Changed to VPS Installer

chore: track assets with git lfs
Changed Avatars to Miku
2026-07-10 19:28:01 +02:00 · 2026-06-30 21:30:34 +02:00 · 2026-06-30 21:30:02 +02:00 · 2026-06-30 00:53:47 +02:00 · 2026-06-30 00:32:15 +02:00 · 2026-06-30 00:27:15 +02:00
105 changed files with 1629 additions and 680 deletions
@@ -2,6 +2,7 @@
 result
 result-*
 *.qcow2
+extra-files/*

 # Ignore everything in the secrets directory
 secrets/*
@@ -1,6 +1,7 @@
 {
  pkgs,
  primaryUser,
+  lib,
  ...
 }:
 {
@@ -8,6 +9,7 @@
    ./settings.nix
    ./homebrew.nix
    ./yabai.nix
+    ./wireguard.nix
  ];

  # nix config
@@ -50,6 +52,12 @@
    info.enable = false; # Skip info pages
  };

+  # Mirrored Network conf
+  networking.knownNetworkServices = [
+    "Wi-Fi"
+    "Ethernet"
+  ];
+
  # homebrew installation manager
  nix-homebrew = {
    user = primaryUser;
@@ -59,15 +67,24 @@

  # macOS-specific settings
  programs.fish.enable = true;
-  environment.shells = [ pkgs.fish ];
  system.primaryUser = primaryUser;
  users.users.${primaryUser} = {
    home = "/Users/${primaryUser}";
    shell = pkgs.fish;
    openssh.authorizedKeys.keyFiles = [ ../secrets/ssh-key ];
  };
+
  environment = {
+    shells = [ pkgs.fish ];
    systemPath = [ "/opt/homebrew/bin" ];
    pathsToLink = [ "/Applications" ];
+    etc."hosts".text = lib.mkAfter ''
+      10.10.0.1  proxy.cyperpunk.de
+      10.10.0.2  controller.cyperpunk.de
+      10.10.0.3  mac.cyperpunk.de
+      10.10.0.30 node1.cyperpunk.de
+      10.10.0.31 node2.cyperpunk.de
+      10.10.0.40 desktop.cyperpunk.de
+    '';
  };
 }
@@ -0,0 +1,40 @@
+{
+  config,
+  pkgs,
+  hostName,
+  ...
+}:
+{
+  sops.secrets."network/wireguard/${hostName}" = {
+    mode = "0400";
+  };
+
+  launchd.daemons.wireguard = {
+    script = ''
+      set -e
+      mkdir -p /etc/wireguard
+      PRIVATE_KEY=$(cat ${config.sops.secrets."network/wireguard/${hostName}".path})
+      cat > /etc/wireguard/wg0.conf << EOF
+      [Interface]
+      Address = $WG_IP
+      PrivateKey = $PRIVATE_KEY
+
+      [Peer]
+      PublicKey = NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=
+      Endpoint = 178.254.8.35:51820
+      AllowedIPs = 10.10.0.0/24
+      PersistentKeepalive = 25
+      EOF
+      chmod 600 /etc/wireguard/wg0.conf
+      ${pkgs.wireguard-tools}/bin/wg-quick up wg0
+    '';
+    environment.WG_IP = "";
+    serviceConfig = {
+      Label = "org.wireguard.wg0";
+      RunAtLoad = true;
+      KeepAlive = false;
+      StandardOutPath = "/var/log/wireguard.log";
+      StandardErrorPath = "/var/log/wireguard.log";
+    };
+  };
+}
@@ -57,11 +57,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1781255309,
-        "narHash": "sha256-n2P5xkAYGylrJ3feu7L6uaCUw/+jW8rk+HO127gDbFA=",
+        "lastModified": 1782648384,
+        "narHash": "sha256-OlHdAqdXasZk1U+Zf9n+ivqHL9kj/UD0DFO4yYTNBYc=",
        "owner": "catppuccin",
        "repo": "nix",
-        "rev": "036c78ea4cd8a42c8546c6316a944fd7d59d4341",
+        "rev": "f2c7dd14ecce785c206a39466cbe227ff62e3803",
        "type": "github"
      },
      "original": {
@@ -90,6 +90,48 @@
        "type": "github"
      }
    },
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1781152676,
+        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
+    "disko_2": {
+      "inputs": {
+        "nixpkgs": [
+          "nixos-anywhere",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1781152676,
+        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "master",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
    "flake-compat": {
      "flake": false,
      "locked": {
@@ -223,6 +265,27 @@
        "type": "github"
      }
    },
+    "home-manager_2": {
+      "inputs": {
+        "nixpkgs": [
+          "impermanence",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1768598210,
+        "narHash": "sha256-kkgA32s/f4jaa4UG+2f8C225Qvclxnqs76mf8zvTVPg=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "c47b2cc64a629f8e075de52e4742de688f930dc6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
    "hyprcursor": {
      "inputs": {
        "hyprlang": "hyprlang",
@@ -647,6 +710,25 @@
        "type": "github"
      }
    },
+    "impermanence": {
+      "inputs": {
+        "home-manager": "home-manager_2",
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "lastModified": 1769548169,
+        "narHash": "sha256-03+JxvzmfwRu+5JafM0DLbxgHttOQZkUtDWBmeUkN8Y=",
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "rev": "7b1d382faf603b6d264f58627330f9faa5cba149",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "type": "github"
+      }
+    },
    "nix-homebrew": {
      "inputs": {
        "brew-src": "brew-src"
@@ -665,6 +747,27 @@
        "type": "github"
      }
    },
+    "nix-vm-test": {
+      "inputs": {
+        "nixpkgs": [
+          "nixos-anywhere",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1781506385,
+        "narHash": "sha256-kvTBHLiqB911yf2D9VThIRfB6Ai/E2H9+mVF0wR+9AY=",
+        "owner": "numtide",
+        "repo": "nix-vm-test",
+        "rev": "2071ebc1f5b2a2e0211a2ca38c4e678092df76a5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "nix-vm-test",
+        "type": "github"
+      }
+    },
    "nixcord": {
      "inputs": {
        "flake-compat": "flake-compat_2",
@@ -688,39 +791,69 @@
        "type": "github"
      }
    },
-    "nixlib": {
+    "nixos-anywhere": {
+      "inputs": {
+        "disko": "disko_2",
+        "nix-vm-test": "nix-vm-test",
+        "nixos-images": "nixos-images",
+        "nixos-stable": "nixos-stable",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "treefmt-nix": "treefmt-nix"
+      },
      "locked": {
-        "lastModified": 1736643958,
-        "narHash": "sha256-tmpqTSWVRJVhpvfSN9KXBvKEXplrwKnSZNAoNPf/S/s=",
+        "lastModified": 1782285665,
+        "narHash": "sha256-ISUNn+z9+BIDGRrNAmEfghvzFmDgKtGHGEYqIDvGeWk=",
        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "rev": "1418bc28a52126761c02dd3d89b2d8ca0f521181",
+        "repo": "nixos-anywhere",
+        "rev": "4b74194d2927a7741d023b3fd2a0d252059f75ee",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
+        "repo": "nixos-anywhere",
        "type": "github"
      }
    },
-    "nixos-generators": {
+    "nixos-images": {
      "inputs": {
-        "nixlib": "nixlib",
-        "nixpkgs": [
+        "nixos-stable": [
+          "nixos-anywhere",
+          "nixos-stable"
+        ],
+        "nixos-unstable": [
+          "nixos-anywhere",
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1769813415,
-        "narHash": "sha256-nnVmNNKBi1YiBNPhKclNYDORoHkuKipoz7EtVnXO50A=",
+        "lastModified": 1781778781,
+        "narHash": "sha256-CYnhWtKIr0xbxQT6N0X1j0FsmCG+cDV498jyO0xevwQ=",
        "owner": "nix-community",
-        "repo": "nixos-generators",
-        "rev": "8946737ff703382fda7623b9fab071d037e897d5",
+        "repo": "nixos-images",
+        "rev": "94cbd4c8da5f130f188af04293514926a947b380",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
-        "repo": "nixos-generators",
+        "repo": "nixos-images",
+        "type": "github"
+      }
+    },
+    "nixos-stable": {
+      "locked": {
+        "lastModified": 1782116945,
+        "narHash": "sha256-G3tw/IXmaH6IQ2upZvhuN9sG8CkuX+BLuJDpE8hz0Ds=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "34268251cf5547d39063f2c5ea9a196246f7f3a6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-26.05",
+        "repo": "nixpkgs",
        "type": "github"
      }
    },
@@ -772,6 +905,22 @@
      }
    },
    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1768564909,
+        "narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "e4bae1bd10c9c57b2cf517953ab70060a828ee6f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
      "locked": {
        "lastModified": 1781577229,
        "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=",
@@ -787,12 +936,26 @@
        "type": "github"
      }
    },
+    "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1782175435,
+        "narHash": "sha256-EMzXKmnOtBQ2MnvpiNOm7E+kOMvdPrIKaeg52Tip2Uk=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "89570f24e97e614aa34aa9ab1c927b6578a43775",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
    "nixvim": {
      "inputs": {
        "flake-parts": "flake-parts_2",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
+        "nixpkgs": "nixpkgs_4",
        "systems": "systems_3"
      },
      "locked": {
@@ -857,14 +1020,16 @@
      "inputs": {
        "catppuccin": "catppuccin",
        "darwin": "darwin",
+        "disko": "disko",
        "home-manager": "home-manager",
        "hyprcursor": "hyprcursor",
        "hyprland": "hyprland",
        "hyprland-plugins": "hyprland-plugins",
+        "impermanence": "impermanence",
        "nix-homebrew": "nix-homebrew",
        "nixcord": "nixcord",
-        "nixos-generators": "nixos-generators",
-        "nixpkgs": "nixpkgs_2",
+        "nixos-anywhere": "nixos-anywhere",
+        "nixpkgs": "nixpkgs_3",
        "nixvim": "nixvim",
        "nur": "nur",
        "sops-nix": "sops-nix",
@@ -973,6 +1138,27 @@
        "type": "github"
      }
    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixos-anywhere",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1780220602,
+        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
    "xdph": {
      "inputs": {
        "hyprland-protocols": [
@@ -5,8 +5,20 @@
    # monorepo w/ recipes ("derivations")
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";

-    nixos-generators = {
-      url = "github:nix-community/nixos-generators";
+    # declarative disk layout
+    disko = {
+      url = "github:nix-community/disko";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # declarative impermanence
+    impermanence = {
+      url = "github:nix-community/impermanence";
+    };
+
+    # declarative installer
+    nixos-anywhere = {
+      url = "github:nix-community/nixos-anywhere";
      inputs.nixpkgs.follows = "nixpkgs";
    };

@@ -51,7 +63,6 @@
    # declarative Neovim
    nixvim = {
      url = "github:nix-community/nixvim";
-      inputs.nixpkgs.follows = "nixpkgs";
    };

    # declarative Discord
@@ -89,65 +100,54 @@
      nixvim,
      hyprland,
      sops-nix,
-      nixos-generators,
      nur,
+      impermanence,
+      disko,
+      nixos-anywhere,
      ...
    }@inputs:
    let
      primaryUser = "phil";

