC86A8";
+            signByDefault = true;
+          };
+          imap = {
+            inherit host;
+            tls.enable = true;
+          };
+          imapnotify.enable = true;
+          smtp = {
+            inherit host;
+            tls.enable = true;
+          };
+          mbsync = {
+            enable = true;
+            create = "both";
+          };
+          passwordCommand = "pass show email/${address}";
+          neomutt = {
+            enable = true;
+            extraMailboxes = [
+              "Sent"
+              "Drafts"
+              "Trash"
+              "Junk"
+            ];
+          };
         };
-        imap = {
-          inherit host;
-          tls.enable = true;
+
+      amneesh =
+        let
+          domain = conf.network.addresses.domain.amneesh;
+          address = "me@${domain}";
+          host = "mail.${domain}";
+        in
+        {
+          inherit address realName;
+          userName = address;
+
+          gpg = {
+            key = "0C2FDA374F2D48D9F9F0F7788EAAB36980C424C2";
+            signByDefault = true;
+          };
+
+          imap = {
+            inherit host;
+            tls.enable = true;
+          };
+          imapnotify.enable = true;
+          smtp = {
+            inherit host;
+            tls.enable = true;
+          };
+          mbsync = {
+            enable = true;
+            create = "both";
+          };
+          passwordCommand = "pass show email/${address}";
+          neomutt = {
+            enable = true;
+            extraMailboxes = [
+              "Sent"
+              "Drafts"
+              "Junk"
+            ];
+          };
         };
-        imapnotify.enable = true;
-        smtp = {
-          inherit host;
-          tls.enable = true;
-        };
-        mbsync = {
-          enable = true;
-          create = "both";
-        };
-        passwordCommand = "pass show email/${address}";
-        neomutt = {
-          enable = true;
-          extraMailboxes = [
-            "Sent"
-            "Drafts"
-            "Trash"
-            "Junk"
-          ];
-        };
-      };
     };
   };
   services = {
@@ -51,18 +100,17 @@ in
       enable = true;
       package = pkgs.neomutt;
       sort = "reverse-date";
-      extraConfig =
-        lib.concatMapStringsSep
-          "\n"
-          builtins.readFile
-          [
-            ./config/neomutt/neomuttrc
-            ./config/neomutt/theme
-          ];
+      extraConfig = lib.concatMapStringsSep "\n" builtins.readFile [
+        ./config/neomutt/neomuttrc
+        ./config/neomutt/theme
+      ];
     };
   };
   home = {
-    packages = with pkgs; [ mailcap w3m ];
+    packages = with pkgs; [
+      mailcap
+      w3m
+    ];
     file = {
       mailcap = {
         source = ./config/mailcap;

home/natto/eww/default.nix

@@ -1,15 +1,21 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 {
   programs.eww = {
     enable = true;
     package = pkgs.eww;
     configDir = lib.cleanSourceWith {
       src = ./.;
-      filter = name: _:
+      filter =
+        name: _:
         let
           baseName = baseNameOf (toString name);
         in
-          !(lib.hasSuffix ".nix" baseName);
+        !(lib.hasSuffix ".nix" baseName);
     };
   };
 
@@ -22,9 +28,8 @@
       let
         deps = [
           config.programs.eww.package
-        ] ++ lib.optional
-          config.wayland.windowManager.hyprland.enable
-          config.wayland.windowManager.hyprland.package
+        ]
+        ++ lib.optional config.wayland.windowManager.hyprland.enable config.wayland.windowManager.hyprland.package
         ++ (with pkgs; [
           coreutils
           bash
@@ -48,4 +53,3 @@
     Install.WantedBy = [ "graphical-session.target" ];
   };
 }
-

home/natto/foot.nix

@@ -0,0 +1,34 @@
+{ conf, ... }:
+{
+  programs = {
+    foot = {
+      enable = true;
+      settings = {
+        main = {
+          font = "Fira Mono:style=Regular:pixelsize=18";
+          font-bold = "Fira Mono:style=Bold:pixelsize=18";
+        };
+        scrollback.lines = 10000;
+        colors = with conf.colors.default; {
+          inherit foreground background;
+          regular0 = surface1;
+          regular1 = red;
+          regular2 = green;
+          regular3 = yellow;
+          regular4 = blue;
+          regular5 = pink;
+          regular6 = teal;
+          regular7 = subtext1;
+          bright0 = surface2;
+          bright1 = red;
+          bright2 = green;
+          bright3 = yellow;
+          bright4 = blue;
+          bright5 = pink;
+          bright6 = teal;
+          bright7 = subtext0;
+        };
+      };
+    };
+  };
+}

home/natto/games.nix

@@ -11,4 +11,3 @@
 
   programs.mangohud.enable = true;
 }
-

home/natto/gtk.nix

@@ -3,7 +3,7 @@
   gtk = {
     enable = true;
     theme = {
-      name = "Catppuccin-Mocha-Standard-Teal-Dark";
+      name = "catppuccin-mocha-teal-standard";
       package = pkgs.catppuccin-gtk.override {
         accents = [ "teal" ];
         variant = "mocha";

home/natto/hypridle.nix

@@ -0,0 +1,29 @@
+{
+  pkgs,
+  config,
+  ...
+}:
+let
+  lock = "${pkgs.systemd}/bin/loginctl lock-session";
+  timeout = 300;
+in
+{
+  # screen idle
+  services.hypridle = {
+    enable = true;
+
+    settings = {
+      general = {
+        before_sleep_cmd = lock;
+        lock_cmd = "pgrep hyprlock || ${config.programs.hyprlock.package}/bin/hyprlock";
+      };
+
+      listener = [
+        {
+          timeout = timeout;
+          on-timeout = lock;
+        }
+      ];
+    };
+  };
+}

home/natto/hyprland.nix

@@ -0,0 +1,207 @@
+{
+  pkgs,
+  inputs,
+  config,
+  lib,
+  conf,
+  ...
+}:
+{
+  wayland = {
+    windowManager = {
+      hyprland = {
+        enable = true;
+
+        package = inputs.hyprland.packages.${pkgs.system}.hyprland;
+
+        portalPackage = inputs.hyprland.packages.${pkgs.system}.xdg-desktop-portal-hyprland;
+
+        xwayland = {
+          enable = true;
+        };
+
+        settings = {
+          monitor = ", highrr, auto, 1";
+
+          input = {
+            kb_layout = "us,us";
+            kb_variant = "colemak_dh";
+            kb_model = "";
+            kb_options = "grp:rctrl_toggle";
+            kb_rules = "";
+            repeat_delay = 300;
+            accel_profile = "flat";
+            follow_mouse = true;
+
+            touchpad = {
+              natural_scroll = true;
+              scroll_factor = 0.4;
+            };
+          };
+
+          general = with conf.colors.argb { a = "ee"; }; {
+            gaps_in = 5;
+            gaps_out = 10;
+            border_size = 2;
+            layout = "dwindle";
+            "col.active_border" = "0x${mauve} 0x${flamingo} 135deg";
+            "col.inactive_border" = "0x${surface0}";
+          };
+
+          decoration = {
+            rounding = 1;
+            inactive_opacity = 0.8;
+
+            shadow = {
+              enabled = true;
+            };
+
+            blur = {
+              enabled = true;
+              size = 8;
+              new_optimizations = true;
+              xray = true;
+            };
+          };
+
+          animations = {
+            enabled = true;
+
+            bezier = [
+              "overshot,0.01,0.9,0.1,1.05"
+              "easeoutexpo,0.16,1,0.3,1"
+            ];
+
+            animation = [
+              "windows,1,7,overshot,popin 50%"
+              "windowsOut,1,7,easeoutexpo,popin 50%"
+              "border,1,10,default"
+              "fade,1,7,default"
+              "workspaces,1,6,overshot"
+            ];
+          };
+
+          cursor = {
+            no_hardware_cursors = true;
+          };
+
+          dwindle = {
+            pseudotile = true;
+            preserve_split = true;
+          };
+
+          misc = {
+            disable_hyprland_logo = true;
+          };
+
+          "$mod" = "SUPER";
+
+          bind =
+            let
+              playerctl = "playerctl -p 'playerctld,%any'";
+            in
+            [
+              # Hyprland operations
+              "$mod ALT, f, exit,"
+              "$mod SHIFT, t, pseudo,"
+              "$mod, f, fullscreen,"
+              "$mod, t, togglefloating,"
+              "$mod, left, movefocus, l"
+              "$mod, h, movefocus, l"
+              "$mod, right, movefocus, r"
+              "$mod, l, movefocus, r"
+              "$mod, up, movefocus, u"
+              "$mod, k, movefocus, u"
+              "$mod, down, movefocus, d"
+              "$mod, j, movefocus, d"
+              "$mod, 1, workspace, 1"
+              "$mod, 2, workspace, 2"
+              "$mod, 3, workspace, 3"
+              "$mod, 4, workspace, 4"
+              "$mod, 5, workspace, 5"
+              "$mod, 6, workspace, 6"
+              "$mod, 7, workspace, 7"
+              "$mod, 8, workspace, 8"
+              "$mod, 9, workspace, 9"
+              "$mod, 0, workspace, 10"
+              "$mod SHIFT, 1, movetoworkspacesilent, 1"
+              "$mod SHIFT, 2, movetoworkspacesilent, 2"
+              "$mod SHIFT, 3, movetoworkspacesilent, 3"
+              "$mod SHIFT, 4, movetoworkspacesilent, 4"
+              "$mod SHIFT, 5, movetoworkspacesilent, 5"
+              "$mod SHIFT, 6, movetoworkspacesilent, 6"
+              "$mod SHIFT, 7, movetoworkspacesilent, 7"
+              "$mod SHIFT, 8, movetoworkspacesilent, 8"
+              "$mod SHIFT, 9, movetoworkspacesilent, 9"
+              "$mod SHIFT, 0, movetoworkspacesilent, 10"
+              "$mod SHIFT, comma, focusmonitor, -1"
+              "$mod SHIFT, period, focusmonitor, +1"
+
+              # Launchers
+              "$mod, RETURN, exec, foot"
+              "$mod, D, exec, pkill tofi || tofi-drun | xargs hyprctl dispatch exec --"
+              "$mod SHIFT, D, exec, pkill tofi || tofi-run --require-match=false | xargs hyprctl dispatch exec --"
+
+              # Media
+              ", XF86AudioRaiseVolume, exec, wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%+"
+              ", XF86AudioLowerVolume, exec, wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-"
+              ", XF86AudioMute, exec, wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle"
+
+              # Backlight
+              ", XF86MonBrightnessUp, exec, light -A 5"
+              ", XF86MonBrightnessDown, exec, light -U 5"
+
+              # XWayland Keymaps
+              "$mod SHIFT, F1, exec, setxkbmap us colemak_dh"
+              "$mod SHIFT, F2, exec, setxkbmap us basic"
+
+              # Screenshot
+              ", PRINT, exec, grimblast --notify copysave screen"
+              "SHIFT, PRINT, exec, grimblast --notify copysave area"
+
+              # Playerctl
+              "$mod, P, exec, ${playerctl} play-pause"
+              ", XF86AudioPlay, exec, ${playerctl} play-pause"
+              ", XF86AudioNext, exec, ${playerctl} position 5+"
+              ", XF86AudioPrev, exec, ${playerctl} position 5-"
+              "$mod, XF86AudioNext, exec, ${playerctl} next"
+              "$mod, XF86AudioPrev, exec, ${playerctl} previous"
+            ];
+
+          binde = [
+            # Hyprland operations
+            "$mod SHIFT, Q, killactive,"
+            "$mod SHIFT, left, movewindow, l"
+            "$mod SHIFT, h, movewindow, l"
+            "$mod SHIFT, right, movewindow, r"
+            "$mod SHIFT, l, movewindow, r"
+            "$mod SHIFT, up, movewindow, u"
+            "$mod SHIFT, k, movewindow, u"
+            "$mod SHIFT, down, movewindow, d"
+            "$mod SHIFT, j, movewindow, d"
+            "SHIFT ALT, left, resizeactive, -10 0"
+            "SHIFT ALT, h, resizeactive, -10 0"
+            "SHIFT ALT, right, resizeactive, 10 0"
+            "SHIFT ALT, l, resizeactive, 10 0"
+            "SHIFT ALT, up, resizeactive, 0 -10"
+            "SHIFT ALT, k, resizeactive, 0 -10"
+            "SHIFT ALT, down, resizeactive, 0 10"
+            "SHIFT ALT, j, resizeactive, 0 10"
+          ];
+
+          bindm = [
+            # Mouse
+            "$mod, mouse:272, movewindow"
+            "$mod, mouse:273, resizewindow"
+            "$mod ALT, mouse:272, resizewindow"
+          ];
+
+          exec-once = [
+            (with config.home.pointerCursor; "hyprctl setcursor ${name} ${toString size} ")
+          ]
+          ++ (with config.programs; lib.optional eww.enable "${eww.package}/bin/eww open bar");
+        };
+      };
+    };
+  };
+}

