Removed coturn

.gitignore

@@ -1,6 +1,7 @@
 # Nix build results
 result
 result-*
+*.qcow2
 
 # Ignore everything in the secrets directory
 secrets/*
@@ -24,6 +25,7 @@ secrets/ssh-private
 # secrets (encrypted via sops, but extra safety)
 secrets/*.yaml~
 
+
 # Editor
 .direnv/
 .envrc

AGENTS.md

@@ -0,0 +1,117 @@
+# AGENTS.md
+
+A guide for AI coding agents working in this Nix flake repository.
+
+## Project Overview
+
+Multi-host Nix flake managing NixOS desktops, macOS via nix-darwin, and a home server cluster — all sharing a common Home Manager configuration. Secrets are encrypted with sops-nix + age.
+
+## Key Commands
+
+```fish
+# Apply config on current host (works on any machine)
+nix-switch   # alias for: sudo nixos-rebuild switch --flake ~/.config/nix#(hostname -s)
+             #        or: sudo darwin-rebuild switch --flake .#(hostname -s)
+
+# Check flake without building (NixOS) / eval toplevel (macOS)
+nix-check
+
+# Validate flake inputs and locks
+nix flake check --no-build
+
+# Format Nix files
+nixfmt <file>    # managed via nixvim, runs nixfmt
+
+# Enter dev shell if defined
+nix develop
+```
+
+## Repo Layout
+
+```
+flake.nix                  # Entry point — defines all hosts via mkSystem
+hosts/<hostname>/          # Per-host configuration.nix + hardware-configuration.nix
+nixos/                     # Shared NixOS system modules (audio, fonts, sops, tailscale…)
+nixos/roles/               # Optional services (Gitea, Matrix, Vaultwarden, AdGuard…)
+darwin/                    # macOS-only system modules (fonts, homebrew, yabai, sketchybar)
+home/                      # Shared Home Manager config (all hosts, both platforms)
+home/desktop/              # Desktop-only home modules — Linux (hyprland/niri, waybar, rofi…)
+home/desktop/sketchybar/   # macOS-only bar config
+home/neovim/               # nixvim configuration split by plugin
+assets/                    # Wallpapers and avatar images — do not modify programmatically
+secrets/                   # age-encrypted secrets — never edit .age files directly
+```
+
+## Hosts
+
+| Hostname | Platform | Type | Notes |
+|---|---|---|---|
+| cyper-desktop | NixOS x86_64 | Desktop | Primary Linux workstation |
+| cyper-mac | macOS x86_64 | Desktop | nix-darwin + Homebrew |
+| cyper-controller | NixOS x86_64 | Server | Runs all roles/services |
+| cyper-node-1 | NixOS x86_64 | Server | `isServer = true` |
+| cyper-node-2 | NixOS x86_64 | Server | `isServer = true` |
+
+## mkSystem Convention
+
+All hosts are built via `mkSystem` in `flake.nix`. Key flags:
+
+- `isDarwin = true` → uses `darwin.lib.darwinSystem` + darwin modules
+- `isServer = true` → skips desktop/GUI modules; both flags are passed as `specialArgs` to all modules via `sharedSpecialArgs`
+
+Guard platform-specific code with:
+
+```nix
+if isDarwin then { ... } else { ... }
+if isServer then { ... } else { ... }
+```
+
+## Home Manager
+
+A single `home/` tree is shared by all hosts. Desktop-only modules live under `home/desktop/` and are conditionally included. The `isDarwin` and `isServer` flags are available as `specialArgs` inside Home Manager modules.
+
+## Secrets
+
+Managed with [sops-nix](https://github.com/Mic92/sops-nix) + age encryption.
+
+- **Never edit `.age` files directly** — use `sops secrets/secrets.yaml`
+- Age key must exist at `~/.config/sops/age/keys.txt` on every host
+- Public keys are declared in `secrets/keys.txt.age` and `.sops.yaml` (if present)
+- Secrets are referenced in Nix via `config.sops.secrets.<name>.path`
+
+## Conventions
+
+- **Formatter:** `nixfmt` (run via nixvim; apply before committing)
+- **No `hardware-configuration.nix` edits** — these are machine-generated; regenerate with `nixos-generate-config` if needed
+- **Homebrew** is managed declaratively via `darwin/homebrew.nix` — do not run `brew install` manually
+- **Catppuccin** theming is applied system-wide via `home/catppuccin.nix` and `nixos/catppuccin.nix`; keep theme tokens consistent across modules
+- **Shell is Fish** — shell aliases and functions live in `home/shell.nix`; use fish syntax
+
+## Adding a New Host
+
+1. Create `hosts/<hostname>/configuration.nix` (and `hardware-configuration.nix` for NixOS)
+2. Add an entry to `nixosConfigurations` (or `darwinConfigurations`) in `flake.nix` via `mkSystem`
+3. Add the host to the machines table in `README.md` and this file
+
+## Adding a New Role/Service
+
+1. Create `nixos/roles/<service>.nix`
+2. Import it in the relevant host's `configuration.nix` or in `nixos/default.nix` behind an `isServer` guard
+3. Add any required secrets to `secrets/secrets.yaml` via `sops`
+
+## PR Checklist
+
+- [ ] `nix flake check --no-build` passes
+- [ ] `nixfmt` applied to changed `.nix` files
+- [ ] No hardcoded paths or usernames — use `primaryUser` / `hostName` from `specialArgs`
+- [ ] Secrets referenced via sops, not inlined
+- [ ] `hardware-configuration.nix` untouched unless intentional
+- [ ] README and AGENTS.md updated if hosts, roles, or structure changed
+
+## Gotchas
+
+- `primaryUser` is defined in `flake.nix` and injected everywhere via `sharedSpecialArgs` — never hardcode the username
+- `home-manager.backupFileExtension = "backup"` is set globally; conflicts create `.backup` files rather than erroring
+- The `l` fish function calls a Groq LLM (`llama-3.3-70b-versatile`) and pipes output through `glow` — it requires `$GROQ_API_KEY` to be set as a file path
+- sketchybar lives under `home/desktop/sketchybar/` but is macOS-only; hyprland/niri are Linux-only
+- `nix-switch` uses `hostname -s` at runtime — the hostname must match a key in `nixosConfigurations` / `darwinConfigurations`

README.md

@@ -1,33 +1,41 @@
 # DerGrumpfs Nix Configuration
 
-A unified Nix configuration for both NixOS and macOS using flakes, nix-darwin, and Home Manager.
+A unified Nix flake managing NixOS desktops, a macOS machine via nix-darwin, and a home server cluster — all sharing a common Home Manager configuration.
-
-## About
-
-A single repository managing both machines declaratively with Nix. Shared home-manager configuration across platforms with platform-specific modules where needed.
 
 **Author:** Phil Keier
 
+---
+
 ## Machines
 
-| Hostname | Platform | Architecture |
+| Hostname | Platform | Architecture | Type |
-|----------|----------|--------------|
+|---|---|---|---|
-| cyper-desktop | NixOS | x86_64-linux |
+| cyper-desktop | NixOS | x86_64-linux | Desktop workstation |
-| cyper-mac | macOS | x86_64-darwin |
+| cyper-mac | macOS | x86_64-darwin | nix-darwin + Homebrew |
+| cyper-controller | NixOS | x86_64-linux | Home server (runs all services) |
+| cyper-node-1 | NixOS | x86_64-linux | Server node |
+| cyper-node-2 | NixOS | x86_64-linux | Server node |
+
+---
 
 ## Prerequisites
 
 ### NixOS
+
 Nix is available out of the box. Enable flakes in your configuration.
 
 ### macOS
+
 Install Nix using the [Determinate Systems installer](https://docs.determinate.systems/#products).
 
-**Note:** Homebrew is managed declaratively via nix-homebrew — if already installed it will auto-migrate, otherwise it is installed automatically.
+> **Note:** Homebrew is managed declaratively via nix-homebrew — if already installed it will auto-migrate, otherwise it is installed automatically.
+
+---
 
 ## Quick Start
 
 ### Clone
+
 ```bash
 git clone https://github.com/DerGrumpf/nix ~/.config/nix
 cd ~/.config/nix
@@ -39,7 +47,10 @@ Replace placeholders in `home/git.nix`:
 - `DerGrumpf` → your Git username
 - `phil.keier@hotmail.com` → your Git email
 
+Update `secrets/keys.txt.age` and `.sops.yaml` with your age public key.
+
 ### Apply
+
 ```bash
 # NixOS
 sudo nixos-rebuild switch --flake .#cyper-desktop
@@ -47,64 +58,83 @@ sudo nixos-rebuild switch --flake .#cyper-desktop
 # macOS
 darwin-rebuild switch --flake .#cyper-mac
 
-# Or after initial setup on either machine
+# Or use the shell alias (auto-detects hostname and platform)
 nix-switch
 ```
 
+### Check (without building)
+
+```bash
+nix-check
+# expands to: nix flake check --no-build (NixOS)
+#          or: nix eval ...darwinConfigurations.(hostname).config... (macOS)
+```
+
+---
+
 ## Project Structure
+
 ```mermaid
 graph TD
     flake[flake.nix] --> desktop[nixosConfigurations<br/>cyper-desktop]
+    flake --> servers[nixosConfigurations<br/>cyper-controller / node-1 / node-2]
     flake --> mac[darwinConfigurations<br/>cyper-mac]
 
     desktop --> nixos[nixos/<br/>NixOS system modules]
-    desktop --> hd[hosts/cyper-desktop/<br/>hardware + networking]
+    desktop --> hd[hosts/cyper-desktop/<br/>hardware + config]
-    desktop --> home[home/<br/>shared home-manager]
+    desktop --> home[home/<br/>shared Home Manager]
+
+    servers --> nixos
+    servers --> roles[nixos/roles/<br/>Gitea · Matrix · Vaultwarden<br/>AdGuard · Searxng · Unifi<br/>Monitoring · Filebrowser]
+    servers --> hc[hosts/cyper-*/]
 
     mac --> darwin[darwin/<br/>macOS system modules]
-    mac --> hm[hosts/cyper-mac/<br/>host specific]
+    mac --> hm[hosts/cyper-mac/]
     mac --> home
 
