Changed to VPS Installer

.gitignore

@@ -2,7 +2,7 @@
 result
 result-*
 *.qcow2
-extra_files/*
+extra-files/*
 
 # Ignore everything in the secrets directory
 secrets/*

darwin/default.nix

@@ -1,6 +1,7 @@
 {
   pkgs,
   primaryUser,
+  lib,
   ...
 }:
 {
@@ -8,6 +9,7 @@
     ./settings.nix
     ./homebrew.nix
     ./yabai.nix
+    ./wireguard.nix
   ];
 
   # nix config
@@ -50,6 +52,12 @@
     info.enable = false; # Skip info pages
   };
 
+  # Mirrored Network conf
+  networking.knownNetworkServices = [
+    "Wi-Fi"
+    "Ethernet"
+  ];
+
   # homebrew installation manager
   nix-homebrew = {
     user = primaryUser;
@@ -59,15 +67,24 @@
 
   # macOS-specific settings
   programs.fish.enable = true;
-  environment.shells = [ pkgs.fish ];
   system.primaryUser = primaryUser;
   users.users.${primaryUser} = {
     home = "/Users/${primaryUser}";
     shell = pkgs.fish;
     openssh.authorizedKeys.keyFiles = [ ../secrets/ssh-key ];
   };
+
   environment = {
+    shells = [ pkgs.fish ];
     systemPath = [ "/opt/homebrew/bin" ];
     pathsToLink = [ "/Applications" ];
+    etc."hosts".text = lib.mkAfter ''
+      10.10.0.1  proxy.cyperpunk.de
+      10.10.0.2  controller.cyperpunk.de
+      10.10.0.3  mac.cyperpunk.de
+      10.10.0.30 node1.cyperpunk.de
+      10.10.0.31 node2.cyperpunk.de
+      10.10.0.40 desktop.cyperpunk.de
+    '';
   };
 }

darwin/wireguard.nix

@@ -0,0 +1,40 @@
+{
+  config,
+  pkgs,
+  hostName,
+  ...
+}:
+{
+  sops.secrets."network/wireguard/${hostName}" = {
+    mode = "0400";
+  };
+
+  launchd.daemons.wireguard = {
+    script = ''
+      set -e
+      mkdir -p /etc/wireguard
+      PRIVATE_KEY=$(cat ${config.sops.secrets."network/wireguard/${hostName}".path})
+      cat > /etc/wireguard/wg0.conf << EOF
+      [Interface]
+      Address = $WG_IP
+      PrivateKey = $PRIVATE_KEY
+
+      [Peer]
+      PublicKey = NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=
+      Endpoint = 178.254.8.35:51820
+      AllowedIPs = 10.10.0.0/24
+      PersistentKeepalive = 25
+      EOF
+      chmod 600 /etc/wireguard/wg0.conf
+      ${pkgs.wireguard-tools}/bin/wg-quick up wg0
+    '';
+    environment.WG_IP = "";
+    serviceConfig = {
+      Label = "org.wireguard.wg0";
+      RunAtLoad = true;
+      KeepAlive = false;
+      StandardOutPath = "/var/log/wireguard.log";
+      StandardErrorPath = "/var/log/wireguard.log";
+    };
+  };
+}

flake.lock

@@ -57,11 +57,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782117778,
+        "lastModified": 1782648384,
-        "narHash": "sha256-x6vIJpJziw3Hs0JKKDP+AeRPWwqyMDOmK6I26tqbYj4=",
+        "narHash": "sha256-OlHdAqdXasZk1U+Zf9n+ivqHL9kj/UD0DFO4yYTNBYc=",
         "owner": "catppuccin",
         "repo": "nix",
-        "rev": "e98afe2dfd950bda4e6a8ef32bb563ec2f04505a",
+        "rev": "f2c7dd14ecce785c206a39466cbe227ff62e3803",
         "type": "github"
       },
       "original": {
@@ -90,6 +90,48 @@
         "type": "github"
       }
     },
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1781152676,
+        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
+    "disko_2": {
+      "inputs": {
+        "nixpkgs": [
+          "nixos-anywhere",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1781152676,
+        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "master",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
     "flake-compat": {
       "flake": false,
       "locked": {
@@ -209,11 +251,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782358560,
+        "lastModified": 1781788787,
-        "narHash": "sha256-vCcLh9pw3XO/+Lxk8r6xv6QnoCrTfGqiACcI7O637Wg=",
+        "narHash": "sha256-YqlTCRRhGvNjcJejPeMuHrYQ/TVhOO2MV/nEGMWb8nk=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3a70e333f2950c302e875c44cfcfaff3f80f36bc",
+        "rev": "d456f483f157d4b706416005da226234b9c116ff",
         "type": "github"
       },
       "original": {
@@ -223,6 +265,27 @@
         "type": "github"
       }
     },
+    "home-manager_2": {
+      "inputs": {
+        "nixpkgs": [
+          "impermanence",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1768598210,
+        "narHash": "sha256-kkgA32s/f4jaa4UG+2f8C225Qvclxnqs76mf8zvTVPg=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "c47b2cc64a629f8e075de52e4742de688f930dc6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
     "hyprcursor": {
       "inputs": {
         "hyprlang": "hyprlang",
@@ -320,11 +383,11 @@
         "xdph": "xdph"
       },
       "locked": {
-        "lastModified": 1782366482,
+        "lastModified": 1781796010,
-        "narHash": "sha256-J+yvgoF+zbYZHJkGxfMCPWa8L3i5Nm7Xlgfw2Eky/Xs=",
+        "narHash": "sha256-bIqjZgUfp3vba/C1UJLVqTo8zdpfqMDvuwWrHmqDWm4=",
         "owner": "hyprwm",
         "repo": "Hyprland",
-        "rev": "c9e1a6c3a05c0310424f99c6b90af1164340af99",
+        "rev": "ae1690c2138313d988c81f5c25a9d0b6fadfd3b1",
         "type": "github"
       },
       "original": {
@@ -647,6 +710,25 @@
         "type": "github"
       }
     },
+    "impermanence": {
+      "inputs": {
+        "home-manager": "home-manager_2",
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "lastModified": 1769548169,
+        "narHash": "sha256-03+JxvzmfwRu+5JafM0DLbxgHttOQZkUtDWBmeUkN8Y=",
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "rev": "7b1d382faf603b6d264f58627330f9faa5cba149",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "type": "github"
+      }
+    },
     "nix-homebrew": {
       "inputs": {
         "brew-src": "brew-src"
@@ -665,6 +747,27 @@
         "type": "github"
       }
     },
+    "nix-vm-test": {
+      "inputs": {
+        "nixpkgs": [
+          "nixos-anywhere",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1781506385,
+        "narHash": "sha256-kvTBHLiqB911yf2D9VThIRfB6Ai/E2H9+mVF0wR+9AY=",
+        "owner": "numtide",
+        "repo": "nix-vm-test",
+        "rev": "2071ebc1f5b2a2e0211a2ca38c4e678092df76a5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "nix-vm-test",
+        "type": "github"
+      }
+    },
     "nixcord": {
       "inputs": {
         "flake-compat": "flake-compat_2",
@@ -675,11 +778,11 @@
         "nixpkgs-nixcord": "nixpkgs-nixcord"
       },
       "locked": {
-        "lastModified": 1782349937,
+        "lastModified": 1781775854,
-        "narHash": "sha256-2haY6BBTL+yCblUup/P9t3D8sUTMSqIok68n+qGjjYI=",
+        "narHash": "sha256-0eb1+zKSTwgD3qsBm7UiuRabahHQNkTP94Z/s3nMK60=",
         "owner": "kaylorben",
         "repo": "nixcord",
-        "rev": "afdacaafb10aa459dfabbb8af99e4b0deb74f1d2",
+        "rev": "b92ceb7923c87dfcfcf84415407b0ca63e17548b",
         "type": "github"
       },
       "original": {
@@ -688,6 +791,72 @@
         "type": "github"
       }
     },
+    "nixos-anywhere": {
+      "inputs": {
+        "disko": "disko_2",
+        "nix-vm-test": "nix-vm-test",
+        "nixos-images": "nixos-images",
+        "nixos-stable": "nixos-stable",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "treefmt-nix": "treefmt-nix"
+      },
+      "locked": {
+        "lastModified": 1782285665,
+        "narHash": "sha256-ISUNn+z9+BIDGRrNAmEfghvzFmDgKtGHGEYqIDvGeWk=",
+        "owner": "nix-community",
+        "repo": "nixos-anywhere",
+        "rev": "4b74194d2927a7741d023b3fd2a0d252059f75ee",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixos-anywhere",
+        "type": "github"
+      }
+    },
+    "nixos-images": {
+      "inputs": {
+        "nixos-stable": [
+          "nixos-anywhere",
+          "nixos-stable"
+        ],
+        "nixos-unstable": [
+          "nixos-anywhere",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1781778781,
+        "narHash": "sha256-CYnhWtKIr0xbxQT6N0X1j0FsmCG+cDV498jyO0xevwQ=",
+        "owner": "nix-community",
+        "repo": "nixos-images",
+        "rev": "94cbd4c8da5f130f188af04293514926a947b380",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixos-images",
+        "type": "github"
+      }
+    },
+    "nixos-stable": {
+      "locked": {
+        "lastModified": 1782116945,
+        "narHash": "sha256-G3tw/IXmaH6IQ2upZvhuN9sG8CkuX+BLuJDpE8hz0Ds=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "34268251cf5547d39063f2c5ea9a196246f7f3a6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-26.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1780749050,
@@ -736,6 +905,22 @@
       }
     },
     "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1768564909,
+        "narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "e4bae1bd10c9c57b2cf517953ab70060a828ee6f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
       "locked": {
         "lastModified": 1781577229,
         "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=",
@@ -751,13 +936,13 @@
         "type": "github"
       }
     },
-    "nixpkgs_3": {
+    "nixpkgs_4": {
       "locked": {
-        "lastModified": 1781607440,
+        "lastModified": 1782175435,
-        "narHash": "sha256-rxO+uc/KFbSJp+pgyXRuAX6QlG9hJdnt0BXpEQRXY+U=",
+        "narHash": "sha256-EMzXKmnOtBQ2MnvpiNOm7E+kOMvdPrIKaeg52Tip2Uk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3e41b24abd260e8f71dbe2f5737d24122f972158",
+        "rev": "89570f24e97e614aa34aa9ab1c927b6578a43775",
         "type": "github"
       },
       "original": {
@@ -770,15 +955,15 @@
     "nixvim": {
       "inputs": {
         "flake-parts": "flake-parts_2",
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs_4",
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1782254890,
+        "lastModified": 1781713417,
-        "narHash": "sha256-kjsEECqhpPnJWqhooXp6tWh2qGQftCPAo2G1GvZtKdw=",
+        "narHash": "sha256-Kaj44jTNmnaFhKrcADx8nXmUYPa7l2HYfb7m6lEPy7Q=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "dbf9550dba8448b03e11d58e5695d6c44a464554",
+        "rev": "caee4e5d4161778815f522d9ea1c9e3dc42462b7",
         "type": "github"
       },
       "original": {
@@ -795,11 +980,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782389847,
+        "lastModified": 1781800183,
-        "narHash": "sha256-eP8eqJcG07GXr/mNOm6xS4ws+7sKw8pPk9xbAf11tb8=",
+        "narHash": "sha256-NcRZr/JQiAvqC2qCyMxcfx/98Hf1epwdtjcbwKHeMf8=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "a573a709b3b6778499500cdea3ea134faef25218",
+        "rev": "0559d992b12ee209570bb325d79e90007b13da52",
         "type": "github"
       },
       "original": {
@@ -835,13 +1020,16 @@
       "inputs": {
         "catppuccin": "catppuccin",
         "darwin": "darwin",
+        "disko": "disko",
         "home-manager": "home-manager",
         "hyprcursor": "hyprcursor",
         "hyprland": "hyprland",
         "hyprland-plugins": "hyprland-plugins",
+        "impermanence": "impermanence",
         "nix-homebrew": "nix-homebrew",
         "nixcord": "nixcord",
-        "nixpkgs": "nixpkgs_2",
+        "nixos-anywhere": "nixos-anywhere",
+        "nixpkgs": "nixpkgs_3",
         "nixvim": "nixvim",
         "nur": "nur",
         "sops-nix": "sops-nix",
@@ -855,11 +1043,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782165805,
+        "lastModified": 1780547341,
-        "narHash": "sha256-478kKQBvK6SYTOdN2h9jhKJv94nbXRbFMfuL1WshErg=",
+        "narHash": "sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "56b24064fdcaedca53553b1a6d607fd23b613a24",
+        "rev": "9ed65852b6257fbeae4355bc24ecfea307ca759a",
         "type": "github"
       },
       "original": {
@@ -876,11 +1064,11 @@
         "systems": "systems_4"
       },
       "locked": {
-        "lastModified": 1782031037,
+        "lastModified": 1781425310,
-        "narHash": "sha256-a7oWSyS7SN81UOqVt481yIEMDsMpaJ7GNdV6Eaz5Yqg=",
+        "narHash": "sha256-GTBka4Df/ZOacmisI/DI2LICyNChEqn/giah83LucdM=",
         "owner": "Gerg-L",
         "repo": "spicetify-nix",
-        "rev": "9cb27462cfd20edac174353f1e95bc03aa888863",
+        "rev": "aeaf7c81a45d3761da61cb05bfc370ac6d1b0441",
         "type": "github"
       },
       "original": {
@@ -950,6 +1138,27 @@
         "type": "github"
       }
     },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixos-anywhere",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1780220602,
+        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
     "xdph": {
       "inputs": {
         "hyprland-protocols": [