-      mkIso =
-        {
-          hostName,
-          isDarwin ? false,
-          isServer ? false,
-        }:
-        nixos-generators.nixosGenerate {
+      installer = nixpkgs.lib.nixosSystem {
        system = "x86_64-linux";
-          format = "iso";
-          specialArgs = {
-            inherit
-              inputs
-              primaryUser
-              self
-              hostName
-              isDarwin
-              isServer
-              ;
-          };
+        specialArgs = { inherit inputs; };
        modules = [
          {
-              nixpkgs.overlays = [
-                inputs.nur.overlays.default
-                (import ./overlays { inherit (inputs) nur; })
-              ];
+            nixpkgs = {
+              config.allowUnfree = true;
+              hostPlatform = "x86_64-linux";
+            };
          }
-            { nixpkgs.config.allowUnfree = true; }
-            { nixpkgs.hostPlatform = "x86_64-linux"; }
-            { networking.hostName = hostName; }
-            ./hosts/${hostName}/configuration.nix
-            ./nixos
-            inputs.sops-nix.nixosModules.sops
-            inputs.home-manager.nixosModules.home-manager
+          ./hosts/installer/configuration.nix
+        ];
+      };
+
+      mkInstall =
        {
-              home-manager = {
-                extraSpecialArgs = {
-                  inherit
-                    inputs
-                    primaryUser
-                    self
-                    hostName
-                    isDarwin
-                    isServer
-                    ;
-                };
-                users.${primaryUser} = import ./home;
-                backupFileExtension = "backup";
-                useGlobalPkgs = true;
-                useUserPackages = true;
-              };
+          hostName,
+          target ? "192.168.2.99",
+        }:
+        let
+          pkgs = nixpkgs.legacyPackages.x86_64-linux;
+        in
+        {
+          type = "app";
+          program = "${
+            pkgs.writeShellApplication {
+              name = "install-${hostName}";
+              runtimeInputs = [ nixos-anywhere.packages.x86_64-linux.nixos-anywhere ];
+              text = ''
+                EXTRA_FILES="''${1:-./extra-files}"
+                TARGET="''${2:-${target}}"
+                nixos-anywhere \
+                  --flake .#${hostName} \
+                  --extra-files "$EXTRA_FILES" \
+                  --chown /persist/secrets/age-key.txt "$(id -u ${primaryUser})":100 \
+                  root@"$TARGET"
+              '';
            }
-          ];
+          }/bin/install-${hostName}";
        };

      mkSystem =
@@ -204,6 +204,8 @@
              [
                { nixpkgs.hostPlatform = system; }
                ./nixos
+                inputs.impermanence.nixosModules.impermanence
+                inputs.disko.nixosModules.disko
              ];

        in
@@ -215,6 +217,8 @@
    in
    {
      nixosConfigurations = {
+        "installer" = installer;
+
        "cyper-desktop" = mkSystem {
          hostName = "cyper-desktop";
          system = "x86_64-linux";
@@ -252,25 +256,28 @@
      };

      packages.x86_64-linux = {
-        cyper-desktop-iso = mkIso { hostName = "cyper-desktop"; };
-        cyper-controller-iso = mkIso {
-          hostName = "cyper-controller";
-          isServer = true;
-        };
-        cyper-proxy-iso = mkIso {
-          hostName = "cyper-proxy";
-          isServer = true;
-        };
-        cyper-node-1-iso = mkIso {
-          hostName = "cyper-node-1";
-          isServer = true;
-        };
-        cyper-node-2-iso = mkIso {
-          hostName = "cyper-node-2";
-          isServer = true;
-        };
+        installer = self.nixosConfigurations.installer.config.system.build.isoImage;
      };

      formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt-tree;
+
+      apps.x86_64-linux = {
+        install-cyper-node-1 = mkInstall {
+          hostName = "cyper-node-1";
+        };
+        install-cyper-node-2 = mkInstall {
+          hostName = "cyper-node-2";
+        };
+        install-cyper-controller = mkInstall {
+          hostName = "cyper-controller";
+        };
+        install-cyper-proxy = mkInstall {
+          hostName = "cyper-proxy";
+          target = ""; # KVM console IP
+        };
+        install-cyper-desktop = mkInstall {
+          hostName = "cyper-desktop";
+        };
+      };
    };
 }
@@ -43,8 +43,8 @@
    enableNixpkgsReleaseCheck = false;
    stateVersion = "26.05";
    sessionVariables = lib.mkIf (!isDarwin && !isServer) {
-      GROQ_API_KEY = config.sops.secrets.GROQ_API_KEY.path;
-      OPENWEATHER_API_KEY = config.sops.secrets.OPENWEATHER_API_KEY.path;
+      GROQ_API_KEY = config.sops.secrets."api_keys/groq".path;
+      OPENWEATHER_API_KEY = config.sops.secrets."api_keys/openweather".path;
    };
    file = lib.mkIf (!isServer) {
      "Pictures/Avatar" = {
@@ -65,15 +65,15 @@
      if isDarwin then
        "/Users/${primaryUser}/.config/nix/secrets/keys.txt"
      else
-        "/home/${primaryUser}/.config/nix/secrets/keys.txt";
+        "/persist/secrets/age-key.txt";
    secrets = {
-      GROQ_API_KEY = { };
-      OPENWEATHER_API_KEY = { };
-      ssh_private_key = {
+      "api_keys/groq" = { };
+      "api_keys/openweather" = { };
+      "ssh/private_key" = {
        path = if isDarwin then "/Users/${primaryUser}/.ssh/ssh" else "/home/${primaryUser}/.ssh/ssh";
        mode = "0600";
      };
-      ssh_github_key = {
+      "ssh/github_key" = {
        path = if isDarwin then "/Users/${primaryUser}/.ssh/github" else "/home/${primaryUser}/.ssh/github";
        mode = "0600";
      };
@@ -1,4 +1,4 @@
-_: {
+{
  imports = [
    ./hyprland
    ./rofi
@@ -8,12 +8,6 @@ in
    packages = with pkgs; [
      adwaita-icon-theme
    ];
-    #pointerCursor = {
-    #  gtk.enable = true;
-    #  name = "catppuccin-mocha-sapphire-cursors";
-    #  package = pkgs.catppuccin-cursors.mochaSapphire;
-    #  size = 24;
-    #};
    file = {
      ".config/gtk-4.0/gtk.css".source = "${theme}/share/themes/${theme_name}/gtk-4.0/gtk.css";
      ".config/gtk-4.0/gtk-dark.css".source = "${theme}/share/themes/${theme_name}/gtk-4.0/gtk-dark.css";
@@ -15,6 +15,7 @@
    pamixer
    brightnessctl
    playerctl
+    waypaper
  ];

  systemd.user.targets.hyprland-session.Unit.Wants = [ "xdg-desktop-autostart.target" ];
@@ -1,6 +1,4 @@
-{ ... }:
 {
-  # Hypridle configuration
  services.hypridle = {
    enable = true;
    settings = {
@@ -8,7 +6,7 @@
        after_sleep_cmd = "hyprctl dispatch dpms on";
        ignore_dbus_inhibit = false;
        lock_cmd = "hyprlock";
-        before_sleep_cmd = "notify-send -u critical \"I'm getting sleepy… I'll see you in my code dreams 💖\" --icon=$HOME/.config/hypr/avatar.png --app-name=Hyprlock";
+        before_sleep_cmd = "notify-send -u critical \"I'm getting sleepy… I'll see you in my code dreams 💖\" --app-name=Hyprlock";
      };

      listener = [
@@ -1,8 +1,4 @@
-{ ... }:
-
 {
-
-  # Hyprlock configuration
  programs.hyprlock = {
    enable = true;
    settings = {
@@ -18,7 +14,7 @@

      background = [
        {
-          path = "~/Pictures/Wallpapers/lucy_with_cat.png";
+          path = "$HOME/Pictures/Wallpapers/lucy_with_cat.png";
          blur_passes = 1;
          blur_size = 5;
        }
@@ -81,7 +77,7 @@
        outline_thickness = 4;
        dots_size = 0.2;
        dots_spacing = 0.2;
-        dots_center = "true";
+        dots_center = true;
        outer_color = "$red";
        inner_color = "$surface0";
        font_color = "$text";
@@ -97,16 +93,17 @@
        valign = "center";
      };

-      image = {
+      image = [
+        {
          monitor = "";
-        path = "~/.config/hypr/avatar/avatar.png";
+          path = "$HOME/Pictures/Avatar/miku_happy_sparkels.png";
          size = 300;
          border_color = "$teal";
          position = "0, 75";
          halign = "center";
          valign = "center";
+        }
+      ];
    };
  };
-  };
-
 }
@@ -1,4 +1,3 @@
-{ ... }:
 {
  services.mako = {
    enable = true;
@@ -6,10 +6,10 @@
    platformTheme.name = "kvantum";
  };
  home.packages = lib.mkIf (!pkgs.stdenv.isDarwin) (
-    with pkgs;
+    with pkgs.kdePackages;
    [
-      kdePackages.qt6ct
-      kdePackages.qtstyleplugin-kvantum
+      qt6ct
+      qtstyleplugin-kvantum
    ]
  );
 }
@@ -150,11 +150,11 @@
      format = "{}";
      return-type = "json";
      exec = ''
-        curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/OPENWEATHER_API_KEY)&units=metric&lang=en" | jq -c '{text: "\(.name) \(.main.temp)C°"}'
+        curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/api_keys/openweather)&units=metric&lang=en" | jq -c '{text: "\(.name) \(.main.temp)C°"}'
      '';
      interval = 120;
      on-click = ''
-        data=$(curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/OPENWEATHER_API_KEY)&units=metric&lang=en")
+        data=$(curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/api_keys/openweather)&units=metric&lang=en")
        city=$(echo "$data" | jq -r '.name')
        temp=$(echo "$data" | jq -r '.main.temp')
        feels=$(echo "$data" | jq -r '.main.feels_like')
@@ -163,7 +163,7 @@
        clouds=$(echo "$data" | jq -r '.clouds.all')
        sunrise=$(echo "$data" | jq -r '.sys.sunrise | strftime("%H:%M")')
        sunset=$(echo "$data" | jq -r '.sys.sunset | strftime("%H:%M")')
-        notify-send "$city" "Temperature: $temp °C\nFeels Like: $feels °C\nHumidity: $humidity%\nWind: $wind m/s\nClouds: $clouds%\nSunrise at: $sunrise\nSunset at: $sunset" -u normal --icon="$HOME/Pictures/Avatar/avatar_weather_no_bg.png"
+        notify-send "$city" "Temperature: $temp °C\nFeels Like: $feels °C\nHumidity: $humidity%\nWind: $wind m/s\nClouds: $clouds%\nSunrise at: $sunrise\nSunset at: $sunset" -u normal --icon="$HOME/Pictures/Avatar/miku_window_no_bg.png"
      '';
    };

@@ -13,12 +13,14 @@
    // (import ./dual.nix { inherit compositor; })
  );

-  home.packages = lib.mkIf (!pkgs.stdenv.isDarwin) (with pkgs; [ cava ]);
+  home = {
+    packages = lib.mkIf (!pkgs.stdenv.isDarwin) (with pkgs; [ cava ]);

