Changed Stuff

.gitignore

@@ -1,6 +1,7 @@
 # Nix build results
 result
 result-*
+*.qcow2
 
 # Ignore everything in the secrets directory
 secrets/*
@@ -24,6 +25,7 @@ secrets/ssh-private
 # secrets (encrypted via sops, but extra safety)
 secrets/*.yaml~
 
+
 # Editor
 .direnv/
 .envrc

flake.lock

@@ -669,6 +669,42 @@
         "type": "github"
       }
     },
+    "nixlib": {
+      "locked": {
+        "lastModified": 1736643958,
+        "narHash": "sha256-tmpqTSWVRJVhpvfSN9KXBvKEXplrwKnSZNAoNPf/S/s=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "1418bc28a52126761c02dd3d89b2d8ca0f521181",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixos-generators": {
+      "inputs": {
+        "nixlib": "nixlib",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1769813415,
+        "narHash": "sha256-nnVmNNKBi1YiBNPhKclNYDORoHkuKipoz7EtVnXO50A=",
+        "owner": "nix-community",
+        "repo": "nixos-generators",
+        "rev": "8946737ff703382fda7623b9fab071d037e897d5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixos-generators",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1775423009,
@@ -771,6 +807,7 @@
         "hyprland-plugins": "hyprland-plugins",
         "nix-homebrew": "nix-homebrew",
         "nixcord": "nixcord",
+        "nixos-generators": "nixos-generators",
         "nixpkgs": "nixpkgs",
         "nixvim": "nixvim",
         "sops-nix": "sops-nix",

flake.nix

@@ -5,6 +5,11 @@
     # monorepo w/ recipes ("derivations")
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
 
+    nixos-generators = {
+      url = "github:nix-community/nixos-generators";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     # declarative Configs
     home-manager = {
       url = "github:nix-community/home-manager/master";
@@ -79,6 +84,7 @@
       nixvim,
       hyprland,
       sops-nix,
+      nixos-generators,
       ...
     }@inputs:
     let
@@ -145,6 +151,12 @@
           system = "x86_64-linux";
         };
 
+        "cyper-controller" = mkSystem {
+          hostName = "cyper-controller";
+          system = "x86_64-linux";
+          isServer = true;
+        };
+
         "cyper-node-1" = mkSystem {
           hostName = "cyper-node-1";
           system = "x86_64-linux";
@@ -163,5 +175,37 @@
         system = "x86_64-darwin";
         isDarwin = true;
       };
+
+      # NEW: flashable image for cyper-controller
+      packages.x86_64-linux.cyper-controller-image = nixos-generators.nixosGenerate {
+        system = "x86_64-linux";
+        format = "raw-efi";
+        specialArgs = {
+          inherit inputs primaryUser self;
+          hostName = "cyper-controller";
+          isDarwin = false;
+          isServer = true;
+        };
+        modules = [
+          { nixpkgs.hostPlatform = "x86_64-linux"; }
+          { networking.hostName = "cyper-controller"; }
+          ./hosts/cyper-controller/configuration.nix
+          ./nixos
+          inputs.sops-nix.nixosModules.sops
+          inputs.home-manager.nixosModules.home-manager
+          {
+            home-manager = {
+              extraSpecialArgs = {
+                inherit inputs primaryUser self;
+                hostName = "cyper-controller";
+                isDarwin = false;
+                isServer = true;
+              };
+              users.${primaryUser} = import ./home;
+              backupFileExtension = "backup";
+            };
+          }
+        ];
+      };
     };
 }

home/desktop/hyprland/default.nix

@@ -6,12 +6,17 @@ let
   theme = "-theme $HOME/.config/rofi/custom.rasi";
   menu = "rofi -show drun ${theme}";
   filebrowser = "rofi -show filebrowser ${theme}";
-  power =
+  power = "rofi -show p -modi p:rofi-power-menu -theme $HOME/.config/rofi/power.rasi";
-    "rofi -show p -modi p:rofi-power-menu -theme $HOME/.config/rofi/power.rasi";
   apps = "rofi -show window ${theme}";
-in {
+in
+{
 
-  imports = [ ./hypridle.nix ./hyprlock.nix ./mako.nix ./portal.nix ];
+  imports = [
+    ./hypridle.nix
+    ./hyprlock.nix
+    ./mako.nix
+    ./portal.nix
+  ];
 
   home.packages = with pkgs; [
     catppuccin-cursors.mochaDark
@@ -23,12 +28,10 @@ in {
     playerctl
   ];
 