home/natto/hyprlock.nix

@@ -0,0 +1,80 @@
+{
+  config,
+  pkgs,
+  conf,
+  ...
+}:
+{
+  programs.hyprlock = {
+    enable = true;
+
+    settings = with conf.colors.argb { a = "ee"; }; {
+      general = {
+        hide_cursor = false;
+      };
+
+      background = [
+        {
+          monitor = "";
+          path = "screenshot";
+          blur_passes = 2;
+        }
+      ];
+
+      input-field = [
+        {
+          monitor = "";
+          size = "300, 60";
+          outline_thickness = 4;
+          valign = "center";
+          halign = "center";
+
+          font_color = "0x${text}";
+          outer_color = "0x${mauve}";
+          inner_color = "0x${surface0}";
+          check_color = "0x${blue}";
+          fail_color = "0x${red}";
+          capslock_color = "0x${yellow}";
+
+          fade_on_empty = false;
+          hide_input = false;
+          placeholder_text = "Logged in as <b>$USER</b>";
+          fail_text = "Fail! <b>($ATTEMPTS)</b>";
+
+          dots_spacing = 0.2;
+          dots_center = true;
+        }
+      ];
+
+      label = [
+        {
+          monitor = "";
+          text = "Layout: $LAYOUT";
+          font_size = 25;
+          color = "0x${text}";
+          position = "30, -30";
+          valign = "top";
+          halign = "left";
+        }
+        {
+          monitor = "";
+          text = "$TIME";
+          font_size = 90;
+          color = "0x${text}";
+          position = "-30, 0";
+          valign = "top";
+          halign = "right";
+        }
+        {
+          monitor = "";
+          text = "cmd[update:3600000] date +\"%A, %d %B %Y\"";
+          font_size = 25;
+          color = "0x${text}";
+          position = "-30, -150";
+          valign = "top";
+          halign = "right";
+        }
+      ];
+    };
+  };
+}

home/natto/hyprpaper.nix

@@ -0,0 +1,18 @@
+{
+  config,
+  ...
+}:
+{
+  services.hyprpaper = {
+    enable = true;
+
+    settings =
+      let
+        wallpaper = "${config.home.homeDirectory}/wallpaper.png";
+      in
+      {
+        preload = [ "${wallpaper}" ];
+        wallpaper = [ ", ${wallpaper}" ];
+      };
+  };
+}

home/natto/mpv.nix

@@ -0,0 +1,13 @@
+{ ... }:
+{
+  programs = {
+    mpv = {
+      enable = true;
+      config = {
+        force-window = true;
+        keep-open = true;
+        save-position-on-quit = true;
+      };
+    };
+  };
+}

home/natto/music.nix

@@ -18,8 +18,7 @@ in
     };
 
     mpd-discord-rpc = {
-      #     inherit (mpd) enable;
-      enable = false;
+      inherit (mpd) enable;
       settings = {
         id = 1039532008424099850; # dont really care
         format = {
@@ -67,7 +66,7 @@ in
 
   home = {
     packages = with pkgs; [
-      playerctl
+      spotify
       mpc_cli
       (ncmpcpp.override {
         visualizerSupport = true;
@@ -82,16 +81,13 @@ in
       source = ./config/ncmpcpp/config;
       target = "${config.xdg.configHome}/ncmpcpp/config";
     };
-
-    sessionVariables = {
-      # LV2_PATH = lib.makeSearchPath "lib/lv2" (with pkgs; [ calf ]);
-    };
   };
 
-
   age.secrets.mpdasrc = {
     file = ./secrets/mpdasrc.age;
     path = "${home}/.config/mpdasrc";
     symlink = false;
   };
+
+  services.playerctld.enable = true;
 }

home/natto/pass.nix

@@ -0,0 +1,6 @@
+{ ... }:
+{
+  programs = {
+    password-store.enable = true;
+  };
+}

home/natto/pdf.nix

@@ -0,0 +1,18 @@
+{ ... }:
+{
+  programs = {
+    zathura = {
+      enable = true;
+      extraConfig = builtins.readFile ./config/zathura/zathurarc;
+      options = {
+        recolor = true;
+        recolor-lightcolor = "rgba(0,0,0,0)";
+        default-bg = "rgba(0,0,0,0.8)";
+      };
+    };
+
+    sioyek = {
+      enable = true;
+    };
+  };
+}

home/natto/pkgs.nix

@@ -1,75 +1,54 @@
-{ flake, pkgs, config, ... }:
 {
-  home.packages = with pkgs; [
-    # A/V, codec and media stuff
-    ffmpeg-full
-    wireplumber
-    pulseaudio
-    pavucontrol
-    spotify
-    imagemagick
+  flake,
+  pkgs,
+  config,
+  ...
+}:
+{
+  home.packages =
+    with pkgs;
+    [
+      # A/V, codec and media stuff
+      ffmpeg-full
+      wireplumber
+      pulseaudio
+      pavucontrol
+      imagemagick
 
-    # Utils
-    neofetch
-    rage
-    curl
-    yt-dlp
-    p7zip
-    unrar
-    vim
-    (flake.packages.${system}.customscripts)
-    cachix
-    steam-run
+      # Utils
+      neofetch
+      rage
+      curl
+      yt-dlp
+      p7zip
+      unrar
+      vim
+      (flake.packages.${system}.customscripts)
+      cachix
+      steam-run
 
-    # GUI utils
-    slack
-    webcord
-    (xfce.thunar.override {
-      thunarPlugins = with xfce; [
-        thunar-media-tags-plugin
-        thunar-volman
-        thunar-archive-plugin
-      ];
-    })
-    xfce.xfconf
-    xfce.tumbler
-    qbittorrent
-    hexchat
-    dunst
-    gnome.zenity
+      # GUI
+      vesktop
+      (xfce.thunar.override {
+        thunarPlugins = with xfce; [
+          thunar-media-tags-plugin
+          thunar-volman
+          thunar-archive-plugin
+        ];
+      })
+      xfce.xfconf
+      xfce.tumbler
+      qbittorrent
+      hexchat
+      dunst
+      zenity
 