flake.nix

@@ -5,6 +5,23 @@
     # monorepo w/ recipes ("derivations")
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
 
+    # declarative disk layout
+    disko = {
+      url = "github:nix-community/disko";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # declarative impermanence
+    impermanence = {
+      url = "github:nix-community/impermanence";
+    };
+
+    # declarative installer
+    nixos-anywhere = {
+      url = "github:nix-community/nixos-anywhere";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     # declarative Configs
     home-manager = {
       url = "github:nix-community/home-manager/master";
@@ -84,86 +101,54 @@
       hyprland,
       sops-nix,
       nur,
+      impermanence,
+      disko,
+      nixos-anywhere,
       ...
     }@inputs:
     let
       primaryUser = "phil";
 
-      /*
+      installer = nixpkgs.lib.nixosSystem {
-        mkIso - Build a NixOS image for a given target.
+        system = "x86_64-linux";
+        specialArgs = { inherit inputs; };
+        modules = [
+          {
+            nixpkgs = {
+              config.allowUnfree = true;
+              hostPlatform = "x86_64-linux";
+            };
+          }
+          ./hosts/installer/configuration.nix
+        ];
+      };
 
-        Available targets (imageModule → imageBuildAttr):
+      mkInstall =
-        		ISO (minimal)  : "${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"         → "isoImage"
-        		ISO (graphical): "${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix" → "isoImage"
-        		Amazon EC2     : "${nixpkgs}/nixos/modules/virtualisation/amazon-image.nix"                       → "amazonImage"
-        		Linode         : "${nixpkgs}/nixos/modules/virtualisation/linode-image.nix"                       → "linodeImage"
-        		Proxmox LXC    : "${nixpkgs}/nixos/modules/virtualisation/proxmox-lxc.nix"                       → "tarball"
-        		Google Cloud   : "${nixpkgs}/nixos/modules/virtualisation/google-compute-image.nix"               → "googleComputeImage"
-        		Azure          : "${nixpkgs}/nixos/modules/virtualisation/azure-image.nix"                        → "azureImage"
-        		QEMU (runnable): "${nixpkgs}/nixos/modules/virtualisation/qemu-vm.nix"                            → "vm"
-        		QEMU (headless): "${nixpkgs}/nixos/modules/virtualisation/qemu-vm.nix"                            → "vmWithBootLoader"
-        - Claude Sonnet 4.6
-      */
-      mkIso =
         {
           hostName,
-          isDarwin ? false,
+          target ? "192.168.2.99",
-          isServer ? false,
-          imageModule ? "${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix",
-          imageBuildAttr ? "isoImage",
         }:
-        (nixpkgs.lib.nixosSystem {
+        let
-          system = "x86_64-linux";
+          pkgs = nixpkgs.legacyPackages.x86_64-linux;
-          specialArgs = {
+        in
-            inherit
+        {
-              inputs
+          type = "app";
-              primaryUser
+          program = "${
-              self
+            pkgs.writeShellApplication {
-              hostName
+              name = "install-${hostName}";
-              isDarwin
+              runtimeInputs = [ nixos-anywhere.packages.x86_64-linux.nixos-anywhere ];
-              isServer
+              text = ''
-              ;
+                EXTRA_FILES="''${1:-./extra-files}"
-          };
+                TARGET="''${2:-${target}}"
-          modules = [
+                nixos-anywhere \
-            imageModule
+                  --flake .#${hostName} \
-            {
+                  --extra-files "$EXTRA_FILES" \
-              nixpkgs.overlays = [
+                  --chown /persist/secrets/age-key.txt "$(id -u ${primaryUser})":100 \
-                inputs.nur.overlays.default
+                  root@"$TARGET"
-                (import ./overlays { inherit (inputs) nur; })
+              '';
-              ];
             }
-            { nixpkgs.config.allowUnfree = true; }
+          }/bin/install-${hostName}";
-            { nixpkgs.hostPlatform = "x86_64-linux"; }
+        };
-            { networking.hostName = hostName; }
-            ./hosts/${hostName}/configuration.nix
-            ./nixos
-            inputs.sops-nix.nixosModules.sops
-            inputs.home-manager.nixosModules.home-manager
-            {
-              home-manager = {
-                extraSpecialArgs = {
-                  inherit
-                    inputs
-                    primaryUser
-                    self
-                    hostName
-                    isDarwin
-                    isServer
-                    ;
-                };
-                users.${primaryUser} = import ./home;
-                backupFileExtension = "backup";
-                useGlobalPkgs = true;
-                useUserPackages = true;
-                sharedModules = [
-                  {
-                    programs.nixvim.nixpkgs.source = inputs.nixpkgs;
-                  }
-                ];
-              };
-            }
-          ];
-        }).config.system.build.${imageBuildAttr};
 