-  systemd.user.targets.hyprland-session.Unit.Wants =
+  systemd.user.targets.hyprland-session.Unit.Wants = [ "xdg-desktop-autostart.target" ];
-    [ "xdg-desktop-autostart.target" ];
 
   wayland.windowManager.hyprland = {
-    package =
+    package = inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.hyprland;
-      inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.hyprland;
     enable = true;
 
     xwayland.enable = true;
@@ -39,9 +42,7 @@ in {
       enableXdgAutostart = false;
     };
 
-    plugins =
+    plugins = with inputs.hyprland-plugins.packages.${pkgs.stdenv.hostPlatform.system}; [
-      with inputs.hyprland-plugins.packages.${pkgs.stdenv.hostPlatform.system};
-      [
       #hyprbars
       #      hyprexpo
     ];
@@ -65,8 +66,10 @@ in {
         "XCURSOR_SIZE,24"
       ];
 
-      monitor =
+      monitor = [
-        [ "DP-1, 1920x1080@60, 1920x0, 1" "HDMI-A-2, 1920x1080@60, 0x0, 1" ];
+        "DP-1, 1920x1080@60, 1920x0, 1"
+        "HDMI-A-2, 1920x1080@60, 0x0, 1"
+      ];
 
       input = {
         kb_layout = "de";
@@ -162,7 +165,7 @@ in {
         disable_splash_rendering = true;
         mouse_move_enables_dpms = true;
         key_press_enables_dpms = true;
-        vfr = true;
+        #        vfr = true;
         vrr = 0;
       };
 
@@ -189,7 +192,11 @@ in {
       #  "noblur, class:^(org\\.gnome\\.|io\\.github\\.|org\\.gtk\\.)"
       #     ];
 
-      exec-once = [ "awww-daemon & disown" "waybar &" ];
+      exec-once = [
+        "awww-daemon --no-cache & disown"
+        "awww img ~/Pictures/Wallpapers/Ghost_in_the_Shell.png"
+        "waybar &"
+      ];
 
       # Keybindings
       bind = [
@@ -261,8 +268,7 @@ in {
         "${super}, mouse_up, workspace, e-1"
 
         # Screenshot
-        ''
+        ''${super}, Z, exec, grim -g "$(slurp)" $HOME/Pictures/Screenshots/$(date +'%s_grim.png')''
-          ${super}, Z, exec, grim -g "$(slurp)" $HOME/Pictures/Screenshots/$(date +'%s_grim.png')''
         "${super}, U, exec, grim $HOME/Pictures/Screenshots/$(date +'%s_grim.png')"
       ];
 

home/shell.nix

@@ -189,7 +189,7 @@
       f = "nvim $(fzf)";
       tree = "eza --icons=always -T";
       i = "kitty +kitten icat";
-      cat = "bat --color=always --style=numbers";
+      bat = "bat --color=always --style=numbers";
       grep = "rg";
       cp = "rsync -ah --progress";
       nix-switch =

hosts/cyper-controller/configuration.nix

@@ -0,0 +1,47 @@
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../../nixos/roles/monitoring.nix
+    ../../nixos/roles/matrix.nix
+    ../../nixos/roles/postgresql.nix
+    ../../nixos/roles/wyl.nix
+    ../../nixos/roles/adguard.nix
+    ../../nixos/roles/unifi.nix
+    ../../nixos/roles/searxng.nix
+    ../../nixos/roles/filebrowser.nix
+    ../../nixos/roles/gitea.nix
+    ../../nixos/roles/vaultwarden.nix
+    ../../nixos/roles/frontpage
+    ../../nixos/roles/cage.nix
+  ];
+
+  networking = {
+    useNetworkd = true;
+    useDHCP = false;
+    firewall.enable = true;
+  };
+
+  systemd.network = {
+    enable = true;
+    networks."10-ethernet" = {
+      matchConfig.Name = "enp1s0";
+      networkConfig = {
+        Address = "192.168.2.2/24";
+        Gateway = "192.168.2.1";
+        DNS = "192.168.2.2";
+        DHCP = "no";
+      };
+    };
+  };
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+      configurationLimit = 10;
+      editor = false;
+    };
+    efi.canTouchEfiVariables = true;
+  };
+
+  system.stateVersion = "26.05";
+}