-    home --> shared[shared<br/>packages, git, shell, python<br/>nixvim, nixcord, spicetify<br/>floorp, obsidian]
+    home --> shared[shared<br/>packages · git · shell · python<br/>nixvim · nixcord · spicetify<br/>floorp · obsidian · ssh]
     home --> deskmod[desktop/]
-
+    deskmod --> dlinux[Linux only<br/>hyprland · niri · waybar<br/>rofi · gtk · qt · xdg · waypaper]
-    deskmod --> dlinux[Linux only<br/>hyprland, niri<br/>waybar, rofi<br/>gtk, qt, onlyoffice<br/>xdg, waypaper]
     deskmod --> dmac[macOS only<br/>sketchybar]
 ```
 
+---
+
 ## Secrets
 
-Secrets are managed with [sops-nix](https://github.com/Mic92/sops-nix) and age encryption. The age key must be present at:
+Secrets are managed with [sops-nix](https://github.com/Mic92/sops-nix) and age encryption.
 
-- **Linux:** `~/.config/sops/age/keys.txt`
+The age key must exist at `~/.config/sops/age/keys.txt` on every host. To edit secrets:
-- **macOS:** `~/.config/sops/age/keys.txt`
+
+```bash
+sops secrets/secrets.yaml
+```
+
+Never edit `.age` files directly.
+
+---
+
+## Shell Aliases (Fish)
+
+| Alias | Expands to |
+|---|---|
+| `nix-switch` | `sudo nixos-rebuild switch --flake ~/.config/nix#(hostname -s)` |
+| `nix-check` | `nix flake check --no-build` (or darwin eval equivalent) |
+| `ls` | `eza --icons=always` |
+| `la` | `eza -la --icons=always` |
+| `tree` | `eza --icons=always -T` |
+| `f` | `nvim $(fzf)` |
+| `grep` | `rg` |
+| `cp` | `rsync -ah --progress` |
+| `l` | LLM prompt via Groq → rendered with `glow` |
+
+---
 
 ## Useful Links
 
 - [Nix manual](https://nixos.org/manual/nix/stable/)
-- [nix-darwin docs](https://github.com/LnL7/nix-darwin)
+- [nix-darwin](https://github.com/LnL7/nix-darwin)
 - [Home Manager options](https://nix-community.github.io/home-manager/options.html)
 - [sops-nix](https://github.com/Mic92/sops-nix)
 - [nixvim](https://github.com/nix-community/nixvim)
-
+- [Catppuccin for Nix](https://github.com/catppuccin/nix)
-# TODO
-
-- [ ] Verify Linux build on `cyper-desktop`
-```bash
-  sudo nixos-rebuild switch --flake ~/.config/nix#cyper-desktop
-```
-- [ ] Verify Darwin build on `cyper-mac`
-```bash
-  darwin-rebuild switch --flake ~/.config/nix#cyper-mac
-```
-- [ ] Commit and push all current changes
-```bash
-  git add -A && git commit -m "unify configs" && git push
-```
-- [ ] Test `nix-check` alias on both machines
-- [ ] Test `nix-switch` alias on both machines after initial builds succeed
-- [ ] Verify sops secrets are accessible on Darwin
-```bash
-  echo $GROQ_API_KEY
-```
-- [ ] Verify sketchybar loads correctly with lua config on macOS

flake.lock

@@ -669,6 +669,42 @@
         "type": "github"
       }
     },
+    "nixlib": {
+      "locked": {
+        "lastModified": 1736643958,
+        "narHash": "sha256-tmpqTSWVRJVhpvfSN9KXBvKEXplrwKnSZNAoNPf/S/s=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "1418bc28a52126761c02dd3d89b2d8ca0f521181",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixos-generators": {
+      "inputs": {
+        "nixlib": "nixlib",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1769813415,
+        "narHash": "sha256-nnVmNNKBi1YiBNPhKclNYDORoHkuKipoz7EtVnXO50A=",
+        "owner": "nix-community",
+        "repo": "nixos-generators",
+        "rev": "8946737ff703382fda7623b9fab071d037e897d5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixos-generators",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1775423009,
@@ -771,6 +807,7 @@
         "hyprland-plugins": "hyprland-plugins",
         "nix-homebrew": "nix-homebrew",
         "nixcord": "nixcord",
+        "nixos-generators": "nixos-generators",
         "nixpkgs": "nixpkgs",
         "nixvim": "nixvim",
         "sops-nix": "sops-nix",

flake.nix

@@ -5,6 +5,11 @@
     # monorepo w/ recipes ("derivations")
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
 
+    nixos-generators = {
+      url = "github:nix-community/nixos-generators";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     # declarative Configs
     home-manager = {
       url = "github:nix-community/home-manager/master";
@@ -79,6 +84,7 @@
       nixvim,
       hyprland,
       sops-nix,
+      nixos-generators,
       ...
     }@inputs:
     let
@@ -145,6 +151,18 @@
           system = "x86_64-linux";
         };
 
+        "cyper-controller" = mkSystem {
+          hostName = "cyper-controller";
+          system = "x86_64-linux";
+          isServer = true;
+        };
+
+        "cyper-proxy" = mkSystem {
+          hostName = "cyper-proxy";
+          system = "x86_64-linux";
+          isServer = true;
+        };
+
         "cyper-node-1" = mkSystem {
           hostName = "cyper-node-1";
           system = "x86_64-linux";
@@ -163,5 +181,37 @@
         system = "x86_64-darwin";
         isDarwin = true;
       };
+
+      # NEW: flashable image for cyper-controller
+      packages.x86_64-linux.cyper-controller-image = nixos-generators.nixosGenerate {
+        system = "x86_64-linux";
+        format = "raw-efi";
+        specialArgs = {
+          inherit inputs primaryUser self;
+          hostName = "cyper-controller";
+          isDarwin = false;
+          isServer = true;
+        };
+        modules = [
+          { nixpkgs.hostPlatform = "x86_64-linux"; }
+          { networking.hostName = "cyper-controller"; }
+          ./hosts/cyper-controller/configuration.nix
+          ./nixos
+          inputs.sops-nix.nixosModules.sops
+          inputs.home-manager.nixosModules.home-manager
+          {
+            home-manager = {
+              extraSpecialArgs = {
+                inherit inputs primaryUser self;
+                hostName = "cyper-controller";
+                isDarwin = false;
+                isServer = true;
+              };
+              users.${primaryUser} = import ./home;
+              backupFileExtension = "backup";
+            };
+          }
+        ];
+      };
     };
 }

home/desktop/hyprland/default.nix

@@ -6,12 +6,17 @@ let
   theme = "-theme $HOME/.config/rofi/custom.rasi";
   menu = "rofi -show drun ${theme}";
   filebrowser = "rofi -show filebrowser ${theme}";
-  power =
+  power = "rofi -show p -modi p:rofi-power-menu -theme $HOME/.config/rofi/power.rasi";
-    "rofi -show p -modi p:rofi-power-menu -theme $HOME/.config/rofi/power.rasi";
   apps = "rofi -show window ${theme}";
-in {
+in
+{
 
-  imports = [ ./hypridle.nix ./hyprlock.nix ./mako.nix ./portal.nix ];
+  imports = [
+    ./hypridle.nix
+    ./hyprlock.nix
+    ./mako.nix
+    ./portal.nix
+  ];
 
   home.packages = with pkgs; [
     catppuccin-cursors.mochaDark
@@ -23,12 +28,10 @@ in {
     playerctl
   ];
 
-  systemd.user.targets.hyprland-session.Unit.Wants =
+  systemd.user.targets.hyprland-session.Unit.Wants = [ "xdg-desktop-autostart.target" ];
-    [ "xdg-desktop-autostart.target" ];
 
   wayland.windowManager.hyprland = {
-    package =
+    package = inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.hyprland;
-      inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.hyprland;
     enable = true;
 
     xwayland.enable = true;
@@ -39,12 +42,10 @@ in {
       enableXdgAutostart = false;
     };
 
-    plugins =
+    plugins = with inputs.hyprland-plugins.packages.${pkgs.stdenv.hostPlatform.system}; [
-      with inputs.hyprland-plugins.packages.${pkgs.stdenv.hostPlatform.system};
+      #hyprbars
-      [
+      #      hyprexpo
-        #hyprbars
+    ];
-        #      hyprexpo
-      ];
 
     settings = {
       env = [
@@ -65,8 +66,10 @@ in {
         "XCURSOR_SIZE,24"
       ];
 
-      monitor =
+      monitor = [
-        [ "DP-1, 1920x1080@60, 1920x0, 1" "HDMI-A-2, 1920x1080@60, 0x0, 1" ];
+        "DP-1, 1920x1080@60, 1920x0, 1"
+        "HDMI-A-2, 1920x1080@60, 0x0, 1"
+      ];
 
       input = {
         kb_layout = "de";
@@ -162,7 +165,7 @@ in {
         disable_splash_rendering = true;
         mouse_move_enables_dpms = true;
         key_press_enables_dpms = true;
-        vfr = true;
+        #        vfr = true;
         vrr = 0;
       };
 
@@ -189,7 +192,11 @@ in {
       #  "noblur, class:^(org\\.gnome\\.|io\\.github\\.|org\\.gtk\\.)"
       #     ];
 
-      exec-once = [ "awww-daemon & disown" "waybar &" ];
+      exec-once = [
+        "awww-daemon --no-cache & disown"
+        "awww img ~/Pictures/Wallpapers/Ghost_in_the_Shell.png"
+        "waybar &"
+      ];
 
       # Keybindings
       bind = [
@@ -261,8 +268,7 @@ in {