       mkSystem =
         {
@@ -205,11 +190,6 @@
                 backupFileExtension = "hm-backup";
                 useGlobalPkgs = true;
                 useUserPackages = true;
-                sharedModules = [
-                  {
-                    programs.nixvim.nixpkgs.source = inputs.nixpkgs;
-                  }
-                ];
               };
             }
           ];
@@ -224,6 +204,8 @@
               [
                 { nixpkgs.hostPlatform = system; }
                 ./nixos
+                inputs.impermanence.nixosModules.impermanence
+                inputs.disko.nixosModules.disko
               ];
 
         in
@@ -235,6 +217,8 @@
     in
     {
       nixosConfigurations = {
+        "installer" = installer;
+
         "cyper-desktop" = mkSystem {
           hostName = "cyper-desktop";
           system = "x86_64-linux";
@@ -272,25 +256,28 @@
       };
 
       packages.x86_64-linux = {
-        cyper-desktop-iso = mkIso { hostName = "cyper-desktop"; };
+        installer = self.nixosConfigurations.installer.config.system.build.isoImage;
-        cyper-controller-iso = mkIso {
-          hostName = "cyper-controller";
-          isServer = true;
-        };
-        cyper-proxy-iso = mkIso {
-          hostName = "cyper-proxy";
-          isServer = true;
-        };
-        cyper-node-1-iso = mkIso {
-          hostName = "cyper-node-1";
-          isServer = true;
-        };
-        cyper-node-2-iso = mkIso {
-          hostName = "cyper-node-2";
-          isServer = true;
-        };
       };
 
       formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt-tree;
+
+      apps.x86_64-linux = {
+        install-cyper-node-1 = mkInstall {
+          hostName = "cyper-node-1";
+        };
+        install-cyper-node-2 = mkInstall {
+          hostName = "cyper-node-2";
+        };
+        install-cyper-controller = mkInstall {
+          hostName = "cyper-controller";
+        };
+        install-cyper-proxy = mkInstall {
+          hostName = "cyper-proxy";
+          target = ""; # KVM console IP
+        };
+        install-cyper-desktop = mkInstall {
+          hostName = "cyper-desktop";
+        };
+      };
     };
 }

home/default.nix

@@ -43,8 +43,8 @@
     enableNixpkgsReleaseCheck = false;
     stateVersion = "26.05";
     sessionVariables = lib.mkIf (!isDarwin && !isServer) {
-      GROQ_API_KEY = config.sops.secrets.GROQ_API_KEY.path;
+      GROQ_API_KEY = config.sops.secrets."api_keys/groq".path;
-      OPENWEATHER_API_KEY = config.sops.secrets.OPENWEATHER_API_KEY.path;
+      OPENWEATHER_API_KEY = config.sops.secrets."api_keys/openweather".path;
     };
     file = lib.mkIf (!isServer) {
       "Pictures/Avatar" = {
@@ -65,15 +65,15 @@
       if isDarwin then
         "/Users/${primaryUser}/.config/nix/secrets/keys.txt"
       else
-        "/home/${primaryUser}/.config/nix/secrets/keys.txt";
+        "/persist/secrets/age-key.txt";
     secrets = {
-      GROQ_API_KEY = { };
+      "api_keys/groq" = { };
-      OPENWEATHER_API_KEY = { };
+      "api_keys/openweather" = { };
-      ssh_private_key = {
+      "ssh/private_key" = {
         path = if isDarwin then "/Users/${primaryUser}/.ssh/ssh" else "/home/${primaryUser}/.ssh/ssh";
         mode = "0600";
       };
-      ssh_github_key = {
+      "ssh/github_key" = {
         path = if isDarwin then "/Users/${primaryUser}/.ssh/github" else "/home/${primaryUser}/.ssh/github";
         mode = "0600";
       };

home/desktop/default.nix

@@ -1,4 +1,4 @@
-_: {
+{
   imports = [
     ./hyprland
     ./rofi

home/desktop/gtk.nix

@@ -8,12 +8,6 @@ in
     packages = with pkgs; [
       adwaita-icon-theme
     ];
-    #pointerCursor = {
-    #  gtk.enable = true;
-    #  name = "catppuccin-mocha-sapphire-cursors";
-    #  package = pkgs.catppuccin-cursors.mochaSapphire;
-    #  size = 24;
-    #};
     file = {
       ".config/gtk-4.0/gtk.css".source = "${theme}/share/themes/${theme_name}/gtk-4.0/gtk.css";
       ".config/gtk-4.0/gtk-dark.css".source = "${theme}/share/themes/${theme_name}/gtk-4.0/gtk-dark.css";

home/desktop/hyprland/default.nix

@@ -15,6 +15,7 @@
     pamixer
     brightnessctl
     playerctl
+    waypaper
   ];
 
   systemd.user.targets.hyprland-session.Unit.Wants = [ "xdg-desktop-autostart.target" ];

home/desktop/hyprland/hypridle.nix

@@ -1,6 +1,4 @@
-{ ... }:
 {
-  # Hypridle configuration
   services.hypridle = {
     enable = true;
     settings = {
@@ -8,7 +6,7 @@
         after_sleep_cmd = "hyprctl dispatch dpms on";
         ignore_dbus_inhibit = false;
         lock_cmd = "hyprlock";
-        before_sleep_cmd = "notify-send -u critical \"I'm getting sleepy… I'll see you in my code dreams 💖\" --icon=$HOME/.config/hypr/avatar.png --app-name=Hyprlock";
+        before_sleep_cmd = "notify-send -u critical \"I'm getting sleepy… I'll see you in my code dreams 💖\" --app-name=Hyprlock";
       };
 
       listener = [

home/desktop/hyprland/hyprlock.nix

@@ -1,8 +1,4 @@
-{ ... }:
-
 {
-
-  # Hyprlock configuration
   programs.hyprlock = {
     enable = true;
     settings = {
@@ -18,7 +14,7 @@
 
       background = [
         {
-          path = "~/Pictures/Wallpapers/lucy_with_cat.png";
+          path = "$HOME/Pictures/Wallpapers/lucy_with_cat.png";
           blur_passes = 1;
           blur_size = 5;
         }
@@ -81,7 +77,7 @@
         outline_thickness = 4;
         dots_size = 0.2;
         dots_spacing = 0.2;
-        dots_center = "true";
+        dots_center = true;
         outer_color = "$red";
         inner_color = "$surface0";
         font_color = "$text";
@@ -97,16 +93,17 @@
         valign = "center";
       };
 
-      image = {
+      image = [
-        monitor = "";
+        {
-        path = "~/.config/hypr/avatar/avatar.png";
+          monitor = "";
-        size = 300;
+          path = "$HOME/Pictures/Avatar/miku_happy_sparkels.png";
-        border_color = "$teal";
+          size = 300;
-        position = "0, 75";
+          border_color = "$teal";
-        halign = "center";
+          position = "0, 75";
-        valign = "center";
+          halign = "center";
-      };
+          valign = "center";
+        }
+      ];
     };
   };
-
 }

home/desktop/hyprland/mako.nix

@@ -1,4 +1,3 @@
-{ ... }:
 {
   services.mako = {
     enable = true;

home/desktop/qt.nix

@@ -6,10 +6,10 @@
     platformTheme.name = "kvantum";
   };
   home.packages = lib.mkIf (!pkgs.stdenv.isDarwin) (
-    with pkgs;
+    with pkgs.kdePackages;
     [
-      kdePackages.qt6ct
+      qt6ct
-      kdePackages.qtstyleplugin-kvantum
+      qtstyleplugin-kvantum
     ]
   );
 }

home/desktop/waybar/common.nix

@@ -150,11 +150,11 @@
       format = "{}";
       return-type = "json";
       exec = ''
-        curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/OPENWEATHER_API_KEY)&units=metric&lang=en" | jq -c '{text: "\(.name) \(.main.temp)C°"}'
+        curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/api_keys/openweather)&units=metric&lang=en" | jq -c '{text: "\(.name) \(.main.temp)C°"}'
       '';
       interval = 120;
       on-click = ''
-        data=$(curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/OPENWEATHER_API_KEY)&units=metric&lang=en")
+        data=$(curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/api_keys/openweather)&units=metric&lang=en")
         city=$(echo "$data" | jq -r '.name')
         temp=$(echo "$data" | jq -r '.main.temp')
         feels=$(echo "$data" | jq -r '.main.feels_like')
@@ -163,7 +163,7 @@
         clouds=$(echo "$data" | jq -r '.clouds.all')
         sunrise=$(echo "$data" | jq -r '.sys.sunrise | strftime("%H:%M")')
         sunset=$(echo "$data" | jq -r '.sys.sunset | strftime("%H:%M")')
-        notify-send "$city" "Temperature: $temp °C\nFeels Like: $feels °C\nHumidity: $humidity%\nWind: $wind m/s\nClouds: $clouds%\nSunrise at: $sunrise\nSunset at: $sunset" -u normal --icon="$HOME/Pictures/Avatar/avatar_weather_no_bg.png"
+        notify-send "$city" "Temperature: $temp °C\nFeels Like: $feels °C\nHumidity: $humidity%\nWind: $wind m/s\nClouds: $clouds%\nSunrise at: $sunrise\nSunset at: $sunset" -u normal --icon="$HOME/Pictures/Avatar/miku_window_no_bg.png"
       '';
     };
 

home/desktop/waybar/default.nix

@@ -13,12 +13,14 @@
     // (import ./dual.nix { inherit compositor; })
   );
 
