Fixed release workflow

.gitea/workflows/ci.yml

@@ -0,0 +1,31 @@
+name: CI
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+
+jobs:
+  check:
+    runs-on: nix
+    env:
+      PATH: "/run/wrappers/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin:/usr/bin:/bin"
+      NIXPKGS_ALLOW_UNFREE: "1"
+    steps:
+      - name: Checkout
+        run: git clone https://git.cyperpunk.de/DerGrumpf/cyper-nix.git .
+
+      - name: Format check
+        run: nix fmt -- --ci
+      
+      - name: Nix flake check
+        run: nix flake check --impure
+
+      - name: Build NixOS configs (dry-run)
+        run: |
+          nix build .#nixosConfigurations.cyper-desktop.config.system.build.toplevel --dry-run
+          nix build .#nixosConfigurations.cyper-controller.config.system.build.toplevel --dry-run
+          nix build .#nixosConfigurations.cyper-proxy.config.system.build.toplevel --dry-run
+          nix build .#nixosConfigurations.cyper-node-1.config.system.build.toplevel --dry-run
+          nix build .#nixosConfigurations.cyper-node-2.config.system.build.toplevel --dry-run
+

.gitea/workflows/release.yml

@@ -0,0 +1,46 @@
+name: Release ISOs
+
+on:
+  workflow_dispatch:
+    workflows: ["CI"]
+    types:
+      - completed
+    branches: ["main"]
+
+jobs:
+  build-isos:
+    runs-on: nix
+    env:
+      NIXPKGS_ALLOW_UNFREE: "1"
+    steps:
+      - name: Checkout
+        run: git clone https://git.cyperpunk.de/DerGrumpf/cyper-nix.git .
+
+      - name: Build ISOs
+        run: |
+          nix build .#packages.x86_64-linux.cyper-desktop-iso --out-link result-desktop
+          nix build .#packages.x86_64-linux.cyper-controller-iso --out-link result-controller
+          nix build .#packages.x86_64-linux.cyper-proxy-iso --out-link result-proxy
+          nix build .#packages.x86_64-linux.cyper-node-1-iso --out-link result-node-1
+          nix build .#packages.x86_64-linux.cyper-node-2-iso --out-link result-node-2
+
+      - name: Create release and upload ISOs
+        run: |
+          TAG="iso-$(date +%Y%m%d-%H%M%S)"
+          COMMIT=$(git -C . rev-parse --short HEAD)
+
+          RELEASE=$(curl -s -X POST \
+            -H "Authorization: token ${{ secrets.CI_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d "{\"tag_name\":\"${TAG}\",\"name\":\"ISOs ${TAG}\",\"body\":\"Automated ISO build from commit ${COMMIT}\"}" \
+            "https://git.cyperpunk.de/api/v1/repos/DerGrumpf/cyper-nix/releases")
+
+          RELEASE_ID=$(echo $RELEASE | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2)
+
+          for result in result-desktop result-controller result-proxy result-node-1 result-node-2; do
+            iso=$(readlink -f $(find $result -name "*.iso" | head -1))
+            curl -s -X POST \
+              -H "Authorization: token ${{ secrets.CI_TOKEN }}" \
+              -F "attachment=@${iso};filename=${result}.iso" \
+              "https://git.cyperpunk.de/api/v1/repos/DerGrumpf/cyper-nix/releases/${RELEASE_ID}/assets"
+          done

darwin/default.nix

@@ -8,14 +8,8 @@
     ./settings.nix
     ./homebrew.nix
     ./yabai.nix
-    ./fonts.nix
   ];
 
-  home-manager.users.${primaryUser}.targets.darwin = {
-    linkApps.enable = true;
-    copyApps.enable = false;
-  };
-
   # nix config
   nix = {
     settings = {
@@ -56,9 +50,6 @@
     info.enable = false; # Skip info pages
   };
 
-  nixpkgs.config = {
-    allowUnfree = true;
-  };
   # homebrew installation manager
   nix-homebrew = {
     user = primaryUser;

darwin/settings.nix

@@ -1,28 +1,28 @@
-{ self, ... }:
+{ self, primaryUser, ... }:
+let
+  hmApps = app: "/Users/${primaryUser}/Applications/Home Manager Apps/${app}.app";
+  sysApps = app: "/System/Applications/${app}.app";
+  apps = app: "/Applications/${app}.app";
+in
 {
-  # touch ID for sudo
   security.pam.services.sudo_local.touchIdAuth = true;
 
-  # system defaults and preferences
   system = {
     stateVersion = 6;
     configurationRevision = self.rev or self.dirtyRev or null;
 
     startup.chime = false;
 
-    activationScripts = {
+    activationScripts.setWallpaper.text = ''
-      setWallpaper.text = ''
       /usr/bin/osascript <<EOF
       tell application "System Events"
         tell every desktop
-            set picture to "/Users/phil/Pictures/Wallpapers/Ghost_in_the_Shell.png"
+          set picture to "/Users/${primaryUser}/Pictures/Wallpapers/Ghost_in_the_Shell.png"
         end tell
       end tell
       EOF
     '';
 
-    };
-
     defaults = {
       ActivityMonitor = {
         IconType = 5;
@@ -37,20 +37,21 @@
         launchanim = true;
         mru-spaces = false;
         orientation = "left";
-        persistent-apps = [
-          { app = "/Users/phil/Applications/Home Manager Apps/kitty.app"; }
-          { app = "/Users/phil/Applications/Home Manager Apps/Vesktop.app"; }
-          { app = "/Users/phil/Applications/Home Manager Apps/Spotify.app"; }
-          { app = "/Users/phil/Applications/Home Manager Apps/Floorp.app"; }
-          { app = "/Users/phil/Applications/Home Manager Apps/Obsidian.app"; }
-          { app = "/Users/phil/Applications/Home Manager Apps/OpenSCAD.app"; }
-          { app = "/Applications/okular.app"; }
-          { app = "/Applications/Affinity.app"; }
-          { app = "/System/Applications/Mail.app"; }
-          { app = "/System/Applications/Launchpad.app"; }
-        ];
         show-recents = false;
         mineffect = "genie";
+        persistent-apps = map (app: { inherit app; }) [
+          (hmApps "kitty")
+          (hmApps "Vesktop")
+          (hmApps "Spotify")
+          (hmApps "Floorp")
+          (hmApps "Obsidian")
+          (hmApps "OpenSCAD")
+          (apps "okular")
+          (apps "Affinity")
+          (apps "Element")
+          (sysApps "Mail")
+          (sysApps "Launchpad")
+        ];
       };
 
       loginwindow = {
@@ -59,11 +60,11 @@
       };
 
       finder = {
-        AppleShowAllFiles = true; # hidden files
+        AppleShowAllFiles = true;
-        AppleShowAllExtensions = true; # file extensions
+        AppleShowAllExtensions = true;
-        _FXShowPosixPathInTitle = true; # title bar full path
+        _FXShowPosixPathInTitle = true;
-        ShowPathbar = true; # breadcrumb nav at bottom
+        ShowPathbar = true;
-        ShowStatusBar = true; # file count & disk space
+        ShowStatusBar = true;
       };
 
       NSGlobalDomain = {

darwin/yabai.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }: {
+_: {
   services = {
     yabai = {
       enable = true;
@@ -38,68 +38,5 @@
         mouse_drop_action = "swap";
       };
     };
-
-    #    skhd = {
-    #      enable = true;
-    #      skhdConfig = ''
-    # Application Bindings
-    #        cmd - q : open -a kitty
-    #        cmd - e : ${pkgs.kitty}/bin/kitty yazi
-    #        cmd - o : open -a "Obsidian"
-    #        cmd - i : open -a "Floorp" 
-    #        cmd - g : open -a "Mail"
-
-    # Window Management (using yabai if installed, otherwise basic macOS)
-    #cmd + shift - c : yabai -m window --close || osascript -e 'tell application "System Events" to keystroke "w" using command down'
-    #cmd + shift - v : yabai -m window --toggle float
-
-    # Focus windows (vim-like)
-    #        cmd - left : yabai -m window --focus west
-    #        cmd - right : yabai -m window --focus east
-    #        cmd - up : yabai -m window --focus north
-    #        cmd - down : yabai -m window --focus south
-
-    # Move windows to spaces (workspaces)
-    #       cmd + shift - 1 : yabai -m window --space 1
-    #       cmd + shift - 2 : yabai -m window --space 2
-    #       cmd + shift - 3 : yabai -m window --space 3
-    #       cmd + shift - 4 : yabai -m window --space 4
-    #       cmd + shift - 5 : yabai -m window --space 5
-    #       cmd + shift - 6 : yabai -m window --space 6
-    #       cmd + shift - 7 : yabai -m window --space 7
-    #       cmd + shift - 8 : yabai -m window --space 8
-    #       cmd + shift - 9 : yabai -m window --space 9
-    #       cmd + shift - 0 : yabai -m window --space 10
-
-    # Switch to spaces (workspaces)
-    #       cmd - 1 : yabai -m space --focus 1
-    #       cmd - 2 : yabai -m space --focus 2
-    #       cmd - 3 : yabai -m space --focus 3
-    #       cmd - 4 : yabai -m space --focus 4
-    #       cmd - 5 : yabai -m space --focus 5
-    #       cmd - 6 : yabai -m space --focus 6
-    #       cmd - 7 : yabai -m space --focus 7
-    #       cmd - 8 : yabai -m space --focus 8
-    #       cmd - 9 : yabai -m space --focus 9
-    #       cmd - 0 : yabai -m space --focus 10
-
-    # Screenshot (macOS native)
-    #       cmd - z : screencapture -i ~/Pictures/Screenshots/$(date +%s).png
-    #       cmd - u : screencapture ~/Pictures/Screenshots/$(date +%s).png
-
-    # Launcher (using Raycast or Spotlight as Rofi alternative)
-    #       cmd - r : open -a "Raycast" || osascript -e 'tell application "System Events" to keystroke space using command down'
-
-    # Lock screen
-    #       cmd - m : pmset displaysleepnow
-
-    # Toggle layout (if using yabai)
-    #       cmd - j : yabai -m space --layout $(yabai -m query --spaces --space | jq -r 'if .type == "bsp" then "float" else "bsp" end')
-    #       cmd - p : yabai -m window --toggle split
-
-    # Reload skhd config
-    #        cmd + shift - r : skhd --reload
-    #      '';
-    #    };
   };
 }

flake.lock

@@ -20,11 +20,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778857089,
+        "lastModified": 1780756231,
-        "narHash": "sha256-TclWRW2SdFeETLaiTG4BA8C8C4m/LppQEldncqyTzAQ=",
+        "narHash": "sha256-tXQxKdG5716uB9/LIkLQqQwHKf5mRSpHoZhz3lyI2Cg=",
         "owner": "hyprwm",
         "repo": "aquamarine",
-        "rev": "ab2b0af63fbc9fb779d684f19149b790978be8a8",
+        "rev": "6ecde03f47172753fe5a2f334f9d3facfb7e6784",
         "type": "github"
       },
       "original": {
@@ -36,16 +36,16 @@
     "brew-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1778427648,
+        "lastModified": 1781226006,
-        "narHash": "sha256-pt9KaDGsMyYWB9JeHs4XGHs870f1lOZe3vx9LpVIhUE=",
+        "narHash": "sha256-w4ZTuOnhYiDxjaynrMTASzp802QblBWmo3wpB8wVN4Y=",
         "owner": "Homebrew",
         "repo": "brew",
-        "rev": "6f293daa9f9f5832e13b497976335e90509886d7",
+        "rev": "109191be4988470b51a60a5ef1998520aa24c01b",
         "type": "github"
       },
       "original": {
         "owner": "Homebrew",
-        "ref": "5.1.11",
+        "ref": "6.0.1",
         "repo": "brew",
         "type": "github"
       }
@@ -57,11 +57,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779446167,
+        "lastModified": 1781255309,
-        "narHash": "sha256-95gfnivOKw+zleITz2OptawwTeSs36Y9u+qeU0xdqT8=",
+        "narHash": "sha256-n2P5xkAYGylrJ3feu7L6uaCUw/+jW8rk+HO127gDbFA=",
         "owner": "catppuccin",
         "repo": "nix",
-        "rev": "229ede9cec873986144e222b2c61c2f239c16125",
+        "rev": "036c78ea4cd8a42c8546c6316a944fd7d59d4341",
         "type": "github"
       },
       "original": {
@@ -77,11 +77,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779036909,
+        "lastModified": 1781761792,
-        "narHash": "sha256-zXcwYQGCT6pzinK+1dBB2ekTVtfxGZAapb3Evdcu4fY=",
+        "narHash": "sha256-rCPytmKNjctLloB6UgK5CRrHSwV4b0ygxtJLPPp8R14=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "56c666e108467d87d13508936aade6d567f2a501",
+        "rev": "a1fa429e945becaf60468600daf649be4ba0350c",
         "type": "github"
       },
       "original": {
@@ -159,6 +159,27 @@
         "type": "github"
       }
     },
+    "flake-parts_3": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "nur",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1733312601,
+        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
     "gitignore": {
       "inputs": {
         "nixpkgs": [
@@ -188,11 +209,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779592288,
+        "lastModified": 1781788787,
-        "narHash": "sha256-pVZwRFVFdHS3D3G07MiZQcSPENnv1xlYCJtfabkqd3Q=",
+        "narHash": "sha256-YqlTCRRhGvNjcJejPeMuHrYQ/TVhOO2MV/nEGMWb8nk=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "23703a32ef3d7803a2f1bb9909a3f46fc5185e37",
+        "rev": "d456f483f157d4b706416005da226234b9c116ff",
         "type": "github"
       },
       "original": {
@@ -293,19 +314,17 @@
         "hyprutils": "hyprutils_2",
         "hyprwayland-scanner": "hyprwayland-scanner",
         "hyprwire": "hyprwire",
-        "nixpkgs": [
+        "nixpkgs": "nixpkgs",
-          "nixpkgs"
-        ],
         "pre-commit-hooks": "pre-commit-hooks",
         "systems": "systems_2",
         "xdph": "xdph"
       },
       "locked": {
-        "lastModified": 1779565977,
+        "lastModified": 1781796010,
-        "narHash": "sha256-OCzhgY7kXuFLczKPf7KjMFS04CPXMAdaiQ+M1kFJVT8=",
+        "narHash": "sha256-bIqjZgUfp3vba/C1UJLVqTo8zdpfqMDvuwWrHmqDWm4=",
         "owner": "hyprwm",
         "repo": "Hyprland",
-        "rev": "abd4abb5e654707edba6f527058292333149f90f",
+        "rev": "ae1690c2138313d988c81f5c25a9d0b6fadfd3b1",
         "type": "github"
       },
       "original": {
@@ -377,11 +396,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779209205,
+        "lastModified": 1781442805,
-        "narHash": "sha256-asc7NpeB8vD66gvZeYcQkaWOs2X6Jgd29vBtP17vjxo=",
+        "narHash": "sha256-Kt56e6Bq2sfqN8yq1RHsS6z+8QKCZelmhaeQQRtZyqU=",
         "owner": "hyprwm",
         "repo": "hyprland-plugins",
-        "rev": "1cb37fad68dff5f5840010c314fed5809b4ee66f",
+        "rev": "1f90c674d51a1ef83c725cd6d02280b4c969fdf7",
         "type": "github"
       },
       "original": {
@@ -561,11 +580,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779475241,
+        "lastModified": 1780251518,
-        "narHash": "sha256-Nw4DN0A5krWNcPBvuWe5Gz2yuxsUUPiDgtu6SVPJQeU=",
+        "narHash": "sha256-fG9xbb1SOAAJ+2kJRakp3ch+BmA/3dEg/K3PoAZTKkw=",
         "owner": "hyprwm",
         "repo": "hyprutils",
-        "rev": "3cd3972b2ee658a14d2610d8494e09259e530124",
+        "rev": "40ede2e7bdec80ba5d4c443160d905e9f841ae5f",
         "type": "github"
       },
       "original": {
@@ -633,11 +652,11 @@
         "brew-src": "brew-src"
       },
       "locked": {
-        "lastModified": 1778851564,
+        "lastModified": 1781389246,
-        "narHash": "sha256-p8wzcnpB2Iys+QzAKM9/Eyw/pUyqCO3sw/NCnDH4dTE=",
+        "narHash": "sha256-ORqLAo/hoJdsZC7UPAuEHev6S0+XIqKEC7vjo5prz1k=",
         "owner": "zhaofengli",
         "repo": "nix-homebrew",
-        "rev": "b3a87b4793205cc111f3c61e25e018ffac3b8039",
+        "rev": "de7953a08ed4bb9245be043e468561c17b89130d",
         "type": "github"
       },
       "original": {
@@ -656,11 +675,11 @@
         "nixpkgs-nixcord": "nixpkgs-nixcord"
       },
       "locked": {
-        "lastModified": 1779498537,
+        "lastModified": 1781775854,
-        "narHash": "sha256-6LQjFDS69JufrN4sVsMNsXxeSF6BbDzMSbN7sVApsaA=",
+        "narHash": "sha256-0eb1+zKSTwgD3qsBm7UiuRabahHQNkTP94Z/s3nMK60=",
         "owner": "kaylorben",
         "repo": "nixcord",
-        "rev": "45a98c17b0d9e695bdee92ab00c76657eddf47e7",
+        "rev": "b92ceb7923c87dfcfcf84415407b0ca63e17548b",
         "type": "github"
       },
       "original": {
@@ -707,15 +726,15 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1779508470,
+        "lastModified": 1780749050,
-        "narHash": "sha256-Ap9KJX+5xHIn3bPIpfNgT6MEXdAECECwo4/rmlQD74M=",
+        "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=",
-        "owner": "nixos",
+        "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "29916453413845e54a65b8a1cf996842300cd299",
+        "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
+        "owner": "NixOS",
         "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
@@ -738,32 +757,32 @@
     },
     "nixpkgs-nixcord": {
       "locked": {
-        "lastModified": 1779102034,
+        "lastModified": 1780453794,
-        "narHash": "sha256-vZJZjLo513IeI8hjzHFc6TDezUd4uCE2Eq4SNO3DNNg=",
+        "narHash": "sha256-bXMRa9VTsHSPXL4Cw8R6JJLQeY3Y/IP4+YJCYVmQ7FY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "687f05a9184cad4eaf905c48b63649e3a86f5433",
+        "rev": "6b316287bae2ee04c9b93c8c858d930fd07d7338",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-25.11",
+        "ref": "nixos-26.05",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1779259093,
+        "lastModified": 1781577229,
-        "narHash": "sha256-7DKWmH23hL2eYdkxCKeqj2i+yljTKuU+3Nk1UPHOnxc=",
+        "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=",
-        "owner": "NixOS",
+        "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "d99b013d5d1931ad77fe3912ed218170dec5d9a4",
+        "rev": "567a49d1913ce81ac6e9582e3553dd90a955875f",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
+        "owner": "nixos",
-        "ref": "nixpkgs-unstable",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -771,15 +790,17 @@
     "nixvim": {
       "inputs": {
         "flake-parts": "flake-parts_2",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1779601302,
+        "lastModified": 1781713417,
-        "narHash": "sha256-ACtB1llc5ZOJM+lxfbIudM2i/c5dFxRJVXVvhOLpjqA=",
+        "narHash": "sha256-Kaj44jTNmnaFhKrcADx8nXmUYPa7l2HYfb7m6lEPy7Q=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "cb0107f6e18cdf7bf79a025fad154a4414c04383",
+        "rev": "caee4e5d4161778815f522d9ea1c9e3dc42462b7",
         "type": "github"
       },
       "original": {
@@ -788,6 +809,27 @@
         "type": "github"
       }
     },
+    "nur": {
+      "inputs": {
+        "flake-parts": "flake-parts_3",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1781800183,
+        "narHash": "sha256-NcRZr/JQiAvqC2qCyMxcfx/98Hf1epwdtjcbwKHeMf8=",
+        "owner": "nix-community",
+        "repo": "NUR",
+        "rev": "0559d992b12ee209570bb325d79e90007b13da52",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "NUR",
+        "type": "github"
+      }
+    },
     "pre-commit-hooks": {
       "inputs": {
         "flake-compat": "flake-compat",
@@ -822,8 +864,9 @@
         "nix-homebrew": "nix-homebrew",
         "nixcord": "nixcord",
         "nixos-generators": "nixos-generators",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_2",
         "nixvim": "nixvim",
+        "nur": "nur",
         "sops-nix": "sops-nix",
         "spicetify-nix": "spicetify-nix"
       }
@@ -835,11 +878,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777944972,
+        "lastModified": 1780547341,
-        "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
+        "narHash": "sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
+        "rev": "9ed65852b6257fbeae4355bc24ecfea307ca759a",
         "type": "github"
       },
       "original": {
@@ -856,11 +899,11 @@
         "systems": "systems_4"
       },
       "locked": {
-        "lastModified": 1779607677,
+        "lastModified": 1781425310,
-        "narHash": "sha256-Ang2de6zfcFF8v7LWqSDD1n6bgYj0vN1PY5hi7lOLsM=",
+        "narHash": "sha256-GTBka4Df/ZOacmisI/DI2LICyNChEqn/giah83LucdM=",
         "owner": "Gerg-L",
         "repo": "spicetify-nix",
-        "rev": "e69b824f3c4f4db836f47193723b6d37f93e0dc0",
+        "rev": "aeaf7c81a45d3761da61cb05bfc370ac6d1b0441",
         "type": "github"
       },
       "original": {
@@ -901,15 +944,16 @@
     },
     "systems_3": {
       "locked": {
-        "lastModified": 1681028828,
+        "lastModified": 1774449309,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
         "owner": "nix-systems",
         "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "rev": "c29398b59d2048c4ab79345812849c9bd15e9150",
         "type": "github"
       },
       "original": {
         "owner": "nix-systems",
+        "ref": "future-26.11",
         "repo": "default",
         "type": "github"
       }
@@ -957,11 +1001,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778265244,
+        "lastModified": 1780133819,
-        "narHash": "sha256-8jlPtGSsv/CQY6tVVyLF4Jjd0gnS+Zbn9yk/V13A9nM=",
+        "narHash": "sha256-0YPKIY3dlnR7SPq7Z8ekFVvzFsfeiAtEj+QUI3KHrlI=",
         "owner": "hyprwm",
         "repo": "xdg-desktop-portal-hyprland",
-        "rev": "813ea5ca9a1702a9a2d1f5836bc00172ef698968",
+        "rev": "4a170c0ba96fd37374f93d8f91c9ed91814828ac",
         "type": "github"
       },
       "original": {