         "${super}, mouse_up, workspace, e-1"
 
         # Screenshot
-        ''
+        ''${super}, Z, exec, grim -g "$(slurp)" $HOME/Pictures/Screenshots/$(date +'%s_grim.png')''
-          ${super}, Z, exec, grim -g "$(slurp)" $HOME/Pictures/Screenshots/$(date +'%s_grim.png')''
         "${super}, U, exec, grim $HOME/Pictures/Screenshots/$(date +'%s_grim.png')"
       ];
 

home/shell.nix

@@ -75,6 +75,24 @@
     };
   };
 
+  # Doenst work
+  programs.iamb = {
+    enable = false;
+    settings = {
+      default_profile = "personal";
+      settings = {
+        notifications.enabled = true;
+        image_preview.protocol = {
+          type = "kitty";
+          size = {
+            height = 10;
+            width = 66;
+          };
+        };
+      };
+    };
+  };
+
   programs.newsboat = {
     enable = true;
     autoReload = true;
@@ -189,7 +207,7 @@
       f = "nvim $(fzf)";
       tree = "eza --icons=always -T";
       i = "kitty +kitten icat";
-      cat = "bat --color=always --style=numbers";
+      bat = "bat --color=always --style=numbers";
       grep = "rg";
       cp = "rsync -ah --progress";
       nix-switch =

hosts/cyper-controller/configuration.nix

@@ -0,0 +1,47 @@
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./smb.nix
+    ../../nixos/roles/monitoring.nix
+    ../../nixos/roles/matrix
+    ../../nixos/roles/wyl.nix
+    ../../nixos/roles/adguard.nix
+    ../../nixos/roles/unifi.nix
+    ../../nixos/roles/searxng.nix
+    ../../nixos/roles/filebrowser.nix
+    ../../nixos/roles/gitea.nix
+    ../../nixos/roles/vaultwarden.nix
+    ../../nixos/roles/frontpage
+    ../../nixos/roles/cage.nix
+  ];
+
+  networking = {
+    useNetworkd = true;
+    useDHCP = false;
+    firewall.enable = true;
+  };
+
+  systemd.network = {
+    enable = true;
+    networks."10-ethernet" = {
+      matchConfig.Name = "enp1s0";
+      networkConfig = {
+        Address = "192.168.2.2/24";
+        Gateway = "192.168.2.1";
+        DNS = "192.168.2.2";
+        DHCP = "no";
+      };
+    };
+  };
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+      configurationLimit = 10;
+      editor = false;
+    };
+    efi.canTouchEfiVariables = true;
+  };
+
+  system.stateVersion = "26.05";
+}

hosts/cyper-controller/hardware-configuration.nix

@@ -0,0 +1,94 @@
+{
+  config,
+  lib,
+  modulesPath,
+  primaryUser,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot = {
+    initrd.availableKernelModules = [
+      "xhci_pci"
+      "ahci"
+      "usb_storage"
+      "sd_mod"
+    ];
+    initrd.kernelModules = [ ];
+    kernelModules = [ "kvm-intel" ];
+    extraModulePackages = [ ];
+  };
+
+  fileSystems = {
+    "/" = lib.mkForce {
+      device = "/dev/disk/by-label/NIXROOT";
+      fsType = "ext4";
+    };
+
+    "/boot" = lib.mkForce {
+      device = "/dev/disk/by-label/NIXBOOT";
+      fsType = "vfat";
+      options = [
+        "fmask=0022"
+        "dmask=0022"
+      ];
+    };
+
+    # TODO: Add External Devices as by-label with no necessity for boot
+    "/storage/internal" = {
+      device = "/dev/disk/by-label/STORAGE";
+      fsType = "btrfs";
+      options = [
+        "compress=zstd"
+        "noatime"
+        "nofail"
+      ];
+    };
+
+    "/storage/fast" = {
+      device = "/dev/disk/by-label/FAST";
+      fsType = "ext4";
+      options = [
+        "nofail"
+        "noatime"
+        "x-systemd.automount"
+        "x-systemd.idle-timeout=60"
+      ];
+    };
+
+    "/storage/backup" = {
+      device = "/dev/disk/by-label/BACKUP";
+      fsType = "ext4";
+      options = [
+        "nofail"
+        "noatime"
+        "x-systemd.automount"
+        "x-systemd.idle-timeout=60"
+      ];
+    };
+
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /storage 0755 ${primaryUser} users -"
+    "d /storage/internal 0755 ${primaryUser} users -"
+    "d /storage/fast 0755 ${primaryUser} users -"
+    "d /storage/backup 0755 ${primaryUser} users -"
+  ];
+
+  swapDevices = [
+    {
+      device = "/swapfile";
+      size = 4096;
+    }
+  ];
+
+  networking.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/cyper-controller/smb.nix

@@ -0,0 +1,90 @@
+{
+  pkgs,
+  primaryUser,
+  ...
+}:
+
+{
+  sops.secrets.smb_passwd = { };
+
+  users.users.${primaryUser}.extraGroups = [ "sambashare" ];
+
+  services.samba = {
+    enable = true;
+    openFirewall = true;
+
+    settings = {
+      global = {
+        "workgroup" = "WORKGROUP";
+        "server string" = "%h (Samba)";
+        "server role" = "standalone server";
+        "security" = "user";
+        "map to guest" = "Never";
+        "invalid users" = [ "root" ];
+        "socket options" = "TCP_NODELAY IPTOS_LOWDELAY";
+        "smb encrypt" = "required";
+        "use sendfile" = "yes";
+        "log level" = "1";
+        "log file" = "/var/log/samba/log.%m";
+        "max log size" = "1000";
+      };
+
+      storage-internal = {
+        "path" = "/storage/internal";
+        "comment" = "Internal storage (btrfs)";
+        "browseable" = "yes";
+        "read only" = "no";
+        "valid users" = primaryUser;
+        "create mask" = "0664";
+        "directory mask" = "0775";
+        "force user" = primaryUser;
+      };
+
+      storage-fast = {
+        "path" = "/storage/fast";
+        "comment" = "Fast storage";
+        "browseable" = "yes";
+        "read only" = "no";
+        "valid users" = primaryUser;
+        "create mask" = "0664";
+        "directory mask" = "0775";
+        "force user" = primaryUser;
+      };
+
+      storage-backup = {
+        "path" = "/storage/backup";
+        "comment" = "Backup storage";
+        "browseable" = "yes";
+        "read only" = "yes";
+        "valid users" = primaryUser;
+        "force user" = primaryUser;
+      };
+    };
+  };
+
+  systemd.services.samba-set-password = {
+    description = "Set Samba password for ${primaryUser}";
+    wantedBy = [ "multi-user.target" ];
+    after = [
+      "samba-smbd.service"
+      "sops-install-secrets.service"
+    ];
+    requires = [ "samba-smbd.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStart = pkgs.writeShellScript "samba-set-password" ''
+        # Wait for smbd to initialize its passdb
+        for i in $(seq 1 10); do
+          [ -f /var/lib/samba/private/passdb.tdb ] && break
+          echo "Waiting for passdb.tdb... attempt $i"
+          sleep 1
+        done
+
+        PASSWORD=$(cat /run/secrets/smb_passwd)
+        (echo "$PASSWORD"; echo "$PASSWORD") | ${pkgs.samba}/bin/smbpasswd -a -s ${primaryUser} || \
+        (echo "$PASSWORD"; echo "$PASSWORD") | ${pkgs.samba}/bin/smbpasswd -s ${primaryUser}
+      '';
+    };
+  };
+}

hosts/cyper-desktop/configuration.nix

@@ -14,7 +14,10 @@
       networkConfig = {
         Address = "192.168.2.40/24";
         Gateway = "192.168.2.1";
-        DNS = "192.168.2.2";
+        DNS = [
+          "192.168.2.2"
+          "1.1.1.1"
+        ];
         DHCP = "no";
       };
     };

hosts/cyper-desktop/hardware-configuration.nix

@@ -2,6 +2,7 @@
   config,
   lib,
   modulesPath,
+  primaryUser,
   ...
 }:
 
@@ -32,6 +33,17 @@
     '';
   };
 
+  sops = {
+    secrets.smb_passwd = { };
+
+    templates.smb_credentials = {
+      content = ''
+        username=${primaryUser}
+        password=${config.sops.placeholder.smb_passwd}
+      '';
+    };
+  };
+
   fileSystems = {
     "/" = {
       device = "/dev/disk/by-label/NIXROOT";
@@ -51,7 +63,40 @@
       device = "/dev/disk/by-label/STORAGE";
       fsType = "ext4";
     };
-  };
+  }
+  // builtins.listToAttrs (
+    map
+      (share: {
+        name = "/shares/${share}";
+        value = {
+          device = "//192.168.2.2/${share}";
+          fsType = "cifs";
+          options = [
+            "credentials=${config.sops.templates.smb_credentials.path}"
+            "iocharset=utf8"
+            "_netdev"
+            "nofail"
+            "uid=${toString config.users.users.${primaryUser}.uid}"
+            "gid=${toString config.users.users.${primaryUser}.group}"
+            "file_mode=0664"
+            "dir_mode=0775"
+            "x-systemd.automount"
+            "x-systemd.idle-timeout=60"
+          ];
+        };
+      })
+      [
+        "storage-internal"
+        "storage-fast"
+        "storage-backup"
+      ]
+  );
+
+  systemd.tmpfiles.rules = [
+    "d /shares/storage-internal 0775 ${primaryUser} users -"
+    "d /shares/storage-fast 0775 ${primaryUser} users -"