-  home.file = lib.mkIf (!pkgs.stdenv.isDarwin) {
+    file = lib.mkIf (!pkgs.stdenv.isDarwin) {
      ".config/waybar" = {
        source = ./configs;
        recursive = true;
      };
    };
+  };
 }
@@ -1,31 +0,0 @@
-{
-  widgets = {
-    "niri/workspaces" = {
-      format = "{icon}";
-      format-icons = {
-        default = "";
-        active = "";
-      };
-    };
-    "custom/swaync" = {
-      tooltip = false;
-      format = "{icon}";
-      format-icons = {
-        notification = "<span foreground='red'><sup></sup></span>";
-        none = " ";
-        dnd-notification = "<span foreground='red'><sup></sup></span>";
-        dnd-none = " ";
-        inhibited-notification = "<span foreground='red'><sup></sup></span>";
-        inhibited-none = " ";
-        dnd-inhibited-notification = "<span foreground='red'><sup></sup></span>";
-        dnd-inhibited-none = " ";
-      };
-      return-type = "json";
-      exec-if = "which swaync-client";
-      exec = "swaync-client -swb";
-      on-click = "swaync-client -t -sw";
-      on-click-right = "swaync-client -d -sw";
-      escape = true;
-    };
-  };
-}
@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, primaryUser, ... }:
 let
  addons = pkgs.nur.repos.rycee.firefox-addons;
  readJson = path: builtins.readFile path;
@@ -22,6 +22,10 @@ let
    };
 in
 {
+  home.persistence."/persist/home".directories = [
+    ".mozilla/firefox/${primaryUser}"
+  ];
+
  programs.floorp = {
    enable = true;

@@ -0,0 +1,11 @@
+{
+  home.persistence."/persist/home" = {
+    hideMounts = true;
+    directories = [
+      ".config/nix"
+      "Documents"
+      "Downloads"
+      "Pictures"
+    ];
+  };
+}
@@ -1,6 +1,4 @@
-{ pkgs, ... }:
 {
-  # Avante: AI-powered coding assistant (Cursor-like experience in Neovim)
  programs.nixvim = {
    plugins = {
      markdown-preview.enable = true;
@@ -14,7 +12,7 @@
          providers = {
            groq = {
              __inherited_from = "openai";
-              api_key_name = "cmd:cat /home/phil/.config/sops-nix/secrets/GROQ_API_KEY";
+              api_key_name = "cmd:cat /home/phil/.config/sops-nix/secrets/api_keys/groq";
              endpoint = "https://api.groq.com/openai/v1/";
              model = "qwen/qwen3-32b";
              system_promt = "You are a helpful coding assistant. Always respond in plain markdown format without using tool calls or JSON structures.";
@@ -29,10 +27,10 @@
            };

            ollama = {
-              endpoint = "http://100.109.179.25:11434"; # tailscale IP, no /v1 suffix
-              model = "qwen2.5:3b"; # swap for "llama3.2:3b" or "deepseek-r1:1.5b"
-              timeout = 60000; # local + small model can be slow on first load
-              disable_tools = true; # these small models aren't reliable at tool calling
+              endpoint = "http://10.10.0.2:11434";
+              model = "qwen2.5:3b";
+              timeout = 60000;
+              disable_tools = true;
              is_env_set.__raw = ''require("avante.providers.ollama").check_endpoint_alive'';
              extra_request_body = {
                options = {
@@ -5,7 +5,6 @@
  programs.nixvim = {
    plugins.conform-nvim = {
      enable = true;
-
      settings = {
        formatters_by_ft = {
          lua = [ "stylua" ];
@@ -13,6 +12,40 @@
          python = [ "black" ];
          rust = [ "rustfmt" ];
          rasi = [ "prettierd" ];
+          c = [ "clang_format" ];
+          cpp = [ "clang_format" ];
+        };
+
+        formatters.clang_format = {
+          # If the file has a project .clang-format (walking up from the
+          # file itself, not nvim's cwd), use it - this is how a real
+          # kernel checkout, or any other C/C++ project's own style,
+          # gets respected automatically. Otherwise fall back to an
+          # inline approximation of kernel style instead of plain LLVM,
+          # since that's the sane default for one-off C files.
+          prepend_args = {
+            __raw = ''
+              function(self, ctx)
+                local found = vim.fs.find(
+                  { ".clang-format", "_clang-format" },
+                  { path = ctx.filename, upward = true }
+                )[1]
+                if found then
+                  return { "-style=file" }
+                end
+                return {
+                  "-style={BasedOnStyle: LLVM, IndentWidth: 8, UseTab: Always, "
+                  .. "TabWidth: 8, BreakBeforeBraces: Linux, ColumnLimit: 80, "
+                  .. "IndentCaseLabels: false, PointerAlignment: Right, "
+                  .. "DerivePointerAlignment: false, SpaceBeforeParens: ControlStatements, "
+                  .. "SpacesInParentheses: false, SpaceAfterCStyleCast: false, "
+                  .. "AllowShortIfStatementsOnASingleLine: false, AllowShortBlocksOnASingleLine: false, "
+                  .. "AllowShortFunctionsOnASingleLine: None, AllowShortLoopsOnASingleLine: false, "
+                  .. "ReflowComments: false}"
+                }
+              end
+            '';
+          };
        };

        format_on_save = {
@@ -21,7 +54,6 @@
        };
      };
    };
-
    # Install formatters
    extraPackages = with pkgs; [
      stylua
@@ -29,6 +61,7 @@
      black
      rustfmt
      prettierd
+      clang-tools # provides clang-format
    ];
  };
 }
@@ -32,6 +32,8 @@

  programs.nixvim = {
    enable = true;
+    nixpkgs.source = inputs.nixpkgs;
+
    defaultEditor = true;
    enableMan = false;

@@ -29,6 +29,7 @@
            installRustc = true;
          };
          pylsp.enable = true; # Python language server
+          clangd.enable = true;
        };

        # Keymaps for LSP actions
@@ -85,6 +86,7 @@
      lua-language-server
      nil
      rust-analyzer
+      clang-tools
    ];
  };
 }
@@ -1,9 +1,17 @@
-{ lib, inputs, ... }:
+{
+  lib,
+  inputs,
+  ...
+}:
 {
  imports = [
    inputs.nixcord.homeModules.nixcord
  ];

+  home.persistence."/persist/home".directories = [
+    ".config/vesktop"
+  ];
+
  programs.nixcord = {
    enable = true;
    discord = lib.mkForce { enable = false; };
@@ -2,6 +2,7 @@
  config,
  pkgs,
  lib,
+  primaryUser,
  ...
 }:
 let
@@ -20,13 +21,18 @@ in
    };
  };

-  home.packages = with pkgs; [
+  home = {
+    packages = with pkgs; [
      git
      git-lfs
      openssh
    ];

-  home.activation.obsidianVault = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+    persistence."/persist/home".directories = [
+      "Notes"
+    ];
+
+    activation.obsidianVault = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
      export PATH="${gitBin}:${gitLfsBin}:$PATH"
      export GIT_SSH_COMMAND="${sshBinary} -o StrictHostKeyChecking=accept-new"
      export GIT_LFS_SKIP_SMUDGE=1
@@ -42,4 +48,5 @@ in
      		${gitBin}/git -C "${vaultPath}" lfs pull
      fi
    '';
+  };
 }
@@ -12,7 +12,7 @@ _: {
          npm = "@ai-sdk/openai-compatible";
          name = "Ollama (tailscale)";
          options = {
-            baseURL = "http://100.109.179.25:11434/v1";
+            baseURL = "http://10.10.0.2:11434/v1";
          };
          models = {
            "llama3.2:3b" = {
@@ -2,10 +2,12 @@
  pkgs,
  isDarwin,
  lib,
+  primaryUser,
  ...
 }:
 {
-  home.packages = with pkgs; [
+  home = {
+    packages = with pkgs; [
      eza # ls replacement
      tdf # terminal pdf viewer
      jq # json parser
@@ -23,6 +25,21 @@
      cmatrix
    ];

+    persistence = lib.mkIf (!isDarwin) {
+      "/persist/home" = {
+        directories = [ ".local/share/zoxide" ];
+        files = [ ".local/share/fish/fish_history" ];
+      };
+    };
+
+    file = {
+      ".config/fastfetch/config.jsonc".source = ./fastfetch.jsonc;
+      ".config/tabiew/theme.toml".source = ./tabiew.toml;
+      ".config/kitty/tab_bar.py".source = ./tab_bar.py;
+      ".hushlogin" = lib.mkIf isDarwin { text = ""; }; # Suppress Login
+    };
+  };
+
  programs = {
    kitty = {
      enable = true;
@@ -243,30 +260,4 @@
    };
  };

-  home = {
-    file = {
-      ".config/fastfetch/config.jsonc".source = ./fastfetch.jsonc;
-      ".config/tabiew/theme.toml".source = ./tabiew.toml;
-      ".config/kitty/tab_bar.py".source = ./tab_bar.py;
-      ".hushlogin" = lib.mkIf isDarwin { text = ""; }; # Suppress Login
-
-      # Link LLM std template
-      ".config/io.datasette.llm/templates/std.yaml".text = ''
-        system: |
-          You are a concise technical assistant running on an Intel Mac (x86_64-darwin) 
-          with nix-darwin and home-manager.
-          
-          Rules:
-          - Always respond in valid markdown
-          - Be concise and direct, no unnecessary explanation
-          - Prefer code blocks for commands and code
-          - You have access to these tools in the shell: nvim, fish, git, 
-            eza, bat, ripgrep, fzf, yazi, glow, llm, zoxide, fastfetch,
-            nix, darwin-rebuild, brew
-          - When suggesting nix config changes, use the nix language
-          - nix-switch rebuilds the system config
-          - nix-check validates the flake without building
-      '';
-    };
-  };
 }
@@ -1,9 +1,17 @@
-{ pkgs, inputs, ... }:
+{
+  pkgs,
+  inputs,
+  ...
+}:
 {
  imports = [
    inputs.spicetify-nix.homeManagerModules.default
  ];