-    # Programming and dev stuff
-    (texlive.combine {
-      inherit (texlive)
-        scheme-small
-        babel
-        lm
-        graphics-def
-        url
-        mhchem
-        wrapfig
-        capt-of
-        minted
-        fvextra
-        xstring
-        catchfile
-        framed
-        upquote
-        pdfsync
-        tocloft
-        enumitem
-        multirow
-        tcolorbox;
-    })
-    python3Packages.pygments
-
-    # Misc
-    anki
-    tor-browser-bundle-bin
-    mailcap
-    libsForQt5.qtstyleplugins
-  ] ++ lib.optionals config.isLaptop [
-    powertop
-    undervolt
-  ];
+      # Misc
+      mailcap
+      libsForQt5.qtstyleplugins
+    ]
+    ++ lib.optionals config.isLaptop [
+      powertop
+      undervolt
+    ];
 }

home/natto/programs.nix

@@ -1,70 +0,0 @@
-{ pkgs, config, conf, ... }:
-{
-  programs = {
-    firefox = {
-      enable = true;
-      profiles.natto = {
-        name = "natto";
-      };
-    };
-    chromium = {
-      enable = true;
-      package = pkgs.ungoogled-chromium;
-    };
-    zathura = {
-      enable = true;
-      extraConfig = builtins.readFile ./config/zathura/zathurarc;
-      options = {
-        recolor = true;
-        recolor-lightcolor = "rgba(0,0,0,0)";
-        default-bg = "rgba(0,0,0,0.8)";
-      };
-    };
-
-    sioyek = {
-      enable = true;
-    };
-
-    go.enable = true;
-    foot = {
-      enable = true;
-      settings = {
-        main = {
-          font = "Fira Mono:style=Regular:pixelsize=18";
-          font-bold = "Fira Mono:style=Bold:pixelsize=18";
-        };
-        scrollback.lines = 4000;
-        colors = with conf.colors.default; {
-          inherit foreground background;
-          regular0 = surface1;
-          regular1 = red;
-          regular2 = green;
-          regular3 = yellow;
-          regular4 = blue;
-          regular5 = pink;
-          regular6 = teal;
-          regular7 = subtext1;
-          bright0 = surface2;
-          bright1 = red;
-          bright2 = green;
-          bright3 = yellow;
-          bright4 = blue;
-          bright5 = pink;
-          bright6 = teal;
-          bright7 = subtext0;
-        };
-      };
-    };
-    mpv = {
-      enable = true;
-      config = {
-        force-window = true;
-        keep-open = true;
-        save-position-on-quit = true;
-      };
-    };
-  };
-  home.sessionVariables = {
-    BROWSER = "firefox";
-  };
-}

home/natto/stuff.nix

@@ -1,4 +1,10 @@
-{ config, lib, pkgs, ... }: {
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
   xdg = {
     enable = true;
     userDirs.enable = true;
@@ -7,28 +13,20 @@
   age.identityPaths = [ "${config.home.homeDirectory}/.ssh/id_ed25519" ];
 
   home = {
-    pointerCursor = {
-      package = pkgs.catppuccin-cursors.mochaFlamingo;
-      name = "Catppuccin-Mocha-Flamingo-Cursors";
-      size = 32;
-      x11 = {
-        enable = true;
-        defaultCursor = "crosshair";
-      };
-      gtk.enable = true;
-    };
-
     sessionVariables = {
       QT_X11_NO_MITSHM = "1";
       HM_CONF_DIR = "/etc/nixos";
       QT_QPA_PLATFORMTHEME = "gtk2";
     };
-
   };
   i18n = {
     inputMethod = {
-      enabled = "fcitx5";
-      fcitx5.addons = with pkgs; [ fcitx5-m17n fcitx5-mozc ];
+      enable = true;
+      type = "fcitx5";
+      fcitx5.addons = with pkgs; [
+        fcitx5-m17n
+        fcitx5-mozc
+      ];
     };
   };
 }

home/natto/tofi.nix

@@ -0,0 +1,37 @@
+{
+  conf,
+  pkgs,
+  config,
+  ...
+}:
+{
+  home.file.tofi = {
+    source = pkgs.writeText "tofi-config" (
+      pkgs.lib.generators.toKeyValue { } (
+        with conf.colors.default;
+        {
+          # https://github.com/philj56/tofi/blob/master/themes/fullscreen
+          width = "100%";
+          height = "100%";
+          border-width = 0;
+          outline-width = 0;
+          padding-left = "35%";
+          padding-top = "35%";
+          result-spacing = 25;
+          num-results = 5;
+          font = "Fira Mono";
+          font-size = 15;
+          text-color = foreground;
+          selection-color = rosewater;
+          selection-match-color = red;
+          background-color = "#000A";
+        }
+      )
+    );
+    target = "${config.xdg.configHome}/tofi/config";
+  };
+
+  home.packages = with pkgs; [
+    tofi
+  ];
+}

home/natto/wayland.nix

@@ -1,64 +1,11 @@
-{ pkgs, config, conf, inputs, ... }:
+{ pkgs, inputs, ... }:
 {
-  imports = [
-    inputs.hyprland.homeManagerModules.default
-
-    ./ags
-    # ./eww
-  ];
-
-  wayland = {
-    windowManager = {
-      sway = {
-        enable = true;
-      };
-      hyprland = {
-        enable = true;
-        xwayland = {
-          enable = true;
-        };
-        extraConfig = (builtins.readFile ./config/hypr/hyprland.conf)
-          + (with config.home.pointerCursor; ''
-          exec-once=hyprctl setcursor ${name} ${toString size}
-        '')
-          + (with conf.colors.argb { a = "ee"; };''
-          general {
-            col.active_border = 0x${mauve} 0x${flamingo} 135deg
-            col.inactive_border = 0x${surface0}
-          }
-        '');
-      };
-    };
-  };
-
-  home.file.tofi = {
-    source = pkgs.writeText "tofi-config" (pkgs.lib.generators.toKeyValue { } (with conf.colors.default; {
-      # https://github.com/philj56/tofi/blob/master/themes/fullscreen
-      width = "100%";
-      height = "100%";
-      border-width = 0;
-      outline-width = 0;
-      padding-left = "35%";
-      padding-top = "35%";
-      result-spacing = 25;
-      num-results = 5;
-      font = "Fira Mono";
-      font-size = 15;
-      text-color = foreground;
-      selection-color = rosewater;
-      selection-match-color = red;
-      background-color = "#000A";
-    }));
-    target = "${config.xdg.configHome}/tofi/config";
-  };
-
   home.packages = with pkgs; [
-    tofi
-    imv
     grim
     slurp
     inputs.hyprland-contrib.packages.${pkgs.system}.grimblast
     wl-clipboard
+    swayimg
     swaybg
   ];
 }

home/natto/xsession.nix

@@ -1,4 +1,9 @@
-{ pkgs, config, flake, ... }:
+{
+  pkgs,
+  config,
+  flake,
+  ...
+}:
 {
   xsession = {
     enable = true;

home/natto/zsh.nix

@@ -3,9 +3,8 @@ let
   secretPath = "${config.home.homeDirectory}/.zshenv_secret";
 in
 {
-  programs.zsh.initExtra = lib.mkForce ''
+  programs.zsh.initContent = lib.mkAfter ''
     . ${secretPath};
-    unsetopt extendedGlob
   '';
 
   age.secrets.zshenv_secret = {

home/overlays/standalone.nix

@@ -0,0 +1,13 @@
+final: prev:
+let
+  pam = prev.pam.overrideAttrs (oa: {
+    postPatch = ''
+      substituteInPlace modules/module-meson.build \
+        --replace "sbindir / 'unix_chkpwd'" "'/usr/bin/unix_chkpwd'"
+    '';
+  });
+in
+{
+  hyprlock = prev.hyprlock.override { inherit pam; };
+  swaylock = prev.swaylock.override { inherit pam; };
+}

hosts/README.org

@@ -3,3 +3,4 @@
 + marisa is my Raspberry Pi 4 (B)
 + remilia is my cloud VM
 + hina is another cloud VM I use for ZNC
++ suwako is an ARM cloud VM

hosts/common/programs/adb/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  programs.adb.enable = true;
+}

hosts/common/programs/dconf/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  programs.dconf.enable = true;
+}

hosts/common/programs/doas/default.nix

@@ -0,0 +1,16 @@
+{ ... }:
+{
+  security = {
+    doas = {
+      enable = true;
+      extraRules = [
+        {
+          groups = [ "wheel" ];
+          keepEnv = true;
+          persist = true;
+          setEnv = [ "PATH" ];
+        }
+      ];
+    };
+  };
+}

hosts/common/programs/git/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  programs.git.enable = true;
+}

hosts/common/programs/gnupg/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  programs.gnupg = {
+    agent = {
+      enableSSHSupport = true;
+      enable = true;
+    };
+  };
+}

hosts/common/programs/nix/default.nix

@@ -3,6 +3,7 @@
   nixpkgs = {
     config = {
       allowBroken = true;
+      allowUnfree = true;
     };
     overlays = [
       self.overlays.default
@@ -15,14 +16,15 @@
     '';
     settings = {
       auto-optimise-store = true;
-      trusted-users = [ "root" "natto" ];
+      trusted-users = [
+        "root"
+        "@wheel"
+      ];
       substituters = [
-        "https://nix-gaming.cachix.org"
         "https://nix-community.cachix.org"
-        #       "https://mirrors.tuna.tsinghua.edu.cn/nix-channels/store"
+        "https://mirrors.tuna.tsinghua.edu.cn/nix-channels/store"
       ];
       trusted-public-keys = [
-        "nix-gaming.cachix.org-1:nbjlureqMbRAxR1gJ/f3hxemL9svXaZF/Ees8vCUUs4="
         "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
       ];
     };

hosts/common/programs/zsh/default.nix

@@ -0,0 +1,13 @@
+{ ... }:
+{
+  programs.zsh = {
+    enable = true;
+    histSize = 30000;
+    enableBashCompletion = true;
+    enableCompletion = true;
+    autosuggestions = {
+      enable = true;
+      highlightStyle = "fg=yellow,bold";
+    };
+  };
+}

hosts/common/security/default.nix

@@ -0,0 +1,21 @@
+{
+  lib,
+  conf,
+  config,
+  ...
+}:
+let
+  domain = conf.network.addresses.domain.natto;
+  nginx = config.services.nginx;
+in
+{
+  security = {
+    acme = lib.mkIf nginx.enable {
+      acceptTerms = true;
+      certs = lib.mapAttrs (n: _: { email = "natto@${domain}"; }) (
+        lib.filterAttrs (_: v: v.enableACME) nginx.virtualHosts
+      );
+    };
+    pki.certificateFiles = [ ../../../cert.pem ];
+  };
+}

hosts/common/services/pipewire/default.nix

@@ -1,6 +1,5 @@
-{ lib, config, pkgs, ... }: {
-  # sound stuff
-  sound.enable = true;
+{ ... }:
+{
   services.pipewire = {
     enable = true;
     alsa = {

hosts/common/services/xserver/default.nix

@@ -1,17 +1,11 @@
 { config, lib, ... }:
 