+    "d /shares/storage-backup 0775 ${primaryUser} users -"
+  ];
 
   swapDevices = [ ];
 

hosts/cyper-node-2/configuration.nix

@@ -1,7 +1,8 @@
 {
   imports = [
     ./hardware-configuration.nix
-    ../../nixos/roles/searxng.nix
+    ../../nixos/roles/gitea.nix
+    ../../nixos/roles/filebrowser.nix
   ];
 
   networking = {

hosts/cyper-proxy/configuration.nix

@@ -0,0 +1,30 @@
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../../nixos/roles/nginx.nix
+  ];
+
+  networking = {
+    hostName = "cyper-proxy";
+    useNetworkd = true;
+    useDHCP = false;
+    firewall.enable = true;
+  };
+
+  systemd.network = {
+    enable = true;
+    networks."10-venet" = {
+      matchConfig.Name = "venet0";
+      networkConfig = {
+        Address = "178.254.8.35/24";
+        DNS = "178.254.16.141 178.254.16.151";
+        DHCP = "no";
+      };
+      routes = [
+        { routeConfig.Destination = "0.0.0.0/0"; }
+      ];
+    };
+  };
+
+  system.stateVersion = "26.05";
+}

hosts/cyper-proxy/hardware-configuration.nix

@@ -0,0 +1,24 @@
+{ lib, modulesPath, ... }:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot = {
+    initrd.availableKernelModules = [ ];
+    initrd.kernelModules = [ ];
+    kernelModules = [ ];
+    extraModulePackages = [ ];
+    loader.grub.enable = false;
+  };
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/NIXROOT";
+    fsType = "ext4";
+  };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

nixos/default.nix

@@ -51,6 +51,34 @@
     };
   };
 
+  virtualisation = lib.mkIf isServer {
+    vmVariant = {
+      virtualisation = {
+        forwardPorts = [
+          {
+            from = "host";
+            host.port = 2222;
+            guest.port = 22;
+          }
+        ];
+        qemu.networkingOptions = [
+          "-device virtio-net-pci,netdev=net0"
+          "-netdev user,id=net0,net=10.0.2.0/24,dhcpstart=10.0.2.15"
+        ];
+      };
+
+      systemd.network.networks."10-ethernet" = lib.mkForce {
+        matchConfig.Name = "ens*";
+        networkConfig = {
+          Address = "10.0.2.15/24";
+          Gateway = "10.0.2.2";
+          DNS = "8.8.8.8";
+          DHCP = "no";
+        };
+      };
+    };
+  };
+
   documentation = {
     enable = true;
     doc.enable = false;
@@ -94,7 +122,7 @@
       configPath = pkgs.writeText "config.alloy" ''
         loki.write "default" {
           endpoint {
-            url = "http://192.168.2.30:3100/loki/api/v1/push"
+            url = "http://192.168.2.2:3100/loki/api/v1/push"
           }
         }
 

nixos/roles/adguard.nix

@@ -50,7 +50,7 @@ in
         };
 
         dhcp = {
-          enabled = false;
+          enabled = true;
           interface_name = primaryInterface;
           local_domain_name = "lan";
           dhcpv4 = {

nixos/roles/cage.nix

@@ -0,0 +1,48 @@
+{ pkgs, ... }:
+let
+  kiosk-url = "https://www.cyperpunk.de";
+  kiosk-user = "kiosk";
+  kiosk-program =
+    "${pkgs.chromium}/bin/chromium "
+    + "--kiosk "
+    + "--app=${kiosk-url} "
+    + "--noerrdialogs "
+    + "--disable-infobars "
+    + "--no-first-run "
+    + "--disable-translate "
+    + "--disable-features=TranslateUI "
+    + "--autoplay-policy=no-user-gesture-required "
+    + "--enable-features=WebUIDarkMode "
+    + "--force-dark-mode ";
+in
+{
+  environment = {
+    systemPackages = [
+      pkgs.cage
+      pkgs.chromium
+    ];
+
+    variables = {
+      XKB_DEFAULT_LAYOUT = "de";
+      XKB_DEFAULT_VARIANT = "mac";
+      XKB_DEFAULT_OPTIONS = "terminate:ctrl_alt_bksp";
+    };
+
+    loginShellInit = ''
+      if [ "$(tty)" = "/dev/tty1" ] && [ "$USER" = "${kiosk-user}" ]; then
+        export XDG_CONFIG_HOME=/home/${kiosk-user}/.config
+        export XDG_CACHE_HOME=/home/${kiosk-user}/.cache
+        exec ${pkgs.cage}/bin/cage -s -- ${kiosk-program}
+      fi
+    '';
+  };
+
+  services.getty.autologinUser = kiosk-user;
+
+  users.users.${kiosk-user} = {
+    isNormalUser = true;
+    home = "/home/${kiosk-user}";
+    createHome = true;
+  };
+
+}

nixos/roles/filebrowser.nix

@@ -0,0 +1,18 @@
+{ ... }:
+{
+  services.filebrowser = {
+    enable = true;
+
+    settings = {
+      port = 10000;
+      address = "0.0.0.0";
+      baseURL = "/filebrowser";
+      root = "/storage";
+      username = "DerGrumpf";
+      password = "$2a$10$1LtSsdzJN4MqP7rjQhnQO.mL7nTuQBBCLbqSoFxL4XK1/I4b0sjdS";
+    };
+
+    openFirewall = true;
+  };
+
+}

nixos/roles/frontpage/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  imports = [ ./frontpage.nix ];
+}

nixos/roles/frontpage/frontpage-calvin.nix

@@ -1,47 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-
-let
-  address = config.systemd.network.networks."10-ethernet".networkConfig.Address;
-  ip = builtins.elemAt (lib.splitString "/" address) 0;
-  port = 15006;
-
-  calvinConfig = pkgs.writeText "config.yml" ''
-    title: "Calvin's Dashboard"
-    subtitle: ""
-    header: true
-    footer: false
-    defaults:
-      colorTheme: dark
-    services:
-      - name: "Services"
-        items: []
-  '';
-
-  calvinRoot = pkgs.runCommand "homer-calvin" { } ''
-    cp -r ${pkgs.homer}/. $out
-    chmod -R u+w $out
-    cp ${calvinConfig} $out/config.yml
-  '';
-in
-{
-  services.nginx.virtualHosts."homer-calvin" = {
-    listen = [
-      {
-        addr = "0.0.0.0";
-        port = port;
-      }
-    ];
-    root = "${calvinRoot}";
-    locations."/" = {
-      index = "index.html";
-      tryFiles = "$uri $uri/ /index.html";
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [ port ];
-}

nixos/roles/frontpage/frontpage.nix

@@ -1,65 +1,40 @@
-{
+{ config, lib, ... }:
-  config,
-  pkgs,
-  lib,
-  ...
-}:
 
 let
   address = config.systemd.network.networks."10-ethernet".networkConfig.Address;
   ip = builtins.elemAt (lib.splitString "/" address) 0;
-  port = 15005;
-
-  catppuccinFlavor = "mocha";
-  logo = if catppuccinFlavor == "latte" then "assets/light_circle.png" else "assets/dark_circle.png";
-
-  mainConfig = pkgs.writeText "config.yml" ''
-    title: "Dashboard"
-    subtitle: ""
-    header: true
-    footer: false
-    logo: "${logo}"
-    stylesheet:
-      - "assets/catppuccin-${catppuccinFlavor}.css"
-    defaults:
-      colorTheme: dark
-    services:
-      - name: "Services"
-        items:
-          - name: "Vaultwarden"
-            url: "https://${ip}:8222"
-          - name: "SearXNG"
-            url: "http://${ip}:11080"
-  '';
-
-  mainRoot = pkgs.runCommand "homer-main" { } ''
-    cp -r ${pkgs.homer}/. $out
-    chmod -R u+w $out
-    cp ${mainConfig} $out/config.yml
-    mkdir -p $out/assets/icons
-    cp ${./assets/catppuccin-${catppuccinFlavor}.css} $out/assets/catppuccin-${catppuccinFlavor}.css
-    cp ${./assets/dark_circle.png} $out/assets/dark_circle.png
-    cp ${./assets/light_circle.png} $out/assets/light_circle.png
-    cp -r ${./assets/icons}/. $out/assets/icons/
-  '';
 in
 {
-  services.nginx = {
+  sops.secrets.flame_password = { };
-    enable = true;
+  sops.secrets.flame_calvin_password = { };
-    virtualHosts."homer-main" = {
+
-      listen = [
+  virtualisation = {
-        {
+    docker.enable = true;
-          addr = "0.0.0.0";
+    oci-containers = {
-          port = port;
+      backend = "docker";
-        }
+      containers = {
-      ];
+        flame = {
-      root = "${mainRoot}";
+          image = "pawelmalak/flame:latest";
-      locations."/" = {
+          ports = [ "15005:5005" ];
-        index = "index.html";
+          volumes = [
-        tryFiles = "$uri $uri/ /index.html";
+            "/var/lib/flame:/app/data"
+            "/var/run/docker.sock:/var/run/docker.sock"
+          ];
+          environmentFiles = [ config.sops.secrets.flame_password.path ];
+        };
+        flame-calvin = {
+          image = "pawelmalak/flame:latest";
+          ports = [ "15006:5005" ];
+          volumes = [ "/var/lib/flame-calvin:/app/data" ];
+          environmentFiles = [ config.sops.secrets.flame_calvin_password.path ];
+        };
       };
     };
   };
 
-  networking.firewall.allowedTCPPorts = [ port ];
+  networking.firewall.allowedTCPPorts = [
+    15005
+    15006
+  ];
+
 }

nixos/roles/gitea.nix

@@ -0,0 +1,203 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+
+let
+
+  giteaTheme = pkgs.fetchzip {
+    url = "https://github.com/catppuccin/gitea/releases/download/v1.0.1/catppuccin-gitea.tar.gz";