+  home.persistence."/persist/home".directories = [
+    ".config/spotify"
+  ];
+
  programs.spicetify =
    let
      spicePkgs = inputs.spicetify-nix.legacyPackages.${pkgs.system};
@@ -1,5 +1,6 @@
 {
  imports = [
+    ./disko.nix
    ./hardware-configuration.nix
    ./smb.nix
    ../../nixos/roles/monitoring.nix
@@ -11,7 +12,6 @@
    ../../nixos/roles/gitea.nix
    ../../nixos/roles/vaultwarden.nix
    ../../nixos/roles/frontpage
-    #../../nixos/roles/paperless-ngx.nix
    ../../nixos/roles/octoprint.nix
    ../../nixos/roles/matrix/postgres-backup.nix
    ../../nixos/roles/kanidm.nix
@@ -22,6 +22,17 @@
    useNetworkd = true;
    useDHCP = false;
    firewall.enable = true;
+    wireguard.interfaces.wg0 = {
+      ips = [ "10.10.0.2/24" ];
+      peers = [
+        {
+          publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=";
+          endpoint = "178.254.8.35:51820";
+          allowedIPs = [ "10.10.0.0/24" ];
+          persistentKeepalive = 25;
+        }
+      ];
+    };
  };

  systemd.network = {
@@ -45,5 +56,6 @@
    };
    efi.canTouchEfiVariables = true;
  };
+
  system.stateVersion = "26.05";
 }
@@ -0,0 +1,62 @@
+{
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/sda";
+    content = {
+      type = "gpt";
+      partitions = {
+        ESP = {
+          size = "512M";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = [
+              "fmask=0022"
+              "dmask=0022"
+            ];
+            extraArgs = [
+              "-n"
+              "NIXBOOT"
+            ];
+          };
+        };
+        swap = {
+          size = "8G";
+          content = {
+            type = "swap";
+            extraArgs = [
+              "-L"
+              "NIXSWAP"
+            ];
+          };
+        };
+        nix = {
+          size = "80G";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/nix";
+            extraArgs = [
+              "-L"
+              "NIXSTORE"
+            ];
+          };
+        };
+        persist = {
+          size = "100%";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/persist";
+            extraArgs = [
+              "-L"
+              "NIXPERSIST"
+            ];
+          };
+        };
+      };
+    };
+  };
+}
@@ -5,7 +5,6 @@
  primaryUser,
  ...
 }:
-
 {
  imports = [
    (modulesPath + "/installer/scan/not-detected.nix")
@@ -17,6 +16,7 @@
      "ahci"
      "usb_storage"
      "sd_mod"
+      "nvme"
    ];
    initrd.kernelModules = [ ];
    kernelModules = [ "kvm-intel" ];
@@ -24,17 +24,13 @@
  };

  fileSystems = {
-    "/" = lib.mkForce {
-      device = "/dev/disk/by-label/NIXROOT";
-      fsType = "ext4";
-    };
-
-    "/boot" = lib.mkForce {
-      device = "/dev/disk/by-label/NIXBOOT";
-      fsType = "vfat";
+    "/" = {
+      device = "none";
+      fsType = "tmpfs";
      options = [
-        "fmask=0022"
-        "dmask=0022"
+        "defaults"
+        "size=6G"
+        "mode=755"
      ];
    };

@@ -70,6 +66,8 @@
      ];
    };

+    "/nix".neededForBoot = true;
+    "/persist".neededForBoot = true;
  };

  systemd.tmpfiles.rules = [
@@ -79,15 +77,7 @@
    "d /storage/backup 0755 ${primaryUser} users -"
  ];

-  swapDevices = [
-    {
-      device = "/swapfile";
-      size = 4096;
-    }
-  ];
-
  networking.useDHCP = lib.mkDefault true;
-
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
@@ -1,11 +1,12 @@
 {
  pkgs,
  primaryUser,
+  config,
  ...
 }:

 {
-  sops.secrets.smb_passwd = { };
+  sops.secrets."network/smb_passwd" = { };

  users.users.${primaryUser}.extraGroups = [ "sambashare" ];

@@ -93,7 +94,7 @@
          sleep 1
        done

-        PASSWORD=$(cat /run/secrets/smb_passwd)
+        PASSWORD=$(cat ${config.sops.secrets."network/smb_passwd".path})
        (echo "$PASSWORD"; echo "$PASSWORD") | ${pkgs.samba}/bin/smbpasswd -a -s ${primaryUser} || \
        (echo "$PASSWORD"; echo "$PASSWORD") | ${pkgs.samba}/bin/smbpasswd -s ${primaryUser}
      '';
@@ -1,11 +1,24 @@
-{ ... }:
 {
-  imports = [ ./hardware-configuration.nix ];
+  imports = [
+    ./disko.nix
+    ./hardware-configuration.nix
+  ];

  networking = {
    useNetworkd = true;
    useDHCP = false;
    firewall.enable = true;
+    wireguard.interfaces.wg0 = {
+      ips = [ "10.10.0.40/24" ];
+      peers = [
+        {
+          publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=";
+          endpoint = "178.254.8.35:51820";
+          allowedIPs = [ "10.10.0.0/24" ];
+          persistentKeepalive = 25;
+        }
+      ];
+    };
  };

  systemd.network = {
@@ -50,4 +63,6 @@

  virtualisation.docker.enable = true;
  users.users.phil.extraGroups = [ "docker" ];
+
+  programs.fuse.userAllowOther = true;
 }
@@ -0,0 +1,68 @@
+{
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/sda";
+    content = {
+      type = "gpt";
+      partitions = {
+
+        ESP = {
+          size = "512M";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = [
+              "fmask=0022"
+              "dmask=0022"
+            ];
+            extraArgs = [
+              "-n"
+              "NIXBOOT"
+            ];
+          };
+        };
+
+        swap = {
+          size = "4G";
+          content = {
+            type = "swap";
+            extraArgs = [
+              "-L"
+              "NIXSWAP"
+            ];
+          };
+        };
+
+        nix = {
+          size = "110G";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/nix";
+            mountOptions = [ "defaults" ];
+            extraArgs = [
+              "-L"
+              "NIXSTORE"
+            ];
+          };
+        };
+
+        persist = {
+          size = "100%";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/persist";
+            extraArgs = [
+              "-L"
+              "NIXPERSIST"
+            ];
+          };
+        };
+
+      };
+    };
+  };
+}
@@ -34,31 +34,29 @@
  };

  sops = {
-    secrets.smb_passwd = { };
-
+    secrets."network/smb_passwd" = { };
    templates.smb_credentials = {
      content = ''
        username=${primaryUser}
-        password=${config.sops.placeholder.smb_passwd}
+        password=${config.sops.placeholder."network/smb_passwd"}
      '';
    };
  };

  fileSystems = {
    "/" = {
-      device = "/dev/disk/by-label/NIXROOT";
-      fsType = "ext4";
-    };
-
-    "/boot" = {
-      device = "/dev/disk/by-label/NIXBOOT";
-      fsType = "vfat";
+      device = "none";
+      fsType = "tmpfs";
      options = [
-        "fmask=0022"
-        "dmask=0022"
+        "defaults"
+        "size=4G"
+        "mode=755"
      ];
    };

+    "/nix".neededForBoot = true;
+    "/persist".neededForBoot = true;
+
    "/storage" = {
      device = "/dev/disk/by-label/STORAGE";
      fsType = "ext4";
@@ -98,8 +96,6 @@
    "d /shares/storage-backup 0775 ${primaryUser} users -"
  ];

-  swapDevices = [ ];
-
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";

  hardware = {
@@ -1 +1,3 @@
-{ ... }: { }
+{
+  launchd.daemons.wireguard.environment.WG_IP = "10.10.0.3/24";
+}
@@ -1,5 +1,6 @@
 {
  imports = [
+    ./disko.nix
    ./hardware-configuration.nix
  ];

@@ -7,6 +8,17 @@
    useNetworkd = true;
    useDHCP = false;
    firewall.enable = true;
+    wireguard.interfaces.wg0 = {
+      ips = [ "10.10.0.30/24" ];
+      peers = [
+        {
+          publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=";
+          endpoint = "178.254.8.35:51820";
+          allowedIPs = [ "10.10.0.0/24" ];
+          persistentKeepalive = 25;
+        }
+      ];
+    };
  };

  systemd.network = {
@@ -0,0 +1,68 @@
+{
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/sda";
+    content = {
+      type = "gpt";
+      partitions = {
+
+        ESP = {
+          size = "512M";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = [
+              "fmask=0022"
+              "dmask=0022"
+            ];
+            extraArgs = [
+              "-n"
+              "NIXBOOT"
+            ];
+          };
+        };
+
+        swap = {
+          size = "4G";
+          content = {
+            type = "swap";
+            extraArgs = [
+              "-L"
+              "NIXSWAP"
+            ];
+          };
+        };
+
+        nix = {
+          size = "50G";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/nix";
+            mountOptions = [ "defaults" ];
+            extraArgs = [
+              "-L"
+              "NIXSTORE"
+            ];
+          };
+        };
+
+        persist = {
+          size = "100%";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/persist";
+            extraArgs = [
+              "-L"
+              "NIXPERSIST"
+            ];
+          };
+        };
+
+      };
+    };
+  };
+}
@@ -4,7 +4,6 @@
  modulesPath,
  ...
 }:
-
 {
  imports = [
    (modulesPath + "/installer/scan/not-detected.nix")
@@ -21,31 +20,21 @@
    kernelModules = [ "kvm-intel" ];
    extraModulePackages = [ ];
  };
+
  fileSystems = {
    "/" = {
-      device = "/dev/disk/by-label/NIXROOT";
-      fsType = "ext4";
-    };
-
-    "/boot" = {
-      device = "/dev/disk/by-label/NIXBOOT";
-      fsType = "vfat";
+      device = "none";
+      fsType = "tmpfs";
      options = [
-        "fmask=0022"
-        "dmask=0022"
+        "defaults"
+        "size=2G"
+        "mode=755"
      ];
    };
+
+    "/nix".neededForBoot = true;
+    "/persist".neededForBoot = true;
  };

-  swapDevices = [
-    {
-      device = "/swapfile";
-      size = 4096;
-    }
-  ];
-
-  networking.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
@@ -1,5 +1,6 @@
 {
  imports = [
+    ./disko.nix
    ./hardware-configuration.nix
  ];

@@ -7,6 +8,17 @@
    useNetworkd = true;
    useDHCP = false;
    firewall.enable = true;
+    wireguard.interfaces.wg0 = {
+      ips = [ "10.10.0.31/24" ];
+      peers = [
+        {
+          publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=";
+          endpoint = "178.254.8.35:51820";
+          allowedIPs = [ "10.10.0.0/24" ];
+          persistentKeepalive = 25;
+        }
+      ];
+    };
  };

  systemd.network = {
@@ -0,0 +1,68 @@
+{
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/sda";
+    content = {
+      type = "gpt";
+      partitions = {
+
+        ESP = {
+          size = "512M";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = [
+              "fmask=0022"
+              "dmask=0022"
+            ];
+            extraArgs = [
+              "-n"
+              "NIXBOOT"
+            ];
+          };
+        };
+
+        swap = {
+          size = "4G";
+          content = {
+            type = "swap";
+            extraArgs = [
+              "-L"
+              "NIXSWAP"
+            ];
+          };
+        };
+
+        nix = {
+          size = "50G";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/nix";
+            mountOptions = [ "defaults" ];
+            extraArgs = [
+              "-L"
+              "NIXSTORE"
+            ];
+          };
+        };
+
+        persist = {
+          size = "100%";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/persist";
+            extraArgs = [
+              "-L"
+              "NIXPERSIST"
+            ];
+          };
+        };
+
+      };
+    };
+  };
+}
@@ -4,7 +4,6 @@
  modulesPath,
  ...
 }:
-
 {
  imports = [
    (modulesPath + "/installer/scan/not-detected.nix")
@@ -21,31 +20,21 @@
    kernelModules = [ "kvm-intel" ];
    extraModulePackages = [ ];
  };
+
  fileSystems = {
    "/" = {
-      device = "/dev/disk/by-label/NIXROOT";
-      fsType = "ext4";
-    };
-
-    "/boot" = {
-      device = "/dev/disk/by-label/NIXBOOT";
-      fsType = "vfat";
+      device = "none";
+      fsType = "tmpfs";
      options = [
-        "fmask=0022"
-        "dmask=0022"
+        "defaults"
+        "size=2G"
+        "mode=755"
      ];
    };
+
+    "/nix".neededForBoot = true;
+    "/persist".neededForBoot = true;
  };