flake.nix

@@ -16,10 +16,15 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    # NIX User Repositorys
+    nur = {
+      url = "github:nix-community/NUR";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     # declarative Hyprland
     hyprland = {
       url = "github:hyprwm/Hyprland";
-      inputs.nixpkgs.follows = "nixpkgs";
     };
 
     hyprland-plugins = {
@@ -46,6 +51,7 @@
     # declarative Neovim
     nixvim = {
       url = "github:nix-community/nixvim";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
 
     # declarative Discord
@@ -84,10 +90,66 @@
       hyprland,
       sops-nix,
       nixos-generators,
+      nur,
       ...
     }@inputs:
     let
       primaryUser = "phil";
+
+      mkIso =
+        {
+          hostName,
+          isDarwin ? false,
+          isServer ? false,
+        }:
+        nixos-generators.nixosGenerate {
+          system = "x86_64-linux";
+          format = "iso";
+          specialArgs = {
+            inherit
+              inputs
+              primaryUser
+              self
+              hostName
+              isDarwin
+              isServer
+              ;
+          };
+          modules = [
+            {
+              nixpkgs.overlays = [
+                inputs.nur.overlays.default
+                (import ./overlays { inherit (inputs) nur; })
+              ];
+            }
+            { nixpkgs.config.allowUnfree = true; }
+            { nixpkgs.hostPlatform = "x86_64-linux"; }
+            { networking.hostName = hostName; }
+            ./hosts/${hostName}/configuration.nix
+            ./nixos
+            inputs.sops-nix.nixosModules.sops
+            inputs.home-manager.nixosModules.home-manager
+            {
+              home-manager = {
+                extraSpecialArgs = {
+                  inherit
+                    inputs
+                    primaryUser
+                    self
+                    hostName
+                    isDarwin
+                    isServer
+                    ;
+                };
+                users.${primaryUser} = import ./home;
+                backupFileExtension = "backup";
+                useGlobalPkgs = true;
+                useUserPackages = true;
+              };
+            }
+          ];
+        };
+
       mkSystem =
         {
           hostName,
@@ -112,6 +174,12 @@
 
           sharedModules = [
             { networking.hostName = hostName; }
+            {
+              nixpkgs = {
+                overlays = [ (import ./overlays { inherit (inputs) nur; }) ];
+                config.allowUnfree = true;
+              };
+            }
             ./hosts/${hostName}/configuration.nix
             inputs.sops-nix.${platformModuleSet}.sops
             inputs.home-manager.${platformModuleSet}.home-manager
@@ -119,7 +187,7 @@
               home-manager = {
                 extraSpecialArgs = sharedSpecialArgs;
                 users.${primaryUser} = import ./home;
-                backupFileExtension = "backup";
+                backupFileExtension = "hm-backup";
                 useGlobalPkgs = true;
                 useUserPackages = true;
               };
@@ -183,36 +251,26 @@
         isDarwin = true;
       };
 
-      # NEW: flashable image for cyper-controller
+      packages.x86_64-linux = {
-      packages.x86_64-linux.cyper-controller-image = nixos-generators.nixosGenerate {
+        cyper-desktop-iso = mkIso { hostName = "cyper-desktop"; };
-        system = "x86_64-linux";
+        cyper-controller-iso = mkIso {
-        format = "raw-efi";
-        specialArgs = {
-          inherit inputs primaryUser self;
           hostName = "cyper-controller";
-          isDarwin = false;
           isServer = true;
         };
-        modules = [
+        cyper-proxy-iso = mkIso {
-          { nixpkgs.hostPlatform = "x86_64-linux"; }
+          hostName = "cyper-proxy";
-          { networking.hostName = "cyper-controller"; }
-          ./hosts/cyper-controller/configuration.nix
-          ./nixos
-          inputs.sops-nix.nixosModules.sops
-          inputs.home-manager.nixosModules.home-manager
-          {
-            home-manager = {
-              extraSpecialArgs = {
-                inherit inputs primaryUser self;
-                hostName = "cyper-controller";
-                isDarwin = false;
           isServer = true;
         };
-              users.${primaryUser} = import ./home;
+        cyper-node-1-iso = mkIso {
-              backupFileExtension = "backup";
+          hostName = "cyper-node-1";
+          isServer = true;
         };
-          }
+        cyper-node-2-iso = mkIso {
-        ];
+          hostName = "cyper-node-2";
+          isServer = true;
         };
       };
+
+      formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt-tree;
+    };
 }

home/catppuccin.nix

@@ -8,7 +8,8 @@
   imports = [ inputs.catppuccin.homeModules.catppuccin ];
 
   catppuccin = {
-    enable = false;
+    enable = true;
+    autoEnable = false;
     accent = "sky";
     flavor = "mocha";
     eza.enable = true;
@@ -49,5 +50,6 @@
       enable = true;
       apply = true;
     };
+    opencode.enable = true;
   };
 }

home/default.nix

@@ -17,12 +17,16 @@
     ./xdg.nix
     ./neovim
     ./python.nix
+    ./fonts.nix
     inputs.sops-nix.homeManagerModules.sops
   ]
   ++ lib.optionals (!isDarwin && !isServer) [
     ./desktop
     ./catppuccin.nix
   ]
+  ++ lib.optionals (!isDarwin) [
+    ./opencode.nix
+  ]
   ++ lib.optionals isDarwin [
     ./desktop/sketchybar
     ./catppuccin.nix
@@ -30,12 +34,13 @@
   ++ lib.optionals (!isServer) [
     ./nixcord.nix
     ./spicetify.nix
-    ./floorp.nix
+    ./floorp
     ./obsidian.nix
   ];
 
   home = {
     username = primaryUser;
+    enableNixpkgsReleaseCheck = false;
     stateVersion = "26.05";
     sessionVariables = lib.mkIf (!isDarwin && !isServer) {
       GROQ_API_KEY = config.sops.secrets.GROQ_API_KEY.path;

home/desktop/default.nix

@@ -1,5 +1,4 @@
-{ pkgs, ... }:
+_: {
-{
   imports = [
     ./hyprland
     ./rofi
@@ -10,11 +9,6 @@
 
   _module.args.compositor = "hyprland";
 
-  home.packages = with pkgs; [
-    waypaper
-    awww
-    onlyoffice-desktopeditors
-  ];
   home.file.".config/waypaper/config.ini".source = ./waypaper.ini;
 
   programs = {

home/desktop/hyprland/default.nix

@@ -1,4 +1,4 @@
-{ inputs, pkgs, ... }:
+{ pkgs, ... }:
 {
   imports = [
     ./hypridle.nix
@@ -19,6 +19,8 @@
 
   systemd.user.targets.hyprland-session.Unit.Wants = [ "xdg-desktop-autostart.target" ];
 
+  services.awww.enable = true;
+
   wayland.windowManager.hyprland = {
     package = null;
     enable = true;
@@ -31,6 +33,6 @@
       enableXdgAutostart = false;
     };
 
-    extraConfig = builtins.readFile ./hyprland.lua;
+    extraConfig = builtins.readFile ./hyprland-scrolling.lua;
   };
 }

home/desktop/hyprland/hyprland-scrolling.lua

@@ -0,0 +1,310 @@
+-- hyprland.lua — migrated from hyprlang for Hyprland 0.55+
+-- https://wiki.hypr.land/Configuring/Start/
+
+-- ── Variables ────────────────────────────────────────────────────────────────
+
+local super = "SUPER"
+local terminal = "kitty"
+local fileManager = "yazi"
+local theme = "-theme $HOME/.config/rofi/custom.rasi"
+local menu = "rofi -show drun " .. theme
+local filebrowser = "rofi -show filebrowser " .. theme
+local power = "rofi -show p -modi p:rofi-power-menu -theme $HOME/.config/rofi/power.rasi"
+local apps = "rofi -show window " .. theme
+local screenshot = "$HOME/Pictures/Screenshots/$(date +'%s_grim.png')"
+
+-- ── Helpers ───────────────────────────────────────────────────────────────────
+
+-- Bind a list of { key, action [, opts] } entries
+local function bind_all(list)
+	for _, b in ipairs(list) do
+		hl.bind(b[1], b[2], b[3])
+	end
+end
+
+-- Bind a list of { key, cmd [, opts] } entries as exec_cmd actions
+local function bind_exec(list)
+	for _, b in ipairs(list) do
+		hl.bind(b[1], hl.dsp.exec_cmd(b[2]), b[3])
+	end
+end
+
+-- Bind a list of { key, layout_msg } entries as layout actions
+local function bind_layout(list)
+	for _, b in ipairs(list) do
+		hl.bind(b[1], hl.dsp.layout(b[2]))
+	end
+end
+
+-- ── Monitors ─────────────────────────────────────────────────────────────────
+
+local monitors = {
+	{ output = "DP-1", mode = "1920x1080@60", position = "1920x0", scale = 1 },
+	{ output = "HDMI-A-2", mode = "1920x1080@60", position = "0x0", scale = 1 },
+}
+
+for _, m in ipairs(monitors) do
+	hl.monitor(m)
+end
+
+-- ── Environment ──────────────────────────────────────────────────────────────
+
+local env_vars = {
+	NIXOS_OZONE_WL = "1",
+	MOZ_ENABLE_WAYLAND = "1",
+	MOZ_WEBRENDER = "1",
+	_JAVA_AWT_WM_NONREPARENTING = "1",
+	QT_WAYLAND_DISABLE_WINDOWDECORATION = "1",
+	QT_QPA_PLATFORM = "wayland",
+	SDL_VIDEODRIVER = "wayland",
+	GDK_BACKEND = "wayland,x11",
+	XCURSOR_SIZE = "24",
+	XCURSOR_THEME = "catppuccin-mocha-dark",
+	EDITOR = "nvim",
+	GSK_RENDERER = "gl",
+	HYPRCURSOR_THEME = "catppuccin-mocha-dark",
+	HYPRCURSOR_SIZE = "24",
+}
+
+for k, v in pairs(env_vars) do
+	hl.env(k, v)
+end
+
+-- ── Autostart ────────────────────────────────────────────────────────────────
+
+local wallpaper = "$HOME/Pictures/Wallpapers/Ghost_in_the_Shell.png"
+
+local autostart = {
+	"sleep 2 && waybar & disown",
+}
+
+hl.on("hyprland.start", function()
+	for _, cmd in ipairs(autostart) do
+		hl.exec_cmd(cmd)
+	end
+end)
+
+-- ── Config ───────────────────────────────────────────────────────────────────
+
+hl.config({
+	debug = {
+		disable_logs = false,
+		enable_stdout_logs = false,
+	},
+
+	input = {
+		kb_layout = "de",
+		kb_variant = "mac",
+		kb_options = "apple:fn_lock",
+		repeat_rate = 50,
+		repeat_delay = 300,
+		accel_profile = "flat",
+		follow_mouse = 1,
+		mouse_refocus = false,
+		sensitivity = 0,
+		numlock_by_default = true,
+		touchpad = {
+			natural_scroll = true,
+			tap_to_click = true,
+		},
+	},
+
+	general = {
+		gaps_in = 2,
+		gaps_out = 0,
+		border_size = 4,
+		col = {
+			active_border = "rgba(a6e3a1ff)",
+			inactive_border = "rgba(f38ba8ff)",
+		},
+		layout = "scrolling",
+		allow_tearing = false,
+	},
+
+	decoration = {
+		rounding = 1,
+		shadow = {
+			enabled = false,
+			range = 16,
+			render_power = 4,
+			color = "rgba(a6e3a1ff)",
+			color_inactive = "rgba(f38ba8ff)",
+		},
+		blur = {
+			enabled = false,
+			size = 1,
+			passes = 3,
+			new_optimizations = true,
+			noise = 0.04,
+		},
+	},
+
+	animations = {
+		enabled = true,
+	},
+
+	scrolling = {
+		column_width = 0.5,
+		fullscreen_on_one_column = true,
+		focus_fit_method = 1,
+		follow_focus = true,
+		follow_min_visible = 0.4,
+		explicit_column_widths = "0.333, 0.5, 0.667, 1.0",
+		wrap_focus = true,
+		wrap_swapcol = true,
+		direction = "right",
+	},
+
+	misc = {
+		force_default_wallpaper = 0,
+		disable_hyprland_logo = true,
+		disable_splash_rendering = true,
+		mouse_move_enables_dpms = true,
+		key_press_enables_dpms = true,
+		vrr = 0,
+	},
+})
+
+-- ── Animations ───────────────────────────────────────────────────────────────
+
+hl.curve("myBezier", { type = "bezier", points = { { 0.05, 0.9 }, { 0.1, 1.05 } } })
+hl.curve("mySpring", { type = "spring", mass = 0.6, stiffness = 70.00, dampening = 10.00 })
+
+local animations = {
+	{ leaf = "windows", enabled = true, speed = 10, spring = "mySpring" },
+	{ leaf = "windowsOut", enabled = true, speed = 10, spring = "mySpring", style = "popin 80%" },
+	{ leaf = "border", enabled = true, speed = 10, spring = "mySpring" },
+	{ leaf = "borderangle", enabled = true, speed = 10, spring = "mySpring" },
+	{ leaf = "fade", enabled = true, speed = 10, spring = "mySpring" },
+	{ leaf = "workspaces", enabled = true, speed = 10, spring = "mySpring" },
+}
+
+for _, anim in ipairs(animations) do
+	hl.animation(anim)
+end
+
+-- ── Devices ──────────────────────────────────────────────────────────────────
+
+local devices = {
+	{ name = "usb-optical-mouse-", sensitivity = 0 },
+}
+
+for _, d in ipairs(devices) do
+	hl.device(d)
+end
+
+-- ── Window Rules ─────────────────────────────────────────────────────────────
+
+local window_rules = {
+	{ name = "kitty_width", match = { class = "kitty" }, scrolling_width = 0.5 },
+	{ name = "browser_width", match = { class = "floorp" }, scrolling_width = 0.667 },
+	{ name = "obsidian_width", match = { class = "obsidian" }, scrolling_width = 0.5 },
+	{ name = "nautilus_width", match = { class = "nautilus" }, scrolling_width = 0.333 },
+	{ name = "thunderbird_width", match = { class = "thunderbird" }, scrolling_width = 0.667 },
+}
+
+for _, rule in ipairs(window_rules) do
+	hl.window_rule(rule)
+end
+
+-- ── Binds ────────────────────────────────────────────────────────────────────
+
+-- Applications & launchers
+bind_exec({
+	{ super .. " + Q", terminal },
+	{ super .. " + E", fileManager },
+	{ super .. " + O", "obsidian" },
+	{ super .. " + I", "floorp" },
+	{ super .. " + G", "thunderbird" },
+	{ "XF86Mail", "thunderbird" },
+	{ super .. " + N", "nautilus" },
+	{ "XF86Search", "nautilus" },
+	-- Rofi
+	{ super .. " + F", filebrowser },
+	{ super .. " + A", apps },
+	{ "Menu", apps },
+	{ super .. " + R", menu },
+	{ "XF86LaunchA", menu },
+	{ super .. " + S", power },
+	{ "XF86LaunchB", power },
+	-- Screenshots
+	{ super .. " + Z", 'grim -g "$(slurp)" ' .. screenshot },
+	{ super .. " + U", "grim " .. screenshot },
+	-- Media & brightness (locked = works on lockscreen, repeating = held key)
+	{ "XF86AudioMute", "pamixer -t", { locked = true } },
+	{ "XF86AudioPlay", "playerctl play-pause", { locked = true } },
+	{ "XF86AudioNext", "playerctl next", { locked = true } },
+	{ "XF86AudioPrev", "playerctl previous", { locked = true } },
+	{ "XF86AudioRaiseVolume", "pamixer -i 5", { locked = true, repeating = true } },
+	{ "XF86AudioLowerVolume", "pamixer -d 5", { locked = true, repeating = true } },
+	{ "XF86MonBrightnessUp", "brightnessctl set +5%", { locked = true, repeating = true } },
+	{ "XF86MonBrightnessDown", "brightnessctl set 5%-", { locked = true, repeating = true } },
+})
+
+-- Window actions
+bind_all({
+	{ super .. " + M", hl.dsp.exit() },
+	{ super .. " + V", hl.dsp.window.float({ action = "toggle" }) },
+	{ super .. " + C", hl.dsp.window.close() },
+	-- Mouse move/resize
+	{ super .. " + mouse:272", hl.dsp.window.drag() },
+	{ super .. " + mouse:273", hl.dsp.window.drag({ resize = true }) },
+	-- Switch workspaces with mouse wheel
+	{ super .. " + mouse_down", hl.dsp.focus({ workspace = "e+1" }) },
+	{ super .. " + mouse_up", hl.dsp.focus({ workspace = "e-1" }) },
+})
+
+-- Directional focus (up/down move within a column; left/right scroll between columns)
+for _, dir in ipairs({ "left", "right", "up", "down" }) do
+	hl.bind(super .. " + " .. dir, hl.dsp.layout("focus " .. dir))
+end
+
+-- Scrolling layout commands
+bind_layout({
+	-- Column navigation
+	{ super .. " + period", "move +col" },
+	{ super .. " + comma", "move -col" },
+	-- Column swap
+	{ super .. " + SHIFT + period", "swapcol r" },
+	{ super .. " + SHIFT + comma", "swapcol l" },
+	-- Column resize (cycle through explicit_column_widths)
+	{ super .. " + equal", "colresize +conf" },
+	{ super .. " + minus", "colresize -conf" },
+	-- Fine-grained resize
+	{ super .. " + SHIFT + equal", "colresize +0.05" },
+	{ super .. " + SHIFT + minus", "colresize -0.05" },
+	-- Fit operations
+	{ super .. " + F1", "fit active" },
+	{ super .. " + F2", "fit visible" },
+	{ super .. " + F3", "fit all" },
+	-- Promote window to its own column / consume into previous
+	{ super .. " + RETURN", "promote" },
+	{ super .. " + SHIFT + RETURN", "consume_or_expel prev" },
+	-- Expel/consume explicitly
+	{ super .. " + bracketright", "expel" },
+	{ super .. " + bracketleft", "consume" },
+	-- Toggle scroll lock for active workspace
+	{ super .. " + SHIFT + S", "inhibit_scroll" },
+})
+
+-- Workspaces 1–10 (key 0 maps to workspace 10)
+for i = 1, 10 do
+	local key = tostring(i % 10)
+	hl.bind(super .. " + " .. key, hl.dsp.focus({ workspace = i }))
+	hl.bind(super .. " + SHIFT + " .. key, hl.dsp.window.move({ workspace = i }))
+end
+
+-- Special workspace (scratchpad)
+hl.bind(super .. " + grave", hl.dsp.window.move({ workspace = "special:magic" }))
+
+-- ── Workspace Rules ───────────────────────────────────────────────────────────
+
+local workspace_rules = {
+	{ workspace = "1", layout_opts = { direction = "right" } },
+	{ workspace = "2", layout_opts = { direction = "right" } },
+	{ workspace = "3", layout_opts = { direction = "right" } },
+}
+
+for _, rule in ipairs(workspace_rules) do
+	hl.workspace_rule(rule)
+end