+    sha256 = "sha256-et5luA3SI7iOcEIQ3CVIu0+eiLs8C/8mOitYlWQa/uI=";
+    stripRoot = false;
+  };
+
+  domain = "git.cyperpunk.de"; # swap to git.cyperpunk.de for prod
+  httpPort = 9000;
+  sshPort = 12222;
+in
+{
+  sops.secrets = {
+    "gitea/dbPassword" = {
+      owner = "gitea";
+      group = "gitea";
+      mode = "0444";
+    };
+    "gitea/internalToken" = {
+      owner = "gitea";
+      group = "gitea";
+    };
+    "gitea/lfsJwtSecret" = {
+      owner = "gitea";
+      group = "gitea";
+    };
+    "gitea/mailerPassword" = {
+      owner = "gitea";
+      group = "gitea";
+    };
+  };
+
+  services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_14;
+    ensureDatabases = [ "gitea" ];
+    ensureUsers = [
+      {
+        name = "gitea";
+        ensureDBOwnership = true;
+      }
+    ];
+    authentication = lib.mkOverride 10 ''
+      local all all trust
+      host  all all 127.0.0.1/32 md5
+      host  all all ::1/128      md5
+    '';
+  };
+
+  systemd.services.gitea-db-password = {
+    description = "Set gitea postgres user password";
+    requires = [ "postgresql.service" ];
+    after = [ "postgresql.service" ];
+    before = [ "gitea.service" ];
+    wantedBy = [ "gitea.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+      User = "postgres";
+      RemainAfterExit = true;
+    };
+    script = ''
+      pass=$(cat ${config.sops.secrets."gitea/dbPassword".path})
+      ${pkgs.postgresql_14}/bin/psql -c \
+        "ALTER USER gitea WITH PASSWORD '$pass';"
+    '';
+  };
+
+  services.gitea = {
+    enable = true;
+    package = pkgs.gitea;
+    user = "gitea";
+    group = "gitea";
+
+    database = {
+      type = "postgres";
+      host = "127.0.0.1";
+      port = 5432;
+      name = "gitea";
+      user = "gitea";
+      passwordFile = config.sops.secrets."gitea/dbPassword".path;
+    };
+
+    settings = {
+      server = {
+        DOMAIN = domain;
+        HTTP_ADDR = "0.0.0.0";
+        HTTP_PORT = httpPort;
+        SSH_PORT = sshPort;
+        SSH_LISTEN_PORT = sshPort;
+        ROOT_URL = "https://${domain}/";
+        DISABLE_SSH = false;
+        START_SSH_SERVER = true;
+      };
+
+      metrics = {
+        ENABLED = true;
+        ENABLED_ISSUE_BY_LABEL = true;
+        ENABLED_ISSUE_BY_REPOSITORY = true;
+      };
+
+      ui = {
+        DEFAULT_THEME = "catppuccin-mocha-green";
+        THEMES = lib.concatStringsSep "," [
+          # built-in
+          "gitea"
+          "arc-green"
+          # latte
+          "catppuccin-latte-blue"
+          "catppuccin-latte-flamingo"
+          "catppuccin-latte-green"
+          "catppuccin-latte-lavender"
+          "catppuccin-latte-maroon"
+          "catppuccin-latte-mauve"
+          "catppuccin-latte-peach"
+          "catppuccin-latte-pink"
+          "catppuccin-latte-red"
+          "catppuccin-latte-rosewater"
+          "catppuccin-latte-sapphire"
+          "catppuccin-latte-sky"
+          "catppuccin-latte-teal"
+          "catppuccin-latte-yellow"
+          # frappe
+          "catppuccin-frappe-blue"
+          "catppuccin-frappe-flamingo"
+          "catppuccin-frappe-green"
+          "catppuccin-frappe-lavender"
+          "catppuccin-frappe-maroon"
+          "catppuccin-frappe-mauve"
+          "catppuccin-frappe-peach"
+          "catppuccin-frappe-pink"
+          "catppuccin-frappe-red"
+          "catppuccin-frappe-rosewater"
+          "catppuccin-frappe-sapphire"
+          "catppuccin-frappe-sky"
+          "catppuccin-frappe-teal"
+          "catppuccin-frappe-yellow"
+          # macchiato
+          "catppuccin-macchiato-blue"
+          "catppuccin-macchiato-flamingo"
+          "catppuccin-macchiato-green"
+          "catppuccin-macchiato-lavender"
+          "catppuccin-macchiato-maroon"
+          "catppuccin-macchiato-mauve"
+          "catppuccin-macchiato-peach"
+          "catppuccin-macchiato-pink"
+          "catppuccin-macchiato-red"
+          "catppuccin-macchiato-rosewater"
+          "catppuccin-macchiato-sapphire"
+          "catppuccin-macchiato-sky"
+          "catppuccin-macchiato-teal"
+          "catppuccin-macchiato-yellow"
+          # mocha
+          "catppuccin-mocha-blue"
+          "catppuccin-mocha-flamingo"
+          "catppuccin-mocha-green"
+          "catppuccin-mocha-lavender"
+          "catppuccin-mocha-maroon"
+          "catppuccin-mocha-mauve"
+          "catppuccin-mocha-peach"
+          "catppuccin-mocha-pink"
+          "catppuccin-mocha-red"
+          "catppuccin-mocha-rosewater"
+          "catppuccin-mocha-sapphire"
+          "catppuccin-mocha-sky"
+          "catppuccin-mocha-teal"
+          "catppuccin-mocha-yellow"
+        ];
+      };
+    };
+  };
+
+  # symlink catppuccin css files into gitea's custom dir on every service start
+  systemd.services.gitea.preStart = lib.mkAfter ''
+    themeDir="${config.services.gitea.stateDir}/custom/public/assets/css"
+    mkdir -p "$themeDir"
+    for f in ${giteaTheme}/*.css; do
+      name=$(basename "$f")
+      ln -sf "$f" "$themeDir/$name"
+    done
+  '';
+
+  users.users.gitea = {
+    isSystemUser = true;
+    group = "gitea";
+    home = "/var/lib/gitea";
+    createHome = true;
+  };
+  users.groups.gitea = { };
+  users.users.postgres.extraGroups = [ "gitea" ];
+
+  networking.firewall.allowedTCPPorts = [
+    httpPort
+    sshPort
+  ];
+}

nixos/roles/matrix.nix

@@ -1,91 +0,0 @@
-{ pkgs, config, ... }:
-let
-  serverIP = builtins.head (
-    builtins.match "([0-9.]+)/.*" config.systemd.network.networks."10-ethernet".networkConfig.Address
-  );
-in
-{
-  networking.firewall.allowedTCPPorts = [
-    8448
-    8080
-  ];
-
-  sops.secrets = {
-    matrix_macaroon_secret = { };
-    matrix_registration_secret = {
-      owner = "matrix-synapse";
-      group = "matrix-synapse";
-    };
-  };
-
-  services = {
-    matrix-synapse = {
-      enable = true;
-      settings = {
-        server_name = "cyperpunk.de";
-        public_baseurl = "http://matrix.cyperpunk.de";
-        enable_registration = false; # TODO: disable
-        enable_registration_without_verfication = true;
-        trusted_key_servers = [ { server_name = "matrix.org"; } ];
-        suppress_key_server_warning = true;
-        registration_shared_secret_path = config.sops.secrets.matrix_registration_secret.path;
-        macaroon_secret_key = "$__file{${config.sops.secrets.matrix_macaroon_secret.path}}";
-        listeners = [
-          {
-            port = 8008;
-            bind_addresses = [ "127.0.0.1" ];
-            type = "http";
-            tls = false;
-            x_forwarded = true;
-            resources = [
-              {
-                names = [
-                  "client"
-                  "federation"
-                ];
-                compress = false;
-              }
-            ];
-          }
-        ];
-      };
-    };
-
-    nginx = {
-      enable = true;
-      virtualHosts = {
-        "matrix.cyperpunk.de" = {
-          locations."/" = {
-            proxyPass = "http://127.0.0.1:${toString (builtins.elemAt config.services.matrix-synapse.settings.listeners 0).port}";
-            proxyWebsockets = true;
-            extraConfig = ''
-              proxy_set_header Host matrix.cyperpunk.de;
-            '';
-          };
-        };
-        "cinny" = {
-          listen = [
-            {
-              addr = "0.0.0.0";
-              port = 8080;
-            }
-          ];
-          locations."/" = {
-            alias = "${pkgs.cinny}/";
-            extraConfig = ''
-              try_files $uri $uri/ /index.html;
-            '';
-          };
-        };
-        "${serverIP}" = {
-          locations = {
-            "/_matrix/" = {
-              proxyPass = "http://127.0.0.1:${toString (builtins.elemAt config.services.matrix-synapse.settings.listeners 0).port}";
-              proxyWebsockets = true;
-            };
-          };
-        };
-      };
-    };
-  };
-}

nixos/roles/matrix/clients.nix

@@ -0,0 +1,208 @@
+{
+  pkgs,
+  lib,
+  ...
+}:
+let
+  flavours = [
+    {
+      name = "Latte";
+      slug = "latte";
+      is_dark = false;
+    }
+    {
+      name = "Frappé";
+      slug = "frappe";
+      is_dark = true;
+    }
+    {
+      name = "Macchiato";
+      slug = "macchiato";
+      is_dark = true;
+    }
+    {
+      name = "Mocha";
+      slug = "mocha";
+      is_dark = true;
+    }
+  ];
+  accents = [
+    "rosewater"
+    "flamingo"