hosts/cyper-controller/hardware-configuration.nix

@@ -0,0 +1,53 @@
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot = {
+    initrd.availableKernelModules = [
+      "xhci_pci"
+      "ahci"
+      "usb_storage"
+      "sd_mod"
+    ];
+    initrd.kernelModules = [ ];
+    kernelModules = [ "kvm-intel" ];
+    extraModulePackages = [ ];
+  };
+  fileSystems = {
+    "/" = lib.mkForce {
+      device = "/dev/disk/by-label/NIXROOT";
+      fsType = "ext4";
+    };
+
+    "/boot" = lib.mkForce {
+      device = "/dev/disk/by-label/NIXBOOT";
+      fsType = "vfat";
+      options = [
+        "fmask=0022"
+        "dmask=0022"
+      ];
+    };
+
+    # TODO: Add External Devices as by-label with no necessity for boot
+  };
+
+  swapDevices = [
+    {
+      device = "/swapfile";
+      size = 4096;
+    }
+  ];
+
+  networking.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/cyper-desktop/configuration.nix

@@ -14,7 +14,10 @@
       networkConfig = {
         Address = "192.168.2.40/24";
         Gateway = "192.168.2.1";
-        DNS = "192.168.2.2";
+        DNS = [
+          "192.168.2.2"
+          "1.1.1.1"
+        ];
         DHCP = "no";
       };
     };

hosts/cyper-node-2/configuration.nix

@@ -1,7 +1,8 @@
 {
   imports = [
     ./hardware-configuration.nix
-    ../../nixos/roles/searxng.nix
+    ../../nixos/roles/gitea.nix
+    ../../nixos/roles/filebrowser.nix
   ];
 
   networking = {

nixos/default.nix

@@ -51,6 +51,34 @@
     };
   };
 
+  virtualisation = lib.mkIf isServer {
+    vmVariant = {
+      virtualisation = {
+        forwardPorts = [
+          {
+            from = "host";
+            host.port = 2222;
+            guest.port = 22;
+          }
+        ];
+        qemu.networkingOptions = [
+          "-device virtio-net-pci,netdev=net0"
+          "-netdev user,id=net0,net=10.0.2.0/24,dhcpstart=10.0.2.15"
+        ];
+      };
+
+      systemd.network.networks."10-ethernet" = lib.mkForce {
+        matchConfig.Name = "ens*";
+        networkConfig = {
+          Address = "10.0.2.15/24";
+          Gateway = "10.0.2.2";
+          DNS = "8.8.8.8";
+          DHCP = "no";
+        };
+      };
+    };
+  };
+
   documentation = {
     enable = true;
     doc.enable = false;

nixos/roles/cage.nix

@@ -0,0 +1,48 @@
+{ pkgs, ... }:
+let
+  kiosk-url = "https://www.cyperpunk.de";
+  kiosk-user = "kiosk";
+  kiosk-program =
+    "${pkgs.chromium}/bin/chromium "
+    + "--kiosk "
+    + "--app=${kiosk-url} "
+    + "--noerrdialogs "
+    + "--disable-infobars "
+    + "--no-first-run "
+    + "--disable-translate "
+    + "--disable-features=TranslateUI "
+    + "--autoplay-policy=no-user-gesture-required "
+    + "--enable-features=WebUIDarkMode "
+    + "--force-dark-mode ";
+in
+{
+  environment = {
+    systemPackages = [
+      pkgs.cage
+      pkgs.chromium
+    ];
+
+    variables = {
+      XKB_DEFAULT_LAYOUT = "de";
+      XKB_DEFAULT_VARIANT = "mac";
+      XKB_DEFAULT_OPTIONS = "terminate:ctrl_alt_bksp";
+    };
+
+    loginShellInit = ''
+      if [ "$(tty)" = "/dev/tty1" ] && [ "$USER" = "${kiosk-user}" ]; then
+        export XDG_CONFIG_HOME=/home/${kiosk-user}/.config
+        export XDG_CACHE_HOME=/home/${kiosk-user}/.cache
+        exec ${pkgs.cage}/bin/cage -s -- ${kiosk-program}
+      fi
+    '';
+  };
+
+  services.getty.autologinUser = kiosk-user;
+
+  users.users.${kiosk-user} = {
+    isNormalUser = true;
+    home = "/home/${kiosk-user}";
+    createHome = true;
+  };
+
+}