-#let
-#  compiledLayout = pkgs.runCommand "keyboard-layout" {} ''
-#    ${pkgs.xorg.xkbcomp}/bin/xkbcomp ${./colemak-dh.xkb} $out
-#  '';
-#in
 {
   services = {
     libinput = {
       enable = true;
       mouse = {
         accelSpeed = "0";
-        #         accelProfile = "flat";
       };
       touchpad = {
         middleEmulation = false;
@@ -22,13 +16,9 @@
     };
     xserver = {
       enable = true;
-      displayManager = {
-        startx = {
-          enable = true;
-        };
-      };
+      displayManager.startx.enable = true;
       xkb.layout = "us";
-      xkb.variant = "colemak_dh"; # trying to ditch DHz now
+      xkb.variant = "colemak_dh";
       autoRepeatDelay = 320;
       autoRepeatInterval = 30;
     };

hosts/common/vault-agent.nix

@@ -1,5 +1,10 @@
 #Taken from https://github.com/MagicRB/dotfiles/blob/master/nix/nixos-modules/vault-agent.nix
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib;
 let
   cfg = config.services.vault-agent;
@@ -59,48 +64,49 @@ in
     };
   };
 
-  config = mkIf cfg.enable
-    ({
+  config = mkIf cfg.enable ({
+    users = {
       users = {
-        users = {
-          "${cfg.userName}" = {
-            group = cfg.groupName;
-            uid = cfg.uid;
-            isSystemUser = true;
-            description = "Vault-Agent User";
-          };
-        };
-        groups = {
-          "${cfg.groupName}" = {
-            gid = cfg.gid;
-          };
+        "${cfg.userName}" = {
+          group = cfg.groupName;
+          uid = cfg.uid;
+          isSystemUser = true;
+          description = "Vault-Agent User";
         };
       };
-      systemd.tmpfiles.rules = mkIf (cfg.secretsDir != null) [
-        "d ${cfg.secretsDir} 6755 vault-agent ${cfg.groupName} 0"
-      ];
-      systemd.services.vault-agent = {
-        description = "Vault Agent";
-        wantedBy = [ "multi-user.target" ];
-        wants = [ "network-online.target" ];
-        after = [ "network-online.target" ];
-        path = (with pkgs; [
+      groups = {
+        "${cfg.groupName}" = {
+          gid = cfg.gid;
+        };
+      };
+    };
+    systemd.tmpfiles.rules = mkIf (cfg.secretsDir != null) [
+      "d ${cfg.secretsDir} 6755 vault-agent ${cfg.groupName} 0"
+    ];
+    systemd.services.vault-agent = {
+      description = "Vault Agent";
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+      path = (
+        with pkgs;
+        [
           glibc
-        ]);
-        serviceConfig = {
-          User = cfg.userName;
-          Group = cfg.groupName;
-          ExecReload = "${pkgs.busybox}/bin/kill -HUP $MAINPID";
-          ExecStart = "${cfg.package}/bin/vault agent -config=${json.generate "vault.json" cfg.settings}";
-          KillMode = "process";
-          KillSignal = "SIGINT";
-          Restart = "on-failure";
-          TimeoutStopSec = "30s";
-          RestartSec = 2;
-          ConfigurationDirectory = "vault-agent";
-          ConfigurationDirectoryMode = "0600";
-        };
+        ]
+      );
+      serviceConfig = {
+        User = cfg.userName;
+        Group = cfg.groupName;
+        ExecReload = "${pkgs.busybox}/bin/kill -HUP $MAINPID";
+        ExecStart = "${cfg.package}/bin/vault agent -config=${json.generate "vault.json" cfg.settings}";
+        KillMode = "process";
+        KillSignal = "SIGINT";
+        Restart = "on-failure";
+        TimeoutStopSec = "30s";
+        RestartSec = 2;
+        ConfigurationDirectory = "vault-agent";
+        ConfigurationDirectoryMode = "0600";
       };
-    });
+    };
+  });
 }
-

hosts/common/x86builder.nix

@@ -0,0 +1,26 @@
+{ config, ... }:
+{
+  nix = {
+    extraOptions = ''
+      builders-use-substitutes = true
+    '';
+    buildMachines = [
+      {
+        hostName = "okina";
+        systems = [
+          "x86_64-linux"
+          "aarch64-linux"
+        ];
+        maxJobs = 4;
+        speedFactor = 2;
+        supportedFeatures = [
+          "nixos-test"
+          "benchmark"
+          "big-parallel"
+          "kvm"
+        ];
+      }
+    ];
+    distributedBuilds = true;
+  };
+}

hosts/default.nix

@@ -3,19 +3,23 @@ let
   inherit (inputs) nixpkgs;
 
   commonModules = [
-    ./nvim.nix
     {
       _module.args = globalArgs;
     }
+    ./common/programs/neovim
+    ./common/programs/nix
+    ./common/programs/zsh
+    ./common/programs/gnupg
+    ./common/programs/git
+    ./common/programs/doas
+    ./common/security
   ];
   desktopModules = [
-    ./xorg.nix
-    ./wayland.nix
-    ./nix.nix
-    ./desktop-pkgs.nix
-    ./sound.nix
+    ./common/programs/adb
+    ./common/programs/dconf
+    ./common/services/xserver
+    ./common/services/pipewire
   ];
-  serverModules = [ ./minimal.nix ];
 in
 {
   flake.nixosConfigurations = {
@@ -45,8 +49,7 @@ in
       modules = [
         ./marisa
       ]
-      ++ commonModules
-      ++ serverModules;
+      ++ commonModules;
     };
 
     #Oracle Cloud VM
@@ -54,11 +57,10 @@ in
       system = "x86_64-linux";
       modules = [
         ./remilia
-        ./x86builder.nix
+        ./common/x86builder.nix
         inputs.mailserver.nixosModules.mailserver
       ]
-      ++ commonModules
-      ++ serverModules;
+      ++ commonModules;
     };
 
     #Oracle Cloud VM
@@ -66,10 +68,19 @@ in
       system = "x86_64-linux";
       modules = [
         ./hina
-        ./x86builder.nix
+        ./common/x86builder.nix
       ]
-      ++ commonModules
-      ++ serverModules;
+      ++ commonModules;
+    };
+
+    #Oracle Cloud VM
+    suwako = nixpkgs.lib.nixosSystem {
+      system = "aarch64-linux";
+      modules = [
+        ./suwako
+        inputs.mailserver.nixosModules.mailserver
+      ]
+      ++ commonModules;
     };
   };
 }

hosts/desktop-pkgs.nix

@@ -1,63 +0,0 @@
-{ lib, config, inputs, pkgs, ... }:
-
-{
-  environment.systemPackages = with pkgs; [
-    tmux
-    bc
-    gnumake
-    pciutils
-    usbutils
-    ntfs3g
-    python3
-    htop
-    wget
-    ripgrep
-    kbd
-    gcc
-    vulkan-tools
-    vulkan-headers
-    jq
-    dconf
-  ];
-
-  fonts.packages = with pkgs; [
-    fira-code
-    fira-mono
-    monoid
-    font-awesome
-    material-icons
-    material-design-icons
-    lohit-fonts.devanagari
-    lohit-fonts.gurmukhi
-    office-code-pro
-    eb-garamond
-    noto-fonts-cjk
-    takao
-    liberation_ttf
-  ];
-
-  programs = {
-    git.enable = true;
-
-    gnupg = {
-      agent = {
-        enableSSHSupport = true;
-        enable = true;
-      };
-    };
-
-    zsh = {
-      enable = true;
-      histSize = 30000;
-      enableBashCompletion = true;
-      enableCompletion = true;
-      autosuggestions = {
-        enable = true;
-        highlightStyle = "fg=yellow,bold";
-      };
-    };
-
-    adb.enable = true;
-    gamemode.enable = true;
-  };
-}

hosts/hina/boot.nix

@@ -3,9 +3,19 @@
   boot = {
     kernel.sysctl."net.ipv4.ip_forward" = 1;
     initrd.kernelModules = [ "bochs" ];
-    initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" ];
+    initrd.availableKernelModules = [
+      "ata_piix"
+      "uhci_hcd"
+      "virtio_pci"
+      "virtio_scsi"
+    ];
     kernelModules = [ "kvm-amd" ];
-    kernelParams = [ "console=ttyS0" "console=tty1" "nvme.shutdown_timeout=10" "libiscsi.debug_libiscsi_eh=1" ];
+    kernelParams = [
+      "console=ttyS0"
+      "console=tty1"
+      "nvme.shutdown_timeout=10"
+      "libiscsi.debug_libiscsi_eh=1"
+    ];
     loader = {
       systemd-boot.enable = true;
       efi.canTouchEfiVariables = true;

hosts/hina/default.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, conf, ... }:
+{
+  config,
+  pkgs,
+  conf,
+  ...
+}:
 {
   imports = [
     ./networking.nix
@@ -16,7 +21,6 @@
     extraGroups = [ "wheel" ];
     openssh.authorizedKeys.keys = conf.network.commonSSHKeys;
   };
-  programs.zsh.enable = true;
 
   system.stateVersion = "21.11";
 }

hosts/hina/hardware.nix

@@ -1,16 +1,20 @@
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
-    [
-      (modulesPath + "/profiles/qemu-guest.nix")
-    ];
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
 