-  home.packages = lib.mkIf (!pkgs.stdenv.isDarwin) (with pkgs; [ cava ]);
+  home = {
+    packages = lib.mkIf (!pkgs.stdenv.isDarwin) (with pkgs; [ cava ]);
 
-  home.file = lib.mkIf (!pkgs.stdenv.isDarwin) {
+    file = lib.mkIf (!pkgs.stdenv.isDarwin) {
-    ".config/waybar" = {
+      ".config/waybar" = {
-      source = ./configs;
+        source = ./configs;
-      recursive = true;
+        recursive = true;
+      };
     };
   };
 }

home/desktop/waybar/niri-wm.nix

@@ -1,31 +0,0 @@
-{
-  widgets = {
-    "niri/workspaces" = {
-      format = "{icon}";
-      format-icons = {
-        default = "";
-        active = "";
-      };
-    };
-    "custom/swaync" = {
-      tooltip = false;
-      format = "{icon}";
-      format-icons = {
-        notification = "<span foreground='red'><sup></sup></span>";
-        none = " ";
-        dnd-notification = "<span foreground='red'><sup></sup></span>";
-        dnd-none = " ";
-        inhibited-notification = "<span foreground='red'><sup></sup></span>";
-        inhibited-none = " ";
-        dnd-inhibited-notification = "<span foreground='red'><sup></sup></span>";
-        dnd-inhibited-none = " ";
-      };
-      return-type = "json";
-      exec-if = "which swaync-client";
-      exec = "swaync-client -swb";
-      on-click = "swaync-client -t -sw";
-      on-click-right = "swaync-client -d -sw";
-      escape = true;
-    };
-  };
-}

home/floorp/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, primaryUser, ... }:
 let
   addons = pkgs.nur.repos.rycee.firefox-addons;
   readJson = path: builtins.readFile path;
@@ -22,6 +22,10 @@ let
     };
 in
 {
+  home.persistence."/persist/home".directories = [
+    ".mozilla/firefox/${primaryUser}"
+  ];
+
   programs.floorp = {
     enable = true;
 

home/impermanence.nix

@@ -0,0 +1,11 @@
+{
+  home.persistence."/persist/home" = {
+    hideMounts = true;
+    directories = [
+      ".config/nix"
+      "Documents"
+      "Downloads"
+      "Pictures"
+    ];
+  };
+}

home/neovim/avante.nix

@@ -1,6 +1,4 @@
-{ pkgs, ... }:
 {
-  # Avante: AI-powered coding assistant (Cursor-like experience in Neovim)
   programs.nixvim = {
     plugins = {
       markdown-preview.enable = true;
@@ -14,7 +12,7 @@
           providers = {
             groq = {
               __inherited_from = "openai";
-              api_key_name = "cmd:cat /home/phil/.config/sops-nix/secrets/GROQ_API_KEY";
+              api_key_name = "cmd:cat /home/phil/.config/sops-nix/secrets/api_keys/groq";
               endpoint = "https://api.groq.com/openai/v1/";
               model = "qwen/qwen3-32b";
               system_promt = "You are a helpful coding assistant. Always respond in plain markdown format without using tool calls or JSON structures.";
@@ -29,10 +27,10 @@
             };
 
             ollama = {
-              endpoint = "http://100.86.56.71:11434"; # tailscale IP, no /v1 suffix
+              endpoint = "http://10.10.0.2:11434";
-              model = "qwen2.5:3b"; # swap for "llama3.2:3b" or "deepseek-r1:1.5b"
+              model = "qwen2.5:3b";
-              timeout = 60000; # local + small model can be slow on first load
+              timeout = 60000;
-              disable_tools = true; # these small models aren't reliable at tool calling
+              disable_tools = true;
               is_env_set.__raw = ''require("avante.providers.ollama").check_endpoint_alive'';
               extra_request_body = {
                 options = {

home/neovim/conform.nix

@@ -5,7 +5,6 @@
   programs.nixvim = {
     plugins.conform-nvim = {
       enable = true;
-
       settings = {
         formatters_by_ft = {
           lua = [ "stylua" ];
@@ -13,6 +12,40 @@
           python = [ "black" ];
           rust = [ "rustfmt" ];
           rasi = [ "prettierd" ];
+          c = [ "clang_format" ];
+          cpp = [ "clang_format" ];
+        };
+
+        formatters.clang_format = {
+          # If the file has a project .clang-format (walking up from the
+          # file itself, not nvim's cwd), use it - this is how a real
+          # kernel checkout, or any other C/C++ project's own style,
+          # gets respected automatically. Otherwise fall back to an
+          # inline approximation of kernel style instead of plain LLVM,
+          # since that's the sane default for one-off C files.
+          prepend_args = {
+            __raw = ''
+              function(self, ctx)
+                local found = vim.fs.find(
+                  { ".clang-format", "_clang-format" },
+                  { path = ctx.filename, upward = true }
+                )[1]
+                if found then
+                  return { "-style=file" }
+                end
+                return {
+                  "-style={BasedOnStyle: LLVM, IndentWidth: 8, UseTab: Always, "
+                  .. "TabWidth: 8, BreakBeforeBraces: Linux, ColumnLimit: 80, "
+                  .. "IndentCaseLabels: false, PointerAlignment: Right, "
+                  .. "DerivePointerAlignment: false, SpaceBeforeParens: ControlStatements, "
+                  .. "SpacesInParentheses: false, SpaceAfterCStyleCast: false, "
+                  .. "AllowShortIfStatementsOnASingleLine: false, AllowShortBlocksOnASingleLine: false, "
+                  .. "AllowShortFunctionsOnASingleLine: None, AllowShortLoopsOnASingleLine: false, "
+                  .. "ReflowComments: false}"
+                }
+              end
+            '';
+          };
         };
 
         format_on_save = {
@@ -21,7 +54,6 @@
         };
       };
     };
-
     # Install formatters
     extraPackages = with pkgs; [
       stylua
@@ -29,6 +61,7 @@
       black
       rustfmt
       prettierd
+      clang-tools # provides clang-format
     ];
   };
 }

home/neovim/default.nix

@@ -32,6 +32,8 @@
 
   programs.nixvim = {
     enable = true;
+    nixpkgs.source = inputs.nixpkgs;
+
     defaultEditor = true;
     enableMan = false;
 

home/neovim/lsp.nix

@@ -29,6 +29,7 @@
             installRustc = true;
           };
           pylsp.enable = true; # Python language server
+          clangd.enable = true;
         };
 
         # Keymaps for LSP actions
@@ -85,6 +86,7 @@
       lua-language-server
       nil
       rust-analyzer
+      clang-tools
     ];
   };
 }

home/nixcord.nix

@@ -1,9 +1,17 @@
-{ lib, inputs, ... }:
+{
+  lib,
+  inputs,
+  ...
+}:
 {
   imports = [
     inputs.nixcord.homeModules.nixcord
   ];
 
+  home.persistence."/persist/home".directories = [
+    ".config/vesktop"
+  ];
+
   programs.nixcord = {
     enable = true;
     discord = lib.mkForce { enable = false; };

home/obsidian.nix

@@ -2,6 +2,7 @@
   config,
   pkgs,
   lib,
+  primaryUser,
   ...
 }:
 let
@@ -20,26 +21,32 @@ in
     };
   };
 
-  home.packages = with pkgs; [
+  home = {
-    git
+    packages = with pkgs; [
-    git-lfs
+      git
-    openssh
+      git-lfs
-  ];
+      openssh
+    ];
 
-  home.activation.obsidianVault = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+    persistence."/persist/home".directories = [
-    export PATH="${gitBin}:${gitLfsBin}:$PATH"
+      "Notes"
-    export GIT_SSH_COMMAND="${sshBinary} -o StrictHostKeyChecking=accept-new"
+    ];
-    export GIT_LFS_SKIP_SMUDGE=1
 