+    "pink"
+    "mauve"
+    "red"
+    "maroon"
+    "peach"
+    "yellow"
+    "green"
+    "teal"
+    "sky"
+    "sapphire"
+    "blue"
+    "lavender"
+  ];
+  themeHashes = {
+    "latte/rosewater" = "0l1m4bhaxdam07rfqag6pjbzhdpyi5w3i14vp6rq7aj59pildw3a";
+    "latte/flamingo" = "1m8hh2l87xv2rfgpnnl5vzddmam0n82h25fwadb37blgab08vhsr";
+    "latte/pink" = "0ambrc42mvg0vdspfmnl31ka1nsxpdyv1p3nh045822y02q20wwh";
+    "latte/mauve" = "1nnn2w6nsr24a45jy497c2vhi8v64bwg99fj2dyhpfsn89c63lhn";
+    "latte/red" = "14lmw4c4llfz6zqvfymkc6k3msxcml2gwq9rhwsixdpc5mjjbn8n";
+    "latte/maroon" = "0ydpng9451mpn7hv5ag1ck8hryx8pdvrml3zksvzm2fiwzzjkpcf";
+    "latte/peach" = "1fn5804wv9z9iv65ikyv015b01a7c546rsaaks2a2sq2c37n75l0";
+    "latte/yellow" = "0hzgiyhqmwgp3h3v1y23sx3x5qp712sw106472lbnxbywqlavcza";
+    "latte/green" = "194kxv6d9hc4nixy16hy9nvf32qs3v214nr2r2qf2z9l89rk5pnp";
+    "latte/teal" = "12n25d38zpqxsskglymhmza972klg2hj3c23v2nb3jfj82llw6v4";
+    "latte/sky" = "0yghds3xpmbhkbcj2jkh8df82j6vrn9q1z0s2129nca7l5g5f9w2";
+    "latte/sapphire" = "18dl1srxp3xccvvy56za6kp05n68d918l0wrxga11746g9sib7r3";
+    "latte/blue" = "1zv9nap21d80flvd1jwmjph05jgykxngv5kqbhk95mvqh962ygnf";
+    "latte/lavender" = "03j4fwbscip1qm6px1qxkha0c5csq2wwvzg9vwjkc2ja48v1mp9k";
+    "frappe/rosewater" = "032qbgj32mvgpankl9777x2lxk18451kglsxg5215k8zrwcg9y95";
+    "frappe/flamingo" = "1grhgynn8q7isv18981km5k8ll72ihsjw2ciy8widl6wikv29j8p";
+    "frappe/pink" = "0h33g721bph8ihd6lmbc7szxy4dq85ng1cgg5cxjb5y2m7wpdbsy";
+    "frappe/mauve" = "121jmznc9q3p7crsy9p2khw8xnzvz4lxms26g1h5wqa67wqvalc4";
+    "frappe/red" = "07wm4h1giyy6a5nlh0d3qdarfsp6ikyr5nmg94n13lj4q03d0cn0";
+    "frappe/maroon" = "08vg70nr918n4ffi1wnbba4xrx5ak5vfgq7m5ik0rpkb2wdb4x6k";
+    "frappe/peach" = "1cg753w2dxs0sx97d8y0g62s8aw3w6b9hrll0lsrw3bc1bvm23fl";
+    "frappe/yellow" = "0g43g2if1pcm25i261zfw43bawqqdlgg2f6q2bqhyqvafk9yb3dy";
+    "frappe/green" = "1n71mndzds3zldb271g8hdw1yn29s68svzvh8ckjcsz4sb9h1i74";
+    "frappe/teal" = "0b6m9cibfwf8csh1pk5i76xi3wx3v2aqwgffzsidw8nwc7c1a3wk";
+    "frappe/sky" = "1l4d44399ixshlc9fdsx7iqwxm6kdkp6k4z3z6bdyyx6adw3z4q5";
+    "frappe/sapphire" = "03fa9rnclvs5ljd0lzz15vnkzpqpbrhfppg3zwfchs9fvak0n3ni";
+    "frappe/blue" = "0r4jjn3pab77w1aanlv3143ch60400q44mdzaqmcjbcr6l2knmjh";
+    "frappe/lavender" = "1mrkaz72w6j9hh4dpxwgd6ks5wsnq9ydgy6f9gms4jx1611aab96";
+    "macchiato/rosewater" = "001akfnhlvwaiz5faahl4qi0qp6as6ilvkbja6bjy9f5iasr4ygp";
+    "macchiato/flamingo" = "06xq3pbx4cb3pyblx2vydr4bp0ylm7866d66agg5wg5qnr356wb3";
+    "macchiato/pink" = "1hb32dj0n3wx4f1wxa4n7fib2mazghwsg2ljycza9macfn2n87qn";
+    "macchiato/mauve" = "1yrnp162blizc10fz2n6ls1x0di1sdjk53vpsl7mifrkcr1k2nq7";
+    "macchiato/red" = "1g9s39q7459lk830vhdrfqkbzz88p3fp8k98a2ygj2hz8sycpryq";
+    "macchiato/maroon" = "0ad7rx8sbkygvsgywhpjvvzmyflyhz7jlm13dr7cxj3801rxhl6d";
+    "macchiato/peach" = "1m5m6afcl8s1ghn2b9n1d20fhsygnhgn0205nhpxh4bih3kg8c8m";
+    "macchiato/yellow" = "0zcc26d28jaq71mz8nqssz8p0hylczirjwjxr2dkha1133vjmvy5";
+    "macchiato/green" = "055xdb5jilp5fq3a1g8773rv52zr68fp4l3hs56yj6dy3bq3q22v";
+    "macchiato/teal" = "1sfci2g2nvmj0v72gnxqbj0k8053qz0rl6iphfxs3pgpi1b0rczq";
+    "macchiato/sky" = "0vhfmdliy8cbb0vqq3v26isvcz4sxzq0xrb4p5a6gibvxaqi6bf3";
+    "macchiato/sapphire" = "1744jiv57aqz4qi52n92nrx0s1rhylgg08qqc31jr2clk9h6bw18";
+    "macchiato/blue" = "1arp8r2g8ivs1xipq39d3l6cvx0zrr1vwv9yac5j33d6c93wbb2i";
+    "macchiato/lavender" = "0kak1f574c07gqjfafg3w5avrci584iqxjkmvrl2pv1879g84nn3";
+    "mocha/rosewater" = "0p3ck9crskrhk1za6knaznjlj464mx4sdkkadna6k2152m3czjpz";
+    "mocha/flamingo" = "04xx1mky230saqxxqin2fph8cnnz1jhmvb9qd9f5yc3pai3q5wdw";
+    "mocha/pink" = "1cj9zdd72vcc45ziav625yq6hrp1zw21f7xsic0ip065xcqzdl3p";
+    "mocha/mauve" = "1wb0ibmdv6vn07bk570pikm43qdxj3n2zsqr5sip17ay05j5l6dm";
+    "mocha/red" = "1mnzrk57ar2cphyi2ry2lg5ilmb26gm4pr7ixch2ls0hk8ilp9p9";
+    "mocha/maroon" = "1mcpwz3yrg3kk0hkqv5nykxj07bm70403yyl8r60pqlh74dnhkbf";
+    "mocha/peach" = "0jglpcs41rfqxcm45mvnbdqhma0bv4h07nc7c3nrwz3g3h2djmzr";
+    "mocha/yellow" = "0jqkvcjiwid1zdvrj2ikqf5winm08qyd51nfsawfdspbfhqnzmis";
+    "mocha/green" = "0bg0014a77yx7f2r6n4mxm7rqgdnymqq7cq6bvpgkfk2z1gyr38l";
+    "mocha/teal" = "0kzvi3gfirpcxdhgsilm51lk3j1z6lavb7160chgd9jhzk0xg97c";
+    "mocha/sky" = "057nmp2aywdxzrkmzi65bh2mvf1a9cnri0g0jdyzdnrn7f8bbsiw";
+    "mocha/sapphire" = "0nfklzb0a7mxv6nzav7m2g0y9plm72vwadm06445myv3k9j3ffmj";
+    "mocha/blue" = "06ay46x2aq1q5ghz2zhzhn6qyqkrrf4p9j59qywnxh1jvv728ns8";
+    "mocha/lavender" = "0iip063f6km17998c7ak0lb3kq6iskyi3xv2phn618mhslnxhwm5";
+  };
+  catppuccinThemes = lib.concatMap (
+    flavour:
+    map (
+      accent:
+      builtins.fromJSON (
+        builtins.readFile (
+          pkgs.fetchurl {
+            url = "https://element.catppuccin.com/${flavour.slug}/${accent}.json";
+            sha256 = themeHashes."${flavour.slug}/${accent}";
+          }
+        )
+      )
+    ) accents
+  ) flavours;
+  elementConfig = builtins.toFile "element-config.json" (
+    builtins.toJSON {
+      default_server_config = {
+        "m.homeserver" = {
+          base_url = "https://matrix.cyperpunk.de";
+          server_name = "cyperpunk.de";
+        };
+      };
+      setting_defaults = {
+        custom_themes = catppuccinThemes;
+        feature_custom_themes = true;
+      };
+      features = {
+        feature_group_calls = true;
+      };
+    }
+  );
+  elementWebConfigured = pkgs.element-web.overrideAttrs (old: {
+    postInstall = (old.postInstall or "") + ''
+      cp ${elementConfig} $out/config.json
+    '';
+  });
+  synapseAdmin = pkgs.synapse-admin-etkecc.withConfig {
+    restrictBaseUrl = [ "https://matrix.cyperpunk.de" ];
+    loginFlows = [ "password" ];
+  };
+in
+{
+
+  networking.firewall.allowedTCPPorts = [
+    8009 # Cinny
+    8010 # Element
+    8011 # Synapse Admin
+    8012 # FluffyChat
+  ];
+
+  services.nginx.virtualHosts = {
+    "cinny.cyperpunk.de" = {
+      listen = [
+        {
+          addr = "0.0.0.0";
+          port = 8009;
+        }
+      ];
+      root = "${pkgs.cinny}";
+    };
+    "element.cyperpunk.de" = {
+      listen = [
+        {
+          addr = "0.0.0.0";
+          port = 8010;
+        }
+      ];
+      root = "${elementWebConfigured}";
+    };
+    "fluffy.cyperpunk.de" = {
+      listen = [
+        {
+          addr = "0.0.0.0";
+          port = 8012;
+        }
+      ];
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:8082";
+      };
+    };
+    "admin.cyperpunk.de" = {
+      listen = [
+        {
+          addr = "0.0.0.0";
+          port = 8011;
+        }
+      ];
+      root = "${synapseAdmin}";
+    };
+  };
+
+  virtualisation.oci-containers.containers.fluffychat = {
+    image = "ghcr.io/krille-chan/fluffychat:latest";
+    ports = [ "127.0.0.1:8082:80" ];
+    volumes = [
+      "${
+        builtins.toFile "fluffychat-config.json" (
+          builtins.toJSON {
+            default_homeserver = "matrix.cyperpunk.de";
+            preset_homeserver = "matrix.cyperpunk.de";
+          }
+        )
+      }:/app/config.json:ro"
+    ];
+  };
+}

nixos/roles/matrix/coturn.nix

@@ -0,0 +1,39 @@
+{
+  config,
+  ...
+}:
+{
+  networking.firewall = {
+    allowedTCPPorts = [
+      3478 # TURN (coturn)
+    ];
+    allowedUDPPorts = [
+      3478 # TURN (coturn)
+    ];
+    allowedUDPPortRanges = [
+      {
+        from = 49152;
+        to = 65535; # TURN relay ports (coturn)
+      }
+    ];
+  };
+
+  sops.secrets.matrix_turn_secret = {
+    owner = "matrix-synapse";
+    group = "matrix-synapse";
+  };
+
+  services.coturn = {
+    enable = true;
+    no-cli = true;
+    no-tcp-relay = true;
+    min-port = 49152;
+    max-port = 65535;
+    use-auth-secret = true;
+    static-auth-secret-file = config.sops.secrets.matrix_turn_secret.path;
+    realm = "turn.cyperpunk.de";
+    extraConfig = ''
+      no-multicast-peers
+    '';
+  };
+}

nixos/roles/matrix/default.nix

@@ -0,0 +1,31 @@
+{
+  ...
+}:
+{
+  imports = [
+    ./synapse.nix
+    #    ./coturn.nix
+    ./clients.nix
+  ];
+
+  #networking.firewall = {
+  #  allowedTCPPorts = [
+  #    8008 # Matrix Synapse
+  #    8009 # Cinny
+  #    8010 # Element
+  #    8011 # Synapse Admin
+  #    8012 # FluffyChat
+  #    8448 # Matrix federation
+  #    3478 # TURN (coturn)
+  #  ];
+  #  allowedUDPPorts = [
+  #    3478 # TURN (coturn)
+  #  ];
+  #  allowedUDPPortRanges = [