home/desktop/hyprland/hyprland.lua

@@ -1,9 +1,7 @@
 -- hyprland.lua — migrated from hyprlang for Hyprland 0.55+
 -- https://wiki.hypr.land/Configuring/Start/
 
---------------------
+-- ── Variables ────────────────────────────────────────────────────────────────
----- VARIABLES -----
---------------------
 
 local super = "SUPER"
 local terminal = "kitty"
@@ -13,46 +11,80 @@ local menu = "rofi -show drun " .. theme
 local filebrowser = "rofi -show filebrowser " .. theme
 local power = "rofi -show p -modi p:rofi-power-menu -theme $HOME/.config/rofi/power.rasi"
 local apps = "rofi -show window " .. theme
+local screenshot = "$HOME/Pictures/Screenshots/$(date +'%s_grim.png')"
 
---------------------
+-- ── Helpers ───────────────────────────────────────────────────────────────────
----- MONITORS ------
---------------------
 
-hl.monitor({ output = "DP-1", mode = "1920x1080@60", position = "1920x0", scale = 1 })
+-- Bind a list of { key, action [, opts] } entries
-hl.monitor({ output = "HDMI-A-2", mode = "1920x1080@60", position = "0x0", scale = 1 })
+local function bind_all(list)
+	for _, b in ipairs(list) do
+		hl.bind(b[1], b[2], b[3])
+	end
+end
 
------------------------------
+-- Bind a list of { key, cmd [, opts] } entries as exec_cmd actions
----- ENVIRONMENT VARIABLES --
+local function bind_exec(list)
------------------------------
+	for _, b in ipairs(list) do
+		hl.bind(b[1], hl.dsp.exec_cmd(b[2]), b[3])
+	end
+end
 
-hl.env("NIXOS_OZONE_WL", "1")
+-- Bind a list of { key, layout_cmd } entries as layout actions
-hl.env("MOZ_ENABLE_WAYLAND", "1")
+local function bind_layout(list)
-hl.env("MOZ_WEBRENDER", "1")
+	for _, b in ipairs(list) do
-hl.env("_JAVA_AWT_WM_NONREPARENTING", "1")
+		hl.bind(b[1], hl.dsp.layout(b[2]))
-hl.env("QT_WAYLAND_DISABLE_WINDOWDECORATION", "1")
+	end
-hl.env("QT_QPA_PLATFORM", "wayland")
+end
-hl.env("SDL_VIDEODRIVER", "wayland")
-hl.env("GDK_BACKEND", "wayland,x11")
-hl.env("XCURSOR_SIZE", "24")
-hl.env("XCURSOR_THEME", "catppuccin-mocha-dark")
-hl.env("EDITOR", "nvim")
-hl.env("GSK_RENDERER", "gl")
-hl.env("HYPRCURSOR_THEME", "catppuccin-mocha-dark")
-hl.env("HYPRCURSOR_SIZE", "24")
 
---------------------
+-- ── Monitors ─────────────────────────────────────────────────────────────────
----- AUTOSTART -----
+
---------------------
+local monitors = {
+	{ output = "DP-1", mode = "1920x1080@60", position = "1920x0", scale = 1 },
+	{ output = "HDMI-A-2", mode = "1920x1080@60", position = "0x0", scale = 1 },
+}
+
+for _, m in ipairs(monitors) do
+	hl.monitor(m)
+end
+
+-- ── Environment ──────────────────────────────────────────────────────────────
+
+local env_vars = {
+	NIXOS_OZONE_WL = "1",
+	MOZ_ENABLE_WAYLAND = "1",
+	MOZ_WEBRENDER = "1",
+	_JAVA_AWT_WM_NONREPARENTING = "1",
+	QT_WAYLAND_DISABLE_WINDOWDECORATION = "1",
+	QT_QPA_PLATFORM = "wayland",
+	SDL_VIDEODRIVER = "wayland",
+	GDK_BACKEND = "wayland,x11",
+	XCURSOR_SIZE = "24",
+	XCURSOR_THEME = "catppuccin-mocha-dark",
+	EDITOR = "nvim",
+	GSK_RENDERER = "gl",
+	HYPRCURSOR_THEME = "catppuccin-mocha-dark",
+	HYPRCURSOR_SIZE = "24",
+}
+
+for k, v in pairs(env_vars) do
+	hl.env(k, v)
+end
+
+-- ── Autostart ────────────────────────────────────────────────────────────────
+
+local autostart = {
+	"awww-daemon --no-cache & disown",
+	"awww img ~/Pictures/Wallpapers/Ghost_in_the_Shell.png",
+	"waybar &",
+}
 
 hl.on("hyprland.start", function()
-	hl.exec_cmd("awww-daemon --no-cache & disown")
+	for _, cmd in ipairs(autostart) do
-	hl.exec_cmd("awww img ~/Pictures/Wallpapers/Ghost_in_the_Shell.png")
+		hl.exec_cmd(cmd)
-	hl.exec_cmd("waybar &")
+	end
 end)
 
---------------------
+-- ── Config ───────────────────────────────────────────────────────────────────
----- CONFIG --------
---------------------
 
 hl.config({
 	debug = {
@@ -73,7 +105,7 @@ hl.config({
 		numlock_by_default = true,
 		touchpad = {
 			natural_scroll = true,
-			tap_to_click = true, -- note: underscore, not hyphen
+			tap_to_click = true,
 		},
 	},
 
@@ -85,7 +117,7 @@ hl.config({
 			active_border = "rgba(a6e3a1ff)",
 			inactive_border = "rgba(f38ba8ff)",
 		},
-		layout = "dwindle",
+		layout = "master",
 		allow_tearing = false,
 	},
 
@@ -111,8 +143,16 @@ hl.config({
 		enabled = true,
 	},
 
-	dwindle = {
+	master = {
-		preserve_split = true,
+		new_status = "slave",
+		new_on_top = false,
+		new_on_active = "after",
+		orientation = "left",
+		mfact = 0.55,
+		allow_small_split = false,
+		smart_resizing = true,
+		drop_at_cursor = true,
+		focus_master_on_close = false,
 	},
 
 	misc = {
@@ -125,60 +165,102 @@ hl.config({
 	},
 })
 
--- Animations (bezier curves + animation tree)
+-- ── Animations ───────────────────────────────────────────────────────────────
+
 hl.curve("myBezier", { type = "bezier", points = { { 0.05, 0.9 }, { 0.1, 1.05 } } })
 
-hl.animation({ leaf = "windows", enabled = true, speed = 7, bezier = "myBezier" })
+local animations = {
-hl.animation({ leaf = "windowsOut", enabled = true, speed = 7, bezier = "default", style = "popin 80%" })
+	{ leaf = "windows", enabled = true, speed = 7, bezier = "myBezier" },
-hl.animation({ leaf = "border", enabled = true, speed = 10, bezier = "default" })
+	{ leaf = "windowsOut", enabled = true, speed = 7, bezier = "default", style = "popin 80%" },
-hl.animation({ leaf = "borderangle", enabled = true, speed = 8, bezier = "default" })
+	{ leaf = "border", enabled = true, speed = 10, bezier = "default" },
-hl.animation({ leaf = "fade", enabled = true, speed = 7, bezier = "default" })
+	{ leaf = "borderangle", enabled = true, speed = 8, bezier = "default" },
-hl.animation({ leaf = "workspaces", enabled = true, speed = 6, bezier = "default" })
+	{ leaf = "fade", enabled = true, speed = 7, bezier = "default" },
+	{ leaf = "workspaces", enabled = true, speed = 6, bezier = "default" },
+}
 
--- Per-device config
+for _, anim in ipairs(animations) do
-hl.device({
+	hl.animation(anim)
-	name = "usb-optical-mouse-",
+end
-	sensitivity = 0,
+
+-- ── Devices ──────────────────────────────────────────────────────────────────
+
+local devices = {
+	{ name = "usb-optical-mouse-", sensitivity = 0 },
+}
+
+for _, d in ipairs(devices) do
+	hl.device(d)
+end
+
+-- ── Binds ────────────────────────────────────────────────────────────────────
+
+-- Applications & launchers
+bind_exec({
+	{ super .. " + Q", terminal },
+	{ super .. " + E", fileManager },
+	{ super .. " + O", "obsidian" },
+	{ super .. " + I", "floorp" },
+	{ super .. " + G", "thunderbird" },
+	{ "XF86Mail", "thunderbird" },
+	{ super .. " + N", "nautilus" },
+	{ "XF86Search", "nautilus" },
+	-- Rofi
+	{ super .. " + F", filebrowser },
+	{ super .. " + A", apps },
+	{ "Menu", apps },
+	{ super .. " + R", menu },
+	{ "XF86LaunchA", menu },
+	{ super .. " + S", power },
+	{ "XF86LaunchB", power },
+	-- Screenshots
+	{ super .. " + Z", 'grim -g "$(slurp)" ' .. screenshot },
+	{ super .. " + U", "grim " .. screenshot },
+	-- Media & brightness (locked = works on lockscreen, repeating = held key)
+	{ "XF86AudioMute", "pamixer -t", { locked = true } },
+	{ "XF86AudioPlay", "playerctl play-pause", { locked = true } },
+	{ "XF86AudioNext", "playerctl next", { locked = true } },
+	{ "XF86AudioPrev", "playerctl previous", { locked = true } },
+	{ "XF86AudioRaiseVolume", "pamixer -i 5", { locked = true, repeating = true } },
+	{ "XF86AudioLowerVolume", "pamixer -d 5", { locked = true, repeating = true } },
+	{ "XF86MonBrightnessUp", "brightnessctl set +5%", { locked = true, repeating = true } },
+	{ "XF86MonBrightnessDown", "brightnessctl set 5%-", { locked = true, repeating = true } },
 })
 
---------------------
+-- Window actions
----- KEYBINDINGS ---
+bind_all({
---------------------
+	{ super .. " + M", hl.dsp.exit() },
+	{ super .. " + P", hl.dsp.window.pseudo() },
+	{ super .. " + V", hl.dsp.window.float({ action = "toggle" }) },
+	{ super .. " + C", hl.dsp.window.close() },
+	-- Mouse move/resize
+	{ super .. " + mouse:272", hl.dsp.window.drag() },
+	{ super .. " + mouse:273", hl.dsp.window.drag({ resize = true }) },
+	-- Scroll through workspaces
+	{ super .. " + mouse_down", hl.dsp.focus({ workspace = "e+1" }) },
+	{ super .. " + mouse_up", hl.dsp.focus({ workspace = "e-1" }) },
+})
 
--- Application bindings
+-- Directional focus
-hl.bind(super .. " + Q", hl.dsp.exec_cmd(terminal))
+for _, dir in ipairs({ "left", "right", "up", "down" }) do
-hl.bind(super .. " + E", hl.dsp.exec_cmd(fileManager))
+	hl.bind(super .. " + " .. dir, hl.dsp.focus({ direction = dir }))
-hl.bind(super .. " + O", hl.dsp.exec_cmd("obsidian"))
+end
-hl.bind(super .. " + I", hl.dsp.exec_cmd("floorp"))
-hl.bind(super .. " + G", hl.dsp.exec_cmd("thunderbird"))
-hl.bind("XF86Mail", hl.dsp.exec_cmd("thunderbird"))
-hl.bind(super .. " + N", hl.dsp.exec_cmd("nautilus"))
-hl.bind("XF86Search", hl.dsp.exec_cmd("nautilus"))
 
--- Exit
+-- Master layout commands
-hl.bind(super .. " + M", hl.dsp.exit())
+bind_layout({
+	{ super .. " + RETURN", "swapwithmaster auto" },
+	{ super .. " + SHIFT + RETURN", "focusmaster auto" },
+	{ super .. " + TAB", "cyclenext" },
+	{ super .. " + SHIFT + TAB", "cycleprev" },
+	{ super .. " + bracketright", "swapnext" },
+	{ super .. " + bracketleft", "swapprev" },
+	{ super .. " + period", "addmaster" },
+	{ super .. " + comma", "removemaster" },
+	{ super .. " + SHIFT + O", "orientationcycle left top right bottom" },
+	{ super .. " + equal", "mfact +0.05" },
+	{ super .. " + minus", "mfact -0.05" },
+})
 
--- Rofi bindings
+-- Workspaces 1–10 (key 0 maps to workspace 10)
-hl.bind(super .. " + F", hl.dsp.exec_cmd(filebrowser))
-hl.bind(super .. " + A", hl.dsp.exec_cmd(apps))
-hl.bind("Menu", hl.dsp.exec_cmd(apps))
-hl.bind(super .. " + R", hl.dsp.exec_cmd(menu))
-hl.bind("XF86LaunchA", hl.dsp.exec_cmd(menu))
-hl.bind(super .. " + S", hl.dsp.exec_cmd(power))
-hl.bind("XF86LaunchB", hl.dsp.exec_cmd(power))
-
--- Move focus
-hl.bind(super .. " + left", hl.dsp.focus({ direction = "left" }))
-hl.bind(super .. " + right", hl.dsp.focus({ direction = "right" }))
-hl.bind(super .. " + up", hl.dsp.focus({ direction = "up" }))
-hl.bind(super .. " + down", hl.dsp.focus({ direction = "down" }))
-
--- Window modifiers
-hl.bind(super .. " + P", hl.dsp.window.pseudo())
-hl.bind(super .. " + V", hl.dsp.window.float({ action = "toggle" }))
-hl.bind(super .. " + C", hl.dsp.window.close())
-
--- Workspaces (1-10, 0 maps to 10)
 for i = 1, 10 do
 	local key = tostring(i % 10)
 	hl.bind(super .. " + " .. key, hl.dsp.focus({ workspace = i }))
@@ -188,24 +270,13 @@ end
 -- Special workspace (scratchpad)
 hl.bind(super .. " + SHIFT + S", hl.dsp.window.move({ workspace = "special:magic" }))
 