-    if [ ! -d "${vaultPath}/.git" ]; then
+    activation.obsidianVault = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
-    		echo "Cloning Obsidian vault (LFS objects will be pulled separately)..."
+      export PATH="${gitBin}:${gitLfsBin}:$PATH"
-    		${gitBin}/git clone "${vaultRepo}" "${vaultPath}"
+      export GIT_SSH_COMMAND="${sshBinary} -o StrictHostKeyChecking=accept-new"
-    		${gitLfsBin}/git-lfs install --local "${vaultPath}"
+      export GIT_LFS_SKIP_SMUDGE=1
-    		${gitBin}/git -C "${vaultPath}" lfs pull
+
-    else
+      if [ ! -d "${vaultPath}/.git" ]; then
-    		echo "Pulling latest changes for Obsidian vault..."
+      		echo "Cloning Obsidian vault (LFS objects will be pulled separately)..."
-    		${gitBin}/git -C "${vaultPath}" pull
+      		${gitBin}/git clone "${vaultRepo}" "${vaultPath}"
-    		${gitBin}/git -C "${vaultPath}" lfs pull
+      		${gitLfsBin}/git-lfs install --local "${vaultPath}"
-    fi
+      		${gitBin}/git -C "${vaultPath}" lfs pull
-  '';
+      else
+      		echo "Pulling latest changes for Obsidian vault..."
+      		${gitBin}/git -C "${vaultPath}" pull
+      		${gitBin}/git -C "${vaultPath}" lfs pull
+      fi
+    '';
+  };
 }

home/opencode.nix

@@ -12,7 +12,7 @@ _: {
           npm = "@ai-sdk/openai-compatible";
           name = "Ollama (tailscale)";
           options = {
-            baseURL = "http://100.86.56.71:11434/v1";
+            baseURL = "http://10.10.0.2:11434/v1";
           };
           models = {
             "llama3.2:3b" = {

home/shell.nix

@@ -2,26 +2,43 @@
   pkgs,
   isDarwin,
   lib,
+  primaryUser,
   ...
 }:
 {
-  home.packages = with pkgs; [
+  home = {
-    eza # ls replacement
+    packages = with pkgs; [
-    tdf # terminal pdf viewer
+      eza # ls replacement
-    jq # json parser
+      tdf # terminal pdf viewer
-    fastfetch # system stats
+      jq # json parser
-    tabiew # Table viewer
+      fastfetch # system stats
-    glow # MD Viewer
+      tabiew # Table viewer
-    fd # find alternative
+      glow # MD Viewer
-    bat # cat alternative
+      fd # find alternative
-    ripgrep # grep alternative
+      bat # cat alternative
-    dnsutils
+      ripgrep # grep alternative
+      dnsutils
 
-    # Fun stuff
+      # Fun stuff
-    zoxide
+      zoxide
-    lolcat
+      lolcat
-    cmatrix
+      cmatrix
-  ];
+    ];
+
+    persistence = lib.mkIf (!isDarwin) {
+      "/persist/home" = {
+        directories = [ ".local/share/zoxide" ];
+        files = [ ".local/share/fish/fish_history" ];
+      };
+    };
+
+    file = {
+      ".config/fastfetch/config.jsonc".source = ./fastfetch.jsonc;
+      ".config/tabiew/theme.toml".source = ./tabiew.toml;
+      ".config/kitty/tab_bar.py".source = ./tab_bar.py;
+      ".hushlogin" = lib.mkIf isDarwin { text = ""; }; # Suppress Login
+    };
+  };
 
   programs = {
     kitty = {
@@ -243,30 +260,4 @@
     };
   };
 
-  home = {
-    file = {
-      ".config/fastfetch/config.jsonc".source = ./fastfetch.jsonc;
-      ".config/tabiew/theme.toml".source = ./tabiew.toml;
-      ".config/kitty/tab_bar.py".source = ./tab_bar.py;
-      ".hushlogin" = lib.mkIf isDarwin { text = ""; }; # Suppress Login
-
-      # Link LLM std template
-      ".config/io.datasette.llm/templates/std.yaml".text = ''
-        system: |
-          You are a concise technical assistant running on an Intel Mac (x86_64-darwin) 
-          with nix-darwin and home-manager.
-          
-          Rules:
-          - Always respond in valid markdown
-          - Be concise and direct, no unnecessary explanation
-          - Prefer code blocks for commands and code
-          - You have access to these tools in the shell: nvim, fish, git, 
-            eza, bat, ripgrep, fzf, yazi, glow, llm, zoxide, fastfetch,
-            nix, darwin-rebuild, brew
-          - When suggesting nix config changes, use the nix language
-          - nix-switch rebuilds the system config
-          - nix-check validates the flake without building
-      '';
-    };
-  };
 }

home/spicetify.nix

@@ -1,9 +1,17 @@
-{ pkgs, inputs, ... }:
+{
+  pkgs,
+  inputs,
+  ...
+}:
 {
   imports = [
     inputs.spicetify-nix.homeManagerModules.default
   ];
 
+  home.persistence."/persist/home".directories = [
+    ".config/spotify"
+  ];
+
   programs.spicetify =
     let
       spicePkgs = inputs.spicetify-nix.legacyPackages.${pkgs.system};

hosts/cyper-controller/configuration.nix

@@ -1,5 +1,6 @@
 {
   imports = [
+    ./disko.nix
     ./hardware-configuration.nix
     ./smb.nix
     ../../nixos/roles/monitoring.nix
@@ -11,7 +12,6 @@
     ../../nixos/roles/gitea.nix
     ../../nixos/roles/vaultwarden.nix
     ../../nixos/roles/frontpage
-    #../../nixos/roles/paperless-ngx.nix
     ../../nixos/roles/octoprint.nix
     ../../nixos/roles/matrix/postgres-backup.nix
     ../../nixos/roles/kanidm.nix
@@ -22,6 +22,17 @@
     useNetworkd = true;
     useDHCP = false;
     firewall.enable = true;
+    wireguard.interfaces.wg0 = {
+      ips = [ "10.10.0.2/24" ];
+      peers = [
+        {
+          publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=";
+          endpoint = "178.254.8.35:51820";
+          allowedIPs = [ "10.10.0.0/24" ];
+          persistentKeepalive = 25;
+        }
+      ];
+    };
   };
 
   systemd.network = {
@@ -45,5 +56,6 @@
     };
     efi.canTouchEfiVariables = true;
   };
+
   system.stateVersion = "26.05";
 }

hosts/cyper-controller/disko.nix

@@ -0,0 +1,62 @@
+{
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/sda";
+    content = {
+      type = "gpt";
+      partitions = {
+        ESP = {
+          size = "512M";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = [
+              "fmask=0022"
+              "dmask=0022"
+            ];
+            extraArgs = [
+              "-n"
+              "NIXBOOT"
+            ];
+          };
+        };
+        swap = {
+          size = "8G";
+          content = {
+            type = "swap";
+            extraArgs = [
+              "-L"
+              "NIXSWAP"
+            ];
+          };
+        };
+        nix = {
+          size = "80G";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/nix";
+            extraArgs = [
+              "-L"
+              "NIXSTORE"
+            ];
+          };
+        };
+        persist = {
+          size = "100%";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/persist";
+            extraArgs = [
+              "-L"
+              "NIXPERSIST"
+            ];
+          };
+        };
+      };
+    };
+  };
+}

hosts/cyper-controller/hardware-configuration.nix

@@ -5,7 +5,6 @@
   primaryUser,
   ...
 }:
-
 {
   imports = [
     (modulesPath + "/installer/scan/not-detected.nix")
@@ -17,25 +16,21 @@
       "ahci"
       "usb_storage"
       "sd_mod"
+      "nvme"
     ];
     initrd.kernelModules = [ ];
     kernelModules = [ "kvm-intel" ];
     extraModulePackages = [ ];
-    zfs.forceImportRoot = false;
   };
 
   fileSystems = {
-    "/" = lib.mkForce {
+    "/" = {
-      device = "/dev/disk/by-label/NIXROOT";
+      device = "none";
-      fsType = "ext4";
+      fsType = "tmpfs";
-    };
-
-    "/boot" = lib.mkForce {
-      device = "/dev/disk/by-label/NIXBOOT";
-      fsType = "vfat";
       options = [
-        "fmask=0022"
+        "defaults"
-        "dmask=0022"
+        "size=6G"
+        "mode=755"
       ];
     };
 
@@ -71,6 +66,8 @@
       ];
     };
 
+    "/nix".neededForBoot = true;
+    "/persist".neededForBoot = true;
   };
 
   systemd.tmpfiles.rules = [
@@ -80,12 +77,7 @@
     "d /storage/backup 0755 ${primaryUser} users -"
   ];
 
-  swapDevices = [
+  networking.useDHCP = lib.mkDefault true;
-    {
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-      device = "/swapfile";
-      size = 4096;
-    }
-  ];
-
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/cyper-controller/smb.nix

@@ -1,11 +1,12 @@
 {
   pkgs,
   primaryUser,
+  config,
   ...
 }:
 
 {
-  sops.secrets.smb_passwd = { };
+  sops.secrets."network/smb_passwd" = { };
 
   users.users.${primaryUser}.extraGroups = [ "sambashare" ];
 