nixos/roles/filebrowser.nix

@@ -0,0 +1,19 @@
+{ ... }:
+{
+  services.filebrowser = {
+    enable = true;
+
+    settings = {
+      port = 10000;
+      address = "0.0.0.0";
+      baseURL = "/filebrowser";
+      root = "/storage";
+    };
+
+    # If you want the port opened in the firewall:
+    openFirewall = true;
+  };
+
+  #networking.firewall.allowedTCPPorts = [ 8080 ];
+
+}

nixos/roles/frontpage/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  imports = [ ./frontpage.nix ];
+}

nixos/roles/frontpage/frontpage-calvin.nix

@@ -1,47 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-
-let
-  address = config.systemd.network.networks."10-ethernet".networkConfig.Address;
-  ip = builtins.elemAt (lib.splitString "/" address) 0;
-  port = 15006;
-
-  calvinConfig = pkgs.writeText "config.yml" ''
-    title: "Calvin's Dashboard"
-    subtitle: ""
-    header: true
-    footer: false
-    defaults:
-      colorTheme: dark
-    services:
-      - name: "Services"
-        items: []
-  '';
-
-  calvinRoot = pkgs.runCommand "homer-calvin" { } ''
-    cp -r ${pkgs.homer}/. $out
-    chmod -R u+w $out
-    cp ${calvinConfig} $out/config.yml
-  '';
-in
-{
-  services.nginx.virtualHosts."homer-calvin" = {
-    listen = [
-      {
-        addr = "0.0.0.0";
-        port = port;
-      }
-    ];
-    root = "${calvinRoot}";
-    locations."/" = {
-      index = "index.html";
-      tryFiles = "$uri $uri/ /index.html";
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [ port ];
-}

nixos/roles/frontpage/frontpage.nix

@@ -1,65 +1,40 @@
-{
+{ config, lib, ... }:
-  config,
-  pkgs,
-  lib,
-  ...
-}:
 
 let
   address = config.systemd.network.networks."10-ethernet".networkConfig.Address;
   ip = builtins.elemAt (lib.splitString "/" address) 0;
-  port = 15005;
-
-  catppuccinFlavor = "mocha";
-  logo = if catppuccinFlavor == "latte" then "assets/light_circle.png" else "assets/dark_circle.png";
-
-  mainConfig = pkgs.writeText "config.yml" ''
-    title: "Dashboard"
-    subtitle: ""
-    header: true
-    footer: false
-    logo: "${logo}"
-    stylesheet:
-      - "assets/catppuccin-${catppuccinFlavor}.css"
-    defaults:
-      colorTheme: dark
-    services:
-      - name: "Services"
-        items:
-          - name: "Vaultwarden"
-            url: "https://${ip}:8222"
-          - name: "SearXNG"
-            url: "http://${ip}:11080"
-  '';
-
-  mainRoot = pkgs.runCommand "homer-main" { } ''
-    cp -r ${pkgs.homer}/. $out
-    chmod -R u+w $out
-    cp ${mainConfig} $out/config.yml
-    mkdir -p $out/assets/icons
-    cp ${./assets/catppuccin-${catppuccinFlavor}.css} $out/assets/catppuccin-${catppuccinFlavor}.css
-    cp ${./assets/dark_circle.png} $out/assets/dark_circle.png
-    cp ${./assets/light_circle.png} $out/assets/light_circle.png
-    cp -r ${./assets/icons}/. $out/assets/icons/
-  '';
 in
 {
-  services.nginx = {
+  sops.secrets.flame_password = { };
-    enable = true;
+  sops.secrets.flame_calvin_password = { };
-    virtualHosts."homer-main" = {
+
-      listen = [
+  virtualisation = {
-        {
+    docker.enable = true;
-          addr = "0.0.0.0";
+    oci-containers = {
-          port = port;
+      backend = "docker";
-        }
+      containers = {
+        flame = {
+          image = "pawelmalak/flame:latest";
+          ports = [ "15005:5005" ];
+          volumes = [
+            "/var/lib/flame:/app/data"
+            "/var/run/docker.sock:/var/run/docker.sock"
           ];
-      root = "${mainRoot}";
+          environmentFiles = [ config.sops.secrets.flame_password.path ];
-      locations."/" = {
+        };
-        index = "index.html";
+        flame-calvin = {
-        tryFiles = "$uri $uri/ /index.html";
+          image = "pawelmalak/flame:latest";
+          ports = [ "15006:5005" ];
+          volumes = [ "/var/lib/flame-calvin:/app/data" ];
+          environmentFiles = [ config.sops.secrets.flame_calvin_password.path ];
+        };
       };
     };
   };
 