--- Scroll through workspaces with mouse wheel
+-- ── Workspace Rules ───────────────────────────────────────────────────────────
-hl.bind(super .. " + mouse_down", hl.dsp.focus({ workspace = "e+1" }))
-hl.bind(super .. " + mouse_up", hl.dsp.focus({ workspace = "e-1" }))
 
--- Screenshot
+local workspace_rules = {
-hl.bind(super .. " + Z", hl.dsp.exec_cmd("grim -g \"$(slurp)\" $HOME/Pictures/Screenshots/$(date +'%s_grim.png')"))
+	{ workspace = "1", layout_opts = { orientation = "left" } },
-hl.bind(super .. " + U", hl.dsp.exec_cmd("grim $HOME/Pictures/Screenshots/$(date +'%s_grim.png')"))
+	{ workspace = "2", layout_opts = { orientation = "top" } },
+}
 
--- Media controls (locked = works on lockscreen, repeating = held key)
+for _, rule in ipairs(workspace_rules) do
-hl.bind("XF86AudioMute", hl.dsp.exec_cmd("pamixer -t"), { locked = true })
+	hl.workspace_rule(rule)
-hl.bind("XF86AudioPlay", hl.dsp.exec_cmd("playerctl play-pause"), { locked = true })
+end
-hl.bind("XF86AudioNext", hl.dsp.exec_cmd("playerctl next"), { locked = true })
-hl.bind("XF86AudioPrev", hl.dsp.exec_cmd("playerctl previous"), { locked = true })
-hl.bind("XF86AudioRaiseVolume", hl.dsp.exec_cmd("pamixer -i 5"), { locked = true, repeating = true })
-hl.bind("XF86AudioLowerVolume", hl.dsp.exec_cmd("pamixer -d 5"), { locked = true, repeating = true })
-hl.bind("XF86MonBrightnessUp", hl.dsp.exec_cmd("brightnessctl set +5%"), { locked = true, repeating = true })
-hl.bind("XF86MonBrightnessDown", hl.dsp.exec_cmd("brightnessctl set 5%-"), { locked = true, repeating = true })
-
--- Mouse bindings for move/resize
-hl.bind(super .. " + mouse:272", hl.dsp.window.drag())
-hl.bind(super .. " + mouse:273", hl.dsp.window.drag({ resize = true }))

home/desktop/niri/swaync.nix

@@ -1,110 +0,0 @@
-{ ... }:
-{
-  services.swaync = {
-    enable = true;
-    settings = {
-      positionX = "center";
-      positionY = "center";
-      layer = "overlay";
-      control-center-layer = "top";
-      layer-shell = true;
-      cssPriority = "user";
-      control-center-margin-top = 100;
-      control-center-margin-bottom = 200;
-      control-center-margin-right = 0;
-      control-center-margin-left = 0;
-      notification-2fa-action = true;
-      notification-inline-replies = false;
-      notification-icon-size = 64;
-      notification-body-image-height = 100;
-      notification-body-image-width = 200;
-      widgets = [
-        "mpris"
-        "volume"
-        "inhibitors"
-        "title"
-        "dnd"
-        "notifications"
-      ];
-      widget-config = {
-
-        mpris = {
-          blacklist = [ ];
-          autohide = false;
-          show-album-art = "always";
-          loop-carousel = false;
-          image-size = 96;
-          image-radius = 12;
-        };
-
-        volume = {
-          label = "gain";
-          show-per-app = false;
-          empty-list-label = "Nothin' is playin'";
-          expand-button-label = "⤢";
-          collaps-button-label = "⤡";
-        };
-
-        title = {
-          text = "Hollerin'";
-          clear-all-button = true;
-          button-text = "Sheriff's Pardon";
-        };
-
-        dnd = {
-          text = "Let'er rest";
-        };
-
-        menubar = {
-          "menu#power" = {
-            label = "Power";
-            position = "right";
-            animation-type = "slide_down";
-            animation-duration = 250;
-            actions = [
-              {
-                label = "Bolt It";
-                command = "hyprlock";
-              }
-              {
-                label = "Ride Out";
-                command = "hyprctl dispatch exit";
-              }
-              {
-                label = "Circle Back";
-                command = "systemctl reboot";
-              }
-              {
-                label = "Bet Down the Horses";
-                command = "systemctl poweroff";
-              }
-            ];
-          };
-
-          "buttons#media" = {
-            position = "left";
-            actions = [
-              {
-                label = "Play/Pause";
-                command = "playerctl play-pause";
-              }
-              {
-                label = "Next";
-                command = "playerctl next";
-              }
-              {
-                label = "Previous";
-                command = "playerctl previous";
-              }
-            ];
-          };
-        };
-
-        notifications = {
-          vexpand = true;
-        };
-
-      };
-    };
-  };
-}

home/desktop/rofi/default.nix

@@ -1,6 +1,11 @@
 { pkgs, lib, ... }: {
-  home.packages =
+  home.packages = lib.mkIf (!pkgs.stdenv.isDarwin) (
-    lib.mkIf (!pkgs.stdenv.isDarwin) (with pkgs; [ rofi-power-menu rofi-calc ]);
+    with pkgs;
+    [
+      rofi-power-menu
+      rofi-calc
+    ]
+  );
 
   programs.rofi = lib.mkIf (!pkgs.stdenv.isDarwin) {
     enable = true;

home/desktop/sketchybar/default.nix

@@ -1,4 +1,10 @@
-{ pkgs, lib, isDarwin, ... }: {
+{
+  pkgs,
+  lib,
+  isDarwin,
+  ...
+}:
+{
   programs.sketchybar = lib.mkIf isDarwin {
     enable = true;
     configType = "lua";

home/desktop/sketchybar/sketchybar.lua

@@ -2,7 +2,7 @@
 -- Save this in ~/.config/sketchybar/
 
 -- SketchyBar Lua API
-sbar = require("sketchybar")
+local sbar = require("sketchybar")
 
 -- Colors (Catppuccin Mocha theme)
 local colors = {
@@ -52,8 +52,8 @@ sbar.default({
 		background = {
 			border_width = 2,
 			corner_radius = 9,
-			border_color = colors.accent,
+			border_color = colors.pink,
-			color = colors.bg,
+			color = colors.base,
 			padding_right = 12,
 		},
 	},
@@ -67,14 +67,14 @@ sbar.bar({
 	padding_left = 12,
 	padding_right = 12,
 	margin = 12,
-	color = colors.bg,
+	color = colors.base,
-	border_color = colors.accent,
+	border_color = colors.pink,
 	border_width = 2,
 	corner_radius = 60,
 })
 
 -- Apple logo menu
-local apple_logo = sbar.add("item", "apple.logo", {
+sbar.add("item", "apple.logo", {
 	icon = {
 		string = " ",
 		padding_left = 6,
@@ -125,7 +125,7 @@ sbar.add("item", "apple.lock", {
 })
 
 -- Spaces
-local space_icons = { "󰖟 ", " ", " ", " ", " ", " ", "7", "8", "9", "10" }
+local space_icons = { "󰖟 ", " ", "󰭻 ", " ", " ", " ", "7", "8", "9", "10" }
 for i = 1, #space_icons do
 	local space = sbar.add("space", "space." .. i, {
 		space = i,
@@ -133,7 +133,7 @@ for i = 1, #space_icons do
 			string = space_icons[i],
 			padding_left = 2,
 			padding_right = 2,
-			highlight_color = colors.green,
+			highlight_color = colors.red,
 		},
 		label = { drawing = false },
 		padding_right = 4,

home/desktop/waybar/common.nix

@@ -150,11 +150,11 @@
       format = "{}";
       return-type = "json";
       exec = ''
-        curl -s -X GET "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat $OPENWEATHER_API_KEY)&units=metric&lang=en" | jq -c '{text: "\(.name) \(.main.temp)C°"}'
+        curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/OPENWEATHER_API_KEY)&units=metric&lang=en" | jq -c '{text: "\(.name) \(.main.temp)C°"}'
       '';
       interval = 120;
       on-click = ''
-        data=$(curl -s -X GET "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat $OPENWEATHER_API_KEY)&units=metric&lang=en")
+        data=$(curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/OPENWEATHER_API_KEY)&units=metric&lang=en")
         city=$(echo "$data" | jq -r '.name')
         temp=$(echo "$data" | jq -r '.main.temp')
         feels=$(echo "$data" | jq -r '.main.feels_like')

home/desktop/waybar/default.nix

@@ -1,8 +1,17 @@
-{ pkgs, lib, compositor ? "hyprland", ... }: {
+{
-  programs.waybar = lib.mkIf (!pkgs.stdenv.isDarwin) ({
+  pkgs,
+  lib,
+  compositor ? "hyprland",
+  ...
+}:
+{
+  programs.waybar = lib.mkIf (!pkgs.stdenv.isDarwin) (
+    {
       enable = true;
       package = pkgs.waybar;
-  } // (import ./dual.nix { inherit compositor; }));
+    }
+    // (import ./dual.nix { inherit compositor; })
+  );
 
   home.packages = lib.mkIf (!pkgs.stdenv.isDarwin) (with pkgs; [ cava ]);
 

home/floorp.nix

@@ -1,5 +0,0 @@
-_: {
-  programs.floorp = {
-    enable = true;
-  };
-}

home/floorp/default.nix

@@ -0,0 +1,168 @@
+{ pkgs, ... }:
+let
+  addons = pkgs.nur.repos.rycee.firefox-addons;
+  readJson = path: builtins.readFile path;
+  buildXpi =
+    {
+      name,
+      addonId,
+      version,
+      url,
+      sha256,
+    }:
+    pkgs.nur.repos.rycee.firefox-addons.buildFirefoxXpiAddon {
+      pname = name;
+      inherit
+        addonId
+        version
+        url
+        sha256
+        ;
+      meta = { };
+    };
+in
+{
+  programs.floorp = {
+    enable = true;
+
+    policies.ExtensionSettings = {
+      "adguardadblocker@adguard.com" = {
+        installation_mode = "force_installed";
+        install_url = "https://addons.mozilla.org/firefox/downloads/file/4805625/adguard_adblocker-5.4.3.1.xpi";
+        default_area = "navbar";
+      };
+      "{446900e4-71c2-419f-a6a7-df9c091e268b}" = {
+        installation_mode = "force_installed";
+        default_area = "navbar";
+      }; # Bitwarden
+      "{7a7a4a92-a2a0-41d1-9fd7-1e92480d612d}" = {
+        installation_mode = "force_installed";
+        default_area = "navbar";
+      }; # Stylus
+      "newtaboverride@agenedia.com" = {
+        installation_mode = "force_installed";
+      };
+      "{3c078156-979c-498b-8990-85f7987dd929}" = {
+        installation_mode = "force_installed";
+      };
+      "firefox@tampermonkey.net" = {
+        installation_mode = "force_installed";
+      };
+      "{7aa7c68a-141f-45c9-a1c6-6e7382debbe1}" = {
+        installation_mode = "force_installed";
+        install_url = "https://addons.mozilla.org/firefox/downloads/file/4147586/catppuccin_mocha-1.0.xpi";
+      };
+    };
+
+    profiles.default = {
+      isDefault = true;
+
+      extraConfig = ''
+        user_pref("extensions.activeThemeID", "{7aa7c68a-141f-45c9-a1c6-6e7382debbe1}");
+      '';
+
+      settings = {
+        # Startup
+        "browser.startup.homepage" = "https://www.cyperpunk.de";
+
+        # UI
+        "browser.ctrlTab.sortByRecentlyUsed" = true;
+        "browser.tabs.closeWindowWithLastTab" = false;
+        "browser.toolbars.bookmarks.visibility" = "never";
+        "browser.toolbars.bookmarks.showOtherBookmarks" = false;
+        "browser.download.useDownloadDir" = false;
+        "general.autoScroll" = true;
+        "intl.locale.requested" = "en";
+        "browser.search.region" = "DE";
+
+        # New tab
+        "browser.newtabpage.activity-stream.feeds.topsites" = false;
+        "browser.newtabpage.activity-stream.showSponsoredTopSites" = false;
+        "browser.newtabpage.activity-stream.showSponsoredCheckboxes" = false;
+        "browser.newtab.extensionControlled" = true;
+
+        # Privacy
+        "signon.rememberSignons" = false;
+        "privacy.clearOnShutdown_v2.formdata" = true;
+        "dom.disable_open_during_load" = false;
+
+        # Devtools
+        "devtools.cache.disabled" = true;
+
+        # Media
+        "media.eme.enabled" = true;
+
+        # Font
+        "font.name.serif.x-western" = "FiraMono Nerd Font";
+
+        # URL bar
+        "browser.urlbar.shortcuts.actions" = false;
+        "browser.urlbar.shortcuts.bookmarks" = false;
+        "browser.urlbar.shortcuts.history" = false;
+        "browser.urlbar.suggest.bookmark" = false;
+
+        # Extensions — skip manual enable prompt on fresh install
+        "extensions.autoDisableScopes" = 0;
+
+        # Floorp specific
+        "floorp.browser.tabs.openNewTabPosition" = -1;
+        "floorp.commandPalette.enabled" = true;
+        "floorp.mousegesture.enabled" = false;
+        "floorp.panelSidebar.enabled" = true;
+        "floorp.workspaces.enabled" = true;
+        "floorp.zenmode.enabled" = false;
+        "floorp.design.configs" = readJson ./design.json;
+        "floorp.panelSidebar.config" = readJson ./panel-sidebar.json;
+        "floorp.panelSidebar.data" = readJson ./panel-sidebar-data.json;
+        "floorp.tabs.sleep.exclusion" = readJson ./tabs-sleep-exclusion.json;
+      };
+
+      search = {
+        force = true;
+        default = "SearXNG";
+        engines = {
+          "SearXNG" = {
+            urls = [ { template = "https://search.cyperpunk.de/search?q={searchTerms}"; } ];
+            definedAliases = [ "@sx" ];
+          };
+        };
+      };
+
+      extensions = {
+        force = true;
+        packages = [
+          addons.bitwarden
+          addons.sidebery
+          addons.tampermonkey
+          addons.stylus
+          addons.new-tab-override
+
+          (buildXpi {
+            name = "adguard-adblocker";
+            addonId = "adguardadblocker@adguard.com";
+            version = "5.4.3.1";
+            url = "https://addons.mozilla.org/firefox/downloads/file/4805625/adguard_adblocker-5.4.3.1.xpi";
+            sha256 = "1rqp8qcc0p6qgqfgpshiqnll5mrl9jyfnks4zygzim436k0k781l";
+          })
+
+          (buildXpi {
+            name = "catppuccin-mocha";
+            addonId = "{7aa7c68a-141f-45c9-a1c6-6e7382debbe1}";
+            version = "1.0";
+            url = "https://addons.mozilla.org/firefox/downloads/file/4147586/catppuccin_mocha-1.0.xpi";
+            sha256 = "04lw5dirdv5636i52gfgyd5l0mkd74qjs2p23mimga3xv8hk1dzl";
+          })
+        ];
+        settings = {
+          "{3c078156-979c-498b-8990-85f7987dd929}".settings = builtins.fromJSON (
+            builtins.readFile ./sidebery.json
+          );
+          "newtaboverride@agenedia.com".settings = {
+            type = "custom_url";
+            url = "https://www.cyperpunk.de/";
+          };
+        };
+      };
+    };
+  };
+}

home/floorp/design.json

@@ -0,0 +1 @@
+{"globalConfigs":{"userInterface":"fluerial","faviconColor":true,"appliedUserJs":""},"tabbar":{"tabbarStyle":"horizontal","tabbarPosition":"optimise-to-vertical-tabbar","multiRowTabBar":{"maxRowEnabled":false,"maxRow":3}},"tab":{"tabScroll":{"enabled":false,"reverse":false,"wrap":false},"tabMinHeight":30,"tabMinWidth":76,"tabPinTitle":false,"tabDubleClickToClose":false,"tabOpenPosition":-1},"uiCustomization":{"navbar":{"position":"top","searchBarTop":false},"display":{"disableFullscreenNotification":false,"deleteBrowserBorder":false},"special":{"optimizeForTreeStyleTab":false,"hideForwardBackwardButton":false,"stgLikeWorkspaces":false},"multirowTab":{"newtabInsideEnabled":false},"bookmarkBar":{"focusExpand":false,"position":"bottom"},"qrCode":{"disableButton":false},"disableFloorpStart":true}}

home/floorp/panel-sidebar-data.json

@@ -0,0 +1 @@
+{"data":[{"id":"default-panel-history","url":"floorp//history","width":0,"type":"static"},{"id":"default-panel-downloads","url":"floorp//downloads","width":0,"type":"static"},{"id":"default-panel-notes","url":"floorp//notes","width":0,"type":"static"},{"type":"web","id":"18849706-ce97-41ce-b6c0-007436e81dad","width":450,"url":"https://cinny.cyperpunk.de/home/","userContextId":0,"userAgent":false}]}

home/floorp/panel-sidebar.json

@@ -0,0 +1 @@
+{"autoUnload":false,"position_start":true,"globalWidth":400,"displayed":true,"webExtensionRunningEnabled":false}

home/floorp/sidebery.json

@@ -0,0 +1 @@
+{"sidebarCSS":"#root.root {--nav-btn-width: 32px;}\n#root.root {--nav-btn-height: 32px;}\n#root.root {--nav-btn-margin: 4px;}\n#root.root {--nav-btn-len-margin: 0px;}\n#root.root {--nav-btn-border-radius: 5px;}\n#root.root {--toolbar-scrollbar-color: #cdd6f4;}\n#root.root {--general-margin: 4px;}\n#root.root {--general-border-radius: 5px;}","ver":"5.5.2","keybindings":{"_execute_sidebar_action":"Ctrl+E","activate":"Alt+Space","reset_selection":"Alt+R","next_panel":"Alt+Period","prev_panel":"Alt+Comma","new_tab_on_panel":"Ctrl+Space","new_tab_in_group":"Ctrl+Shift+Space","up":"Alt+Up","down":"Alt+Down","up_shift":"Alt+Shift+Up","down_shift":"Alt+Shift+Down"}}