-  swapDevices = [
-    {
-      device = "/swapfile";
-      size = 4096;
-    }
-  ];
-
-  networking.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
@@ -1,6 +1,7 @@
 { ... }:
 {
  imports = [
+    ./disko.nix
    ./hardware-configuration.nix
    ../../nixos/roles/nginx.nix
    #    ../../nixos/roles/jitsi.nix
@@ -13,18 +14,18 @@
    interfaces.ens3 = {
      ipv4.addresses = [
        {
-          address = "178.254.8.35";
-          prefixLength = 23;
+          address = "195.90.219.9";
+          prefixLength = 22;
        }
      ];
      ipv6.addresses = [
        {
-          address = "2a00:6800:3:1094::1";
+          address = "2a00:6800:3:113e::1";
          prefixLength = 64;
        }
      ];
    };
-    defaultGateway = "178.254.8.1";
+    defaultGateway = "195.90.216.1";

    defaultGateway6 = {
      address = "2a00:6800:3::1";
@@ -36,18 +37,46 @@
      "178.254.16.141"
    ];

+    wireguard.interfaces.wg0 = {
+      ips = [ "10.10.0.1/24" ];
+      listenPort = 51820;
+      peers = [
+        {
+          publicKey = "EvML4de3CReNW8aF+lJAsPZ+p6FICOyjCsAZJBwIwX8=";
+          allowedIPs = [ "10.10.0.2/32" ];
+        }
+        {
+          publicKey = "WkY45tGnNZQuJTf1MPN6I92spxHts/kpzXRSZE9se2c=";
+          allowedIPs = [ "10.10.0.3/32" ];
+        }
+        {
+          publicKey = "oAstNd7Wxpj2PqSyS87q+8y8WtaLK7hZ5Ytfncml9EM=";
+          allowedIPs = [ "10.10.0.40/32" ];
+        }
+        {
+          publicKey = "GrFH3I5QqjRij7Jl+eOL6Ou6zK6MtH5/kAsA5AmGckM=";
+          allowedIPs = [ "10.10.0.30/32" ];
+        }
+        {
+          publicKey = "IddGAijZVCVxGj/aMasjfroIy9r8Owar4MO9xfvNNBY=";
+          allowedIPs = [ "10.10.0.31/32" ];
+        }
+      ];
+    };
+
    firewall.allowedTCPPorts = [
      80
      443
+      51820
    ];

    hosts = {
-      "178.254.8.35" = [
+      "195.90.219.9" = [
        "cyperpunk.de"
        "matrix.cyperpunk.de"
      ];

-      "2a00:6800:3:1094::1" = [
+      "2a00:6800:3:113e::1" = [
        "cyperpunk.de"
        "matrix.cyperpunk.de"
      ];
@@ -0,0 +1,65 @@
+{
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/vda";
+    content = {
+      type = "gpt";
+      partitions = {
+        boot = {
+          size = "1M";
+          type = "EF02";
+        };
+        ESP = {
+          size = "512M";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = [
+              "fmask=0022"
+              "dmask=0022"
+            ];
+            extraArgs = [
+              "-n"
+              "NIXBOOT"
+            ];
+          };
+        };
+        swap = {
+          size = "4G";
+          content = {
+            type = "swap";
+            extraArgs = [
+              "-L"
+              "NIXSWAP"
+            ];
+          };
+        };
+        nix = {
+          size = "40G";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/nix";
+            extraArgs = [
+              "-L"
+              "NIXSTORE"
+            ];
+          };
+        };
+        persist = {
+          size = "100%";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/persist";
+            extraArgs = [
+              "-L"
+              "NIXPERSIST"
+            ];
+          };
+        };
+      };
+    };
+  };
+}
@@ -5,11 +5,6 @@
  ];

  boot = {
-    loader.grub = {
-      enable = true;
-      device = "/dev/vda";
-    };
-
    initrd = {
      availableKernelModules = [
        "ata_piix"
@@ -21,27 +16,24 @@
      ];
      kernelModules = [ ];
    };
+    kernel.sysctl."net.ipv4.ip_forward" = 1;
    kernelModules = [ ];
    extraModulePackages = [ ];
  };

  fileSystems = {
    "/" = {
-      device = "/dev/disk/by-label/NIXROOT";
-      fsType = "ext4";
-    };
-
-    "/boot" = {
-      device = "/dev/disk/by-label/NIXBOOT";
-      fsType = "vfat";
+      device = "none";
+      fsType = "tmpfs";
      options = [
-        "fmask=0022"
-        "dmask=0022"
+        "defaults"
+        "size=2G"
+        "mode=755"
      ];
    };
+
+    "/nix".neededForBoot = true;
+    "/persist".neededForBoot = true;
  };
-
-  swapDevices = [ ];
-
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }
@@ -0,0 +1,86 @@
+{ modulesPath, pkgs, ... }:
+{
+  imports = [ (modulesPath + "/installer/cd-dvd/installation-cd-minimal.nix") ];
+
+  boot.zfs.forceImportRoot = false;
+
+  time.timeZone = "Europe/Berlin";
+  i18n = {
+    defaultLocale = "en_US.UTF-8";
+    extraLocaleSettings = {
+      LC_ADDRESS = "de_DE.UTF-8";
+      LC_IDENTIFICATION = "de_DE.UTF-8";
+      LC_MEASUREMENT = "de_DE.UTF-8";
+      LC_MONETARY = "de_DE.UTF-8";
+      LC_NAME = "de_DE.UTF-8";
+      LC_NUMERIC = "de_DE.UTF-8";
+      LC_PAPER = "de_DE.UTF-8";
+      LC_TELEPHONE = "de_DE.UTF-8";
+      LC_TIME = "de_DE.UTF-8";
+    };
+  };
+
+  services.openssh = {
+    enable = true;
+    openFirewall = true;
+    settings = {
+      PermitRootLogin = "yes";
+      PasswordAuthentication = false;
+    };
+  };
+
+  users.users = {
+    root.openssh.authorizedKeys.keyFiles = [
+      ../../secrets/ssh-key
+    ];
+
+    phil = {
+      isNormalUser = true;
+      password = "nixos";
+      extraGroups = [ "wheel" ];
+      openssh.authorizedKeys.keyFiles = [
+        ../../secrets/ssh-key
+      ];
+    };
+  };
+
+  security.sudo = {
+    enable = true;
+    wheelNeedsPassword = false;
+  };
+
+  networking = {
+    useNetworkd = true;
+    useDHCP = false;
+    firewall.enable = false;
+  };
+
+  systemd.network = {
+    enable = true;
+    networks."10-ethernet" = {
+      matchConfig.Name = "en*";
+      networkConfig = {
+        #Address = "192.168.2.99/24";
+        #Gateway = "192.168.2.1";
+        #DNS = "192.168.2.2";
+        Address = "195.90.219.9/22";
+        Gateway = "195.90.216.1";
+        DNS = [
+          "178.254.16.151"
+          "178.254.16.141"
+        ];
+        DHCP = "no";
+      };
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    htop
+    lsscsi
+    pciutils
+    usbutils
+    nvme-cli
+  ];
+
+  system.stateVersion = "26.05";
+}
@@ -11,8 +11,9 @@
  imports = [
    ./sops.nix
    ./locale.nix
-    ./tailscale.nix
+    ./wireguard.nix
    ./ssh.nix
+    ./impermanence.nix
  ]
  ++ lib.optionals (!isServer) [
    ./regreet.nix
@@ -22,10 +23,12 @@
    ./catppuccin.nix
  ];

-  sops.secrets."nix_cache_priv_key" = {
-
+  sops.secrets = {
+    "nix/cache_priv_key" = {
      mode = "0400";
    };
+    "nix/cachix_auth_token" = { };
+  };

  nix = {
    settings = {
@@ -47,7 +50,7 @@
        "https://nix-community.cachix.org"
        "https://cyper-cache.cachix.org"
      ];
-      secret-key-files = [ config.sops.secrets."nix_cache_priv_key".path ];
+      secret-key-files = [ config.sops.secrets."nix/cache_priv_key".path ];
      trusted-public-keys = [
        "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
        "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
@@ -112,8 +115,6 @@
    };
  };

-  sops.secrets.cachix_auth_token = { };
-
  systemd.services.cachix-push = {
    description = "Push new store paths to Cachix";
    after = [ "multi-user.target" ];
@@ -121,14 +122,28 @@
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
-      ExecStart = "${pkgs.bash}/bin/bash -c 'CACHIX_AUTH_TOKEN=$(cat ${config.sops.secrets.cachix_auth_token.path}) ${pkgs.nix}/bin/nix path-info --recursive /run/current-system | CACHIX_AUTH_TOKEN=$(cat ${config.sops.secrets.cachix_auth_token.path}) ${pkgs.cachix}/bin/cachix push cyper-cache'";
+      ExecStart = "${pkgs.bash}/bin/bash -c 'CACHIX_AUTH_TOKEN=$(cat ${
+        config.sops.secrets."nix/cachix_auth_token".path
+      }) ${pkgs.nix}/bin/nix path-info --recursive /run/current-system | CACHIX_AUTH_TOKEN=$(cat ${
+        config.sops.secrets."nix/cachix_auth_token".path
+      }) ${pkgs.cachix}/bin/cachix push cyper-cache'";
    };
  };