-  fileSystems."/" =
-    {
-      device = "/dev/disk/by-uuid/d91adce2-9059-4a8a-86e7-dee6ecc85b2b";
-      fsType = "ext4";
-    };
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/cloudimg-rootfs";
+    fsType = "ext4";
+  };
 
   swapDevices = [
     {

hosts/hina/networking.nix

@@ -1,16 +1,25 @@
-{ lib, config, conf, pkgs, ... }:
+{
+  lib,
+  config,
+  conf,
+  pkgs,
+  ...
+}:
 {
   networking = {
     useDHCP = false;
     hostName = "hina";
-    firewall =
-      {
-        interfaces = {
-          ens3 = {
-            allowedTCPPorts = [ 9898 80 443 ];
-          };
+    firewall = {
+      interfaces = {
+        ens3 = {
+          allowedTCPPorts = [
+            9898
+            80
+            443
+          ];
         };
       };
+    };
     interfaces = {
       ens3 = {
         useDHCP = true;

hosts/hina/services.nix

@@ -1,4 +1,10 @@
-{ config, pkgs, lib, conf, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  conf,
+  ...
+}:
 let
   domain = conf.network.addresses.domain.natto;
 in
@@ -31,12 +37,4 @@ in
       };
     };
   };
-
-  security.acme = {
-    acceptTerms = true;
-    certs = lib.mapAttrs (n: _: { email = "natto@${domain}"; })
-      (lib.filterAttrs (_: v: v.enableACME) config.services.nginx.virtualHosts);
-  };
-  security.pki.certificateFiles = [ ../../cert.pem ];
 }
-

hosts/marisa/boot.nix

@@ -2,19 +2,33 @@
 {
   boot = {
     consoleLogLevel = 7;
-    kernelParams = [ "console=ttyS0,115200n8" "console=ttyAMA0,115200n8" "console=tty0" ];
+    kernelParams = [
+      "console=ttyS0,115200n8"
+      "console=ttyAMA0,115200n8"
+      "console=tty0"
+    ];
     kernelPackages = pkgs.linuxPackages_5_10;
-    initrd.availableKernelModules = [ "xhci_pci" "usb_storage" "usbhid" "uas" "pcie-brcmstb" "vc4" ];
+    initrd.availableKernelModules = [
+      "xhci_pci"
+      "usb_storage"
+      "usbhid"
+      "uas"
+      "pcie-brcmstb"
+      "vc4"
+    ];
     loader = {
       grub.enable = false;
       generic-extlinux-compatible.enable = true;
-      /* raspberryPi= {
+      /*
+        raspberryPi= {
         version = 4;
         firmwareConfig = "dtparam=sd_poll_once=on";
         enable = true;
-        }; */
+        };
+      */
     };
-    /* kernelPatches = [
+    /*
+      kernelPatches = [
       {
       name = "change-pgtable";
       patch = null;
@@ -22,6 +36,7 @@
       CONFIG_PGTABLE_LEVELS 4
       '';
       }
-      ];*/
+      ];
+    */
   };
 }

hosts/marisa/default.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, conf, ... }:
+{
+  config,
+  pkgs,
+  conf,
+  ...
+}:
 {
   imports = [
     ./networking.nix
@@ -14,10 +19,7 @@
     extraGroups = [ "wheel" ];
     openssh.authorizedKeys.keys = conf.network.commonSSHKeys;
   };
-  programs.zsh.enable = true;
 
   time.timeZone = "Asia/Kolkata";
   system.stateVersion = "21.05";
-
-  security.pki.certificateFiles = [ ../../cert.pem ../../consul-agent-ca.pem ];
 }

hosts/marisa/hardware.nix

@@ -1,21 +1,24 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 {
-  fileSystems."/" =
-    {
-      device = "/dev/disk/by-label/NIXOS_SD";
-      fsType = "ext4";
-    };
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/NIXOS_SD";
+    fsType = "ext4";
+  };
 
-  fileSystems."/nix/store" =
-    {
-      device = "/nix/store";
-      fsType = "none";
-      options = [ "bind" ];
-    };
+  fileSystems."/nix/store" = {
+    device = "/nix/store";
+    fsType = "none";
+    options = [ "bind" ];
+  };
 
   swapDevices = [
     {

hosts/marisa/networking.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, conf, ... }:
+{
+  config,
+  pkgs,
+  conf,
+  ...
+}:
 {
   networking = {
     hostName = "marisa";
@@ -7,10 +12,10 @@
         22 # ssh
         80 # http
         #  5454
-        5001 #gitea
-        4646 #nomad
+        5001 # gitea
+        4646 # nomad
         #  8500 #vault nomad consul
-        8000 #simpler-filehost
+        8000 # simpler-filehost
         #  6666 #concourse
         #  202 #gitea-ssh
       ];
@@ -25,16 +30,20 @@
 
     interfaces = {
       eth0 = {
-        ipv4.addresses = [{
-          prefixLength = 24;
-          address = "192.168.1.159";
-        }];
+        ipv4.addresses = [
+          {
+            prefixLength = 24;
+            address = "192.168.1.159";
+          }
+        ];
       };
       wlan0 = {
-        ipv4.addresses = [{
-          prefixLength = 24;
-          address = "192.168.1.159";
-        }];
+        ipv4.addresses = [
+          {
+            prefixLength = 24;
+            address = "192.168.1.159";
+          }
+        ];
       };
     };
     wireguard.interfaces.wg0 = with conf.network.addresses.wireguard.ips; {
@@ -52,6 +61,9 @@
       ];
     };
     defaultGateway = "192.168.1.1";
-    nameservers = [ "1.1.1.1" "8.8.8.8" ];
+    nameservers = [
+      "1.1.1.1"
+      "8.8.8.8"
+    ];
   };
 }

hosts/marisa/services/default.nix

@@ -3,33 +3,20 @@
 
   imports = [
     # ./hashicorp.nix
-    ./filehost.nix
-    ./gitea.nix
   ];
 
-  # Add secrets to nomad, consul and vault
   virtualisation.docker = {
     enable = true;
     daemon.settings = {
-      #     default-cgroupns-mode = "host";
     };
   };
   services = {
     openssh = {
       enable = true;
-      ports = [ 22 22001 ];
+      ports = [
+        22
+        22001
+      ];
     };
-    postgresql = {
-      enable = true;
-      authentication = ''
-        local gitea all ident map=gitea-map
-      '';
-      identMap =
-        ''
-          gitea-map gitea gitea
-        '';
-    };
-
   };
 }
-

hosts/marisa/services/filehost.nix

@@ -1,19 +0,0 @@
-{ config, pkgs, inputs, conf, ... }:
-{
-  systemd.services.filehost = {
-    enable = true;
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "simple";
-      Environment = [
-        "TITLE=nattofiles"
-        "USER_URL=https://f.${conf.network.addresses.domain.natto}"
-        "ROCKET_LIMITS={file=\"512MB\",data-form=\"512MB\"}"
-        "ROCKET_LOG_LEVEL=debug"
-        "ROCKET_ADDRESS=0.0.0.0"
-      ];
-      Restart = "on-failure";
-      ExecStart = "${inputs.filehost.packages.${pkgs.system}.simpler-filehost}/bin/simpler-filehost";
-    };
-  };
-}

hosts/marisa/services/hashicorp.nix

@@ -6,7 +6,10 @@
       enable = true;
       enableDocker = true;
       dropPrivileges = false;
-      extraPackages = with pkgs; [ consul cni-plugins ];
+      extraPackages = with pkgs; [
+        consul
+        cni-plugins
+      ];
       extraSettingsPaths = [ "/run/nomad/nomad.json" ];
     };
     vault = {
@@ -27,4 +30,3 @@
     };
   };
 }
-

hosts/minimal.nix

@@ -1,41 +0,0 @@
-{ config, pkgs, ... }:
-{
-  security = {
-    sudo.enable = false;
-    doas = {
-      enable = true;
-      extraRules = [
-        {
-          groups = [ "wheel" ];
-          keepEnv = true;
-          persist = true;
-        }
-      ];
-    };
-  };
-
-  environment.systemPackages = with pkgs; [
-    git
-    htop
-    vim
-    tmux
-    wireguard-tools
-    nmap
-    gcc
-  ];
-
-  programs = {
-    gnupg = {
-      agent = {
-        enable = true;
-      };
-    };
-  };
-
-  nix = {
-    extraOptions = ''
-      experimental-features = nix-command flakes
-    '';
-    settings.trusted-users = [ "root" ];
-  };
-}

hosts/okina/boot.nix

@@ -1,21 +1,41 @@
-{ lib, config, pkgs, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
 
 {
   boot = {
     kernelPackages = pkgs.linuxPackages;
     initrd = {
-      availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
+      availableKernelModules = [
+        "xhci_pci"
+        "ahci"
+        "nvme"
+        "usbhid"
+        "usb_storage"
+        "sd_mod"
+      ];
       kernelModules = [ ];
     };
-    kernelParams = [ "i915.force_probe=56a1" "resume_offset=11287312" ];
+
+    kernelParams = [ "i915.force_probe=56a1" ];
 
     #   kernelModules = [ "kvm-intel" "i2c-dev" "ddcci_backlight" ];
-    kernelModules = [ "kvm-intel" "i2c-dev" ];
+    kernelModules = [
+      "kvm-intel"
+      "i2c-dev"
+    ];
     #   extraModulePackages = with config.boot.kernelPackages; [ v4l2loopback r8125 ddcci-driver ];
-    extraModulePackages = with config.boot.kernelPackages; [ v4l2loopback r8125 ];
+    extraModulePackages = with config.boot.kernelPackages; [
+      v4l2loopback
+      r8125
+    ];
     blacklistedKernelModules = [ "r8169" ];
+    extraModprobeConfig = ''options snd-intel-dspcfg dsp_driver=1 '';
 
-    resumeDevice = "/dev/disk/by-uuid/5679b901-3a70-4422-81f5-af91f287500b";
+    resumeDevice = "/dev/disk/by-uuid/3770e3bd-a200-4e36-b3a5-4963d13865f9";
 
     loader = {
       efi = {

hosts/okina/default.nix

@@ -1,12 +1,11 @@
 { lib, config, ... }:
 {
-  imports =
-    [
-      ./hardware.nix
-      ./stuff.nix
-      ./networking.nix
-      ./boot.nix
-      ./services.nix
-    ];
+  imports = [
+    ./hardware.nix
+    ./stuff.nix
+    ./networking.nix
+    ./boot.nix
+    ./services.nix
+  ];
   system.stateVersion = "23.05";
 }

hosts/okina/hardware.nix

@@ -1,42 +1,45 @@
-{ config, lib, modulesPath, pkgs, ... }:
+{
+  config,
+  lib,
+  modulesPath,
+  pkgs,
+  ...
+}:
 
 {
-  imports =
-    [
-      (modulesPath + "/installer/scan/not-detected.nix")
-    ];
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
 
-  fileSystems."/" =
-    {
-      device = "/dev/disk/by-uuid/5679b901-3a70-4422-81f5-af91f287500b";
-      fsType = "btrfs";
-      options = [ "compress-force=zstd:3" ];
-    };
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/5679b901-3a70-4422-81f5-af91f287500b";
+    fsType = "btrfs";
+    options = [ "compress-force=zstd:3" ];
+  };
 