-  networking.firewall.allowedTCPPorts = [ port ];
+  networking.firewall.allowedTCPPorts = [
+    15005
+    15006
+  ];
+
 }

nixos/roles/gitea.nix

@@ -0,0 +1,206 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+
+let
+
+  giteaTheme = pkgs.fetchzip {
+    url = "https://github.com/catppuccin/gitea/releases/download/v1.0.1/catppuccin-gitea.tar.gz";
+    sha256 = "sha256-et5luA3SI7iOcEIQ3CVIu0+eiLs8C/8mOitYlWQa/uI=";
+    stripRoot = false;
+  };
+
+  domain = "192.168.2.31"; # swap to git.cyperpunk.de for prod
+  httpPort = 9000;
+  sshPort = 12222;
+in
+{
+  sops.secrets = {
+    "gitea/dbPassword" = {
+      owner = "gitea";
+      group = "gitea";
+      mode = "0444";
+    };
+    "gitea/internalToken" = {
+      owner = "gitea";
+      group = "gitea";
+    };
+    "gitea/lfsJwtSecret" = {
+      owner = "gitea";
+      group = "gitea";
+    };
+    "gitea/mailerPassword" = {
+      owner = "gitea";
+      group = "gitea";
+    };
+  };
+
+  services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_14;
+    ensureDatabases = [ "gitea" ];
+    ensureUsers = [
+      {
+        name = "gitea";
+        ensureDBOwnership = true;
+      }
+    ];
+    authentication = lib.mkOverride 10 ''
+      local all all trust
+      host  all all 127.0.0.1/32 md5
+      host  all all ::1/128      md5
+    '';
+  };
+
+  systemd.services.gitea-db-password = {
+    description = "Set gitea postgres user password";
+    requires = [ "postgresql.service" ];
+    after = [ "postgresql.service" ];
+    before = [ "gitea.service" ];
+    wantedBy = [ "gitea.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+      User = "postgres";
+      RemainAfterExit = true;
+    };
+    script = ''
+      pass=$(cat ${config.sops.secrets."gitea/dbPassword".path})
+      ${pkgs.postgresql_14}/bin/psql -c \
+        "ALTER USER gitea WITH PASSWORD '$pass';"
+    '';
+  };
+
+  services.gitea = {
+    enable = true;
+    package = pkgs.gitea;
+    user = "gitea";
+    group = "gitea";
+
+    database = {
+      type = "postgres";
+      host = "127.0.0.1";
+      port = 5432;
+      name = "gitea";
+      user = "gitea";
+      passwordFile = config.sops.secrets."gitea/dbPassword".path;
+    };
+
+    settings = {
+      server = {
+        DOMAIN = domain;
+        HTTP_ADDR = "0.0.0.0";
+        HTTP_PORT = httpPort;
+        SSH_PORT = sshPort;
+        SSH_LISTEN_PORT = sshPort;
+        ROOT_URL = "http://${domain}:${toString httpPort}/";
+        DISABLE_SSH = false;
+        START_SSH_SERVER = true;
+      };
+
+      # security = {
+      #   SECRET_KEY_URI = "file://${config.sops.secrets."gitea/secretKey".path}";
+      #   INTERNAL_TOKEN_URI = "file://${config.sops.secrets."gitea/internalToken".path}";
+      # };
+
+      #lfs = {
+      #   JWT_SECRET_URI = "file://${config.sops.secrets."gitea/lfsJwtSecret".path}";
+      # };
+
+      ui = {
+        DEFAULT_THEME = "catppuccin-mocha-green";
+        THEMES = lib.concatStringsSep "," [
+          # built-in
+          "gitea"
+          "arc-green"
+          # latte
+          "catppuccin-latte-blue"
+          "catppuccin-latte-flamingo"
+          "catppuccin-latte-green"
+          "catppuccin-latte-lavender"
+          "catppuccin-latte-maroon"
+          "catppuccin-latte-mauve"
+          "catppuccin-latte-peach"
+          "catppuccin-latte-pink"
+          "catppuccin-latte-red"
+          "catppuccin-latte-rosewater"
+          "catppuccin-latte-sapphire"
+          "catppuccin-latte-sky"
+          "catppuccin-latte-teal"
+          "catppuccin-latte-yellow"
+          # frappe
+          "catppuccin-frappe-blue"
+          "catppuccin-frappe-flamingo"
+          "catppuccin-frappe-green"
+          "catppuccin-frappe-lavender"
+          "catppuccin-frappe-maroon"
+          "catppuccin-frappe-mauve"
+          "catppuccin-frappe-peach"
+          "catppuccin-frappe-pink"
+          "catppuccin-frappe-red"
+          "catppuccin-frappe-rosewater"
+          "catppuccin-frappe-sapphire"
+          "catppuccin-frappe-sky"
+          "catppuccin-frappe-teal"
+          "catppuccin-frappe-yellow"
+          # macchiato
+          "catppuccin-macchiato-blue"
+          "catppuccin-macchiato-flamingo"
+          "catppuccin-macchiato-green"
+          "catppuccin-macchiato-lavender"
+          "catppuccin-macchiato-maroon"
+          "catppuccin-macchiato-mauve"
+          "catppuccin-macchiato-peach"
+          "catppuccin-macchiato-pink"
+          "catppuccin-macchiato-red"
+          "catppuccin-macchiato-rosewater"
+          "catppuccin-macchiato-sapphire"
+          "catppuccin-macchiato-sky"
+          "catppuccin-macchiato-teal"
+          "catppuccin-macchiato-yellow"
+          # mocha
+          "catppuccin-mocha-blue"
+          "catppuccin-mocha-flamingo"
+          "catppuccin-mocha-green"
+          "catppuccin-mocha-lavender"
+          "catppuccin-mocha-maroon"
+          "catppuccin-mocha-mauve"
+          "catppuccin-mocha-peach"
+          "catppuccin-mocha-pink"
+          "catppuccin-mocha-red"
+          "catppuccin-mocha-rosewater"
+          "catppuccin-mocha-sapphire"
+          "catppuccin-mocha-sky"
+          "catppuccin-mocha-teal"
+          "catppuccin-mocha-yellow"
+        ];
+      };
+    };
+  };
+
+  # symlink catppuccin css files into gitea's custom dir on every service start
+  systemd.services.gitea.preStart = lib.mkAfter ''
+    themeDir="${config.services.gitea.stateDir}/custom/public/assets/css"
+    mkdir -p "$themeDir"
+    for f in ${giteaTheme}/*.css; do
+      name=$(basename "$f")
+      ln -sf "$f" "$themeDir/$name"
+    done
+  '';
+
+  users.users.gitea = {
+    isSystemUser = true;
+    group = "gitea";
+    home = "/var/lib/gitea";
+    createHome = true;
+  };
+  users.groups.gitea = { };
+  users.users.postgres.extraGroups = [ "gitea" ];
+
+  networking.firewall.allowedTCPPorts = [
+    httpPort
+    sshPort
+  ];
+}