home/floorp/tabs-sleep-exclusion.json

@@ -0,0 +1 @@
+{"enabled":true,"patterns":["cyperpunk.de"]}

home/fonts.nix

@@ -1,7 +1,8 @@
-# TODO: Duplicate file
 { pkgs, ... }:
 {
-  fonts.packages = with pkgs; [
+  fonts.fontconfig.enable = true;
+
+  home.packages = with pkgs; [
     nerd-fonts.fira-code
     nerd-fonts.fira-mono
     nerd-fonts.hack

home/neovim/alpha.nix

@@ -46,10 +46,14 @@
           {
             type = "button";
             val = "[+] New file";
-            on_press.__raw =
+            on_press.__raw = "function() vim.cmd[[ene]] vim.cmd[[startinsert]] end";
-              "function() vim.cmd[[ene]] vim.cmd[[startinsert]] end";
             opts = {
-              keymap = [ "n" "e" ":ene <BAR> startinsert <CR>" { } ];
+              keymap = [
+                "n"
+                "e"
+                ":ene <BAR> startinsert <CR>"
+                { }
+              ];
               shortcut = "e";
               position = "center";
               cursor = 3;
@@ -63,7 +67,12 @@
             val = "[?] Find file";
             on_press.__raw = "function() vim.cmd[[Telescope find_files]] end";
             opts = {
-              keymap = [ "n" "f" ":Telescope find_files <CR>" { } ];
+              keymap = [
+                "n"
+                "f"
+                ":Telescope find_files <CR>"
+                { }
+              ];
               shortcut = "f";
               position = "center";
               cursor = 3;
@@ -77,7 +86,12 @@
             val = "[~] Recent files";
             on_press.__raw = "function() vim.cmd[[Telescope oldfiles]] end";
             opts = {
-              keymap = [ "n" "r" ":Telescope oldfiles <CR>" { } ];
+              keymap = [
+                "n"
+                "r"
+                ":Telescope oldfiles <CR>"
+                { }
+              ];
               shortcut = "r";
               position = "center";
               cursor = 3;
@@ -91,7 +105,12 @@
             val = "[Y] Yazi";
             on_press.__raw = "function() require('yazi').yazi() end";
             opts = {
-              keymap = [ "n" "y" ":Yazi<CR>" { } ];
+              keymap = [
+                "n"
+                "y"
+                ":Yazi<CR>"
+                { }
+              ];
               shortcut = "y";
               position = "center";
               cursor = 3;
@@ -105,7 +124,12 @@
             val = "[A] Open Prompt";
             #on_press.__raw = "function() require('yazi').yazi() end";
             opts = {
-              keymap = [ "n" "a" ":AvanteChatNew<CR>" { } ];
+              keymap = [
+                "n"
+                "a"
+                ":AvanteChatNew<CR>"
+                { }
+              ];
               shortcut = "a";
               position = "center";
               cursor = 3;
@@ -119,7 +143,12 @@
             val = "[X] Quit";
             on_press.__raw = "function() vim.cmd[[qa]] end";
             opts = {
-              keymap = [ "n" "q" ":qa<CR>" { } ];
+              keymap = [
+                "n"
+                "q"
+                ":qa<CR>"
+                { }
+              ];
               shortcut = "q";
               position = "center";
               cursor = 3;

home/neovim/avante.nix

@@ -5,21 +5,18 @@
     plugins = {
       markdown-preview.enable = true;
       render-markdown.enable = true;
-      #extraConfigLuaPre = ''
-      #  vim.env.GROQ_API_KEY = os.getenv("GROQ_API_KEY")
-      #'';
-      # TODO: Integrate CoPilot https://github.com/settings/copilot/features
       avante = {
         enable = true;
         autoLoad = true;
         settings = {
-          provider = "groq";
+          provider = "ollama";
 
-          providers.groq = {
+          providers = {
+            groq = {
               __inherited_from = "openai";
               api_key_name = "cmd:cat /home/phil/.config/sops-nix/secrets/GROQ_API_KEY";
               endpoint = "https://api.groq.com/openai/v1/";
-            model = "qwen/qwen3-32b"; # "llama-3.3-70b-versatile";
+              model = "qwen/qwen3-32b";
               system_promt = "You are a helpful coding assistant. Always respond in plain markdown format without using tool calls or JSON structures.";
               disable_tools = true;
               extra_request_body = {
@@ -31,7 +28,21 @@
               };
             };
 
-          #        auto_suggestions_provider = "copilot";
+            ollama = {
+              endpoint = "http://100.109.179.25:11434"; # tailscale IP, no /v1 suffix
+              model = "qwen2.5:3b"; # swap for "llama3.2:3b" or "deepseek-r1:1.5b"
+              timeout = 60000; # local + small model can be slow on first load
+              disable_tools = true; # these small models aren't reliable at tool calling
+              is_env_set.__raw = ''require("avante.providers.ollama").check_endpoint_alive'';
+              extra_request_body = {
+                options = {
+                  temperature = 0.7;
+                  num_ctx = 8192;
+                  keep_alive = "5m";
+                };
+              };
+            };
+          };
 
           render = {
             markdown = true;
@@ -40,7 +51,6 @@
             code = true;
             link = true;
           };
-
           behaviour = {
             enable_cursor_planning_mode = false;
             auto_suggestions = false;
@@ -51,7 +61,6 @@
             use_selection_as_context = true;
             max_context_tokens = 2000;
           };
-
           mappings = {
             ask = "<leader>aa";
             edit = "<leader>ae";
@@ -84,11 +93,9 @@
               reverse_switch_windows = "<S-Tab>";
             };
           };
-
           hints = {
             enabled = true;
           };
-
           windows = {
             position = "right";
             wrap = true;
@@ -98,22 +105,18 @@
               rounded = true;
             };
           };
-
           highlights = {
             diff = {
               current = "DiffText";
               incoming = "DiffAdd";
             };
           };
-
           diff = {
             autojump = true;
             list_opener = "copen";
           };
         };
       };
-
-      extraPackages = with pkgs; [ curl ];
     };
   };
 }

home/neovim/default.nix

@@ -1,4 +1,8 @@
-{ pkgs, inputs, ... }:
+{
+  pkgs,
+  inputs,
+  ...
+}:
 {
   imports = [
     inputs.nixvim.homeModules.nixvim
@@ -17,6 +21,7 @@
     #./molten.nix
     ./which-key.nix
     ./diffview.nix
+    ./live-server.nix
   ];
 
   home.packages = with pkgs; [
@@ -28,6 +33,7 @@
   programs.nixvim = {
     enable = true;
     defaultEditor = true;
+    enableMan = false;
 
     # Leader key
     globals.mapleader = " ";

home/neovim/diffview.nix

@@ -2,12 +2,32 @@ _: {
   programs.nixvim = {
     plugins.diffview = {
       enable = true;
-      keymaps = {
+      settings.keymaps.view = [
-        "]x" = "<cmd>DiffviewConflictNext<CR>";
+        {
-        "[x" = "<cmd>DiffviewConflictPrev<CR>";
+          mode = "n";
-        "do" = "<cmd>DiffviewFocusOurs<CR>";
+          key = "]x";
-        "dt" = "<cmd>DiffviewFocusTheirs<CR>";
+          action = "<cmd>DiffviewConflictNext<CR>";
-      };
+          description = "Next conflict";
+        }
+        {
+          mode = "n";
+          key = "[x";
+          action = "<cmd>DiffviewConflictPrev<CR>";
+          description = "Previous conflict";
+        }
+        {
+          mode = "n";
+          key = "do";
+          action = "<cmd>DiffviewFocusOurs<CR>";
+          description = "Focus ours";
+        }
+        {
+          mode = "n";
+          key = "dt";
+          action = "<cmd>DiffviewFocusTheirs<CR>";
+          description = "Focus theirs";
+        }
+      ];
     };
   };
 }

home/neovim/live-server.nix

@@ -1,4 +1,3 @@
-# TODO: Remove; nodePackages is unmaintained inside nixpkgs
 { pkgs, ... }:
 {
   # Live Server: Auto-reload browser for web development
@@ -13,6 +12,6 @@
       }
     ];
 
-    extraPackages = with pkgs; [ nodePackages.browser-sync ];
+    extraPackages = with pkgs; [ browser-sync ];
   };
 }

home/neovim/molten.nix

@@ -2,8 +2,8 @@
   programs.nixvim = lib.mkIf (!isDarwin) {
     plugins.molten = {
       enable = true;
-      python3Dependencies = p:
+      python3Dependencies =
-        with p; [
+        p: with p; [
           pynvim
           jupyter-client
           cairosvg

home/neovim/openscad.nix

@@ -4,7 +4,7 @@
   # cheatsheet, snippets, offline manual and fuzzy help
   programs.nixvim = {
     plugins.openscad = {
-      enable = true;
+      enable = false;
       autoLoad = true;
       settings = {
         fuzzy_finder = "fzf";

home/obsidian.nix

@@ -1,4 +1,45 @@
-_: {
+{
-  # TODO: Add Automatic Vault pull and detection
+  config,
-  programs.obsidian.enable = true;
+  pkgs,
+  lib,
+  ...
+}:
+let
+  vaultRepo = "ssh://gitea@git.cyperpunk.de:12222/DerGrumpf/Notes.git";
+  vaultPath = "${config.home.homeDirectory}/Notes";
+  sshBinary = "${pkgs.openssh}/bin/ssh";
+  gitBin = "${pkgs.git}/bin";
+  gitLfsBin = "${pkgs.git-lfs}/bin";
+in
+{
+  programs.obsidian = {
+    enable = true;
+    vaults.notes = {
+      target = "Notes";
+      settings = { };
+    };
+  };
+
+  home.packages = with pkgs; [
+    git
+    git-lfs
+    openssh
+  ];
+
+  home.activation.obsidianVault = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+    export PATH="${gitBin}:${gitLfsBin}:$PATH"
+    export GIT_SSH_COMMAND="${sshBinary} -o StrictHostKeyChecking=accept-new"
+    export GIT_LFS_SKIP_SMUDGE=1
+
+    if [ ! -d "${vaultPath}/.git" ]; then
+    		echo "Cloning Obsidian vault (LFS objects will be pulled separately)..."
+    		${gitBin}/git clone "${vaultRepo}" "${vaultPath}"
+    		${gitLfsBin}/git-lfs install --local "${vaultPath}"
+    		${gitBin}/git -C "${vaultPath}" lfs pull
+    else
+    		echo "Pulling latest changes for Obsidian vault..."
+    		${gitBin}/git -C "${vaultPath}" pull
+    		${gitBin}/git -C "${vaultPath}" lfs pull
+    fi
+  '';
 }

home/onlyoffice.nix

@@ -1,4 +1,3 @@
 { pkgs, ... }: {
-  programs.onlyoffice =
+  programs.onlyoffice = pkgs.lib.mkIf (!pkgs.stdenv.isDarwin) { enable = true; };
-    pkgs.lib.mkIf (!pkgs.stdenv.isDarwin) { enable = true; };
 }

home/opencode.nix

@@ -0,0 +1,35 @@
+_: {
+  programs.opencode = {
+    enable = true;
+
+    settings = {
+      enabled_providers = [ "ollama" ];
+
+      model = "ollama/llama3.2:3b";
+
+      provider = {
+        ollama = {
+          npm = "@ai-sdk/openai-compatible";
+          name = "Ollama (tailscale)";
+          options = {
+            baseURL = "http://100.109.179.25:11434/v1";
+          };
+          models = {
+            "llama3.2:3b" = {
+              name = "Llama 3.2 3B";
+            };
+            "qwen2.5:3b" = {
+              name = "Qwen 2.5 3B";
+            };
+            "deepseek-r1:1.5b" = {
+              name = "DeepSeek-R1 1.5B";
+            };
+            "gemma4:e2b" = {
+              name = "Gemma 4 2B Edge";
+            };
+          };
+        };
+      };
+    };
+  };
+}

home/packages.nix

@@ -18,7 +18,7 @@
         jq
         yq-go
         # GUI
-        openscad
+        #        openscad
         fstl
         # PDF Tools
         pandoc
@@ -33,8 +33,11 @@
         gnutar
         unrar
         sops
+        age
         # Nix tools
         nix-index
+        ncdu
+        tty-solitaire
       ]
       ++ lib.optionals (!pkgs.stdenv.isDarwin) [
         # dev tools
@@ -48,7 +51,6 @@
         which
         libnotify
         # encryption
-        age
         ssh-to-age
       ]
       ++ lib.optionals (!pkgs.stdenv.isDarwin && !isServer) [
@@ -64,7 +66,8 @@
         xonotic
         irssi
         blender
-        cinny-desktop
+        nixpkgs-review
+        netradiant-custom
       ]
       ++ lib.optionals pkgs.stdenv.isDarwin [ graphite-cli ];
   };

home/shell.nix

@@ -15,19 +15,16 @@
     fd # find alternative
     bat # cat alternative
     ripgrep # grep alternative
-    doas # sudo alternative
     dnsutils
 
-    # LLM in the Terminal
-    (pkgs.llm.withPlugins { llm-groq = true; })
-
     # Fun stuff
     zoxide
     lolcat
     cmatrix
   ];
 
-  programs.kitty = {
+  programs = {
+    kitty = {
       enable = true;
 
       font = {
@@ -77,60 +74,9 @@
       };
     };
 
-  # Doenst work
+    cava = lib.mkIf (!isDarwin) { enable = true; };
-  programs.iamb = {
-    enable = false;
-    settings = {
-      default_profile = "personal";
-      settings = {
-        notifications.enabled = true;
-        image_preview.protocol = {
-          type = "kitty";
-          size = {
-            height = 10;
-            width = 66;
-          };
-        };
-      };
-    };
-  };
 
-  programs.newsboat = {
+    yazi = {
-    enable = true;
-    autoReload = true;
-    browser = if isDarwin then "open" else "xdg-open";
-    urls = [
-      {
-        url = "https://www.tagesschau.de/xml/rss2";
-        tags = [
-          "news"
-          "de"
-        ];
-      }
-      {
-        url = "https://www.spiegel.de/schlagzeilen/index.rss";
-        tags = [
-          "news"
-          "de"
-        ];
-      }
-      {
-        url = "https://www.focus.de/rss";
-        tags = [
-          "news"
-          "de"
-        ];
-      }
-      {
-        url = "https://feeds.feedburner.com/blogspot/rkEL";
-        tags = [ "blog" ];
-      }
-    ];
-  };
-
-  programs.cava = lib.mkIf (!isDarwin) { enable = true; };
-
-  programs.yazi = {
       enable = true;
       enableBashIntegration = true;
       enableZshIntegration = true;
@@ -145,7 +91,7 @@
       };
     };
 
-  programs.fzf = {
+    fzf = {
       enable = true;
       enableBashIntegration = true;
       enableZshIntegration = true;
@@ -161,43 +107,31 @@
       ];
     };
 
-  # TODO: Install OpenCode
+    nushell = {
-  programs.nushell = {
       enable = true;
-
       shellAliases = {
-      #      ls = "eza --icons=always";
         la = "ls -la";
-      #tree = "eza --icons=always -T";
         i = "kitty +kitten icat";
-      #      cat = "bat --color=always --style=numbers";
         grep = "rg";
       };
-
       extraConfig = ''
         $env.config = {
         show_banner: false
         }
-
         # Starship
         $env.STARSHIP_SHELL = "nu"
         mkdir ~/.cache/starship
         starship init nu | save -f ~/.cache/starship/init.nu
-
         # fzf picker for nvim
         def f [] { nvim (fzf) }
-
-      # llm | glow
-      def l [...args] { llm prompt -m groq/llama-3.3-70b-versatile -t std ...$args | glow }
       '';
-
       extraEnv = ''
         starship init nu | save -f ~/.cache/starship/init.nu
         use ~/.cache/starship/init.nu
       '';
     };
 
-  programs.fish = {
+    fish = {
       enable = true;
 
       shellAliases = {
@@ -237,36 +171,9 @@
           echo "      |___/|_|             |_|                                 ";
         end
       '';
-
-    functions.l = {
-      body = ''
-        if test -f "$GROQ_API_KEY"
-          set -x GROQ_API_KEY (cat $GROQ_API_KEY)
-        end
-        llm prompt -m groq/llama-3.3-70b-versatile -t std $argv | glow
-      '';
-    };
     };
 
-  # Link LLM std template
+    starship = {
-  home.file.".config/io.datasette.llm/templates/std.yaml".text = ''
-    system: |
-      You are a concise technical assistant running on an Intel Mac (x86_64-darwin) 
-      with nix-darwin and home-manager.
-      
-      Rules:
-      - Always respond in valid markdown
-      - Be concise and direct, no unnecessary explanation
-      - Prefer code blocks for commands and code
-      - You have access to these tools in the shell: nvim, fish, git, 
-        eza, bat, ripgrep, fzf, yazi, glow, llm, zoxide, fastfetch,
-        nix, darwin-rebuild, brew
-      - When suggesting nix config changes, use the nix language
-      - nix-switch rebuilds the system config
-      - nix-check validates the flake without building
-  '';
-
-  programs.starship = {
       enable = true;
       settings = {
         add_newline = true;
@@ -334,11 +241,32 @@
         };
       };
     };
+  };
 
-  home.file = {
+  home = {
+    file = {
       ".config/fastfetch/config.jsonc".source = ./fastfetch.jsonc;
       ".config/tabiew/theme.toml".source = ./tabiew.toml;
       ".config/kitty/tab_bar.py".source = ./tab_bar.py;
       ".hushlogin" = lib.mkIf isDarwin { text = ""; }; # Suppress Login
+
+      # Link LLM std template
+      ".config/io.datasette.llm/templates/std.yaml".text = ''
+        system: |
+          You are a concise technical assistant running on an Intel Mac (x86_64-darwin) 
+          with nix-darwin and home-manager.
+          
+          Rules:
+          - Always respond in valid markdown
+          - Be concise and direct, no unnecessary explanation
+          - Prefer code blocks for commands and code
+          - You have access to these tools in the shell: nvim, fish, git, 
+            eza, bat, ripgrep, fzf, yazi, glow, llm, zoxide, fastfetch,
+            nix, darwin-rebuild, brew
+          - When suggesting nix config changes, use the nix language
+          - nix-switch rebuilds the system config
+          - nix-check validates the flake without building
+      '';
+    };
   };
 }

hosts/cyper-controller/configuration.nix

@@ -11,10 +11,11 @@
     ../../nixos/roles/gitea.nix
     ../../nixos/roles/vaultwarden.nix
     ../../nixos/roles/frontpage
-    ../../nixos/roles/paperless-ngx.nix
+    #../../nixos/roles/paperless-ngx.nix
     ../../nixos/roles/octoprint.nix
     ../../nixos/roles/matrix/postgres-backup.nix
     ../../nixos/roles/kanidm.nix
+    ../../nixos/roles/ollama.nix
   ];
 
   networking = {

hosts/cyper-controller/hardware-configuration.nix

@@ -38,7 +38,6 @@
       ];
     };
 