-  fileSystems."/boot/efi" =
-    {
-      device = "/dev/disk/by-uuid/A2E5-006F";
-      fsType = "vfat";
-    };
+  fileSystems."/boot/efi" = {
+    device = "/dev/disk/by-uuid/A2E5-006F";
+    fsType = "vfat";
+  };
 
-  fileSystems."/media/omghi" =
-    {
-      device = "/dev/disk/by-uuid/0e862bdb-168a-42cc-8a28-0ae9e9a0753c";
-      fsType = "ext4";
-    };
+  fileSystems."/media/omghi" = {
+    device = "/dev/disk/by-uuid/0e862bdb-168a-42cc-8a28-0ae9e9a0753c";
+    fsType = "ext4";
+  };
 
-  fileSystems."/media/real" =
-    {
-      device = "/dev/disk/by-uuid/8086be20-c770-46be-bd8f-5bd2d7735c7d";
-      fsType = "btrfs";
-      options = [ "compress-force=zstd:3" ];
-    };
+  fileSystems."/media/real" = {
+    device = "/dev/disk/by-uuid/8086be20-c770-46be-bd8f-5bd2d7735c7d";
+    fsType = "btrfs";
+    options = [ "compress-force=zstd:3" ];
+  };
 
-  /* fileSystems."/media/ntfs" =
+  /*
+    fileSystems."/media/ntfs" =
     {
       device = "/dev/disk/by-uuid/54034ca6-d3cd-11ee-9e0c-f020ff87c985";
       fsType = "ntfs";
-    };*/
+    };
+  */
 
   zramSwap = {
     enable = true;
@@ -46,7 +49,7 @@
   };
 
   swapDevices = [
-    { device = "/var/swap"; size = 32768; }
+    { device = "/dev/disk/by-uuid/3770e3bd-a200-4e36-b3a5-4963d13865f9"; }
   ];
 
   powerManagement = {
@@ -55,17 +58,18 @@
   };
 
   hardware = {
+    steam-hardware.enable = true;
     bluetooth.enable = true;
     cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-    opengl = {
-      driSupport32Bit = true;
+    graphics = {
+      enable32Bit = true;
       enable = true;
-      package = pkgs.mesa.drivers;
-      package32 = pkgs.pkgsi686Linux.mesa.drivers;
+      package = pkgs.mesa;
+      package32 = pkgs.pkgsi686Linux.mesa;
       extraPackages = with pkgs; [
         intel-media-driver
         intel-compute-runtime
-        onevpl-intel-gpu
+        vpl-gpu-rt
       ];
     };
   };

hosts/okina/networking.nix

@@ -1,4 +1,10 @@
-{ config, pkgs, conf, lib, ... }:
+{
+  config,
+  pkgs,
+  conf,
+  lib,
+  ...
+}:
 
 {
   networking = {
@@ -10,21 +16,53 @@
     };
 
     firewall = {
-      allowedTCPPorts = [ 22 18172 6600 8001 7590 25565 9092 8096 ];
-      allowedUDPPorts = [ 22 17840 18172 ];
+      allowedTCPPorts = [
+        22
+        18172
+        6600
+        8001
+        7590
+        25565
+        9092
+        8096
+      ];
+      allowedUDPPorts = [
+        22
+        17840
+        18172
+      ];
       trustedInterfaces = [ "docker0" ];
     };
 
     interfaces = {
-      enp7s0 = {
-        ipv4.addresses = [{
-          prefixLength = 24;
-          address = "192.168.1.106";
-        }];
-      };
+      /*
+        enp7s0 = {
+          ipv4.addresses = [{
+            prefixLength = 24;
+            address = "192.168.1.106";
+          }];
+        };
+      */
     };
 
-    defaultGateway = "192.168.1.1";
-    nameservers = [ "1.1.1.1" "8.8.8.8" ];
+    wireguard.interfaces.wg0 = with conf.network.addresses.wireguard.ips; {
+      ips = [ okina ];
+      listenPort = 17840;
+      privateKeyFile = "/var/secrets/wg.key";
+      peers = [
+        {
+          #Oracle VM1
+          publicKey = "z0Y2VNEWcyVQVSqRHiwmiJ5/0MgSPM+HZfEcwIccSxM=";
+          allowedIPs = [ remilia ];
+          endpoint = "${conf.network.addresses.domain.natto}:17840";
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+
+    nameservers = [
+      "1.1.1.1"
+      "8.8.8.8"
+    ];
   };
 }

hosts/okina/services.nix

@@ -1,4 +1,9 @@
-{ lib, config, pkgs, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
 {
   services = {
     openssh = {
@@ -8,14 +13,13 @@
     ratbagd.enable = true;
     btrfs.autoScrub.enable = true;
     gvfs.enable = true;
-    logind.extraConfig = "RuntimeDirectorySize=30%";
     printing = {
       enable = true;
       drivers = [ pkgs.hplip ];
     };
     avahi = lib.mkIf config.services.printing.enable {
       enable = true;
-      nssmdns = true;
+      nssmdns4 = true;
       openFirewall = true;
     };
   };
@@ -24,7 +28,6 @@
     libvirtd.wantedBy = lib.mkForce [ ];
   };
 
-  security.pki.certificateFiles = [ ../../cert.pem ];
   virtualisation = {
     docker = {
       enable = true;

hosts/okina/stuff.nix

@@ -1,4 +1,9 @@
-{ lib, config, pkgs, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
 {
   time.timeZone = "Asia/Kolkata";
 
@@ -8,25 +13,24 @@
     rtkit.enable = true;
     polkit.enable = true;
     sudo.enable = true;
-    doas = {
-      enable = true;
-      extraRules = [
-        {
-          users = [ "natto" ];
-          keepEnv = true;
-          persist = true;
-          setEnv = [ "SSH_AUTH_SOCK" "PATH" "SHELL" ];
-        }
-      ];
-    };
   };
+
   console.useXkbConfig = true;
 
   users.users.natto = {
     isNormalUser = true;
     shell = pkgs.zsh;
     home = "/home/natto";
-    extraGroups = [ "wheel" "adbusers" "video" "libvirtd" "docker" "networkmanager" "dialout" ];
+    extraGroups = [
+      "wheel"
+      "adbusers"
+      "video"
+      "libvirtd"
+      "docker"
+      "networkmanager"
+      "dialout"
+      "pipewire"
+    ];
   };
 
   virtualisation = {

hosts/remilia/boot.nix

@@ -3,9 +3,19 @@
   boot = {
     kernel.sysctl."net.ipv4.ip_forward" = 1;
     initrd.kernelModules = [ "bochs" ];
-    initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" ];
+    initrd.availableKernelModules = [
+      "ata_piix"
+      "uhci_hcd"
+      "virtio_pci"
+      "virtio_scsi"
+    ];
     kernelModules = [ "kvm-amd" ];
-    kernelParams = [ "console=ttyS0" "console=tty1" "nvme.shutdown_timeout=10" "libiscsi.debug_libiscsi_eh=1" ];
+    kernelParams = [
+      "console=ttyS0"
+      "console=tty1"
+      "nvme.shutdown_timeout=10"
+      "libiscsi.debug_libiscsi_eh=1"
+    ];
     loader = {
       systemd-boot.enable = true;
       efi.canTouchEfiVariables = true;

hosts/remilia/default.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, conf, ... }:
+{
+  config,
+  pkgs,
+  conf,
+  ...
+}:
 {
   imports = [
     ./networking.nix
@@ -17,7 +22,6 @@
     extraGroups = [ "wheel" ];
     openssh.authorizedKeys.keys = conf.network.commonSSHKeys;
   };
-  programs.zsh.enable = true;
 
   system.stateVersion = "21.11";
 }

hosts/remilia/hardware.nix

@@ -1,16 +1,20 @@
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
-    [
-      (modulesPath + "/profiles/qemu-guest.nix")
-    ];
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
 
-  fileSystems."/" =
-    {
-      device = "/dev/disk/by-uuid/d91adce2-9059-4a8a-86e7-dee6ecc85b2b";
-      fsType = "ext4";
-    };
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/cloudimg-rootfs";
+    fsType = "ext4";
+  };
 
   swapDevices = [
     {

hosts/remilia/mailserver.nix

@@ -1,14 +1,23 @@
-{ config, pkgs, conf, network, ... }:
+{
+  config,
+  pkgs,
+  conf,
+  network,
+  ...
+}:
 {
   mailserver =
-    let domain = conf.network.addresses.domain.natto; in
+    let
+      domain = conf.network.addresses.domain.natto;
+    in
     rec {
       enable = true;
+      stateVersion = 3;
       fqdn = "mail.${domain}";
       sendingFqdn = fqdn;
       domains = [ domain ];
       certificateDomains = [ "mail.${domain}" ];
-      certificateScheme = 3;
+      certificateScheme = "acme-nginx";
       loginAccounts = {
         "natto@${domain}" = {
           hashedPasswordFile = "/var/secrets/natto@${domain}.key";