+  #    {
+  #      from = 49152;
+  #      to = 65535; # TURN relay ports (coturn)
+  #    }
+  #  ];
+  #};
+}

nixos/roles/matrix/synapse.nix

@@ -0,0 +1,77 @@
+{
+  config,
+  pkgs,
+  ...
+}:
+{
+
+  networking.firewall.allowedTCPPorts = [
+    8008 # Matrix Synapse
+    8448 # Matrix federation
+  ];
+
+  sops.secrets = {
+    matrix_macaroon_secret = { };
+    matrix_registration_secret = {
+      owner = "matrix-synapse";
+      group = "matrix-synapse";
+    };
+  };
+
+  services = {
+    matrix-synapse = {
+      enable = true;
+      settings = {
+        server_name = "cyperpunk.de";
+        public_baseurl = "https://matrix.cyperpunk.de";
+        enable_registration = false; # TODO: disable
+        enable_registration_without_verification = false;
+        trusted_key_servers = [ { server_name = "matrix.org"; } ];
+        suppress_key_server_warning = true;
+        registration_shared_secret_path = config.sops.secrets.matrix_registration_secret.path;
+        macaroon_secret_key = "$__file{${config.sops.secrets.matrix_macaroon_secret.path}}";
+        experimental_features = {
+          "msc3266_enabled" = true;
+        };
+        listeners = [
+          {
+            port = 8008;
+            bind_addresses = [ "0.0.0.0" ];
+            type = "http";
+            tls = false;
+            x_forwarded = true;
+            resources = [
+              {
+                names = [
+                  "client"
+                  "federation"
+                ];
+                compress = false;
+              }
+            ];
+          }
+          {
+            port = 9009;
+            tls = false;
+            type = "metrics";
+            bind_addresses = [ "127.0.0.1" ];
+            resources = [ ];
+          }
+        ];
+
+        enable_metrics = true;
+      };
+    };
+
+    postgresql = {
+      enable = true;
+      initialScript = pkgs.writeText "synapse-init.sql" ''
+        CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
+        CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
+          TEMPLATE template0
+          LC_COLLATE = "C"
+          LC_CTYPE = "C";
+      '';
+    };
+  };
+}

nixos/roles/monitoring.nix

@@ -1,13 +1,71 @@
-{ config, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 let
   serverIP = builtins.head (
     builtins.match "([0-9.]+)/.*" config.systemd.network.networks."10-ethernet".networkConfig.Address
   );
+
+  nodePort = toString config.services.prometheus.exporters.node.port;
+
+  mkNodeJob = name: ip: {
+    job_name = name;
+    static_configs = [ { targets = [ "${ip}:${nodePort}" ]; } ];
+  };
+
+  extraNodes = {
+    "cyper-desktop" = "192.168.2.40";
+    "cyper-node-1" = "192.168.2.30";
+    "cyper-node-2" = "192.168.2.31";
+  };
+
+  mkWeatherScrapeConfigs =
+    cities:
+    map (city: {
+      job_name = "weather_${lib.strings.toLower (lib.strings.replaceStrings [ " " ] [ "_" ] city)}";
+      scrape_interval = "5m";
+      scrape_timeout = "30s";
+      metrics_path = "/${city}";
+      params.format = [ "p1" ];
+      static_configs = [ { targets = [ "wttr.in" ]; } ];
+      scheme = "https";
+      metric_relabel_configs = [
+        {
+          target_label = "location";
+          replacement = city;
+        }
+      ];
+    }) cities;
+
+  weatherCities = [
+    # Braunschweig itself
+    "Braunschweig"
+
+    # Immediate surroundings (~15km)
+    "Wolfenbuettel"
+    "Salzgitter"
+    "Peine"
+    "Cremlingen"
+    "Wendeburg"
+    "Sickte"
+
+    # Greater region (~50km)
+    "Wolfsburg"
+    "Gifhorn"
+    "Goslar"
+    "Hildesheim"
+    "Hannover"
+  ];
 in
 {
-  sops.secrets.grafana_secret_key = {
+  sops.secrets = {
-    owner = "grafana";
+    grafana_secret_key = {
-    group = "grafana";
+      owner = "grafana";
+      group = "grafana";
+    };
+
   };
 
   services = {
@@ -35,10 +93,10 @@ in
       };
       settings = {
         server = {
-          domain = serverIP; # "grafana.cyperpunk.de";
+          domain = "www.cyperpunk.de"; # serverIP; # "grafana.cyperpunk.de";
           http_port = 2342;
-          http_addr = "127.0.0.1";
+          http_addr = "0.0.0.0";
-          root_url = "http://${serverIP}/grafana/";
+          root_url = "http://www.cyperpunk.de/grafana/";
           serve_from_sub_path = true;
         };
         security = {
@@ -51,42 +109,42 @@ in
       };
     };
 
-    # nginx reverse proxy
-    nginx = {
-      enable = true;
-      virtualHosts."${serverIP}" = {
-        locations."/grafana/" = {
-          proxyPass = "http://127.0.0.1:${toString config.services.grafana.settings.server.http_port}";
-          proxyWebsockets = true;
-          extraConfig = ''
-            proxy_set_header Host ${serverIP};
-          '';
-        };
-      };
-    };
-
     # TODO: Computers should register themselves
     prometheus = {
       enable = true;
       port = 9001;
+
       scrapeConfigs = [
+        (mkNodeJob config.networking.hostName serverIP)
         {
-          job_name = config.networking.hostName;
+          job_name = "gitea";
           static_configs = [
             {
-              targets = [ "${serverIP}:${toString config.services.prometheus.exporters.node.port}" ];
+              targets = [
+                "localhost:${toString config.services.gitea.settings.server.HTTP_PORT}"
+              ];
+            }
+          ];
+          metrics_path = "/metrics";
+        }
+        {
+          job_name = "synapse";
+          scrape_interval = "15s";
+          metrics_path = "/_synapse/metrics";
+          static_configs = [
+            {
+              targets = [ "127.0.0.1:9009" ];
+              labels = {
+                instance = config.networking.hostName;
+                job = "master";
+                index = "1";
+              };
             }
           ];
         }
-        {
+      ]
-          job_name = "cyper-desktop";
+      ++ (lib.mapAttrsToList mkNodeJob extraNodes)
-          static_configs = [
+      ++ (mkWeatherScrapeConfigs weatherCities);
-            {
-              targets = [ "192.168.2.40:${toString config.services.prometheus.exporters.node.port}" ];
-            }
-          ];
-        }
-      ];
     };
 
     loki = {
@@ -133,9 +191,7 @@ in
   };
 
   networking.firewall.allowedTCPPorts = [
-    80
+    2342
-    443
-    # TODO: Remove
     9001
     3100
   ];

nixos/roles/nginx.nix

@@ -0,0 +1,142 @@
+{ ... }:
+
+{
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "your@email.de";
+  };
+
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+
+    virtualHosts = {
+      "git.cyperpunk.de" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://100.109.179.25:9000";
+        };
+      };
+
+      "www.cyperpunk.de" = {
+        enableACME = true;
+        locations = {
+          "/" = {
+            proxyPass = "http://100.109.179.25:15005";
+            proxyWebsockets = true;
+          };
+          "/grafana" = {
+            proxyPass = "http://100.109.179.25:2342";
+            proxyWebsockets = true;
+          };
+        };
+      };
+
+      "search.cyperpunk.de" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://100.109.179.25:11080";
+        };
+      };
+
+      "vault.cyperpunk.de" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://100.109.179.25:8222";
+          proxyWebsockets = true;
+        };
+      };
+
+      "file.cyperpunk.de" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://100.109.179.25:10000";
+        };
+      };
+
+      "calvin.cyperpunk.de" = {
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://100.109.179.25:15006";
+        };
+      };
+
+      "cyperpunk.de" = {
+        forceSSL = true;
+        enableACME = true;
+        http2 = true;
+        extraConfig = ''
+          client_max_body_size 50m;
+        '';
+        locations."/" = {
+          proxyPass = "http://100.109.179.25:8008";
+          proxyWebsockets = true;
+        };
+      };
+
+      "matrix.cyperpunk.de" = {
+        forceSSL = true;
+        enableACME = true;
+        http2 = true;
+        extraConfig = ''
+          client_max_body_size 50m;
+        '';
+        locations."/" = {
+          proxyPass = "http://100.109.179.25:8008";
+          proxyWebsockets = true;
+        };
+      };
+
+      "cinny.cyperpunk.de" = {
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://100.109.179.25:8009";
+          proxyWebsockets = true;