nixos/roles/restore.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Usage: sudo ./restore.sh gitea_dump_*.sql gitea_data_*.tar.gz
+set -euo pipefail
+
+SQL_DUMP="${1:?provide the .sql dump as first argument}"
+DATA_ARCHIVE="${2:?provide the data .tar.gz as second argument}"
+
+GITEA_HOME="/var/lib/gitea"
+GITEA_USER="gitea"
+DB_NAME="gitea"
+DB_USER="gitea"
+
+echo "[1/5] Stopping gitea..."
+systemctl stop gitea
+
+echo "[2/5] Waiting for postgres..."
+until sudo -u postgres psql -c '\q' 2>/dev/null; do sleep 1; done
+
+echo "[3/5] Restoring database..."
+sudo -u postgres psql -c "DROP DATABASE IF EXISTS ${DB_NAME};"
+sudo -u postgres psql -c "CREATE DATABASE ${DB_NAME} OWNER ${DB_USER};"
+sudo -u postgres psql -d "$DB_NAME" < "$SQL_DUMP"
+echo "      done."
+
+echo "[4/5] Restoring gitea data..."
+# data/gitea from the docker volume -> /var/lib/gitea
+tar xzf "$DATA_ARCHIVE" --strip-components=2 -C "$GITEA_HOME" ./data/gitea
+
+# ssh host keys -> /var/lib/gitea/ssh
+mkdir -p "$GITEA_HOME/ssh"
+tar xzf "$DATA_ARCHIVE" --strip-components=1 -C "$GITEA_HOME/ssh" ./ssh
+
+chown -R "$GITEA_USER":"$GITEA_USER" "$GITEA_HOME"
+echo "      done."
+
+echo "[5/5] Starting gitea..."
+systemctl start gitea
+systemctl status gitea --no-pager