-    # TODO: Add External Devices as by-label with no necessity for boot
     "/storage/internal" = {
       device = "/dev/disk/by-label/STORAGE";
       fsType = "btrfs";

hosts/cyper-desktop/configuration.nix

@@ -33,16 +33,21 @@
     efi.canTouchEfiVariables = true;
   };
 
-  services.desktopManager.plasma6.enable = false;
+  services = {
-  services.displayManager.sddm = {
+    desktopManager.plasma6.enable = false;
+    displayManager.sddm = {
       enable = false;
       wayland.enable = true;
     };
+  };
 
   environment.pathsToLink = [
     "/share/applications"
     "/share/xdg-desktop-portal"
   ];
 
-  system.stateVersion = "26.05";
+  system.stateVersion = "26.11";
+
+  virtualisation.docker.enable = true;
+  users.users.phil.extraGroups = [ "docker" ];
 }

hosts/cyper-node-1/configuration.nix

@@ -1,11 +1,6 @@
 {
   imports = [
     ./hardware-configuration.nix
-    ../../nixos/roles/monitoring.nix
-    ../../nixos/roles/matrix.nix
-    ../../nixos/roles/postgresql.nix
-    ../../nixos/roles/wyl.nix
-    ../../nixos/roles/adguard.nix
   ];
 
   networking = {

hosts/cyper-node-2/configuration.nix

@@ -1,8 +1,6 @@
 {
   imports = [
     ./hardware-configuration.nix
-    ../../nixos/roles/gitea.nix
-    ../../nixos/roles/filebrowser.nix
   ];
 
   networking = {

hosts/cyper-proxy/hardware-configuration.nix

@@ -34,9 +34,12 @@
     "/boot" = {
       device = "/dev/disk/by-label/NIXBOOT";
       fsType = "vfat";
-    options = [ "fmask=0022" "dmask=0022" ];
+      options = [
+        "fmask=0022"
+        "dmask=0022"
+      ];
+    };
   };
-};
 
   swapDevices = [ ];
 

nixos/catppuccin.nix

@@ -4,6 +4,7 @@
 
   catppuccin = {
     enable = true;
+    autoEnable = false;
     accent = "sky";
     flavor = "mocha";
     cache.enable = true;
@@ -11,9 +12,5 @@
       enable = true;
       accent = "sapphire";
     };
-    fcitx5.enable = false;
-    forgejo.enable = false;
-    gitea.enable = false;
-    sddm.enable = false;
   };
 }

nixos/default.nix

@@ -9,7 +9,6 @@
 }:
 {
   imports = [
-    ./fonts.nix
     ./sops.nix
     ./locale.nix
     ./tailscale.nix
@@ -19,7 +18,6 @@
     ./regreet.nix
     ./plymouth.nix
     ./audio.nix
-    #    ./webcam.nix
     ./virt.nix
     ./catppuccin.nix
   ];
@@ -50,6 +48,7 @@
         "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
         "cyper-cache.cachix.org-1:pOpeWFEjGHg9XvqRg+DQpYnGRQNp+z+QEF8Ev2mbSoM="
       ];
+      auto-optimise-store = true;
     };
     gc = {
       automatic = true;
@@ -58,33 +57,9 @@
     };
   };
 
-  # TODO: Get rid of this
+  nixpkgs.config = {
-  virtualisation = lib.mkIf isServer {
+    allowUnfree = true;
-    vmVariant = {
+    permittedInsecurePackages = [ "olm-3.2.16" ];
-      virtualisation = {
-        forwardPorts = [
-          {
-            from = "host";
-            host.port = 2222;
-            guest.port = 22;
-          }
-        ];
-        qemu.networkingOptions = [
-          "-device virtio-net-pci,netdev=net0"
-          "-netdev user,id=net0,net=10.0.2.0/24,dhcpstart=10.0.2.15"
-        ];
-      };
-
-      systemd.network.networks."10-ethernet" = lib.mkForce {
-        matchConfig.Name = "ens*";
-        networkConfig = {
-          Address = "10.0.2.15/24";
-          Gateway = "10.0.2.2";
-          DNS = "8.8.8.8";
-          DHCP = "no";
-        };
-      };
-    };
   };
 
   documentation = {
@@ -94,11 +69,6 @@
     info.enable = false;
   };
 
-  nixpkgs = {
-    overlays = [ (import ./packages/overlays.nix) ];
-    config.allowUnfree = true;
-  };
-
   programs = {
     fish.enable = true;
   }
@@ -115,6 +85,8 @@
     };
   };
 
+  environment.systemPackages = with pkgs; [ git ];
+
   security = lib.mkIf (!isServer) {
     pam.services.swaylock = { };
     polkit.enable = true;

nixos/fonts.nix

@@ -1,9 +0,0 @@
-# TODO: Duplicate file
-{ pkgs, ... }:
-{
-  fonts.packages = with pkgs; [
-    nerd-fonts.fira-code
-    nerd-fonts.fira-mono
-    nerd-fonts.hack
-  ];
-}

nixos/packages/overlays.nix

@@ -1,4 +0,0 @@
-final: prev: {
-  gs1200-exporter = final.callPackage ./gs1200-exporter.nix { };
-  oidcwarden = final.callPackage ./oidcwarden.nix { inherit (prev) vaultwarden; };
-}

nixos/plymouth.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ lib, ... }:
 {
   boot = {
     plymouth = {
@@ -15,6 +15,6 @@
       "udev.log_priority=3"
       "rd.systemd.show_status=auto"
     ];
-    loader.timeout = 0;
+    loader.timeout = lib.mkDefault 0;
   };
 }

nixos/roles/gitea.nix

@@ -2,6 +2,7 @@
   pkgs,
   lib,
   config,
+  primaryUser,
   ...
 }:
 
@@ -36,6 +37,9 @@ in
       owner = "gitea";
       group = "gitea";
     };
+    "gitea/runnerToken" = {
+      mode = "0444";
+    };
     "kanidm_gitea_secret" = {
       owner = "gitea";
       group = "gitea";
@@ -43,24 +47,8 @@ in
     };
   };
 
-  services.postgresql = {
+  systemd.services = {
-    enable = true;
+    gitea-db-password = {
-    package = pkgs.postgresql_14;
-    ensureDatabases = [ "gitea" ];
-    ensureUsers = [
-      {
-        name = "gitea";
-        ensureDBOwnership = true;
-      }
-    ];
-    authentication = lib.mkOverride 10 ''
-      local all all trust
-      host  all all 127.0.0.1/32 md5
-      host  all all ::1/128      md5
-    '';
-  };
-
-  systemd.services.gitea-db-password = {
       description = "Set gitea postgres user password";
       requires = [ "postgresql.service" ];
       after = [ "postgresql.service" ];
@@ -78,7 +66,35 @@ in
       '';
     };
 
-  services.gitea = {
+    gitea.preStart = lib.mkAfter ''
+      themeDir="${config.services.gitea.stateDir}/custom/public/assets/css"
+      mkdir -p "$themeDir"
+      for f in ${giteaTheme}/*.css; do
+        name=$(basename "$f")
+        ln -sf "$f" "$themeDir/$name"
+      done
+    '';
+  };
+
+  services = {
+    postgresql = {
+      enable = true;
+      package = pkgs.postgresql_14;
+      ensureDatabases = [ "gitea" ];
+      ensureUsers = [
+        {
+          name = "gitea";
+          ensureDBOwnership = true;
+        }
+      ];
+      authentication = lib.mkOverride 10 ''
+        local all all trust
+        host  all all 127.0.0.1/32 md5
+        host  all all ::1/128      md5
+      '';
+    };
+
+    gitea = {
       enable = true;
       package = pkgs.gitea;
       user = "gitea";
@@ -188,24 +204,42 @@ in
       };
     };
 
-  # symlink catppuccin css files into gitea's custom dir on every service start
+    gitea-actions-runner.instances."cyper_nix" = {
-  systemd.services.gitea.preStart = lib.mkAfter ''
+      enable = true;
-    themeDir="${config.services.gitea.stateDir}/custom/public/assets/css"
+      url = "https://git.cyperpunk.de";
-    mkdir -p "$themeDir"
+      tokenFile = config.sops.secrets."gitea/runnerToken".path;
-    for f in ${giteaTheme}/*.css; do
+      name = "cyper-controller";
-      name=$(basename "$f")
+      labels = [ "nix:host" ];
-      ln -sf "$f" "$themeDir/$name"
-    done
-  '';
 
-  users.users.gitea = {
+      hostPackages = with pkgs; [
+        bash
+        coreutils
+        curl
+        gawk
+        gitMinimal
+        gnused
+        nodejs
+        wget
+        nix
+      ];
+    };
+  };
+
+  users = {
+    users = {
+      gitea = {
         isSystemUser = true;
         group = "gitea";
         home = "/var/lib/gitea";
         createHome = true;
       };
-  users.groups.gitea = { };
+
-  users.users.postgres.extraGroups = [ "gitea" ];
+      postgres.extraGroups = [ "gitea" ];
+    };
+    groups = {
+      gitea = { };
+    };
+  };
 
   networking.firewall.allowedTCPPorts = [
     httpPort

nixos/roles/matrix/default.nix

@@ -11,5 +11,6 @@
     ./maubot.nix
     ./discord-bridge.nix
     ./whatsapp-bridge.nix
+    ./meta-bridge.nix
   ];
 }

nixos/roles/matrix/discord-bridge.nix

@@ -1,17 +1,23 @@
 { config, lib, ... }:
 {
-  nixpkgs.config.permittedInsecurePackages = [ "olm-3.2.16" ];
+  sops.secrets = {
-
+    discord_bot_token = {
-  sops.secrets.discord_bot_token = {
       owner = "mautrix-discord";
       group = "mautrix-discord";
     };
-  sops.secrets.discord_client_id = {
+    discord_client_id = {
       owner = "mautrix-discord";
       group = "mautrix-discord";
     };
+    discord_pickle_key = {
+      owner = "mautrix-discord";
+      group = "mautrix-discord";
+    };
+  };
 
-  systemd.services.mautrix-discord-env = {
+  systemd = {
+    services = {
+      mautrix-discord-env = {
         before = [ "mautrix-discord-registration.service" ];
         wantedBy = [ "multi-user.target" ];
         serviceConfig = {
@@ -22,12 +28,21 @@
           mkdir -p /run/mautrix-discord
           echo "DISCORD_BOT_TOKEN=$(cat ${config.sops.secrets.discord_bot_token.path})" > /run/mautrix-discord/env
           echo "DISCORD_CLIENT_ID=$(cat ${config.sops.secrets.discord_client_id.path})" >> /run/mautrix-discord/env
+          echo "DISCORD_PICKLE_KEY=$(cat ${config.sops.secrets.discord_pickle_key.path})" >> /run/mautrix-discord/env
           chmod 600 /run/mautrix-discord/env
           chown mautrix-discord:mautrix-discord /run/mautrix-discord/env
         '';
       };
 
-  services.postgresql = {
+      mautrix-discord-registration.serviceConfig.UMask = lib.mkForce "0750";
+    };
+    tmpfiles.rules = [
+      "z /var/lib/mautrix-discord/discord-registration.yaml 0640 mautrix-discord mautrix-discord -"
+    ];
+  };
+
+  services = {
+    postgresql = {
       ensureUsers = [
         {
           name = "mautrix-discord";
@@ -37,7 +52,7 @@
       ensureDatabases = [ "mautrix-discord" ];
     };
 
-  services.mautrix-discord = {
+    mautrix-discord = {
       enable = true;
       environmentFile = "/run/mautrix-discord/env";
       settings = {
@@ -66,7 +81,16 @@
               };
             };
           };
-
+          encryption = {
+            allow = true;
+            default = true;
+            pickle_key = "$DISCORD_PICKLE_KEY";
+            verification_levels = {
+              receive = "unverified";
+              send = "unverified";
+              share = "cross-signed-tofu";
+            };
+          };
         };
         discord = {
           client_id = "$DISCORD_CLIENT_ID";
@@ -74,5 +98,7 @@
         };
       };
     };
-  systemd.services.mautrix-discord-registration.serviceConfig.UMask = lib.mkForce "0022";
+  };
+
+  users.users.matrix-synapse.extraGroups = [ "mautrix-discord" ];
 }

nixos/roles/matrix/meta-bridge.nix

@@ -0,0 +1,125 @@
+{ config, lib, ... }:
+{
+  sops.secrets = {
+    meta_as_token = {
+      owner = "mautrix-meta-facebook";
+      group = "mautrix-meta";
+    };
+    meta_hs_token = {
+      owner = "mautrix-meta-facebook";
+      group = "mautrix-meta";
+    };
+    instagram_as_token = {
+      owner = "mautrix-meta-instagram";
+      group = "mautrix-meta";
+    };
+    instagram_hs_token = {
+      owner = "mautrix-meta-instagram";
+      group = "mautrix-meta";
+    };
+  };
+
+  systemd.services = {
+    mautrix-meta-facebook-env = {
+      before = [ "mautrix-meta-facebook-registration.service" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+      script = ''
+        mkdir -p /run/mautrix-meta-facebook
+        echo "META_AS_TOKEN=$(cat ${config.sops.secrets.meta_as_token.path})" > /run/mautrix-meta-facebook/env
+        echo "META_HS_TOKEN=$(cat ${config.sops.secrets.meta_hs_token.path})" >> /run/mautrix-meta-facebook/env
+        chmod 600 /run/mautrix-meta-facebook/env
+        chown mautrix-meta-facebook:mautrix-meta /run/mautrix-meta-facebook/env
+      '';
+    };
+
+    mautrix-meta-instagram-env = {
+      before = [ "mautrix-meta-instagram-registration.service" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+      script = ''
+        mkdir -p /run/mautrix-meta-instagram
+        echo "INSTAGRAM_AS_TOKEN=$(cat ${config.sops.secrets.instagram_as_token.path})" > /run/mautrix-meta-instagram/env
+        echo "INSTAGRAM_HS_TOKEN=$(cat ${config.sops.secrets.instagram_hs_token.path})" >> /run/mautrix-meta-instagram/env
+        chmod 600 /run/mautrix-meta-instagram/env
+        chown mautrix-meta-instagram:mautrix-meta /run/mautrix-meta-instagram/env
+      '';
+    };
+
+    mautrix-meta-facebook-registration.serviceConfig.UMask = lib.mkForce "0022";
+    mautrix-meta-instagram-registration.serviceConfig.UMask = lib.mkForce "0022";
+  };
+
+  services = {
+    postgresql = {
+      ensureUsers = [
+        {
+          name = "mautrix-meta-facebook";
+          ensureDBOwnership = true;
+        }
+        {
+          name = "mautrix-meta-instagram";
+          ensureDBOwnership = true;
+        }
+      ];
+      ensureDatabases = [
+        "mautrix-meta-facebook"
+        "mautrix-meta-instagram"
+      ];
+    };
+
+    mautrix-meta.instances = {
+      facebook = {
+        enable = true;
+        environmentFile = "/run/mautrix-meta-facebook/env";
+        settings = {
+          homeserver = {
+            address = "http://127.0.0.1:8008";
+            domain = "cyperpunk.de";
+          };
+          database = {
+            type = "postgres";
+            uri = "postgres:///mautrix-meta-facebook?host=/run/postgresql&sslmode=disable";
+          };
+          appservice = {
+            as_token = "$META_AS_TOKEN";
+            hs_token = "$META_HS_TOKEN";
+          };
+          bridge.permissions = {
+            "cyperpunk.de" = "user";
+            "@dergrumpf:cyperpunk.de" = "admin";
+          };
+        };
+      };
+
+      instagram = {
+        enable = true;
+        environmentFile = "/run/mautrix-meta-instagram/env";
+        settings = {
+          homeserver = {
+            address = "http://127.0.0.1:8008";
+            domain = "cyperpunk.de";
+          };
+          database = {
+            type = "postgres";
+            uri = "postgres:///mautrix-meta-instagram?host=/run/postgresql&sslmode=disable";
+          };
+          appservice = {
+            as_token = "$INSTAGRAM_AS_TOKEN";
+            hs_token = "$INSTAGRAM_HS_TOKEN";
+          };
+          bridge.permissions = {
+            "cyperpunk.de" = "user";
+            "@dergrumpf:cyperpunk.de" = "admin";
+          };
+        };
+      };
+    };
+  };
+}

nixos/roles/monitoring.nix

@@ -62,7 +62,7 @@ in
       };
       settings = {
         server = {
-          domain = "www.cyperpunk.de"; # serverIP; # "grafana.cyperpunk.de";
+          domain = "www.cyperpunk.de";
           http_port = 2342;
           http_addr = "0.0.0.0";
           root_url = "https://www.cyperpunk.de/grafana/";
@@ -71,6 +71,8 @@ in
         security = {
           secret_key = "$__file{${config.sops.secrets.grafana_secret_key.path}}";
           allow_embedding = true;
+          cookie_samesite = "none";
+          cookie_secure = true;
         };
         auth = {
           disable_login_form = false;
@@ -92,6 +94,10 @@ in
           auto_assign_org_role = "Admin";
           skip_org_role_sync = true;
         };
+        "auth.anonymous" = {
+          enabled = true;
+          org_role = "Viewer";
+        };
       };
     };
 

nixos/roles/nginx.nix

@@ -36,6 +36,10 @@ in
     12222
   ];
 
+  systemd.tmpfiles.rules = [
+    "d /var/www/home.cyperpunk.de 0755 nginx nginx -"
+  ];
+
   security.acme = {
     acceptTerms = true;
     defaults.email = "phil.keier@hotmail.com";
@@ -70,6 +74,17 @@ in
       "calvin.cyperpunk.de" = mkWsProxy 15006;
       "auth.cyperpunk.de" = mkHttpsProxy 8444;
 