-  networking.firewall.allowedTCPPorts = [
+  networking = {
+    hosts = {
+      "10.10.0.1" = [ "proxy.cyperpunk.de" ];
+      "10.10.0.2" = [ "controller.cyperpunk.de" ];
+      "10.10.0.3" = [ "mac.cyperpunk.de" ];
+      "10.10.0.30" = [ "node1.cyperpunk.de" ];
+      "10.10.0.31" = [ "node2.cyperpunk.de" ];
+      "10.10.0.40" = [ "desktop.cyperpunk.de" ];
+    };
+    firewall.allowedTCPPorts = [
      9002
      3100
    ];
+  };

  users.users.${primaryUser} = {
    home = "/home/${primaryUser}";
@@ -0,0 +1,18 @@
+_: {
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    files = [
+      "/etc/machine-id"
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/etc/ssh/ssh_host_ed25519_key.pub"
+      "/etc/ssh/ssh_host_rsa_key"
+      "/etc/ssh/ssh_host_rsa_key.pub"
+    ];
+    directories = [
+      "/var/lib/nixos"
+      "/var/lib/systemd"
+      "/var/log"
+      "/var/lib/tailscale"
+    ];
+  };
+}
@@ -1,6 +1,7 @@
 {
  lib,
  pkgs,
+  primaryUser,
  ...
 }:
 {
@@ -8,35 +9,46 @@
    "greetd/background.png".source = ../assets/wallpapers/lucy_with_cat.png;
    "greetd/environments".text = ''
      Hyprland
-      niri-session
      fish
    '';
  };

  programs.regreet = {
-    enable = false;
-
+    enable = true;
    cageArgs = [
      "-s"
      "-m"
      "last"
    ];
-
+    theme = {
+      name = "catppuccin-mocha-standard-sky-dark";
+      package = pkgs.catppuccin-gtk;
+    };
+    cursorTheme = {
+      name = "catppuccin-mocha-sapphire-cursors";
+      package = pkgs.catppuccin-cursors.mochaSapphire;
+    };
+    iconTheme = {
+      name = "Papirus-Dark";
+      package = pkgs.papirus-icon-theme;
+    };
+    font = {
+      name = "FiraCode Nerd Font Propo";
+      size = 12;
+      package = pkgs.nerd-fonts.fira-code;
+    };
    settings = {
-
      background = {
        path = "/etc/greetd/background.png";
        fit = "Fill";
      };
-
      GTK = {
        application_prefer_dark_theme = true;
-        cursor_theme_name = lib.mkForce "catppuccin-mocha-dark-cursors";
+        cursor_theme_name = lib.mkForce "catppuccin-mocha-sapphire-cursors";
        font_name = lib.mkForce "FiraCode Nerd Font Propo 12";
        icon_theme_name = lib.mkForce "Papirus-Dark";
-        theme_name = lib.mkForce "catppuccin-mocha-standard-mauve-dark";
+        theme_name = lib.mkForce "catppuccin-mocha-standard-sky-dark";
      };
-
      commands = {
        reboot = [
          "systemctl"
@@ -46,16 +58,10 @@
          "systemctl"
          "poweroff"
        ];
-        x11_prefix = [
-          "startx"
-          "/usr/bin/env"
-        ];
      };
-
      appearance = {
        greeting_msg = "Hey there!";
      };
-
      widget.clock = {
        format = "%A %d.%m.%Y %T";
        resolution = "500ms";
@@ -69,12 +75,12 @@
    enable = true;
    settings = {
      default_session = {
-        command = "${pkgs.tuigreet}/bin/tuigreet --cmd start-hyprland";
+        command = "${pkgs.greetd.regreet}/bin/regreet";
        user = "greeter";
      };
      initial_session = {
-        command = "Hyprland";
-        user = "phil";
+        command = "start-hyprland";
+        user = primaryUser;
      };
    };
  };
@@ -1,5 +1,13 @@
-{ ... }:
 {
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/filebrowser";
+      user = "filebrowser";
+      group = "filebrowser";
+      mode = "0750";
+    }
+  ];
+
  services.filebrowser = {
    enable = true;

@@ -13,7 +13,7 @@ let
        "/var/lib/flame-${name}:/app/data"
      ]
      ++ extraVolumes;
-      environmentFiles = [ config.sops.secrets."flame_${name}_password".path ];
+      environmentFiles = [ config.sops.secrets."services/flame/${name}_password".path ];
    };

  instances = [
@@ -29,8 +29,35 @@ let
  ];
 in
 {
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/flame-phil";
+      user = "root";
+      group = "root";
+      mode = "0755";
+    }
+    {
+      directory = "/var/lib/flame-calvin";
+      user = "root";
+      group = "root";
+      mode = "0755";
+    }
+    {
+      directory = "/var/lib/docker";
+      user = "root";
+      group = "root";
+      mode = "0710";
+    }
+    {
+      directory = "/var/lib/private";
+      user = "root";
+      group = "root";
+      mode = "0700";
+    }
+  ];
+
  sops.secrets = lib.listToAttrs (
-    map ({ name, ... }: lib.nameValuePair "flame_${name}_password" { }) instances
+    map ({ name, ... }: lib.nameValuePair "services/flame/${name}_password" { }) instances
  );

  virtualisation = {
@@ -2,7 +2,6 @@
  pkgs,
  lib,
  config,
-  primaryUser,
  ...
 }:

@@ -20,33 +19,48 @@ let
 in
 {
  sops.secrets = {
-    "gitea/dbPassword" = {
+    "services/gitea/db_password" = {
      owner = "gitea";
      group = "gitea";
      mode = "0444";
    };
-    "gitea/internalToken" = {
+    "services/gitea/internal_token" = {
      owner = "gitea";
      group = "gitea";
    };
-    "gitea/lfsJwtSecret" = {
+    "services/gitea/lfs_jwt_secret" = {
      owner = "gitea";
      group = "gitea";
    };
-    "gitea/mailerPassword" = {
+    "services/gitea/mailer_password" = {
      owner = "gitea";
      group = "gitea";
    };
-    "gitea/runnerToken" = {
+    "services/gitea/runner_token" = {
      mode = "0444";
    };
-    "kanidm_gitea_secret" = {
+    "kanidm/gitea_secret" = {
      owner = "gitea";
      group = "gitea";
      mode = "0444";
    };
  };

+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/gitea";
+      user = "gitea";
+      group = "gitea";
+      mode = "0750";
+    }
+    {
+      directory = "/var/lib/postgresql";
+      user = "postgres";
+      group = "postgres";
+      mode = "0750";
+    }
+  ];
+
  systemd.services = {
    gitea-db-password = {
      description = "Set gitea postgres user password";
@@ -60,7 +74,7 @@ in
        RemainAfterExit = true;
      };
      script = ''
-        pass=$(cat ${config.sops.secrets."gitea/dbPassword".path})
+        pass=$(cat ${config.sops.secrets."services/gitea/db_password".path})
        ${pkgs.postgresql_14}/bin/psql -c \
          "ALTER USER gitea WITH PASSWORD '$pass';"
      '';
@@ -111,7 +125,7 @@ in
        port = 5432;
        name = "gitea";
        user = "gitea";
-        passwordFile = config.sops.secrets."gitea/dbPassword".path;
+        passwordFile = config.sops.secrets."services/gitea/db_password".path;
      };

      settings = {
@@ -207,7 +221,7 @@ in
    gitea-actions-runner.instances."cyper_nix" = {
      enable = true;
      url = "https://git.cyperpunk.de";
-      tokenFile = config.sops.secrets."gitea/runnerToken".path;
+      tokenFile = config.sops.secrets."services/gitea/runner_token".path;
      name = "cyper-controller";
      labels = [ "nix:host" ];

@@ -5,6 +5,15 @@ let
  certDir = "/var/lib/kanidm/tls";
 in
 {
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/kanidm";
+      user = "kanidm";
+      group = "kanidm";
+      mode = "0750";
+    }
+  ];
+
  systemd.services.kanidm-selfsigned-cert = {
    description = "Generate self-signed TLS certificate for Kanidm";
    wantedBy = [ "kanidm.service" ];
@@ -149,6 +149,15 @@ let

 in
 {
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/containers";
+      user = "root";
+      group = "root";
+      mode = "0700";
+    }
+  ];
+
  services.nginx.virtualHosts = {
    "cinny.cyperpunk.de" = {
      forceSSL = true;
@@ -1,15 +1,14 @@
 { config, lib, ... }:
 {
  sops.secrets = {
-    coturn_static_auth_secret = {
+    "matrix/coturn_static_auth_secret" = {
      owner = "turnserver";
      group = "turnserver";
    };
-
    coturn_static_auth_secret_synapse = {
      owner = "matrix-synapse";
      group = "matrix-synapse";
-      key = "coturn_static_auth_secret";
+      key = "matrix/coturn_static_auth_secret";
    };
  };

@@ -21,7 +20,7 @@
      min-port = 49000;
      max-port = 50000;
      use-auth-secret = true;
-      static-auth-secret-file = config.sops.secrets.coturn_static_auth_secret.path;
+      static-auth-secret-file = config.sops.secrets."matrix/coturn_static_auth_secret".path;
      realm = "turn.cyperpunk.de";
      cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
      pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
@@ -6,7 +6,7 @@
    ./synapse.nix
    ./livekit.nix
    ./clients.nix
-    ./mjolnir.nix
+    ./draupnir.nix
    ./coturn.nix
    ./maubot.nix
    ./discord-bridge.nix
@@ -1,20 +1,29 @@
 { config, lib, ... }:
 {
  sops.secrets = {
-    discord_bot_token = {
+    "matrix/bridges/discord/bot_token" = {
      owner = "mautrix-discord";
      group = "mautrix-discord";
    };
-    discord_client_id = {
+    "matrix/bridges/discord/client_id" = {
      owner = "mautrix-discord";
      group = "mautrix-discord";
    };
-    discord_pickle_key = {
+    "matrix/bridges/discord/pickle_key" = {
      owner = "mautrix-discord";
      group = "mautrix-discord";
    };
  };

+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/mautrix-discord";
+      user = "mautrix-discord";
+      group = "mautrix-discord";
+      mode = "0750";
+    }
+  ];
+
  systemd = {
    services = {
      mautrix-discord-env = {
@@ -26,9 +35,15 @@
        };
        script = ''
          mkdir -p /run/mautrix-discord
-          echo "DISCORD_BOT_TOKEN=$(cat ${config.sops.secrets.discord_bot_token.path})" > /run/mautrix-discord/env
-          echo "DISCORD_CLIENT_ID=$(cat ${config.sops.secrets.discord_client_id.path})" >> /run/mautrix-discord/env
-          echo "DISCORD_PICKLE_KEY=$(cat ${config.sops.secrets.discord_pickle_key.path})" >> /run/mautrix-discord/env
+          echo "DISCORD_BOT_TOKEN=$(cat ${
+            config.sops.secrets."matrix/bridges/discord/bot_token".path
+          })" > /run/mautrix-discord/env
+          echo "DISCORD_CLIENT_ID=$(cat ${
+            config.sops.secrets."matrix/bridges/discord/client_id".path
+          })" >> /run/mautrix-discord/env
+          echo "DISCORD_PICKLE_KEY=$(cat ${
+            config.sops.secrets."matrix/bridges/discord/pickle_key".path
+          })" >> /run/mautrix-discord/env
          chmod 600 /run/mautrix-discord/env
          chown mautrix-discord:mautrix-discord /run/mautrix-discord/env
        '';
@@ -0,0 +1,22 @@
+{ config, ... }:
+{
+  sops.secrets."matrix/draupnir_access_token" = { };
+
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/private";
+      user = "root";
+      group = "root";
+      mode = "0700";
+    }
+  ];
+
+  services.draupnir = {
+    enable = true;
+    secrets.accessToken = config.sops.secrets."matrix/draupnir_access_token".path;
+    settings = {
+      homeserverUrl = "https://matrix.cyperpunk.de";
+      managementRoom = "!eErCimyDjLSebHjpJA:cyperpunk.de";
+    };
+  };
+}
@@ -1,18 +1,20 @@
 { config, ... }:
 {
-  sops.secrets.livekit_key_file = { };
+  sops.secrets."matrix/livekit_key_file" = { };

-  services.livekit = {
+  services = {
+    livekit = {
      enable = true;
      openFirewall = true;
      settings.room.auto_create = false;
-    keyFile = config.sops.secrets.livekit_key_file.path;
+      keyFile = config.sops.secrets."matrix/livekit_key_file".path;
    };

-  services.lk-jwt-service = {
+    lk-jwt-service = {
      enable = true;
      livekitUrl = "wss://cyperpunk.de/livekit/sfu";
-    keyFile = config.sops.secrets.livekit_key_file.path;
+      keyFile = config.sops.secrets."matrix/livekit_key_file".path;
+    };
  };

  systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = "cyperpunk.de";
@@ -1,9 +1,20 @@
 { config, pkgs, ... }:
 {
-  environment.systemPackages = with pkgs; [
+  environment = {
+    systemPackages = with pkgs; [
      maubot
    ];