secrets/secrets.yaml

@@ -4,6 +4,13 @@ grafana_secret_key: ENC[AES256_GCM,data:d6tu4kL7flfbdeOYk21zkSRmVe+NvVwd14jgr9Ds
 matrix_macaroon_secret: ENC[AES256_GCM,data:a9nMar+p+FXIsxxSqO/to2OJOvD1erfwLwwBeKOcWBu7xykHxqD+pCmrGhg=,iv:rp4ZDVIlZ7SN1RFHB2CfSV5ISPMl9pC4U8Jgqpz48Qs=,tag:LxmWUZE3mG4acagQmlieag==,type:str]
 matrix_registration_secret: ENC[AES256_GCM,data:KhKkJZqwE8xk4/tuQ7NYTv/Ot1qCAiy8yUbDyVvRa0H5BT4amCBIdATfR4Q=,iv:HBN+GorT1VpWCVkDugk4UxYLEYKJIoDZh2d+oUDLc8g=,tag:hHus458yVnH0qaQ4u37IZg==,type:str]
 vaultwarden_admin_token: ENC[AES256_GCM,data:yoBs4CaIEJXB5b3PEwTpXFgxpX39hR9A4r9yamwDV7cTSRRp3n3O2VjDKTcI5Vo6RP2QUjcqUqYf98cZ09wDMc+6+oHHJke7+O0FgRgOC0vOQFs4bfZCBJBLxogrGiwtLGkyykR6VYhrT64AN3CbrXflj82OED2Hl8WwEdruBzGIcfnh6FqQowDx6vDR/kXXJHk=,iv:PJQo5V7FaKPQ+GzZNsy3KB+xyjcDKJ1UBHErrqgn/1U=,tag:BRIDJEDOAeToqio/DHMQaA==,type:str]
+flame_password: ENC[AES256_GCM,data:1rNB2CskrMV3EYII+0JfZVDvZE8=,iv:pHJtc+1YSPRYrZG97X3r0+x/cPPUlr8jO+0w2HR+VNw=,tag:qQ/1IPxweBt9iIH4Zsh7+A==,type:str]
+flame_calvin_password: ENC[AES256_GCM,data:P5ppyqTjAJ1TL4hXtx5WyoS9a+g=,iv:sq98P3Oqud2FXfqsD76YS/p5NEF2xlN0MfG+ukCB9B0=,tag:AeKnu4Hg4xQ3tII0y6oNpQ==,type:str]
+gitea:
+    dbPassword: ENC[AES256_GCM,data:S6VvRgkdYk1AzXljyQEEq68UJ9zrFy6+INBMIAspXNcqcM6o+es19o0mcXA=,iv:/pHYpkZZq+9Md+75uSCb2YXfSvaDzUh6mMfH53wb7eg=,tag:ZnbyCQwrK2JnbO5HFqgJYw==,type:str]
+    internalToken: ENC[AES256_GCM,data:7N8TkPNb1YdCk2uAcCvVd2pKRVOf85//DYxAvz0UCg1E8ccEI5630xVyKafDFiSTM4ER7xiYelartzXL0jLWSf3QNOjSHUP8TIAz4bJRAZUJPxO917bURSLGGe7WEOfONzqy3Ts5QhrJ,iv:DiIs1ytlwLvqD/Ejep6m2fmpSqdFZkxBcgLNt6+29jY=,tag:8jsEcOkH0p+1mP9cnVjiDQ==,type:str]
+    lfsJwtSecret: ENC[AES256_GCM,data:L20mFZ6zwsF3ZUoodarTJV+vhUdLlBrUbHz7FpEzJ2/C6AdFc1ZZcioN3g==,iv:E2C3gg1OYQ46Ae2bGnhF+3uw+q77l+yph3Kd2fxwW9M=,tag:VQkQ4R9S8Dr39rSLhL/X1w==,type:str]
+    mailerPassword: ""