hosts/remilia/networking.nix

@@ -1,27 +1,44 @@
-{ lib, config, conf, pkgs, ... }:
+{
+  lib,
+  config,
+  conf,
+  pkgs,
+  ...
+}:
 {
   networking = {
     useDHCP = false;
     hostName = "remilia";
-    firewall =
-      {
-        interfaces = {
-          ens3 = {
-            allowedTCPPorts = [ 80 81 443 444 993 465 143 25 22 22001 22002 4444 ]
-              ++ (map (x: x.sourcePort) config.networking.nat.forwardPorts);
-            allowedUDPPorts = [ 17840 ];
-          };
+    firewall = {
+      interfaces = {
+        ens3 = {
+          allowedTCPPorts = [
+            80
+            81
+            443
+            444
+            993
+            465
+            143
+            25
+            22
+            22001
+            22002
+            4444
+          ]
+          ++ (map (x: x.sourcePort) config.networking.nat.forwardPorts);
+          allowedUDPPorts = [ 17840 ];
         };
-        extraCommands = lib.concatMapStringsSep "\n"
-          (x:
-            let
-              t = lib.splitString ":" x.destination;
-            in
-            with lib;
-            "iptables -t nat -A POSTROUTING -d ${head t} -p tcp -m tcp --dport ${last t} -j MASQUERADE"
-          )
-          config.networking.nat.forwardPorts;
       };
+      extraCommands = lib.concatMapStringsSep "\n" (
+        x:
+        let
+          t = lib.splitString ":" x.destination;
+        in
+        with lib;
+        "iptables -t nat -A POSTROUTING -d ${head t} -p tcp -m tcp --dport ${last t} -j MASQUERADE"
+      ) config.networking.nat.forwardPorts;
+    };
     interfaces = {
       ens3 = {
         useDHCP = true;
@@ -65,13 +82,21 @@
             allowedIPs = [ ips.marisa ];
           }
           {
-            publicKey = "SqskEH7hz7Gv9ZS+FYLRFgKZyJCFbBFCyuvzBYnbfVU=";
+            publicKey = "oliAKHloLOulQrDwG+2NZIYg0sQAsuQ/q/lLkPCdcRE=";
             allowedIPs = [ ips.satori ];
           }
           {
             publicKey = "IHYIan9Xq2PBTSzcMdHpzx4PM67l09WdsGa6s+siyH0=";
             allowedIPs = [ ips.hina ];
           }
+          {
+            publicKey = "BRdWQYPyfZeEWGtghhoYZf90nOsU/kXB3vOFJ6A17Ao=";
+            allowedIPs = [ ips.okina ];
+          }
+          {
+            publicKey = "JriOM0LQr/YbdeIH++qY4O32vlcc8L2AC1MDoFGCpmA=";
+            allowedIPs = [ ips.suwako ];
+          }
         ];
       };
     };

hosts/remilia/services.nix

@@ -1,4 +1,10 @@
-{ config, pkgs, lib, conf, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  conf,
+  ...
+}:
 let
   domain = conf.network.addresses.domain.natto;
 in
@@ -8,7 +14,10 @@ in
     openssh = {
       enable = true;
       settings.PermitRootLogin = "yes";
-      ports = [ 22 22002 ];
+      ports = [
+        22
+        22002
+      ];
     };
     nginx = {
       enable = true;
@@ -24,20 +33,28 @@ in
       '';
       virtualHosts =
         let
-          genericHttpRProxy = { addr, ssl ? true, conf ? "" }: {
-            enableACME = ssl;
-            # addSSL = ssl;
-            forceSSL = ssl;
-            locations."/" = {
-              proxyPass = toString addr;
-              extraConfig = ''
-                expires $expires;
-                proxy_set_header Host $host;
-              '' + conf;
+          genericHttpRProxy =
+            {
+              addr,
+              ssl ? true,
+              conf ? "",
+            }:
+            {
+              enableACME = ssl;
+              # addSSL = ssl;
+              forceSSL = ssl;
+              locations."/" = {
+                proxyPass = toString addr;
+                extraConfig = ''
+                  expires $expires;
+                  proxy_set_header Host $host;
+                ''
+                + conf;
+              };
             };
-          };
         in
-        with conf.network.addresses.wireguard.ips; {
+        with conf.network.addresses.wireguard.ips;
+        {
           "${domain}" = {
             addSSL = true;
             enableACME = true;
@@ -47,11 +64,13 @@ in
             };
             serverAliases = [ "www.${domain}" ];
           };
-          # "vault.${domain}" = genericHttpRProxy { addr = "https://${marisa}:8800"; };
-          # "consul.${domain}" = genericHttpRProxy { addr = "http://${marisa}:8500"; };
-          "f.${domain}" = genericHttpRProxy { addr = "http://${marisa}:8000"; };
+
+          # MPD server
           "radio.${domain}" = genericHttpRProxy { addr = "http://${satori}:8001"; };
-          /* "radio.${domain}" = {
+
+          # Some random music server I once had
+          /*
+            "radio.${domain}" = {
             addSSL = true;
             enableACME = true;
             locations."/" = {
@@ -62,13 +81,29 @@ in
             '';
             };
             locations."= /".return = "301 /radio";
-            };*/
+            };
+          */
 
-          "git.${domain}" = genericHttpRProxy {
-            addr = "http://${marisa}:5001";
-            conf = "client_max_body_size 64M;";
-          };
-          /*"nomad.${domain}" = genericHttpRProxy {
+          # Gitea
+          /*
+            "git.${domain}" = genericHttpRProxy {
+              addr = "http://${marisa}:5001";
+              conf = "client_max_body_size 64M;";
+            };
+          */
+
+          # Personal filehost
+          # "f.${domain}" = genericHttpRProxy { addr = "http://${marisa}:8000"; };
+
+          # Hashicorp Vault
+          # "vault.${domain}" = genericHttpRProxy { addr = "https://${marisa}:8800"; };
+
+          # Hashicorp Consul
+          # "consul.${domain}" = genericHttpRProxy { addr = "http://${marisa}:8500"; };
+
+          # Hashicorp Nomad
+          /*
+            "nomad.${domain}" = genericHttpRProxy {
             addr = "http://${marisa}:4646";
             conf = ''
             proxy_buffering off;
@@ -79,15 +114,4 @@ in
         };
     };
   };
-
-  security.acme = {
-    acceptTerms = true;
-    certs = {
-      "${domain}".extraDomainNames = lib.singleton "www.${domain}";
-    } //
-    lib.mapAttrs (n: _: { email = "natto@${domain}"; })
-      (lib.filterAttrs (_: v: v.enableACME) config.services.nginx.virtualHosts);
-  };
-  security.pki.certificateFiles = [ ../../cert.pem ];
 }
-

hosts/satori/boot.nix

@@ -1,22 +1,49 @@
-{ lib, config, pkgs, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
 
 {
   boot = {
     kernelPackages = pkgs.linuxPackages_latest;
     initrd = {
-      availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" "vfio-pci" ];
-      /*     preDeviceCommands = ''
+      availableKernelModules = [
+        "xhci_pci"
+        "ahci"
+        "nvme"
+        "usb_storage"
+        "sd_mod"
+        "vfio-pci"
+      ];
+      /*
+        preDeviceCommands = ''
         DEVS="0000:01:00.0 0000:01:00.1 0000:01:00.2 0000:01:00.3"
         for DEV in $DEVS; do
         echo "vfio-pci" > /sys/bus/pci/devices/$DEV/driver_override
         done
         modprobe -i vfio-pci
-        '';*/
+        '';
+      */
       kernelModules = [ ];
     };
-    kernelParams = [ "intel_pstate=active" "intel_iommu=on" "nvidia_drm.modeset=1" "clearcpuid=512" ];
-    kernelModules = [ "kvm-intel" "snd-seq" "snd-rawmidi" "joydev" ];
-    extraModulePackages = with config.boot.kernelPackages; [ nvidia_x11 v4l2loopback ];
+    kernelParams = [
+      "intel_pstate=active"
+      "intel_iommu=on"
+      "nvidia_drm.modeset=1"
+      "clearcpuid=512"
+    ];
+    kernelModules = [
+      "kvm-intel"
+      "snd-seq"
+      "snd-rawmidi"
+      "joydev"
+    ];
+    extraModulePackages = with config.boot.kernelPackages; [
+      nvidia_x11
+      v4l2loopback
+    ];
     loader = {
       efi = {
         canTouchEfiVariables = true;

hosts/satori/default.nix

@@ -1,13 +1,12 @@
 { lib, config, ... }:
 {
-  imports =
-    [
-      ./hardware.nix
-      ./stuff.nix
-      ./networking.nix
-      ./boot.nix
-      ./services.nix
-      ./graphics.nix
-    ];
+  imports = [
+    ./hardware.nix
+    ./stuff.nix
+    ./networking.nix
+    ./boot.nix
+    ./services.nix
+    ./graphics.nix
+  ];
   system.stateVersion = "23.05";
 }

hosts/satori/graphics.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   nvidia-offload = pkgs.writeShellScriptBin "nvi" ''
     export __NV_PRIME_RENDER_OFFLOAD=1
@@ -13,21 +18,25 @@ in
     nvidia-offload
   ];
   hardware = {
-    opengl = {
-      driSupport32Bit = true;
+    graphics = {
+      enable32Bit = true;
       enable = true;
-      package = pkgs.mesa.drivers;
-      package32 = pkgs.pkgsi686Linux.mesa.drivers;
+      package = pkgs.mesa;
+      package32 = pkgs.pkgsi686Linux.mesa;
     };
     nvidia = {
       package = config.boot.kernelPackages.nvidia_x11;
       prime = {
         #      sync.enable = true;
-        offload = { enable = true; };
+        offload = {
+          enable = true;
+        };
         intelBusId = "PCI:0:2:0";
         nvidiaBusId = "PCI:1:0:0";
       };
-      modesetting = { enable = true; };
+      modesetting = {
+        enable = true;
+      };
       powerManagement = {
         enable = true;
         finegrained = true;

hosts/satori/hardware.nix

@@ -1,23 +1,30 @@
-{ config, lib, modulesPath, ... }:
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
-    [
-      (modulesPath + "/installer/scan/not-detected.nix")
-    ];
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
 
-  fileSystems."/" =
-    {
-      device = "/dev/disk/by-uuid/4c02ddf5-d00e-4d84-856f-c327ae44d047";
-      fsType = "btrfs";
-      options = [ "compress-force=zstd:3" ];
-    };
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/59af143c-1a87-4654-9b31-7594ac8ba530";
+    fsType = "ext4";
+  };
 
-  fileSystems."/boot/efi" =
-    {
-      device = "/dev/disk/by-uuid/2424-5639";
-      fsType = "vfat";
-    };
+  fileSystems."/media/real" = {
+    device = "/dev/disk/by-uuid/8086be20-c770-46be-bd8f-5bd2d7735c7d";
+    fsType = "btrfs";
+    options = [ "compress-force=zstd:3" ];
+  };
+
+  fileSystems."/boot/efi" = {
+    device = "/dev/disk/by-uuid/2424-5639";
+    fsType = "vfat";
+  };
 
   zramSwap = {
     enable = true;
@@ -27,7 +34,10 @@
   };
 
   swapDevices = [
-    { device = "/var/swap"; size = 4096; }
+    {
+      device = "/var/swap";
+      size = 4096;
+    }
   ];
 
   powerManagement = {

hosts/satori/networking.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, conf, ... }:
+{
+  config,
+  pkgs,
+  conf,
+  ...
+}:
 