+    persistence."/persist".directories = [
+      {
+        directory = "/var/lib/maubot";
+        user = "maubot";
+        group = "maubot";
+        mode = "0750";
+      }
+    ];
+  };
+
  services = {
    maubot = {
      enable = true;
@@ -1,24 +1,39 @@
 { config, lib, ... }:
 {
  sops.secrets = {
-    meta_as_token = {
+    "matrix/bridges/meta/as_token" = {
      owner = "mautrix-meta-facebook";
      group = "mautrix-meta";
    };
-    meta_hs_token = {
+    "matrix/bridges/meta/hs_token" = {
      owner = "mautrix-meta-facebook";
      group = "mautrix-meta";
    };
-    instagram_as_token = {
+    "matrix/bridges/instagram/as_token" = {
      owner = "mautrix-meta-instagram";
      group = "mautrix-meta";
    };
-    instagram_hs_token = {
+    "matrix/bridges/instagram/hs_token" = {
      owner = "mautrix-meta-instagram";
      group = "mautrix-meta";
    };
  };

+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/mautrix-meta-facebook";
+      user = "mautrix-meta-facebook";
+      group = "mautrix-meta";
+      mode = "0750";
+    }
+    {
+      directory = "/var/lib/mautrix-meta-instagram";
+      user = "mautrix-meta-instagram";
+      group = "mautrix-meta";
+      mode = "0750";
+    }
+  ];
+
  systemd.services = {
    mautrix-meta-facebook-env = {
      before = [ "mautrix-meta-facebook-registration.service" ];
@@ -29,8 +44,12 @@
      };
      script = ''
        mkdir -p /run/mautrix-meta-facebook
-        echo "META_AS_TOKEN=$(cat ${config.sops.secrets.meta_as_token.path})" > /run/mautrix-meta-facebook/env
-        echo "META_HS_TOKEN=$(cat ${config.sops.secrets.meta_hs_token.path})" >> /run/mautrix-meta-facebook/env
+        echo "META_AS_TOKEN=$(cat ${
+          config.sops.secrets."matrix/bridges/meta/as_token".path
+        })" > /run/mautrix-meta-facebook/env
+        echo "META_HS_TOKEN=$(cat ${
+          config.sops.secrets."matrix/bridges/meta/hs_token".path
+        })" >> /run/mautrix-meta-facebook/env
        chmod 600 /run/mautrix-meta-facebook/env
        chown mautrix-meta-facebook:mautrix-meta /run/mautrix-meta-facebook/env
      '';
@@ -45,8 +64,12 @@
      };
      script = ''
        mkdir -p /run/mautrix-meta-instagram
-        echo "INSTAGRAM_AS_TOKEN=$(cat ${config.sops.secrets.instagram_as_token.path})" > /run/mautrix-meta-instagram/env
-        echo "INSTAGRAM_HS_TOKEN=$(cat ${config.sops.secrets.instagram_hs_token.path})" >> /run/mautrix-meta-instagram/env
+        echo "INSTAGRAM_AS_TOKEN=$(cat ${
+          config.sops.secrets."matrix/bridges/instagram/as_token".path
+        })" > /run/mautrix-meta-instagram/env
+        echo "INSTAGRAM_HS_TOKEN=$(cat ${
+          config.sops.secrets."matrix/bridges/instagram/hs_token".path
+        })" >> /run/mautrix-meta-instagram/env
        chmod 600 /run/mautrix-meta-instagram/env
        chown mautrix-meta-instagram:mautrix-meta /run/mautrix-meta-instagram/env
      '';
@@ -1,17 +0,0 @@
-{ config, ... }:
-{
-  sops.secrets.mjolnir_access_token = { };
-
-  services.draupnir = {
-    enable = true;
-    secrets.accessToken = config.sops.secrets.mjolnir_access_token.path;
-    settings = {
-      homeserverUrl = "https://matrix.cyperpunk.de";
-      managementRoom = "!eErCimyDjLSebHjpJA:cyperpunk.de";
-    };
-  };
-}
-
-#curl -X POST https://matrix.cyperpunk.de/_matrix/client/v3/login \
-#  -H "Content-Type: application/json" \
-#  -d '{"type":"m.login.password ","user":"mjolnir","password":"i318HXBRkt)Lh$nOPwq#6n9z&<W[XJ&2c4$Zf>7jV}-uQCE{<plwk;LZ)10*N<~1"}'
@@ -1,12 +1,11 @@
 {
  config,
  pkgs,
-  lib,
  ...
 }:
 {
  sops.secrets = {
-    pg_replication_password = {
+    "postgres/replication_password" = {
      owner = "root";
      group = "root";
    };
@@ -18,12 +17,10 @@
    description = "PostgreSQL WAL streaming replica (Docker)";
    requires = [
      "docker.service"
-      "tailscaled.service"
      "network-online.target"
    ];
    after = [
      "docker.service"
-      "tailscaled.service"
      "network-online.target"
    ];
    wantedBy = [ "multi-user.target" ];
@@ -32,25 +29,23 @@
      Type = "simple";
      Restart = "on-failure";
      RestartSec = "10s";
+      TimeoutStartSec = "0";
    };

    preStart = ''
      DATADIR="/storage/backup/postgresql-replica"
-            PG_PASS=$(cat ${config.sops.secrets.pg_replication_password.path})
-
+      PG_PASS=$(cat ${config.sops.secrets."postgres/replication_password".path})
      ${pkgs.docker}/bin/docker pull postgres:17
-
      if [ ! -f "$DATADIR/PG_VERSION" ]; then
        echo "No data dir found — running pg_basebackup..."
        rm -rf "$DATADIR"
-
        ${pkgs.docker}/bin/docker run --rm \
          -e PGPASSWORD="$PG_PASS" \
          -v "/storage/backup:/out" \
          --network host \
          postgres:17 \
          pg_basebackup \
-                  --host=100.109.10.91 \
+            --host=10.10.0.1 \
            --port=5432 \
            --username=replicator \
            --pgdata=/out/postgresql-replica \
@@ -58,16 +53,10 @@
            --checkpoint=fast \
            --progress \
            --verbose
-
-              # standby signal
        touch "$DATADIR/standby.signal"
-
-              # primary conninfo
        cat > "$DATADIR/postgresql.auto.conf" <<EOF
-      primary_conninfo = 'host=100.109.10.91 port=5432 user=replicator password=$PG_PASS application_name=cyper-controller sslmode=require'
+      primary_conninfo = 'host=10.10.0.1 port=5432 user=replicator password=$PG_PASS application_name=cyper-controller sslmode=disable'
      EOF
-
-              # minimal postgresql.conf
        cat > "$DATADIR/postgresql.conf" <<EOF
      hot_standby = on
      hot_standby_feedback = on
@@ -75,11 +64,8 @@
      port = 5434
      listen_addresses = '*'
      EOF
-
        chown -R 999:999 "$DATADIR"
      fi
-
-            # ensure postgresql.conf exists on subsequent starts
      if [ ! -f "$DATADIR/postgresql.conf" ]; then
        cat > "$DATADIR/postgresql.conf" <<EOF
      hot_standby = on
@@ -34,30 +34,45 @@ let
 in
 {
  sops.secrets = {
-    matrix_macaroon_secret = { };
-    matrix_registration_secret = {
+    "matrix/macaroon_secret" = { };
+    "matrix/registration_secret" = {
      owner = "matrix-synapse";
      group = "matrix-synapse";
    };
-    pg_replication_password = {
+    "postgres/replication_password" = {
      owner = "postgres";
      group = "postgres";
    };
-    kanidm_synapse_secret = {
+    "kanidm/synapse_secret" = {
      owner = "matrix-synapse";
      group = "matrix-synapse";
    };
  };

-  systemd.tmpfiles.rules = [
-    "d /var/www/matrix            0755 nginx nginx -"
-    "L+ /var/www/matrix/index.html   0644 nginx nginx - ${matrixIndexHtml}"
-    "L+ /var/www/matrix/register.php 0644 nginx nginx - ${matrixRegisterPhp}"
-    "L+ /var/www/matrix/style.css  0644 nginx nginx - ${matrixStyleCss}"
-    "L+ /var/www/matrix/app.js     0644 nginx nginx - ${matrixAppJs}"
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/matrix-synapse";
+      user = "matrix-synapse";
+      group = "matrix-synapse";
+      mode = "0700";
+    }
+    {
+      directory = "/var/lib/postgresql";
+      user = "postgres";
+      group = "postgres";
+      mode = "0750";
+    }
+    {
+      directory = "/var/lib/acme";
+      user = "acme";
+      group = "acme";
+      mode = "0755";
+    }
  ];

-  services.phpfpm.pools.matrix = {
+  services = {
+
+    phpfpm.pools.matrix = {
      user = "nginx";
      group = "nginx";
      settings = {
@@ -72,7 +87,6 @@ in
      phpPackage = pkgs.php.withExtensions ({ enabled, all }: enabled ++ [ all.curl ]);
    };

-  services = {
    matrix-synapse = {
      enable = true;
      settings = {
@@ -81,8 +95,8 @@ in
        enable_registration = false;
        trusted_key_servers = [ { server_name = "matrix.org"; } ];
        suppress_key_server_warning = true;
-        registration_shared_secret_path = config.sops.secrets.matrix_registration_secret.path;
-        macaroon_secret_key = "$__file{${config.sops.secrets.matrix_macaroon_secret.path}}";
+        registration_shared_secret_path = config.sops.secrets."matrix/registration_secret".path;
+        macaroon_secret_key = "$__file{${config.sops.secrets."matrix/macaroon_secret".path}}";
        matrix_rtc = {
          enabled = true;
          transports = [
@@ -135,7 +149,7 @@ in
            type = "metrics";
            bind_addresses = [
              "127.0.0.1"
-              "100.109.10.91"
+              "10.10.0.1"
            ];
            resources = [ ];
          }
@@ -148,7 +162,7 @@ in
            idp_name = "Kanidm";
            issuer = "https://auth.cyperpunk.de/oauth2/openid/synapse";
            client_id = "synapse";
-            client_secret_path = config.sops.secrets.kanidm_synapse_secret.path;
+            client_secret_path = config.sops.secrets."kanidm/synapse_secret".path;
            scopes = [
              "openid"
              "profile"
@@ -236,10 +250,11 @@ in
        wal_level = "replica";
        max_wal_senders = 5;
        wal_keep_size = "512MB";
-        listen_addresses = lib.mkForce "127.0.0.1,100.109.10.91";
+        listen_addresses = lib.mkForce "127.0.0.1,10.10.0.1";
+        ssl = true;
      };
      authentication = lib.mkAfter ''
-        host replication replicator 100.0.0.0/8 scram-sha-256
+        hostssl replication replicator 10.10.0.2/32 scram-sha-256
      '';
    };

@@ -251,15 +266,26 @@ in
    };
  };