@@ -93,7 +94,7 @@
           sleep 1
         done
 
-        PASSWORD=$(cat /run/secrets/smb_passwd)
+        PASSWORD=$(cat ${config.sops.secrets."network/smb_passwd".path})
         (echo "$PASSWORD"; echo "$PASSWORD") | ${pkgs.samba}/bin/smbpasswd -a -s ${primaryUser} || \
         (echo "$PASSWORD"; echo "$PASSWORD") | ${pkgs.samba}/bin/smbpasswd -s ${primaryUser}
       '';

hosts/cyper-desktop/configuration.nix

@@ -1,11 +1,24 @@
-{ ... }:
 {
-  imports = [ ./hardware-configuration.nix ];
+  imports = [
+    ./disko.nix
+    ./hardware-configuration.nix
+  ];
 
   networking = {
     useNetworkd = true;
     useDHCP = false;
     firewall.enable = true;
+    wireguard.interfaces.wg0 = {
+      ips = [ "10.10.0.40/24" ];
+      peers = [
+        {
+          publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=";
+          endpoint = "178.254.8.35:51820";
+          allowedIPs = [ "10.10.0.0/24" ];
+          persistentKeepalive = 25;
+        }
+      ];
+    };
   };
 
   systemd.network = {
@@ -50,4 +63,6 @@
 
   virtualisation.docker.enable = true;
   users.users.phil.extraGroups = [ "docker" ];
+
+  programs.fuse.userAllowOther = true;
 }

hosts/cyper-desktop/disko.nix

@@ -0,0 +1,68 @@
+{
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/sda";
+    content = {
+      type = "gpt";
+      partitions = {
+
+        ESP = {
+          size = "512M";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = [
+              "fmask=0022"
+              "dmask=0022"
+            ];
+            extraArgs = [
+              "-n"
+              "NIXBOOT"
+            ];
+          };
+        };
+
+        swap = {
+          size = "4G";
+          content = {
+            type = "swap";
+            extraArgs = [
+              "-L"
+              "NIXSWAP"
+            ];
+          };
+        };
+
+        nix = {
+          size = "110G";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/nix";
+            mountOptions = [ "defaults" ];
+            extraArgs = [
+              "-L"
+              "NIXSTORE"
+            ];
+          };
+        };
+
+        persist = {
+          size = "100%";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/persist";
+            extraArgs = [
+              "-L"
+              "NIXPERSIST"
+            ];
+          };
+        };
+
+      };
+    };
+  };
+}

hosts/cyper-desktop/hardware-configuration.nix

@@ -31,35 +31,32 @@
     extraModprobeConfig = ''
       options v4l2loopback exclusive_caps=1 card_label="Virtual Camera"
     '';
-    zfs.forceImportRoot = false;
   };
 
   sops = {
-    secrets.smb_passwd = { };
+    secrets."network/smb_passwd" = { };
-
     templates.smb_credentials = {
       content = ''
         username=${primaryUser}
-        password=${config.sops.placeholder.smb_passwd}
+        password=${config.sops.placeholder."network/smb_passwd"}
       '';
     };
   };
 
   fileSystems = {
     "/" = {
-      device = "/dev/disk/by-label/NIXROOT";
+      device = "none";
-      fsType = "ext4";
+      fsType = "tmpfs";
-    };
-
-    "/boot" = {
-      device = "/dev/disk/by-label/NIXBOOT";
-      fsType = "vfat";
       options = [
-        "fmask=0022"
+        "defaults"
-        "dmask=0022"
+        "size=4G"
+        "mode=755"
       ];
     };
 
+    "/nix".neededForBoot = true;
+    "/persist".neededForBoot = true;
+
     "/storage" = {
       device = "/dev/disk/by-label/STORAGE";
       fsType = "ext4";
@@ -99,8 +96,6 @@
     "d /shares/storage-backup 0775 ${primaryUser} users -"
   ];
 
-  swapDevices = [ ];
-
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 
   hardware = {

hosts/cyper-mac/configuration.nix

@@ -1 +1,3 @@
-{ ... }: { }
+{
+  launchd.daemons.wireguard.environment.WG_IP = "10.10.0.3/24";
+}

hosts/cyper-node-1/configuration.nix

@@ -1,5 +1,6 @@
 {
   imports = [
+    ./disko.nix
     ./hardware-configuration.nix
   ];
 
@@ -7,6 +8,17 @@
     useNetworkd = true;
     useDHCP = false;
     firewall.enable = true;
+    wireguard.interfaces.wg0 = {
+      ips = [ "10.10.0.30/24" ];
+      peers = [
+        {
+          publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=";
+          endpoint = "178.254.8.35:51820";
+          allowedIPs = [ "10.10.0.0/24" ];
+          persistentKeepalive = 25;
+        }
+      ];
+    };
   };
 
   systemd.network = {

hosts/cyper-node-1/disko.nix

@@ -0,0 +1,68 @@
+{
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/sda";
+    content = {
+      type = "gpt";
+      partitions = {
+
+        ESP = {
+          size = "512M";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = [
+              "fmask=0022"
+              "dmask=0022"
+            ];
+            extraArgs = [
+              "-n"
+              "NIXBOOT"
+            ];
+          };
+        };
+
+        swap = {
+          size = "4G";
+          content = {
+            type = "swap";
+            extraArgs = [
+              "-L"
+              "NIXSWAP"
+            ];
+          };
+        };
+
+        nix = {
+          size = "50G";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/nix";
+            mountOptions = [ "defaults" ];
+            extraArgs = [
+              "-L"
+              "NIXSTORE"
+            ];
+          };
+        };
+
+        persist = {
+          size = "100%";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/persist";
+            extraArgs = [
+              "-L"
+              "NIXPERSIST"
+            ];
+          };
+        };
+
+      };
+    };
+  };
+}

hosts/cyper-node-1/hardware-configuration.nix

@@ -4,7 +4,6 @@
   modulesPath,
   ...
 }:
-
 {
   imports = [
     (modulesPath + "/installer/scan/not-detected.nix")
@@ -20,34 +19,22 @@
     initrd.kernelModules = [ ];
     kernelModules = [ "kvm-intel" ];
     extraModulePackages = [ ];
-    zfs.forceImportRoot = false;
   };
 
   fileSystems = {
     "/" = {
-      device = "/dev/disk/by-label/NIXROOT";
+      device = "none";
-      fsType = "ext4";
+      fsType = "tmpfs";
-    };
-
-    "/boot" = {
-      device = "/dev/disk/by-label/NIXBOOT";
-      fsType = "vfat";
       options = [
-        "fmask=0022"
+        "defaults"
-        "dmask=0022"
+        "size=2G"
+        "mode=755"
       ];
     };
+
+    "/nix".neededForBoot = true;
+    "/persist".neededForBoot = true;
   };
 
-  swapDevices = [
-    {
-      device = "/swapfile";
-      size = 4096;
-    }
-  ];
-
-  networking.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/cyper-node-2/configuration.nix

@@ -1,5 +1,6 @@
 {
   imports = [
+    ./disko.nix
     ./hardware-configuration.nix
   ];
 
@@ -7,6 +8,17 @@
     useNetworkd = true;
     useDHCP = false;
     firewall.enable = true;
+    wireguard.interfaces.wg0 = {
+      ips = [ "10.10.0.31/24" ];
+      peers = [
+        {
+          publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=";
+          endpoint = "178.254.8.35:51820";
+          allowedIPs = [ "10.10.0.0/24" ];
+          persistentKeepalive = 25;
+        }
+      ];
+    };
   };
 
   systemd.network = {

hosts/cyper-node-2/disko.nix

@@ -0,0 +1,68 @@
+{
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/sda";
+    content = {
+      type = "gpt";
+      partitions = {
+
+        ESP = {
+          size = "512M";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = [
+              "fmask=0022"
+              "dmask=0022"
+            ];
+            extraArgs = [
+              "-n"
+              "NIXBOOT"
+            ];
+          };
+        };
+
+        swap = {
+          size = "4G";
+          content = {
+            type = "swap";
+            extraArgs = [
+              "-L"
+              "NIXSWAP"
+            ];
+          };
+        };
+
+        nix = {
+          size = "50G";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/nix";
+            mountOptions = [ "defaults" ];
+            extraArgs = [
+              "-L"
+              "NIXSTORE"
+            ];
+          };
+        };
+
+        persist = {
+          size = "100%";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/persist";
+            extraArgs = [
+              "-L"
+              "NIXPERSIST"
+            ];
+          };
+        };
+
+      };
+    };
+  };
+}

hosts/cyper-node-2/hardware-configuration.nix

@@ -4,7 +4,6 @@
   modulesPath,
   ...
 }:
-
 {
   imports = [
     (modulesPath + "/installer/scan/not-detected.nix")
@@ -20,34 +19,22 @@
     initrd.kernelModules = [ ];
     kernelModules = [ "kvm-intel" ];
     extraModulePackages = [ ];
-    zfs.forceImportRoot = false;
   };
 
   fileSystems = {
     "/" = {
-      device = "/dev/disk/by-label/NIXROOT";
+      device = "none";
-      fsType = "ext4";
+      fsType = "tmpfs";
-    };
-
-    "/boot" = {
-      device = "/dev/disk/by-label/NIXBOOT";
-      fsType = "vfat";
       options = [
-        "fmask=0022"
+        "defaults"
-        "dmask=0022"
+        "size=2G"
+        "mode=755"
       ];
     };
+
+    "/nix".neededForBoot = true;
+    "/persist".neededForBoot = true;
   };
 
-  swapDevices = [
-    {
-      device = "/swapfile";
-      size = 4096;
-    }
-  ];
-
-  networking.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/cyper-proxy/configuration.nix

@@ -1,6 +1,7 @@
 { ... }:
 {
   imports = [
+    ./disko.nix
     ./hardware-configuration.nix
     ../../nixos/roles/nginx.nix
     #    ../../nixos/roles/jitsi.nix
@@ -13,18 +14,18 @@
     interfaces.ens3 = {
       ipv4.addresses = [
         {
-          address = "178.254.8.35";
+          address = "195.90.219.9";
-          prefixLength = 23;
+          prefixLength = 22;
         }
       ];
       ipv6.addresses = [
         {
-          address = "2a00:6800:3:1094::1";
+          address = "2a00:6800:3:113e::1";
           prefixLength = 64;
         }
       ];
     };
-    defaultGateway = "178.254.8.1";
+    defaultGateway = "195.90.216.1";
 
     defaultGateway6 = {
       address = "2a00:6800:3::1";
@@ -36,18 +37,46 @@
       "178.254.16.141"
     ];
 