 {
   networking = {
@@ -10,8 +15,20 @@
     };
 
     firewall = {
-      allowedTCPPorts = [ 22 18172 6600 8001 7590 25565 9092 ];
-      allowedUDPPorts = [ 22 17840 18172 ];
+      allowedTCPPorts = [
+        22
+        18172
+        6600
+        8001
+        7590
+        25565
+        9092
+      ];
+      allowedUDPPorts = [
+        22
+        17840
+        18172
+      ];
       trustedInterfaces = [ "docker0" ];
     };
 
@@ -19,16 +36,21 @@
       ips = [ satori ];
       listenPort = 17840;
       privateKeyFile = "/var/secrets/wg.key";
-      peers = [{
-        #Oracle VM1
-        publicKey = "z0Y2VNEWcyVQVSqRHiwmiJ5/0MgSPM+HZfEcwIccSxM=";
-        allowedIPs = [ remilia ];
-        endpoint = "${conf.network.addresses.domain.natto}:17840";
-        persistentKeepalive = 25;
-      }];
+      peers = [
+        {
+          #Oracle VM1
+          publicKey = "z0Y2VNEWcyVQVSqRHiwmiJ5/0MgSPM+HZfEcwIccSxM=";
+          allowedIPs = [ remilia ];
+          endpoint = "${conf.network.addresses.domain.natto}:17840";
+          persistentKeepalive = 25;
+        }
+      ];
     };
 
     defaultGateway = "192.168.1.1";
-    nameservers = [ "1.1.1.1" "8.8.8.8" ];
+    nameservers = [
+      "1.1.1.1"
+      "8.8.8.8"
+    ];
   };
 }

hosts/satori/services.nix

@@ -1,4 +1,9 @@
-{ lib, config, pkgs, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
 {
   services = {
     openssh = {
@@ -21,7 +26,6 @@
     libvirtd.wantedBy = lib.mkForce [ ];
   };
 
-  security.pki.certificateFiles = [ ../../cert.pem ];
   virtualisation = {
     docker = {
       enable = true;

hosts/satori/stuff.nix

@@ -1,4 +1,9 @@
-{ lib, config, pkgs, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
 {
   time.timeZone = "Asia/Kolkata";
 
@@ -8,26 +13,22 @@
     rtkit.enable = true;
     polkit.enable = true;
     sudo.enable = true;
-    doas = {
-      enable = true;
-      extraRules = [
-        {
-          users = [ "natto" ];
-          keepEnv = true;
-          persist = true;
-          setEnv = [ "SSH_AUTH_SOCK" "PATH" "SHELL" ];
-        }
-      ];
-    };
   };
   console.useXkbConfig = true;
 
-
   users.users.natto = {
     isNormalUser = true;
     shell = pkgs.zsh;
     home = "/home/natto";
-    extraGroups = [ "wheel" "adbusers" "video" "libvirtd" "docker" "networkmanager" "dialout" ];
+    extraGroups = [
+      "wheel"
+      "adbusers"
+      "video"
+      "libvirtd"
+      "docker"
+      "networkmanager"
+      "dialout"
+    ];
   };
 
   virtualisation = {

hosts/suwako/boot.nix

@@ -0,0 +1,24 @@
+{ config, ... }:
+{
+  boot = {
+    kernel.sysctl."net.ipv4.ip_forward" = 1;
+    initrd.kernelModules = [ "bochs" ];
+    initrd.availableKernelModules = [
+      "ata_piix"
+      "uhci_hcd"
+      "virtio_pci"
+      "virtio_scsi"
+    ];
+    kernelModules = [ "kvm-amd" ];
+    kernelParams = [
+      "console=ttyS0"
+      "console=tty1"
+      "nvme.shutdown_timeout=10"
+      "libiscsi.debug_libiscsi_eh=1"
+    ];
+    loader = {
+      systemd-boot.enable = true;
+      efi.canTouchEfiVariables = true;
+    };
+  };
+}

hosts/suwako/default.nix

@@ -0,0 +1,27 @@
+{
+  config,
+  pkgs,
+  conf,
+  ...
+}:
+{
+  imports = [
+    ./networking.nix
+    ./hardware.nix
+    ./boot.nix
+    ./services
+    ./mailserver.nix
+  ];
+
+  time.timeZone = "Asia/Kolkata";
+
+  users.users.kero = {
+    isNormalUser = true;
+    shell = pkgs.zsh;
+    home = "/home/kero";
+    extraGroups = [ "wheel" ];
+    openssh.authorizedKeys.keys = conf.network.commonSSHKeys;
+  };
+
+  system.stateVersion = "24.05";
+}

hosts/suwako/hardware.nix

@@ -0,0 +1,26 @@
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/cloudimg-rootfs";
+    fsType = "ext4";
+  };
+
+  swapDevices = [
+    {
+      device = "/swapfile";
+      size = 3084;
+      priority = 0;
+    }
+  ];
+}

hosts/suwako/mailserver.nix

@@ -0,0 +1,26 @@
+{
+  conf,
+  ...
+}:
+{
+  mailserver =
+    let
+      domain = conf.network.addresses.domain.amneesh;
+    in
+    rec {
+      enable = true;
+      stateVersion = 3;
+      fqdn = "mail.${domain}";
+      sendingFqdn = fqdn;
+      domains = [ domain ];
+      certificateDomains = [ "mail.${domain}" ];
+      certificateScheme = "acme-nginx";
+      loginAccounts = {
+        "me@${domain}" = {
+          hashedPasswordFile = "/var/secrets/me@${domain}.key";
+        };
+      };
+      enablePop3 = false;
+      enablePop3Ssl = false;
+    };
+}

hosts/suwako/networking.nix

@@ -0,0 +1,42 @@
+{
+  conf,
+  ...
+}:
+{
+  networking = {
+    useDHCP = false;
+    hostName = "suwako";
+    firewall = {
+      interfaces = {
+        enp0s6 = {
+          allowedTCPPorts = [
+            22
+            443
+            80
+            25565 # minecraft
+          ];
+        };
+      };
+    };
+    interfaces = {
+      enp0s6 = {
+        useDHCP = true;
+      };
+    };
+
+    wireguard.interfaces.wg0 = with conf.network.addresses.wireguard.ips; {
+      ips = [ suwako ];
+      listenPort = 17840;
+      privateKeyFile = "/var/secrets/wg.key";
+      peers = [
+        {
+          #Oracle VM1
+          publicKey = "z0Y2VNEWcyVQVSqRHiwmiJ5/0MgSPM+HZfEcwIccSxM=";
+          allowedIPs = [ remilia ];
+          endpoint = "${conf.network.addresses.domain.natto}:17840";
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+  };
+}

hosts/suwako/services/default.nix

@@ -0,0 +1,33 @@
+{ ... }:
+{
+  imports = [
+    ./nginx.nix
+    ./pufferpanel.nix
+    ./filehost.nix
+    ./gitea.nix
+  ];
+
+  virtualisation.docker = {
+    enable = true;
+  };
+
+  services = {
+    cron.enable = true;
+
+    openssh = {
+      enable = true;
+      settings.PermitRootLogin = "yes";
+      ports = [ 22 ];
+    };
+
+    postgresql = {
+      enable = true;
+      authentication = ''
+        local gitea all ident map=gitea-map
+      '';
+      identMap = ''
+        gitea-map gitea gitea
+      '';
+    };
+  };
+}

hosts/suwako/services/filehost.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  pkgs,
+  inputs,
+  conf,
+  ...
+}:
+{
+  systemd.services = rec {
+    filehost = {
+      enable = true;
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "simple";
+        Environment = [
+          "TITLE=nattofiles"
+          "INTERNAL_HOST=0.0.0.0"
+          "INTERNAL_PORT=8000"
+          "MAX_FILESIZE_MB=500"
+          "EXTERNAL_HAS_TLS=1"
+          "EXTERNAL_HOST=f.${conf.network.addresses.domain.natto}"
+        ];
+        Restart = "on-failure";
+        ExecStart = "${inputs.filehost.packages.${pkgs.system}.yamaf}/bin/yamaf";
+      };
+    };
+
+    filehost-chutiya = lib.recursiveUpdate filehost {
+      serviceConfig.Environment = [
+          "TITLE=chutiyafiles"
+          "INTERNAL_HOST=0.0.0.0"
+          "INTERNAL_PORT=8001"
+          "MAX_FILESIZE_MB=500"
+          "EXTERNAL_HAS_TLS=1"
+          "EXTERNAL_HOST=f.${conf.network.addresses.domain.chutiya}"
+        ];
+      };
+    };
+}

hosts/suwako/services/gitea.nix

@@ -1,4 +1,8 @@
-{ config, pkgs, conf, ... }:
+{
+  conf,
+  lib,
+  ...
+}:
 {
   services = {
     gitea = rec {
@@ -20,22 +24,32 @@
             HTTP_PORT = 5001;
             ROOT_URL = "https://git.${domain}";
             SSH_DOMAIN = "git.${domain}";
-            SSH_PORT = 22001;
+            SSH_PORT = 22;
             SSH_LISTEN_PORT = SSH_PORT;
           };
           mailer = rec {
             ENABLED = true;
             FROM = "masti@${domain}";
-            TYPE = "smtp";
-            HOST = "mail.${domain}";
-            IS_TLS_ENABLED = true;
+            SMTP_ADDR = "mail.${domain}";
+            PROTOCOL = "smtps";
             USER = FROM;
             REGISTER_MAIL_CONFIRM = true;
           };
+          service = {
+            ENABLE_CAPTCHA = true;
+            EMAIL_DOMAIN_ALLOWLIST = lib.strings.concatStringsSep "," [
+              "gmail.com"
+              "outlook.com"
+              "proton.me"
+              "protonmail.com"
+              conf.network.addresses.domain.natto
+              conf.network.addresses.domain.amneesh
+              conf.network.addresses.domain.chutiya
+            ];
+          };
           oauth2_client.REGISTER_MAIL_CONFIRM = true;
           actions.ENABLED = false;
         };
     };
   };
 }
-