-  systemd.services = {
+  systemd = {
+    services = {
      matrix-synapse.serviceConfig.ReadOnlyPaths = [
        "/var/lib/mautrix-discord"
        "/var/lib/mautrix-whatsapp"
      ];
      postgresql.postStart = lib.mkAfter ''
-      PG_PASS=$(cat ${config.sops.secrets.pg_replication_password.path})
+        PG_PASS=$(cat ${config.sops.secrets."postgres/replication_password".path})
        ${config.services.postgresql.package}/bin/psql -U postgres -c \
          "ALTER ROLE replicator WITH PASSWORD '$PG_PASS';"
      '';
    };
+
+    tmpfiles.rules = [
+      "d /var/www/matrix            0755 nginx nginx -"
+      "L+ /var/www/matrix/index.html   0644 nginx nginx - ${matrixIndexHtml}"
+      "L+ /var/www/matrix/register.php 0644 nginx nginx - ${matrixRegisterPhp}"
+      "L+ /var/www/matrix/style.css  0644 nginx nginx - ${matrixStyleCss}"
+      "L+ /var/www/matrix/app.js     0644 nginx nginx - ${matrixAppJs}"
+    ];
+  };
+
 }
@@ -1,6 +1,16 @@
-{ ... }:
 {
-  services.postgresql = {
+
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/mautrix-whatsapp";
+      user = "mautrix-whatsapp";
+      group = "mautrix-whatsapp";
+      mode = "0750";
+    }
+  ];
+
+  services = {
+    postgresql = {
      ensureUsers = [
        {
          name = "mautrix-whatsapp";
@@ -10,7 +20,7 @@
      ensureDatabases = [ "mautrix-whatsapp" ];
    };

-  services.mautrix-whatsapp = {
+    mautrix-whatsapp = {
      enable = true;
      settings = {
        homeserver = {
@@ -27,4 +37,5 @@
        };
      };
    };
+  };
 }
@@ -27,20 +27,29 @@ in
  imports = [ ./gs-exporter.nix ];

  sops.secrets = {
-    grafana_secret_key = {
+    "services/grafana/secret_key" = {
      owner = "grafana";
      group = "grafana";
    };
-    kanidm_grafana_secret = {
+    "kanidm/grafana_secret" = {
      owner = "grafana";
      group = "grafana";
    };
-    zyxel_pass = {
+    "network/zyxel_pass" = {
      group = "gs1200-exporter";
      mode = "0440";
    };
  };

+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/grafana";
+      user = "grafana";
+      group = "grafana";
+      mode = "0750";
+    }
+  ];
+
  users.groups.gs1200-exporter = { };

  services = {
@@ -69,7 +78,7 @@ in
          serve_from_sub_path = true;
        };
        security = {
-          secret_key = "$__file{${config.sops.secrets.grafana_secret_key.path}}";
+          secret_key = "$__file{${config.sops.secrets."services/grafana/secret_key".path}}";
          allow_embedding = true;
          cookie_samesite = "none";
          cookie_secure = true;
@@ -82,7 +91,7 @@ in
          enabled = true;
          name = "Kanidm";
          client_id = "grafana";
-          client_secret = "$__file{${config.sops.secrets.kanidm_grafana_secret.path}}";
+          client_secret = "$__file{${config.sops.secrets."kanidm/grafana_secret".path}}";
          scopes = "openid profile email";
          auth_url = "https://auth.cyperpunk.de/ui/oauth2";
          token_url = "https://auth.cyperpunk.de/oauth2/token";
@@ -125,7 +134,7 @@ in
          metrics_path = "/_synapse/metrics";
          static_configs = [
            {
-              targets = [ "100.109.10.91:9009" ];
+              targets = [ "10.10.0.1:9009" ];
              labels = {
                instance = "cyper-proxy";
                job = "master";
@@ -149,7 +158,7 @@ in
          job_name = "postgresql-proxy";
          static_configs = [
            {
-              targets = [ "100.109.10.91:9188" ];
+              targets = [ "10.10.0.1:9188" ];
              labels = {
                instance = "cyper-proxy";
              };
@@ -172,13 +181,13 @@ in
      zyxel1 = {
        address = "192.168.2.3";
        port = 9934;
-        passwordFile = config.sops.secrets.zyxel_pass.path;
+        passwordFile = config.sops.secrets."network/zyxel_pass".path;
        group = "gs1200-exporter";
      };
      zyxel2 = {
        address = "192.168.2.4";
        port = 9935;
-        passwordFile = config.sops.secrets.zyxel_pass.path;
+        passwordFile = config.sops.secrets."network/zyxel_pass".path;
        group = "gs1200-exporter";
      };
    };
@@ -1,6 +1,6 @@
 _:
 let
-  upstream = "100.109.179.25";
+  upstream = "10.10.0.2";

  mkProxy = port: {
    forceSSL = true;
@@ -48,6 +48,16 @@ let
 in
 {
  nixpkgs.overlays = [ octoprint-overlay ];
+
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/octoprint";
+      user = "octoprint";
+      group = "octoprint";
+      mode = "0750";
+    }
+  ];
+
  services.octoprint = {
    enable = true;
    host = "0.0.0.0";
@@ -1,11 +1,10 @@
 { config, ... }:
 {
-
  sops.secrets = {
-    paperless_admin = {
+    "services/paperless/admin" = {
      owner = "paperless";
    };
-    paperless_oidc_secret = {
+    "services/paperless/oidc_secret" = {
      owner = "paperless";
    };
  };
@@ -18,14 +17,14 @@
    consumptionDir = "/storage/fast/paperless/consume";
    dataDir = "/storage/fast/paperless";
    configureTika = true;
-    passwordFile = config.sops.secrets.paperless_admin.path;
+    passwordFile = config.sops.secrets."services/paperless/admin".path;
    settings = {
      PAPERLESS_USE_X_FORWARDED_HOST = true;
      PAPERLESS_USE_X_FORWARDED_PORT = true;
-      PAPERLESS_ALLOWED_HOSTS = "ngx.cyperpunk.de,100.109.179.25,localhost";
+      PAPERLESS_ALLOWED_HOSTS = "ngx.cyperpunk.de,10.10.0.2,localhost";
      PAPERLESS_CSRF_TRUSTED_ORIGINS = [
        "https://ngx.cyperpunk.de"
-        "http://100.109.179.25:28101"
+        "http://10.10.0.2:28101"
      ];
      PAPERLESS_OCR_LANGUAGE = "deu+eng";
      PAPERLESS_CONSUMER_POLLING = 60;
@@ -54,7 +53,7 @@
        requires = [ "systemd-tmpfiles-setup.service" ];
      };
      paperless-web = {
-        serviceConfig.EnvironmentFiles = [ config.sops.secrets.paperless_oidc_secret.path ];
+        serviceConfig.EnvironmentFiles = [ config.sops.secrets."services/paperless/oidc_secret".path ];
      };
    };
  };
@@ -1,6 +1,15 @@
 { pkgs, ... }:

 {
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/unifi";
+      user = "unifi";
+      group = "unifi";
+      mode = "0750";
+    }
+  ];
+
  services.unifi = {
    enable = true;
    unifiPackage = pkgs.unifi;
@@ -8,14 +8,25 @@ let
  userScss = builtins.readFile ./user.vaultwarden.scss.hbs;
 in
 {
-  sops.secrets.vaultwarden_env = {
+
+  sops.secrets."services/vaultwarden/env" = {
    owner = "vaultwarden";
    group = "vaultwarden";
  };
+
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/vaultwarden";
+      user = "vaultwarden";
+      group = "vaultwarden";
+      mode = "0750";
+    }
+  ];
+
  services.vaultwarden = {
    enable = true;
    package = pkgs.oidcwarden;
-    environmentFile = config.sops.secrets.vaultwarden_env.path;
+    environmentFile = config.sops.secrets."services/vaultwarden/env".path;
    backupDir = "/var/local/vaultwarden/backup";
    config = {
      DOMAIN = "https://vault.cyperpunk.de";
@@ -31,7 +42,9 @@ in
      SSO_PKCE = false;
    };
  };
+
  networking.firewall.allowedTCPPorts = [ port ];
+
  systemd = {
    services.vaultwarden-backup-rotate = {
      description = "Rotate old Vaultwarden backups";
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
DerGrumpf	4a9bfcaf26	Changed to VPS Installer	2026-07-10 19:28:01 +02:00
DerGrumpf	4619826e15	chore: track assets with git lfs	2026-06-30 21:30:34 +02:00
DerGrumpf	65d1577cc6	Changed Avatars to Miku	2026-06-30 21:30:02 +02:00
DerGrumpf	70ab04e947	Fixed Home Manager API Change	2026-06-30 00:53:47 +02:00
DerGrumpf	57bed639e8	Reworked Hyprland dir	2026-06-30 00:32:15 +02:00
DerGrumpf	a0f6f9052b	Added impermanence to home manager	2026-06-30 00:27:15 +02:00
DerGrumpf	f1c99682ac	Added disko setup for desktop	2026-06-30 00:01:44 +02:00
DerGrumpf	649942096f	Added disko setup for desktop	2026-06-30 00:00:47 +02:00
DerGrumpf	6668c810d3	Added Fixed Wireguard ips to hosts dns lookup	2026-06-29 18:13:11 +02:00
DerGrumpf	73ff128705	Reorderd Secrets to match a structure	2026-06-29 12:17:55 +02:00
DerGrumpf	a24e82bf5a	Swapped volatile Tailscale ips for fixed wireguard ips	2026-06-29 11:29:17 +02:00
DerGrumpf	cbfb1fef0e	Setup Wireguard configuration	2026-06-29 11:24:19 +02:00
DerGrumpf	23ecd70457	Changed name from Mjolnir to Draupnir	2026-06-28 23:29:04 +02:00
DerGrumpf	15182d6de3	Changed name from Mjolnir to Draupnir	2026-06-28 23:28:32 +02:00
DerGrumpf	708b00ac61	Added Impermanence and Disko setup to Proxy	2026-06-28 23:23:56 +02:00
DerGrumpf	75bd7875cb	Fixed WAL writing of postgres backup	2026-06-28 19:34:34 +02:00
DerGrumpf	a292eb6b09	Added Impermanence to services runned by cyper-controller	2026-06-28 15:02:42 +02:00
DerGrumpf	bbf95a5a8c	Added Install script for hosts	2026-06-28 00:18:08 +02:00
DerGrumpf	b7edb85dd8	Fixed Home manager sops nix	2026-06-27 23:10:07 +02:00
DerGrumpf	bd56dec0b1	Fixed sops secret path for home manager; added automatic tailscale auth	2026-06-27 22:10:55 +02:00
DerGrumpf	57f6b25a9e	Added Disko setup; And test impermanence on node 1 & 2	2026-06-27 21:43:29 +02:00
DerGrumpf	e2e63fbcab	Added Disko setup	2026-06-27 10:00:19 +02:00
DerGrumpf	60d9a97ae8	WIP: Added Hardware configurations for node servers as a test	2026-06-24 19:27:57 +02:00
DerGrumpf	dbcba53ede	WIP: Groundwork for impermanence setup for nixos and home	2026-06-24 19:07:40 +02:00
DerGrumpf	b9a7d03a59	Init feature/impermanence	2026-06-24 10:20:42 +02:00