+        };
+      };
+
+      "element.cyperpunk.de" = {
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://100.109.179.25:8010";
+          proxyWebsockets = true;
+        };
+      };
+
+      "fluffy.cyperpunk.de" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://100.109.179.25:8012";
+          proxyWebsockets = true;
+        };
+      };
+
+      "livekit.cyperpunk.de" = {
+        enableACME = true;
+        locations = {
+          "/" = {
+            proxyPass = "http://192.168.64.1:7880";
+            proxyWebsockets = true;
+          };
+          "/_matrix/livekit/jwt" = {
+            proxyPass = "http://192.168.64.1:8080";
+            proxyWebsockets = true;
+          };
+        };
+      };
+    };
+  };
+}

nixos/roles/postgresql.nix

@@ -2,12 +2,6 @@
 {
   services.postgresql = {
     enable = true;
-    initialScript = pkgs.writeText "synapse-init.sql" ''
+
-      CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
-      CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
-        TEMPLATE template0
-        LC_COLLATE = "C"
-        LC_CTYPE = "C";
-    '';
   };
 }

nixos/roles/unifi.nix

@@ -9,18 +9,4 @@
     mongodbPackage = pkgs.mongodb-7_0;
     openFirewall = true; # opens 3478/udp, 10001/udp, 8080, 8443, 8843, 8880, 6789
   };
-
-  networking.firewall = {
-    allowedTCPPorts = [
-      8443
-      8080
-      8880
-      8843
-      6789
-    ];
-    allowedUDPPorts = [
-      3478
-      10001
-    ];
-  };
 }

nixos/roles/vaultwarden.nix

@@ -17,13 +17,12 @@ in
     backupDir = "/var/local/vaultwarden/backup";
 
     config = {
-      DOMAIN = "http://${ip}:${toString port}";
+      DOMAIN = "https://vault.cyperpunk.de"; # "http://${ip}:${toString port}";
       ROCKET_ADDRESS = "0.0.0.0";
       ROCKET_PORT = port;
       ROCKET_LOG = "critical";
       SIGNUPS_ALLOWED = true;
       WEBSOCKET_ENABLED = true;
-      ROCKET_TLS = "{certs=\"/var/lib/vaultwarden/ssl/cert.pem\",key=\"/var/lib/vaultwarden/ssl/key.pem\"}";
     };
   };
 
@@ -34,39 +33,21 @@ in
 
   networking.firewall.allowedTCPPorts = [ port ];
 
-  systemd.services.vaultwarden-backup-rotate = {
+  systemd = {
-    description = "Rotate old Vaultwarden backups";
+    services.vaultwarden-backup-rotate = {
-    serviceConfig = {
+      description = "Rotate old Vaultwarden backups";
-      Type = "oneshot";
+      serviceConfig = {
-      ExecStart = "${pkgs.findutils}/bin/find /var/lib/vaultwarden/backup -mtime +30 -delete";
+        Type = "oneshot";
+        ExecStart = "${pkgs.findutils}/bin/find /var/lib/vaultwarden/backup -mtime +30 -delete";
+      };
     };
-  };
 
-  systemd.timers.vaultwarden-backup-rotate = {
+    timers.vaultwarden-backup-rotate = {
-    wantedBy = [ "timers.target" ];
+      wantedBy = [ "timers.target" ];
-    timerConfig = {
+      timerConfig = {
-      OnCalendar = "daily";
+        OnCalendar = "daily";
-      Persistent = true;
+        Persistent = true;
+      };
     };
   };
-
-  # TODO: Remove for proper TLS Setup
-  systemd.services.vaultwarden-gen-cert = {
-    description = "Generate self-signed cert for Vaultwarden";
-    before = [ "vaultwarden.service" ];
-    wantedBy = [ "vaultwarden.service" ];
-    serviceConfig.Type = "oneshot";
-    script = ''
-      mkdir -p /var/lib/vaultwarden/ssl
-      if [ ! -f /var/lib/vaultwarden/ssl/cert.pem ]; then
-        ${pkgs.openssl}/bin/openssl req -x509 -newkey rsa:4096 -nodes \
-          -keyout /var/lib/vaultwarden/ssl/key.pem \
-          -out /var/lib/vaultwarden/ssl/cert.pem \
-          -days 3650 \
-          -subj "/CN=${ip}" \
-          -addext "subjectAltName=IP:${ip}"
-        chown -R vaultwarden:vaultwarden /var/lib/vaultwarden/ssl
-      fi
-    '';
-  };
 }

secrets/secrets.yaml

@@ -1,9 +1,17 @@
 GROQ_API_KEY: ENC[AES256_GCM,data:OyuC4jfw67sCDa0XBGr78S6pzPV1ruy7KiIqPMgWWcOCVm3Y/khXEYPMjUTGrq9YLOw1MLso0OE=,iv:0y9klMYVtGsqAaLc2JidjZYSLhhbcbWbnBf8sZiC3rM=,tag:r6G2pzZn2d9JIaS+ozKnmg==,type:str]
 OPENWEATHER_API_KEY: ENC[AES256_GCM,data:bcuLz70u40nZfNgPTaeNRXdR/zjx0SQjwMbMNNFqROI=,iv:VCzse1a1/k1ZDIpFPL1QhjuS6YaDyohWi61JZaoc0Ws=,tag:UJSNyniNNLfGGRY/uiJcRA==,type:str]
+smb_passwd: ENC[AES256_GCM,data:+9RYomcnCZSME5DzuJWTLbS3IGJHhIYWZ5SmsgOn6YQ=,iv:VRPVR7DD+swjeUZKe54XYm3wn/KB4RqvQAyYXQbS+A8=,tag:NnA89efo6HVL0scHgyTZMQ==,type:str]
 grafana_secret_key: ENC[AES256_GCM,data:d6tu4kL7flfbdeOYk21zkSRmVe+NvVwd14jgr9Ds0adfgYetN852G25Z8/g=,iv:uWuwGBZVK1syhEfO9nLZUWwa801759tNJx+Pmnz3xeg=,tag:X6/NcdGZHAdIlOwxNPo/Ew==,type:str]
 matrix_macaroon_secret: ENC[AES256_GCM,data:a9nMar+p+FXIsxxSqO/to2OJOvD1erfwLwwBeKOcWBu7xykHxqD+pCmrGhg=,iv:rp4ZDVIlZ7SN1RFHB2CfSV5ISPMl9pC4U8Jgqpz48Qs=,tag:LxmWUZE3mG4acagQmlieag==,type:str]
 matrix_registration_secret: ENC[AES256_GCM,data:KhKkJZqwE8xk4/tuQ7NYTv/Ot1qCAiy8yUbDyVvRa0H5BT4amCBIdATfR4Q=,iv:HBN+GorT1VpWCVkDugk4UxYLEYKJIoDZh2d+oUDLc8g=,tag:hHus458yVnH0qaQ4u37IZg==,type:str]
 vaultwarden_admin_token: ENC[AES256_GCM,data:yoBs4CaIEJXB5b3PEwTpXFgxpX39hR9A4r9yamwDV7cTSRRp3n3O2VjDKTcI5Vo6RP2QUjcqUqYf98cZ09wDMc+6+oHHJke7+O0FgRgOC0vOQFs4bfZCBJBLxogrGiwtLGkyykR6VYhrT64AN3CbrXflj82OED2Hl8WwEdruBzGIcfnh6FqQowDx6vDR/kXXJHk=,iv:PJQo5V7FaKPQ+GzZNsy3KB+xyjcDKJ1UBHErrqgn/1U=,tag:BRIDJEDOAeToqio/DHMQaA==,type:str]
+flame_password: ENC[AES256_GCM,data:1rNB2CskrMV3EYII+0JfZVDvZE8=,iv:pHJtc+1YSPRYrZG97X3r0+x/cPPUlr8jO+0w2HR+VNw=,tag:qQ/1IPxweBt9iIH4Zsh7+A==,type:str]
+flame_calvin_password: ENC[AES256_GCM,data:P5ppyqTjAJ1TL4hXtx5WyoS9a+g=,iv:sq98P3Oqud2FXfqsD76YS/p5NEF2xlN0MfG+ukCB9B0=,tag:AeKnu4Hg4xQ3tII0y6oNpQ==,type:str]
+gitea:
+    dbPassword: ENC[AES256_GCM,data:S6VvRgkdYk1AzXljyQEEq68UJ9zrFy6+INBMIAspXNcqcM6o+es19o0mcXA=,iv:/pHYpkZZq+9Md+75uSCb2YXfSvaDzUh6mMfH53wb7eg=,tag:ZnbyCQwrK2JnbO5HFqgJYw==,type:str]
+    internalToken: ENC[AES256_GCM,data:7N8TkPNb1YdCk2uAcCvVd2pKRVOf85//DYxAvz0UCg1E8ccEI5630xVyKafDFiSTM4ER7xiYelartzXL0jLWSf3QNOjSHUP8TIAz4bJRAZUJPxO917bURSLGGe7WEOfONzqy3Ts5QhrJ,iv:DiIs1ytlwLvqD/Ejep6m2fmpSqdFZkxBcgLNt6+29jY=,tag:8jsEcOkH0p+1mP9cnVjiDQ==,type:str]
+    lfsJwtSecret: ENC[AES256_GCM,data:L20mFZ6zwsF3ZUoodarTJV+vhUdLlBrUbHz7FpEzJ2/C6AdFc1ZZcioN3g==,iv:E2C3gg1OYQ46Ae2bGnhF+3uw+q77l+yph3Kd2fxwW9M=,tag:VQkQ4R9S8Dr39rSLhL/X1w==,type:str]
+    mailerPassword: ""
 ssh_private_key: ENC[AES256_GCM,data:R511mVFVk1ogAd5CKk/2P6rtT4NnHIFfKyqeCen545QgcvDqDFmW0rFBmPJyipaya2srJNoWvKJbnvxWtTYeJh2tPAybRMoUicStIFMUn3FPNfjx/WuQFLhKLoU3UOHHPJnkFqkQ9MBqLq2k5K7MVsNNFTxIDCKS1jPgkTmAWjRZ0EFiRXLa+Gvnz3GP5ltgfjDwdPeb5xp0/AqKPD8jea9w5ClR6ckrRHCLsfXhL2e9IaF4B96JlIv4rICLX3HmeIgM2PKl2MnSt8we5z39bBoLSA0yWG6BvpiMBaFqbo7jeHf1SxI6R404/emHhwW3pwSCDrq2ZE1ATG2UmA5NssFcVuaBPBoQer+n5haVYMNpNUp6rtKZeAIbf5JEOXJ6CJqiInfnnzOMNGhGFkGUYkhsy3p6Ti/lmNMPX/xtY+8ZqMwXf5drssm5KgnQ5nDbVqnTWAhoT/D3t+cJVAaXGTGw88fU0X95dZr8vaL/5nBCj1uUdv5cRBJ8PGhqbBX8PoiXrtGooBGhxf6nHbxIneSzG1++MZGo3e1G,iv:D1lgCnZKm3Gyv6cZpQ7zGW7JXN5RCwoaas+LroTkhPc=,tag:WI6Nr1cX8gm5pjFpu/Ok0w==,type:str]
 ssh_github_key: ENC[AES256_GCM,data:vZAH4cRDsgGXLAppQKOyUPOvmBJZ27bujMGz4hQ8tt0xhGFUP28llwGZz/VRuU02Yv4alLgVWBAIPuyhZT9f35KnjIR1Mmb7HXk/6oaNM59/lBiISLrnOpC10WmJ9O5krKdxwP8ZDvHA34B0s+oYNkTNXiU0S8AVg3icploax7ylKH5Dorj53kjdYSTjd8KN6ZsgCKmcz97+GnP0IgdmauyNL7e+kv9WIfE8Xx1kGvC8WVnidX2YhSxm6vt8l60eUj9etRigU88oFYTDZ+mIf4lucSpzaLZutz2fM/16D/o9SS7mmTrEllj2S+IXc9ZZTRKKDLbW+yv0XUi0XZi+OHAdZScjS54NZKyT9uWrc/IDJHammGsoHRQpHZtbGhkeFi/KdJsYBsWItslXjM0xJVtFIM2tMnd10kv9UGuXsSl9J4NC0rpz3aXnQqG4ZAhMjN9D/DTJpB4K0pcFyd2FDWdrbKq5iPfnU/V6ecnHPML6wCt6gua/LdK1MWoG3l2SqwMLYj1r7UW5fQZqSw1EK0BAtp9cQMLBL/2w8ykMfWpLekE=,iv:gcinU7xOoXQkFVkLNB3sQYHAcZy3pZN+bDRIq4sspys=,tag:yawgAHBKIkGpnKPHsRId4g==,type:str]
 sops:
@@ -17,7 +25,7 @@ sops:
             N3I5dzUwc3JtYzczMUhyT04vSHlZamMKT+FzYcDLmlEFYxm/XoBpJb8XaZzBH1v9
             6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-11T11:56:39Z"
+    lastmodified: "2026-04-21T21:07:46Z"
-    mac: ENC[AES256_GCM,data:PvlzNkTrXA61gXToaB1VhTRE3fP8jWJrCb5Fmk2dpFOv48WB4vO5nUwQM/XnDvk9A3j3HRuCnIOtEs5Fs5N3lrEFh51PBgUBHPGh+vJIumqbemsxc//oEF4e/FrqUpouW0i6P82ZHKs4qAMT9qG53+2m9/wc2pp8IWlQC9Gkg8o=,iv:zAzOdxiwgnKI8yYxTXzXzbDm2fZYEzmXkAjpJXAD0lY=,tag:/p7YAx+FmKVuFOLNbYzBZA==,type:str]
+    mac: ENC[AES256_GCM,data:pMpc0UWS11OUvY1KS0D6GZkOP1EXM3b9+2VCS23P8js2MAktfzRjfhS2/KKx4XS1tpiHxmoF/eUmZqD+gqIIci4fVx3mpm2lMMx6HpOokM7Q8AEC2cOyJ9NInaZO5ogE7TY81oT8qnuOHPw3sFQARN9e0PLdJajrWWHX6gR2Odk=,iv:yks2AnUrP/6QeIrGGO4w66hvKHTtbFEPVC0GKptWa8g=,tag:VRuaTgfcM2dSi20jYYfp+w==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.12.2