 ssh_private_key: ENC[AES256_GCM,data:R511mVFVk1ogAd5CKk/2P6rtT4NnHIFfKyqeCen545QgcvDqDFmW0rFBmPJyipaya2srJNoWvKJbnvxWtTYeJh2tPAybRMoUicStIFMUn3FPNfjx/WuQFLhKLoU3UOHHPJnkFqkQ9MBqLq2k5K7MVsNNFTxIDCKS1jPgkTmAWjRZ0EFiRXLa+Gvnz3GP5ltgfjDwdPeb5xp0/AqKPD8jea9w5ClR6ckrRHCLsfXhL2e9IaF4B96JlIv4rICLX3HmeIgM2PKl2MnSt8we5z39bBoLSA0yWG6BvpiMBaFqbo7jeHf1SxI6R404/emHhwW3pwSCDrq2ZE1ATG2UmA5NssFcVuaBPBoQer+n5haVYMNpNUp6rtKZeAIbf5JEOXJ6CJqiInfnnzOMNGhGFkGUYkhsy3p6Ti/lmNMPX/xtY+8ZqMwXf5drssm5KgnQ5nDbVqnTWAhoT/D3t+cJVAaXGTGw88fU0X95dZr8vaL/5nBCj1uUdv5cRBJ8PGhqbBX8PoiXrtGooBGhxf6nHbxIneSzG1++MZGo3e1G,iv:D1lgCnZKm3Gyv6cZpQ7zGW7JXN5RCwoaas+LroTkhPc=,tag:WI6Nr1cX8gm5pjFpu/Ok0w==,type:str]
 ssh_github_key: ENC[AES256_GCM,data:vZAH4cRDsgGXLAppQKOyUPOvmBJZ27bujMGz4hQ8tt0xhGFUP28llwGZz/VRuU02Yv4alLgVWBAIPuyhZT9f35KnjIR1Mmb7HXk/6oaNM59/lBiISLrnOpC10WmJ9O5krKdxwP8ZDvHA34B0s+oYNkTNXiU0S8AVg3icploax7ylKH5Dorj53kjdYSTjd8KN6ZsgCKmcz97+GnP0IgdmauyNL7e+kv9WIfE8Xx1kGvC8WVnidX2YhSxm6vt8l60eUj9etRigU88oFYTDZ+mIf4lucSpzaLZutz2fM/16D/o9SS7mmTrEllj2S+IXc9ZZTRKKDLbW+yv0XUi0XZi+OHAdZScjS54NZKyT9uWrc/IDJHammGsoHRQpHZtbGhkeFi/KdJsYBsWItslXjM0xJVtFIM2tMnd10kv9UGuXsSl9J4NC0rpz3aXnQqG4ZAhMjN9D/DTJpB4K0pcFyd2FDWdrbKq5iPfnU/V6ecnHPML6wCt6gua/LdK1MWoG3l2SqwMLYj1r7UW5fQZqSw1EK0BAtp9cQMLBL/2w8ykMfWpLekE=,iv:gcinU7xOoXQkFVkLNB3sQYHAcZy3pZN+bDRIq4sspys=,tag:yawgAHBKIkGpnKPHsRId4g==,type:str]
 sops:
@@ -17,7 +24,7 @@ sops:
             N3I5dzUwc3JtYzczMUhyT04vSHlZamMKT+FzYcDLmlEFYxm/XoBpJb8XaZzBH1v9
             6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-11T11:56:39Z"
+    lastmodified: "2026-04-11T21:27:16Z"
-    mac: ENC[AES256_GCM,data:PvlzNkTrXA61gXToaB1VhTRE3fP8jWJrCb5Fmk2dpFOv48WB4vO5nUwQM/XnDvk9A3j3HRuCnIOtEs5Fs5N3lrEFh51PBgUBHPGh+vJIumqbemsxc//oEF4e/FrqUpouW0i6P82ZHKs4qAMT9qG53+2m9/wc2pp8IWlQC9Gkg8o=,iv:zAzOdxiwgnKI8yYxTXzXzbDm2fZYEzmXkAjpJXAD0lY=,tag:/p7YAx+FmKVuFOLNbYzBZA==,type:str]
+    mac: ENC[AES256_GCM,data:6uKae66muzkB8qPMUSkya4r4wA4oYnNttu+Md0USTHyY0VlMZefucfgpPGr79JC4l0u99kVRNyEqIY1kp/tdspeKHtGfpWmX4Djx/jMOSPWfzX99Y9ICC9KIdZgYdVJeGiwJKZUEHU0vlAopFGODQ2++sHqjrIAxO1EkGFkAgRA=,iv:Z00NF38aNk26n8+d+3b2bKFJjlN5LVWplyyE6ED9rUw=,tag:5xdT9q0dQXW/SA3CduzJug==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.12.2