+      #"home.cyperpunk.de" = {
+      #  forceSSL = true;
+      #  enableACME = true;
+      #  locations."/" = {
+      #    root = "/var/www/home.cyperpunk.de";
+      #    extraConfig = ''
+      #      try_files $uri $uri/ =404;
+      #    '';
+      #  };
+      #};
+
       "www.cyperpunk.de" = {
         forceSSL = true;
         enableACME = true;
@@ -81,6 +96,10 @@ in
           "/grafana" = {
             proxyPass = "http://${upstream}:2342";
             proxyWebsockets = true;
+            extraConfig = ''
+              add_header X-Frame-Options "";
+              add_header Content-Security-Policy "frame-ancestors *";
+            '';
           };
         };
       };

nixos/roles/ollama.nix

@@ -0,0 +1,23 @@
+_: {
+  services.ollama = {
+    enable = true;
+
+    host = "0.0.0.0";
+    port = 11434;
+
+    openFirewall = true;
+
+    loadModels = [
+      "llama3.2:3b"
+      "qwen2.5:3b"
+      "deepseek-r1:1.5b"
+      "gemma4:e2b"
+    ];
+
+    syncModels = true;
+
+    environmentVariables = {
+      OLLAMA_CONTEXT_LENGTH = "16384";
+    };
+  };
+}

nixos/roles/unifi.nix

@@ -1,8 +1,6 @@
 { pkgs, ... }:
 
 {
-  nixpkgs.config.allowUnfree = true;
-
   services.unifi = {
     enable = true;
     unifiPackage = pkgs.unifi;

nixos/roles/user.vaultwarden.scss.hbs

@@ -0,0 +1,374 @@
+/* ===== Catppuccin for Vaultwarden ===== */
+/* Light: Latte | Dark: Mocha */
+
+:root {
+  /* ---------- Palette ---------- */
+  --ctp-rosewater: #dc8a78;
+  --ctp-flamingo: #dd7878;
+  --ctp-pink: #ea76cb;
+  --ctp-mauve: #8839ef;
+  --ctp-red: #d20f39;
+  --ctp-maroon: #e64553;
+  --ctp-peach: #fe640b;
+  --ctp-yellow: #df8e1d;
+  --ctp-green: #40a02b;
+  --ctp-teal: #179299;
+  --ctp-sky: #04a5e5;
+  --ctp-sapphire: #209fb5;
+  --ctp-blue: #1e66f5;
+  --ctp-lavender: #7287fd;
+  --ctp-text: #4c4f69;
+  --ctp-subtext1: #5c5f77;
+  --ctp-subtext0: #6c6f85;
+  --ctp-overlay2: #7c7f93;
+  --ctp-overlay1: #8c8fa1;
+  --ctp-overlay0: #9ca0b0;
+  --ctp-surface2: #acb0be;
+  --ctp-surface1: #bcc0cc;
+  --ctp-surface0: #ccd0da;
+  --ctp-base: #eff1f5;
+  --ctp-mantle: #e6e9ef;
+  --ctp-crust: #dce0e8;
+
+  /* ---------- Semantic mappings ---------- */
+  --color-white: #ffffff;
+  --color-black: #000000;
+  --color-white-rgb: 255, 255, 255;
+  --color-black-rgb: 0, 0, 0;
+
+  /* Grays (using Catppuccin surface hierarchy) */
+  --color-gray-050: var(--ctp-base);
+  --color-gray-100: var(--ctp-mantle);
+  --color-gray-200: var(--ctp-crust);
+  --color-gray-300: var(--ctp-surface0);
+  --color-gray-400: var(--ctp-surface1);
+  --color-gray-400-rgb: 188, 192, 204; /* approx surface1 */
+  --color-gray-500: var(--ctp-surface2);
+  --color-gray-600: var(--ctp-overlay0);
+  --color-gray-700: var(--ctp-overlay1);
+  --color-gray-800: var(--ctp-overlay2);
+  --color-gray-900: var(--ctp-text);
+  --color-gray-950: var(--ctp-subtext0);
+  --color-gray-950-rgb: 108, 111, 133; /* subtext0 */
+
+  /* Brand / Primary (using Blue) */
+  --color-brand-050: #eef6ff; /* keep similar, but we’ll use surface tints? We'll just leave as is or tint */
+  --color-brand-100: var(--ctp-surface0);
+  --color-brand-200: var(--ctp-surface1);
+  --color-brand-300: #8ec5ff;
+  --color-brand-400: #6baefa;
+  --color-brand-500: var(--ctp-blue);
+  --color-brand-600: var(--ctp-blue);
+  --color-brand-700: var(--ctp-blue);
+  --color-brand-800: #0d43af; /* keep a dark blue for contrast */
+  --color-brand-900: #0c3276;
+  --color-brand-950: #162455;
+  --color-brand-950-rgb: 22, 36, 85;
+
+  /* Red */
+  --color-red-050: var(--ctp-surface0);
+  --color-red-100: var(--ctp-mantle);
+  --color-red-200: var(--ctp-crust);
+  --color-red-300: var(--ctp-red);
+  --color-red-400: var(--ctp-red);
+  --color-red-500: var(--ctp-red);
+  --color-red-600: var(--ctp-red);
+  --color-red-700: var(--ctp-red);
+  --color-red-800: var(--ctp-maroon);
+  --color-red-900: var(--ctp-maroon);
+  --color-red-950: var(--ctp-maroon);
+
+  /* Orange / Warning */
+  --color-orange-050: var(--ctp-surface0);
+  --color-orange-100: var(--ctp-mantle);
+  --color-orange-200: var(--ctp-crust);
+  --color-orange-300: var(--ctp-peach);
+  --color-orange-400: var(--ctp-peach);
+  --color-orange-500: var(--ctp-peach);
+  --color-orange-600: var(--ctp-peach);
+  --color-orange-700: var(--ctp-peach);
+  --color-orange-800: var(--ctp-yellow);
+  --color-orange-900: var(--ctp-yellow);
+  --color-orange-950: var(--ctp-yellow);
+
+  /* Yellow */
+  --color-yellow-050: var(--ctp-surface0);
+  --color-yellow-100: var(--ctp-mantle);
+  --color-yellow-200: var(--ctp-crust);
+  --color-yellow-300: var(--ctp-yellow);
+  --color-yellow-400: var(--ctp-yellow);
+  --color-yellow-500: var(--ctp-yellow);
+  --color-yellow-600: var(--ctp-yellow);
+  --color-yellow-700: var(--ctp-yellow);
+  --color-yellow-800: var(--ctp-yellow);
+  --color-yellow-900: var(--ctp-yellow);
+  --color-yellow-950: var(--ctp-yellow);
+
+  /* Green / Success */
+  --color-green-050: var(--ctp-surface0);
+  --color-green-100: var(--ctp-mantle);
+  --color-green-200: var(--ctp-crust);
+  --color-green-300: var(--ctp-green);
+  --color-green-400: var(--ctp-green);
+  --color-green-500: var(--ctp-green);
+  --color-green-600: var(--ctp-green);
+  --color-green-700: var(--ctp-green);
+  --color-green-800: var(--ctp-teal);
+  --color-green-900: var(--ctp-teal);
+  --color-green-950: var(--ctp-teal);
+
+  /* Pink */
+  --color-pink-050: var(--ctp-surface0);
+  --color-pink-100: var(--ctp-mantle);
+  --color-pink-200: var(--ctp-crust);
+  --color-pink-300: var(--ctp-pink);
+  --color-pink-400: var(--ctp-pink);
+  --color-pink-500: var(--ctp-pink);
+  --color-pink-600: var(--ctp-pink);
+  --color-pink-700: var(--ctp-mauve);
+  --color-pink-800: var(--ctp-mauve);
+  --color-pink-900: var(--ctp-mauve);
+  --color-pink-950: var(--ctp-mauve);
+
+  /* Coral (use Peach) */
+  --color-coral-050: var(--ctp-surface0);
+  --color-coral-100: var(--ctp-mantle);
+  --color-coral-200: var(--ctp-crust);
+  --color-coral-300: var(--ctp-peach);
+  --color-coral-400: var(--ctp-peach);
+  --color-coral-500: var(--ctp-peach);
+  --color-coral-600: var(--ctp-peach);
+  --color-coral-700: var(--ctp-peach);
+  --color-coral-800: var(--ctp-peach);
+  --color-coral-900: var(--ctp-peach);
+  --color-coral-950: var(--ctp-peach);
+
+  /* Teal */
+  --color-teal-050: var(--ctp-surface0);
+  --color-teal-100: var(--ctp-mantle);
+  --color-teal-200: var(--ctp-crust);
+  --color-teal-300: var(--ctp-teal);
+  --color-teal-400: var(--ctp-teal);
+  --color-teal-500: var(--ctp-teal);
+  --color-teal-600: var(--ctp-teal);
+  --color-teal-700: var(--ctp-teal);
+  --color-teal-800: var(--ctp-sky);
+  --color-teal-900: var(--ctp-sky);
+  --color-teal-950: var(--ctp-sky);
+
+  /* Purple (use Mauve) */
+  --color-purple-050: var(--ctp-surface0);
+  --color-purple-100: var(--ctp-mantle);
+  --color-purple-200: var(--ctp-crust);
+  --color-purple-300: var(--ctp-mauve);
+  --color-purple-400: var(--ctp-mauve);
+  --color-purple-500: var(--ctp-mauve);
+  --color-purple-600: var(--ctp-mauve);
+  --color-purple-700: var(--ctp-mauve);
+  --color-purple-800: var(--ctp-mauve);
+  --color-purple-900: var(--ctp-mauve);
+  --color-purple-950: var(--ctp-mauve);
+
+  /* Semantic foreground / background aliases */
+  --color-fg-heading: var(--ctp-text);
+  --color-fg-body: var(--ctp-text);
+  --color-fg-body-subtle: var(--ctp-subtext1);
+  --color-fg-disabled: var(--ctp-overlay0);
+  --color-fg-brand: var(--ctp-blue);
+  --color-fg-success: var(--ctp-green);
+  --color-fg-danger: var(--ctp-red);
+  --color-fg-warning: var(--ctp-peach);
+  --color-fg-sensitive: var(--ctp-pink);
+
+  --color-bg-primary: var(--ctp-base);
+  --color-bg-secondary: var(--ctp-mantle);
+  --color-bg-tertiary: var(--ctp-crust);
+  --color-bg-quaternary: var(--ctp-surface0);
+  --color-bg-disabled: var(--ctp-surface0);
+  --color-bg-gray: var(--ctp-surface1);
+  --color-bg-gray-strong: var(--ctp-surface2);
+  --color-bg-contrast-soft: var(--ctp-overlay1);
+  --color-bg-contrast: var(--ctp-overlay2);
+  --color-bg-contrast-strong: var(--ctp-text);
+
+  --color-border-muted: var(--ctp-mantle);
+  --color-border-light: var(--ctp-crust);
+  --color-border-base: var(--ctp-surface0);
+  --color-border-strong: var(--ctp-surface1);
+  --color-border-stronger: var(--ctp-overlay0);
+
+  --color-bg-hover: rgba(var(--color-gray-950-rgb), 0.05);
+  --color-bg-hover-contrast: rgba(255, 255, 255, 0.05);
+  --color-bg-overlay: rgba(2, 6, 24, 0.3); /* keep dark overlay */
+
+  /* Navigation (primary sidebar) */
+  --color-nav-fg-primary: var(--ctp-text);
+  --color-nav-bg-primary: var(--ctp-mantle);
+  --color-nav-bg-primary-strong: var(--ctp-crust);
+  --color-nav-bg-primary-hover: rgba(0,0,0,0.05);
+  --color-nav-bg-primary-hover-strong: rgba(0,0,0,0.1);
+  --color-nav-border-primary: var(--ctp-blue);
+  --color-nav-border-primary-focus: var(--ctp-text);
+
+  /* Misc */
+  --color-transparent-hover: rgb(0 0 0 / 0.02);
+  --color-shadow: 108 111 133; /* subtext0 */
+  --color-background: 239 241 245; /* base */
+  --color-background-alt: 230 233 239; /* mantle */
+  --color-background-alt2: 23 92 219; /* keep as original? We'll set to blue */
+  --color-background-alt3: 33 37 41; /* we map to crust rgb */
+  --color-background-alt4: 16 18 21;
+  --color-primary-100: 219 229 246; /* we map to surface0 */
+  --color-primary-300: 108 117 125;
+  --color-primary-600: 30 102 245; /* blue */
+  --color-primary-700: 13 60 119;
+  --color-secondary-100: 188 192 204;
+  --color-secondary-300: 156 160 176;
+  --color-secondary-500: 124 127 147;
+  --color-secondary-600: 108 111 133;
+  --color-secondary-700: 92 95 119;
+  --color-info-100: 219 229 246;
+  --color-info-600: 30 102 245;
+  --color-info-700: 13 36 123;
+  --color-warning-100: 255 244 212;
+  --color-warning-600: 254 100 11; /* peach */
+  --color-warning-700: 223 142 29; /* yellow */
+  --color-danger-100: 255 236 239;
+  --color-danger-600: 210 15 57; /* red */
+  --color-danger-700: 149 27 42;
+  --color-success-100: 213 243 216;
+  --color-success-600: 64 160 43; /* green */
+  --color-success-700: 8 81 15;
+  --color-notification-100: 255 225 247;
+  --color-notification-600: 192 17 118;
+  --color-text-main: 27 32 41; /* will be overridden by CT-Text */
+  --color-text-muted: 108 111 133;
+  --color-text-contrast: 255 255 255;
+  --color-text-alt2: 255 255 255;
+  --color-text-code: 234 118 203; /* pink */
+  --color-hover-default: rgba(30 102 245 / 0.1);
+  --color-hover-contrast: rgba(255 255 255 / 0.15);
+}
+
+/* ===== Dark Theme (Mocha) ===== */
+html.theme_dark {
+  --ctp-rosewater: #f5e0dc;
+  --ctp-flamingo: #f2cdcd;
+  --ctp-pink: #f5c2e7;
+  --ctp-mauve: #cba6f7;
+  --ctp-red: #f38ba8;
+  --ctp-maroon: #eba0ac;
+  --ctp-peach: #fab387;
+  --ctp-yellow: #f9e2af;
+  --ctp-green: #a6e3a1;
+  --ctp-teal: #94e2d5;
+  --ctp-sky: #89dceb;
+  --ctp-sapphire: #74c7ec;
+  --ctp-blue: #89b4fa;
+  --ctp-lavender: #b4befe;
+  --ctp-text: #cdd6f4;
+  --ctp-subtext1: #bac2de;
+  --ctp-subtext0: #a6adc8;
+  --ctp-overlay2: #9399b2;
+  --ctp-overlay1: #7f849c;
+  --ctp-overlay0: #6c7086;
+  --ctp-surface2: #585b70;
+  --ctp-surface1: #45475a;
+  --ctp-surface0: #313244;
+  --ctp-base: #1e1e2e;
+  --ctp-mantle: #181825;
+  --ctp-crust: #11111b;
+
+  /* Grays */
+  --color-gray-050: var(--ctp-base);
+  --color-gray-100: var(--ctp-mantle);
+  --color-gray-200: var(--ctp-crust);
+  --color-gray-300: var(--ctp-surface0);
+  --color-gray-400: var(--ctp-surface1);
+  --color-gray-500: var(--ctp-surface2);
+  --color-gray-600: var(--ctp-overlay0);
+  --color-gray-700: var(--ctp-overlay1);
+  --color-gray-800: var(--ctp-overlay2);
+  --color-gray-900: var(--ctp-text);
+  --color-gray-950: var(--ctp-subtext0);
+  --color-gray-400-rgb: 69, 71, 90; /* surface1 */
+  --color-gray-950-rgb: 166, 173, 200; /* subtext0 */
+
+  /* Adjust semantic mappings for dark */
+  --color-fg-heading: var(--ctp-text);
+  --color-fg-body: var(--ctp-text);
+  --color-fg-body-subtle: var(--ctp-subtext1);
+  --color-fg-disabled: var(--ctp-overlay0);
+  --color-fg-brand: var(--ctp-blue);
+  --color-fg-success: var(--ctp-green);
+  --color-fg-danger: var(--ctp-red);
+  --color-fg-warning: var(--ctp-peach);
+  --color-fg-sensitive: var(--ctp-pink);
+
+  --color-bg-primary: var(--ctp-base);
+  --color-bg-secondary: var(--ctp-mantle);
+  --color-bg-tertiary: var(--ctp-crust);
+  --color-bg-quaternary: var(--ctp-surface0);
+  --color-bg-disabled: var(--ctp-surface0);
+  --color-bg-gray: var(--ctp-surface1);
+  --color-bg-gray-strong: var(--ctp-surface2);
+  --color-bg-contrast-soft: var(--ctp-overlay1);
+  --color-bg-contrast: var(--ctp-overlay2);
+  --color-bg-contrast-strong: var(--ctp-text);
+
+  --color-border-muted: var(--ctp-mantle);
+  --color-border-light: var(--ctp-crust);
+  --color-border-base: var(--ctp-surface0);
+  --color-border-strong: var(--ctp-surface1);
+  --color-border-stronger: var(--ctp-overlay0);
+
+  --color-bg-hover: rgba(166, 173, 200, 0.1);
+  --color-bg-hover-contrast: rgba(255, 255, 255, 0.05);
+  --color-bg-overlay: rgba(17, 17, 27, 0.7); /* crust with opacity */
+
+  --color-nav-fg-primary: var(--ctp-text);
+  --color-nav-bg-primary: var(--ctp-mantle);
+  --color-nav-bg-primary-strong: var(--ctp-crust);
+  --color-nav-bg-primary-hover: rgba(255,255,255,0.05);
+  --color-nav-bg-primary-hover-strong: rgba(255,255,255,0.1);
+  --color-nav-border-primary: var(--ctp-blue);
+  --color-nav-border-primary-focus: var(--ctp-text);
+
+  /* Misc rgb values */
+  --color-shadow: 166 173 200;
+  --color-background: 30 30 46; /* base */
+  --color-background-alt: 24 24 37; /* mantle */
+  --color-background-alt2: 137 180 250; /* blue */
+  --color-background-alt3: 17 17 27; /* crust */
+  --color-background-alt4: 17 17 27;
+  --color-primary-100: 49 50 68;
+  --color-primary-300: 69 71 90;
+  --color-primary-600: 137 180 250; /* blue */
+  --color-primary-700: 137 180 250;
+  --color-secondary-100: 69 71 90;
+  --color-secondary-300: 88 91 112;
+  --color-secondary-500: 108 112 134;
+  --color-secondary-600: 124 128 150;
+  --color-secondary-700: 147 153 178;
+  --color-info-100: 49 50 68;
+  --color-info-600: 137 180 250;
+  --color-info-700: 137 180 250;
+  --color-warning-100: 49 50 68;
+  --color-warning-600: 250 179 135; /* peach */
+  --color-warning-700: 249 226 175; /* yellow */
+  --color-danger-100: 49 50 68;
+  --color-danger-600: 243 139 168; /* red */
+  --color-danger-700: 235 160 172; /* maroon */
+  --color-success-100: 49 50 68;
+  --color-success-600: 166 227 161; /* green */
+  --color-success-700: 148 226 213; /* teal */
+  --color-notification-100: 49 50 68;
+  --color-notification-600: 245 194 231; /* pink */
+  --color-text-main: 205 214 244; /* text */
+  --color-text-muted: 166 173 200;
+  --color-text-contrast: 30 30 46;
+  --color-text-alt2: 30 30 46;
+  --color-text-code: 245 194 231;
+  --color-hover-default: rgba(137 180 250 / 0.1);
+  --color-hover-contrast: rgba(30 30 46 / 0.15);
+}