+    wireguard.interfaces.wg0 = {
+      ips = [ "10.10.0.1/24" ];
+      listenPort = 51820;
+      peers = [
+        {
+          publicKey = "EvML4de3CReNW8aF+lJAsPZ+p6FICOyjCsAZJBwIwX8=";
+          allowedIPs = [ "10.10.0.2/32" ];
+        }
+        {
+          publicKey = "WkY45tGnNZQuJTf1MPN6I92spxHts/kpzXRSZE9se2c=";
+          allowedIPs = [ "10.10.0.3/32" ];
+        }
+        {
+          publicKey = "oAstNd7Wxpj2PqSyS87q+8y8WtaLK7hZ5Ytfncml9EM=";
+          allowedIPs = [ "10.10.0.40/32" ];
+        }
+        {
+          publicKey = "GrFH3I5QqjRij7Jl+eOL6Ou6zK6MtH5/kAsA5AmGckM=";
+          allowedIPs = [ "10.10.0.30/32" ];
+        }
+        {
+          publicKey = "IddGAijZVCVxGj/aMasjfroIy9r8Owar4MO9xfvNNBY=";
+          allowedIPs = [ "10.10.0.31/32" ];
+        }
+      ];
+    };
+
     firewall.allowedTCPPorts = [
       80
       443
+      51820
     ];
 
     hosts = {
-      "178.254.8.35" = [
+      "195.90.219.9" = [
         "cyperpunk.de"
         "matrix.cyperpunk.de"
       ];
 
-      "2a00:6800:3:1094::1" = [
+      "2a00:6800:3:113e::1" = [
         "cyperpunk.de"
         "matrix.cyperpunk.de"
       ];

hosts/cyper-proxy/disko.nix

@@ -0,0 +1,65 @@
+{
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/vda";
+    content = {
+      type = "gpt";
+      partitions = {
+        boot = {
+          size = "1M";
+          type = "EF02";
+        };
+        ESP = {
+          size = "512M";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = [
+              "fmask=0022"
+              "dmask=0022"
+            ];
+            extraArgs = [
+              "-n"
+              "NIXBOOT"
+            ];
+          };
+        };
+        swap = {
+          size = "4G";
+          content = {
+            type = "swap";
+            extraArgs = [
+              "-L"
+              "NIXSWAP"
+            ];
+          };
+        };
+        nix = {
+          size = "40G";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/nix";
+            extraArgs = [
+              "-L"
+              "NIXSTORE"
+            ];
+          };
+        };
+        persist = {
+          size = "100%";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/persist";
+            extraArgs = [
+              "-L"
+              "NIXPERSIST"
+            ];
+          };
+        };
+      };
+    };
+  };
+}

hosts/cyper-proxy/hardware-configuration.nix

@@ -5,11 +5,6 @@
   ];
 
   boot = {
-    loader.grub = {
-      enable = true;
-      device = "/dev/vda";
-    };
-
     initrd = {
       availableKernelModules = [
         "ata_piix"
@@ -21,26 +16,24 @@
       ];
       kernelModules = [ ];
     };
+    kernel.sysctl."net.ipv4.ip_forward" = 1;
     kernelModules = [ ];
     extraModulePackages = [ ];
-    zfs.forceImportRoot = false;
   };
 
   fileSystems = {
     "/" = {
-      device = "/dev/disk/by-label/NIXROOT";
+      device = "none";
-      fsType = "ext4";
+      fsType = "tmpfs";
-    };
-
-    "/boot" = {
-      device = "/dev/disk/by-label/NIXBOOT";
-      fsType = "vfat";
       options = [
-        "fmask=0022"
+        "defaults"
-        "dmask=0022"
+        "size=2G"
+        "mode=755"
       ];
     };
-  };
 
-  swapDevices = [ ];
+    "/nix".neededForBoot = true;
+    "/persist".neededForBoot = true;
+  };
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }

hosts/installer/configuration.nix

@@ -0,0 +1,86 @@
+{ modulesPath, pkgs, ... }:
+{
+  imports = [ (modulesPath + "/installer/cd-dvd/installation-cd-minimal.nix") ];
+
+  boot.zfs.forceImportRoot = false;
+
+  time.timeZone = "Europe/Berlin";
+  i18n = {
+    defaultLocale = "en_US.UTF-8";
+    extraLocaleSettings = {
+      LC_ADDRESS = "de_DE.UTF-8";
+      LC_IDENTIFICATION = "de_DE.UTF-8";
+      LC_MEASUREMENT = "de_DE.UTF-8";
+      LC_MONETARY = "de_DE.UTF-8";
+      LC_NAME = "de_DE.UTF-8";
+      LC_NUMERIC = "de_DE.UTF-8";
+      LC_PAPER = "de_DE.UTF-8";
+      LC_TELEPHONE = "de_DE.UTF-8";
+      LC_TIME = "de_DE.UTF-8";
+    };
+  };
+
+  services.openssh = {
+    enable = true;
+    openFirewall = true;
+    settings = {
+      PermitRootLogin = "yes";
+      PasswordAuthentication = false;
+    };
+  };
+
+  users.users = {
+    root.openssh.authorizedKeys.keyFiles = [
+      ../../secrets/ssh-key
+    ];
+
+    phil = {
+      isNormalUser = true;
+      password = "nixos";
+      extraGroups = [ "wheel" ];
+      openssh.authorizedKeys.keyFiles = [
+        ../../secrets/ssh-key
+      ];
+    };
+  };
+
+  security.sudo = {
+    enable = true;
+    wheelNeedsPassword = false;
+  };
+
+  networking = {
+    useNetworkd = true;
+    useDHCP = false;
+    firewall.enable = false;
+  };
+
+  systemd.network = {
+    enable = true;
+    networks."10-ethernet" = {
+      matchConfig.Name = "en*";
+      networkConfig = {
+        #Address = "192.168.2.99/24";
+        #Gateway = "192.168.2.1";
+        #DNS = "192.168.2.2";
+        Address = "195.90.219.9/22";
+        Gateway = "195.90.216.1";
+        DNS = [
+          "178.254.16.151"
+          "178.254.16.141"
+        ];
+        DHCP = "no";
+      };
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    htop
+    lsscsi
+    pciutils
+    usbutils
+    nvme-cli
+  ];
+
+  system.stateVersion = "26.05";
+}

nixos/default.nix

@@ -11,8 +11,9 @@
   imports = [
     ./sops.nix
     ./locale.nix
-    ./tailscale.nix
+    ./wireguard.nix
     ./ssh.nix
+    ./impermanence.nix
   ]
   ++ lib.optionals (!isServer) [
     ./regreet.nix
@@ -22,9 +23,11 @@
     ./catppuccin.nix
   ];
 
-  sops.secrets."nix_cache_priv_key" = {
+  sops.secrets = {
-
+    "nix/cache_priv_key" = {
-    mode = "0400";
+      mode = "0400";
+    };
+    "nix/cachix_auth_token" = { };
   };
 
   nix = {
@@ -47,7 +50,7 @@
         "https://nix-community.cachix.org"
         "https://cyper-cache.cachix.org"
       ];
-      secret-key-files = [ config.sops.secrets."nix_cache_priv_key".path ];
+      secret-key-files = [ config.sops.secrets."nix/cache_priv_key".path ];
       trusted-public-keys = [
         "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
         "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
@@ -112,8 +115,6 @@
     };
   };
 
-  sops.secrets.cachix_auth_token = { };
-
   systemd.services.cachix-push = {
     description = "Push new store paths to Cachix";
     after = [ "multi-user.target" ];
@@ -121,14 +122,28 @@
     serviceConfig = {
       Type = "oneshot";
       RemainAfterExit = true;
-      ExecStart = "${pkgs.bash}/bin/bash -c 'CACHIX_AUTH_TOKEN=$(cat ${config.sops.secrets.cachix_auth_token.path}) ${pkgs.nix}/bin/nix path-info --recursive /run/current-system | CACHIX_AUTH_TOKEN=$(cat ${config.sops.secrets.cachix_auth_token.path}) ${pkgs.cachix}/bin/cachix push cyper-cache'";
+      ExecStart = "${pkgs.bash}/bin/bash -c 'CACHIX_AUTH_TOKEN=$(cat ${
+        config.sops.secrets."nix/cachix_auth_token".path
+      }) ${pkgs.nix}/bin/nix path-info --recursive /run/current-system | CACHIX_AUTH_TOKEN=$(cat ${
+        config.sops.secrets."nix/cachix_auth_token".path
+      }) ${pkgs.cachix}/bin/cachix push cyper-cache'";
     };
   };
 