nixos/roles/vaultwarden.nix

@@ -5,6 +5,7 @@
 }:
 let
   port = 8222;
+  userScss = builtins.readFile ./user.vaultwarden.scss.hbs;
 in
 {
   sops.secrets.vaultwarden_env = {
@@ -39,6 +40,7 @@ in
         ExecStart = "${pkgs.findutils}/bin/find /var/lib/vaultwarden/backup -mtime +30 -delete";
       };
     };
+
     timers.vaultwarden-backup-rotate = {
       wantedBy = [ "timers.target" ];
       timerConfig = {
@@ -46,5 +48,11 @@ in
         Persistent = true;
       };
     };
+
+    tmpfiles.rules = [
+      "d /var/lib/vaultwarden/templates 0750 vaultwarden vaultwarden -"
+      "d /var/lib/vaultwarden/templates/scss 0750 vaultwarden vaultwarden -"
+      "L+ /var/lib/vaultwarden/templates/scss/user.vaultwarden.scss.hbs 0640 vaultwarden vaultwarden - ${pkgs.writeText "user.vaultwarden.scss.hbs" userScss}"
+    ];
   };
 }

nixos/webcam.nix

@@ -1,28 +0,0 @@
-{ pkgs, ... }: {
-
-  # TODO: This need to be tested against the cam and kernel rules need to be refined
-  services.udev.extraRules = ''
-    ACTION=="add", \
-    SUBSYSTEM=="usb", \
-    ATTR{idVendor}=="04a9", \
-    ATTR{idProduct}=="31ea", \
-    RUN+="${pkgs.systemd}/bin/systemctl restart webcam"
-  '';
-
-  systemd.services.webcam = {
-    enable = true;
-    description = "Canon Camera Webcam";
-    script = ''
-      ${pkgs.gphoto2}/bin/gphoto2 --stdout --capture-movie | \
-      ${pkgs.ffmpeg}/bin/ffmpeg \
-      -i - \
-      -vcodec rawvideo \
-      -pix_fmt yuv420p \
-      -threads 0 \
-      -framerate 30 \
-      -f v4l2 \
-      /dev/video0
-    '';
-    wantedBy = [ "multi-user.target" ];
-  };
-}

overlays/default.nix

@@ -0,0 +1,10 @@
+{ nur }:
+final: prev:
+(nur.overlays.default final prev)
+// {
+  gs1200-exporter = final.callPackage ./gs1200-exporter.nix { };
+  oidcwarden = final.callPackage ./oidcwarden.nix {
+    inherit (prev) vaultwarden;
+  };
+  netradiant-custom = final.callPackage ./netradiant-custom.nix { };
+}

overlays/netradiant-custom.nix

@@ -0,0 +1,100 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchgit,
+  pkg-config,
+  makeWrapper,
+  subversion,
+  git,
+  unzip,
+  wget,
+  qt5,
+  glib,
+  libxml2,
+  zlib,
+  libpng,
+  assimp,
+}:
+let
+  xonoticPack = fetchgit {
+    url = "https://gitlab.com/xonotic/netradiant-xonoticpack.git";
+    rev = "b9b95499e6bd1082a4eaff78664f9243cbcbb2e1";
+    hash = "sha256-boSWipgiQzXHFJ0KGpd8xbwik3hKQK3IKSNByUaUHBk=";
+  };
+in
+stdenv.mkDerivation rec {
+  pname = "netradiant-custom";
+  version = "20260114";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Garux";
+    repo = "netradiant-custom";
+    rev = version;
+    hash = "sha256-dlJn10Y45mx3UwxvB8mzw5Ok8LvvxVpMwDAdHXSt5dk=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    makeWrapper
+    subversion
+    git
+    unzip
+    wget
+  ];
+
+  buildInputs = [
+    qt5.qtbase
+    qt5.qtsvg
+    glib
+    libxml2
+    zlib
+    libpng
+    assimp
+  ];
+
+  makeFlags = [
+    "DOWNLOAD_GAMEPACKS=no"
+    "DEPENDENCIES_CHECK=off"
+    "BUILD=release"
+  ];
+
+  enableParallelBuilding = true;
+
+  dontWrapQtApps = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/opt/netradiant-custom
+    cp -r install/* $out/opt/netradiant-custom/
+
+    # Replicates what upstream's install-gamepack.sh does:
+    # - files in <pack>/games/*.game go into gamepacks/games/
+    # - directories named <pack>/*.game go into gamepacks/ directly
+    mkdir -p $out/opt/netradiant-custom/gamepacks/games
+    if [ -d "${xonoticPack}/games" ]; then
+      cp -r ${xonoticPack}/games/*.game $out/opt/netradiant-custom/gamepacks/games/
+    fi
+    for d in ${xonoticPack}/*.game; do
+      cp -r "$d" $out/opt/netradiant-custom/gamepacks/
+    done
+
+    mkdir -p $out/bin
+    makeWrapper $out/opt/netradiant-custom/radiant.x86_64 $out/bin/netradiant-custom \
+      --chdir "$out/opt/netradiant-custom" \
+      --prefix QT_PLUGIN_PATH : "${qt5.qtbase}/${qt5.qtbase.qtPluginPrefix}" \
+      --set QT_QPA_PLATFORM xcb
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Cross-platform level editor for id Tech based games (NetRadiant fork)";
+    homepage = "https://github.com/Garux/netradiant-custom";
+    license = lib.licenses.gpl2Plus;
+    mainProgram = "netradiant-custom";
+    platforms = lib.platforms.linux;
+  };
+}

overlays/oidcwarden.nix

@@ -15,8 +15,9 @@ in
 vaultwarden.overrideAttrs (old: {
   pname = "oidcwarden";
   inherit src;
-  cargoDeps = rustPlatform.importCargoLock {
+  cargoDeps = rustPlatform.fetchCargoVendor {
-    lockFile = "${src}/Cargo.lock";
+    inherit src;
+    hash = "sha256-eGsYNaLYRCrTRaoyfhxnoeA2ytYeyGGvHnAbpEIayzs=";
   };
   postInstall = (old.postInstall or "") + ''
     mv $out/bin/oidcwarden $out/bin/vaultwarden

secrets/secrets.yaml

@@ -18,6 +18,11 @@ mjolnir_access_token: ENC[AES256_GCM,data:vvrAY9CAkEIGEzah+TQiwa6PahGuXVvU7wzBpT
 coturn_static_auth_secret: ENC[AES256_GCM,data:7AI0E8Hu4WxI5q4j1GqBMSQ+evE006uPMtwIfGn4eFz+XB2JA6fhhiGMPPxSkqOyK+3eZJ5ahiG05JpmBmmAbw==,iv:hQJQQDVo43U7lvV754PC1THeFCpZZEyag+BslXyoDos=,tag:Vkm+IXr1h8ZNpah6UYaKng==,type:str]
 discord_bot_token: ENC[AES256_GCM,data:j37Qo3FCyRwNFqWSWpnQKCs+AxH5HlQ8U5If7ylHilQoORp8Pb3TtNETTJSjZyvUXllldevAbHrbAEEKnNfoUJx1U8/wl6H0,iv:WQqxFXTE+0LIB2lSvVcnr4LNXPE7uzNc0Kk8NU6Z/aE=,tag:fNeQLhoThEgfa4sSGKLZCw==,type:str]
 discord_client_id: ENC[AES256_GCM,data:U/iUKXT6Nsl6LRN9lPh1xaIaqw==,iv:k7kQ8rJBrMs3YwD9aDfZ6qhd7H3aVsSPTOwEIxVTw2Y=,tag:2wKhxGbf+P+h3BYeWUSczA==,type:str]
+discord_pickle_key: ENC[AES256_GCM,data:6j1pBQxmK8kFELSBBeJ0FwzAHz1GTGhxQwrvhlLtiU9+HICBBJqmFra1veZSO4yLchye/yPZ9Ha7oau+SgOI6w==,iv:YcTQQFcfLK33CpZnhEiKkt71e4ziarGKPyt7mmdQ+NA=,tag:AJRD4xYvYOZ0L1Xo+O+aGg==,type:str]
+meta_as_token: ENC[AES256_GCM,data:WNkfHIRl9bGdzGRgjE2C9fymA0nX/ginNqRldyygaWw=,iv:BTVB+sf46mEQ/+FXCe4SRgmkfpnO2wnWlpKr/4uQbe0=,tag:qP42MN2qm1Tn6physjLK5g==,type:str]
+meta_hs_token: ENC[AES256_GCM,data:BG7sSy0dIxf8EwjIA3rXxRZ+6IRPc2sJKSFXw+aldvY=,iv:gjk3pl/iV6rivxxrnR0jjEiSkmj0Jl5ojsudepKpxtY=,tag:n+BGaHRD+CqfXCbRPtFmfw==,type:str]
+instagram_as_token: ENC[AES256_GCM,data:zKAv60IezEYqDEZNOFS5aKgNztBL9JUM9sfTZCD+vkg=,iv:3xCkVfT0S947LzpDzC0N1kuHOBhVaveK3m0cay0DlGc=,tag:NgJq8YN2r6NKj8pwlsgkXA==,type:str]
+instagram_hs_token: ENC[AES256_GCM,data:+Lp9PQLUxyn/xS+L/hFcsufF0UxQJTiEd/7su8NmobI=,iv:ad9Urc8CwTfLWWRpUL6/TxfTB7LU8XoPq3kp8ifhfr0=,tag:0KkcdDAB/9rcuIgbLBZAkQ==,type:str]
 pg_replication_password: ENC[AES256_GCM,data:w2h07D+j3LNkcbvoKQ2Qp3HSvC2Wf5HRAPAo/HNhmUkHBOaDyILNxo7IDjqajv0jytpG7q4joCJQhS7tEUlA9Q==,iv:26ZurAq61IDqGdAl0yPpoTJElo93hJJIEUlza4DGDNc=,tag:a46FOKgeqEEZE+rC+H9NbQ==,type:str]
 kanidm_gitea_secret: ENC[AES256_GCM,data:RavtSb5BaJGwwLB/oGzG/KK2AyV+IzEjihVxnD3/dVnxmxcG+CITIYPLvFUJjmvY,iv:Cg8dAhtJXDvRGULIkpWAyuhhlLEdvN+4lyjHPR/740I=,tag:8kMGrOjXEA4GWSLlP7oIkA==,type:str]
 gitea:
@@ -25,12 +30,12 @@ gitea:
     internalToken: ENC[AES256_GCM,data:7N8TkPNb1YdCk2uAcCvVd2pKRVOf85//DYxAvz0UCg1E8ccEI5630xVyKafDFiSTM4ER7xiYelartzXL0jLWSf3QNOjSHUP8TIAz4bJRAZUJPxO917bURSLGGe7WEOfONzqy3Ts5QhrJ,iv:DiIs1ytlwLvqD/Ejep6m2fmpSqdFZkxBcgLNt6+29jY=,tag:8jsEcOkH0p+1mP9cnVjiDQ==,type:str]
     lfsJwtSecret: ENC[AES256_GCM,data:L20mFZ6zwsF3ZUoodarTJV+vhUdLlBrUbHz7FpEzJ2/C6AdFc1ZZcioN3g==,iv:E2C3gg1OYQ46Ae2bGnhF+3uw+q77l+yph3Kd2fxwW9M=,tag:VQkQ4R9S8Dr39rSLhL/X1w==,type:str]
     mailerPassword: ""
+    runnerToken: ENC[AES256_GCM,data:giY3e3oHqWytgIWfnuKxOfrp8R+u7I0lMzEGnLWXnZWL9aQkVsM1kiF1FNKn/A==,iv:YsQrAKU8pncPeSSosOFn9BjU676KCh956FGC2hnCuac=,tag:+eZ1y6P/85XNPD9gVVNMgA==,type:str]
 ssh_private_key: ENC[AES256_GCM,data:R511mVFVk1ogAd5CKk/2P6rtT4NnHIFfKyqeCen545QgcvDqDFmW0rFBmPJyipaya2srJNoWvKJbnvxWtTYeJh2tPAybRMoUicStIFMUn3FPNfjx/WuQFLhKLoU3UOHHPJnkFqkQ9MBqLq2k5K7MVsNNFTxIDCKS1jPgkTmAWjRZ0EFiRXLa+Gvnz3GP5ltgfjDwdPeb5xp0/AqKPD8jea9w5ClR6ckrRHCLsfXhL2e9IaF4B96JlIv4rICLX3HmeIgM2PKl2MnSt8we5z39bBoLSA0yWG6BvpiMBaFqbo7jeHf1SxI6R404/emHhwW3pwSCDrq2ZE1ATG2UmA5NssFcVuaBPBoQer+n5haVYMNpNUp6rtKZeAIbf5JEOXJ6CJqiInfnnzOMNGhGFkGUYkhsy3p6Ti/lmNMPX/xtY+8ZqMwXf5drssm5KgnQ5nDbVqnTWAhoT/D3t+cJVAaXGTGw88fU0X95dZr8vaL/5nBCj1uUdv5cRBJ8PGhqbBX8PoiXrtGooBGhxf6nHbxIneSzG1++MZGo3e1G,iv:D1lgCnZKm3Gyv6cZpQ7zGW7JXN5RCwoaas+LroTkhPc=,tag:WI6Nr1cX8gm5pjFpu/Ok0w==,type:str]
 ssh_github_key: ENC[AES256_GCM,data:vZAH4cRDsgGXLAppQKOyUPOvmBJZ27bujMGz4hQ8tt0xhGFUP28llwGZz/VRuU02Yv4alLgVWBAIPuyhZT9f35KnjIR1Mmb7HXk/6oaNM59/lBiISLrnOpC10WmJ9O5krKdxwP8ZDvHA34B0s+oYNkTNXiU0S8AVg3icploax7ylKH5Dorj53kjdYSTjd8KN6ZsgCKmcz97+GnP0IgdmauyNL7e+kv9WIfE8Xx1kGvC8WVnidX2YhSxm6vt8l60eUj9etRigU88oFYTDZ+mIf4lucSpzaLZutz2fM/16D/o9SS7mmTrEllj2S+IXc9ZZTRKKDLbW+yv0XUi0XZi+OHAdZScjS54NZKyT9uWrc/IDJHammGsoHRQpHZtbGhkeFi/KdJsYBsWItslXjM0xJVtFIM2tMnd10kv9UGuXsSl9J4NC0rpz3aXnQqG4ZAhMjN9D/DTJpB4K0pcFyd2FDWdrbKq5iPfnU/V6ecnHPML6wCt6gua/LdK1MWoG3l2SqwMLYj1r7UW5fQZqSw1EK0BAtp9cQMLBL/2w8ykMfWpLekE=,iv:gcinU7xOoXQkFVkLNB3sQYHAcZy3pZN+bDRIq4sspys=,tag:yawgAHBKIkGpnKPHsRId4g==,type:str]
 sops:
     age:
-        - recipient: age10pyhca0jy75wtqv5hrn0gf0jcam5272zx9h73a8xwwaxyfq89c0qs5dr9t
+        - enc: |
-          enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMMVVaazhud2paM29JbEJx
             aUFnajhSd3NxTzB0MndhRk03WjNvV3BVc0NNCnpxR1pjbXVrZ3RPQkppNHJpQ3pX
@@ -38,7 +43,8 @@ sops:
             N3I5dzUwc3JtYzczMUhyT04vSHlZamMKT+FzYcDLmlEFYxm/XoBpJb8XaZzBH1v9
             6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-20T08:25:30Z"
+          recipient: age10pyhca0jy75wtqv5hrn0gf0jcam5272zx9h73a8xwwaxyfq89c0qs5dr9t
-    mac: ENC[AES256_GCM,data:rh4FcdDtUVvEvv/0XR/J62SgRlv/c0Wve4IIjlr3jItdPkIIkncX+ychxwSIqQEzcQD4BO6MJ7Ex1HXcOP0+5pg3Qvysj+J8y5JGpoIi2dAGh9A7uzMG/cOQD4TuUAQl+HsO6U9b/hrJg6qwyqxrvsupEkH4c7zCb7WbpZfn0o0=,iv:ZQ59dQXJqvLIqlyJmHCByF12Oi6e9vp9ikGGIERIyQE=,tag:Mgbxhu7rOdiHFv+EoYAPuA==,type:str]
+    lastmodified: "2026-06-22T18:17:22Z"
+    mac: ENC[AES256_GCM,data:nIGjfBCia9y1+f0dE6TRK6pBLo3B+vqmK88t5xrCY9j+SIzPvCc2Iv6h8AXSfunvIZpxODhn+PmX2FBwa9TtNVePi/Iywu43fRGHz67gSVYTyTBoLRAxqW/7hEvRMXu0ECUfAPzQCq3rd4iWjMXyIYU/FsX9g4NlIno0zcCV5cs=,iv:M4FBoxzojH01hScrRoET3AwmG3qevhkxiET+W94drh0=,tag:rHf7wbkp64FKybjZL0EDDQ==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.12.2
+    version: 3.13.1