-  networking.firewall.allowedTCPPorts = [
+  networking = {
-    9002
+    hosts = {
-    3100
+      "10.10.0.1" = [ "proxy.cyperpunk.de" ];
-  ];
+      "10.10.0.2" = [ "controller.cyperpunk.de" ];
+      "10.10.0.3" = [ "mac.cyperpunk.de" ];
+      "10.10.0.30" = [ "node1.cyperpunk.de" ];
+      "10.10.0.31" = [ "node2.cyperpunk.de" ];
+      "10.10.0.40" = [ "desktop.cyperpunk.de" ];
+    };
+    firewall.allowedTCPPorts = [
+      9002
+      3100
+    ];
+  };
 
   users.users.${primaryUser} = {
     home = "/home/${primaryUser}";

nixos/impermanence.nix

@@ -0,0 +1,18 @@
+_: {
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    files = [
+      "/etc/machine-id"
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/etc/ssh/ssh_host_ed25519_key.pub"
+      "/etc/ssh/ssh_host_rsa_key"
+      "/etc/ssh/ssh_host_rsa_key.pub"
+    ];
+    directories = [
+      "/var/lib/nixos"
+      "/var/lib/systemd"
+      "/var/log"
+      "/var/lib/tailscale"
+    ];
+  };
+}

nixos/regreet.nix

@@ -1,6 +1,7 @@
 {
   lib,
   pkgs,
+  primaryUser,
   ...
 }:
 {
@@ -8,35 +9,46 @@
     "greetd/background.png".source = ../assets/wallpapers/lucy_with_cat.png;
     "greetd/environments".text = ''
       Hyprland
-      niri-session
       fish
     '';
   };
 
   programs.regreet = {
-    enable = false;
+    enable = true;
-
     cageArgs = [
       "-s"
       "-m"
       "last"
     ];
-
+    theme = {
+      name = "catppuccin-mocha-standard-sky-dark";
+      package = pkgs.catppuccin-gtk;
+    };
+    cursorTheme = {
+      name = "catppuccin-mocha-sapphire-cursors";
+      package = pkgs.catppuccin-cursors.mochaSapphire;
+    };
+    iconTheme = {
+      name = "Papirus-Dark";
+      package = pkgs.papirus-icon-theme;
+    };
+    font = {
+      name = "FiraCode Nerd Font Propo";
+      size = 12;
+      package = pkgs.nerd-fonts.fira-code;
+    };
     settings = {
-
       background = {
         path = "/etc/greetd/background.png";
         fit = "Fill";
       };
-
       GTK = {
         application_prefer_dark_theme = true;
-        cursor_theme_name = lib.mkForce "catppuccin-mocha-dark-cursors";
+        cursor_theme_name = lib.mkForce "catppuccin-mocha-sapphire-cursors";
         font_name = lib.mkForce "FiraCode Nerd Font Propo 12";
         icon_theme_name = lib.mkForce "Papirus-Dark";
-        theme_name = lib.mkForce "catppuccin-mocha-standard-mauve-dark";
+        theme_name = lib.mkForce "catppuccin-mocha-standard-sky-dark";
       };
-
       commands = {
         reboot = [
           "systemctl"
@@ -46,16 +58,10 @@
           "systemctl"
           "poweroff"
         ];
-        x11_prefix = [
-          "startx"
-          "/usr/bin/env"
-        ];
       };
-
       appearance = {
         greeting_msg = "Hey there!";
       };
-
       widget.clock = {
         format = "%A %d.%m.%Y %T";
         resolution = "500ms";
@@ -69,12 +75,12 @@
     enable = true;
     settings = {
       default_session = {
-        command = "${pkgs.tuigreet}/bin/tuigreet --cmd start-hyprland";
+        command = "${pkgs.greetd.regreet}/bin/regreet";
         user = "greeter";
       };
       initial_session = {
-        command = "Hyprland";
+        command = "start-hyprland";
-        user = "phil";
+        user = primaryUser;
       };
     };
   };

nixos/roles/filebrowser.nix

@@ -1,5 +1,13 @@
-{ ... }:
 {
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/filebrowser";
+      user = "filebrowser";
+      group = "filebrowser";
+      mode = "0750";
+    }
+  ];
+
   services.filebrowser = {
     enable = true;
 

nixos/roles/frontpage/frontpage.nix

@@ -13,7 +13,7 @@ let
         "/var/lib/flame-${name}:/app/data"
       ]
       ++ extraVolumes;
-      environmentFiles = [ config.sops.secrets."flame_${name}_password".path ];
+      environmentFiles = [ config.sops.secrets."services/flame/${name}_password".path ];
     };
 
   instances = [
@@ -29,8 +29,35 @@ let
   ];
 in
 {
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/flame-phil";
+      user = "root";
+      group = "root";
+      mode = "0755";
+    }
+    {
+      directory = "/var/lib/flame-calvin";
+      user = "root";
+      group = "root";
+      mode = "0755";
+    }
+    {
+      directory = "/var/lib/docker";
+      user = "root";
+      group = "root";
+      mode = "0710";
+    }
+    {
+      directory = "/var/lib/private";
+      user = "root";
+      group = "root";
+      mode = "0700";
+    }
+  ];
+
   sops.secrets = lib.listToAttrs (
-    map ({ name, ... }: lib.nameValuePair "flame_${name}_password" { }) instances
+    map ({ name, ... }: lib.nameValuePair "services/flame/${name}_password" { }) instances
   );
 
   virtualisation = {

nixos/roles/gitea.nix

@@ -2,7 +2,6 @@
   pkgs,
   lib,
   config,
-  primaryUser,
   ...
 }:
 
@@ -20,33 +19,48 @@ let
 in
 {
   sops.secrets = {
-    "gitea/dbPassword" = {
+    "services/gitea/db_password" = {
       owner = "gitea";
       group = "gitea";
       mode = "0444";
     };
-    "gitea/internalToken" = {
+    "services/gitea/internal_token" = {
       owner = "gitea";
       group = "gitea";
     };
-    "gitea/lfsJwtSecret" = {
+    "services/gitea/lfs_jwt_secret" = {
       owner = "gitea";
       group = "gitea";
     };
-    "gitea/mailerPassword" = {
+    "services/gitea/mailer_password" = {
       owner = "gitea";
       group = "gitea";
     };
-    "gitea/runnerToken" = {
+    "services/gitea/runner_token" = {
       mode = "0444";
     };
-    "kanidm_gitea_secret" = {
+    "kanidm/gitea_secret" = {
       owner = "gitea";
       group = "gitea";
       mode = "0444";
     };
   };
 
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/gitea";
+      user = "gitea";
+      group = "gitea";
+      mode = "0750";
+    }
+    {
+      directory = "/var/lib/postgresql";
+      user = "postgres";
+      group = "postgres";
+      mode = "0750";
+    }
+  ];
+
   systemd.services = {
     gitea-db-password = {
       description = "Set gitea postgres user password";
@@ -60,7 +74,7 @@ in
         RemainAfterExit = true;
       };
       script = ''
-        pass=$(cat ${config.sops.secrets."gitea/dbPassword".path})
+        pass=$(cat ${config.sops.secrets."services/gitea/db_password".path})
         ${pkgs.postgresql_14}/bin/psql -c \
           "ALTER USER gitea WITH PASSWORD '$pass';"
       '';
@@ -111,7 +125,7 @@ in
         port = 5432;
         name = "gitea";
         user = "gitea";
-        passwordFile = config.sops.secrets."gitea/dbPassword".path;
+        passwordFile = config.sops.secrets."services/gitea/db_password".path;
       };
 
       settings = {
@@ -207,7 +221,7 @@ in
     gitea-actions-runner.instances."cyper_nix" = {
       enable = true;
       url = "https://git.cyperpunk.de";
-      tokenFile = config.sops.secrets."gitea/runnerToken".path;
+      tokenFile = config.sops.secrets."services/gitea/runner_token".path;
       name = "cyper-controller";
       labels = [ "nix:host" ];
 

nixos/roles/kanidm.nix

@@ -5,6 +5,15 @@ let
   certDir = "/var/lib/kanidm/tls";
 in
 {
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/kanidm";
+      user = "kanidm";
+      group = "kanidm";
+      mode = "0750";
+    }
+  ];
+
   systemd.services.kanidm-selfsigned-cert = {
     description = "Generate self-signed TLS certificate for Kanidm";
     wantedBy = [ "kanidm.service" ];

nixos/roles/matrix/clients.nix

@@ -149,6 +149,15 @@ let
 
 in
 {
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/containers";
+      user = "root";
+      group = "root";
+      mode = "0700";
+    }
+  ];
+
   services.nginx.virtualHosts = {
     "cinny.cyperpunk.de" = {
       forceSSL = true;

nixos/roles/matrix/coturn.nix

@@ -1,15 +1,14 @@
 { config, lib, ... }:
 {
   sops.secrets = {
-    coturn_static_auth_secret = {
+    "matrix/coturn_static_auth_secret" = {
       owner = "turnserver";
       group = "turnserver";
     };
-
     coturn_static_auth_secret_synapse = {
       owner = "matrix-synapse";
       group = "matrix-synapse";
-      key = "coturn_static_auth_secret";
+      key = "matrix/coturn_static_auth_secret";
     };
   };
 
@@ -21,7 +20,7 @@
       min-port = 49000;
       max-port = 50000;
       use-auth-secret = true;
-      static-auth-secret-file = config.sops.secrets.coturn_static_auth_secret.path;
+      static-auth-secret-file = config.sops.secrets."matrix/coturn_static_auth_secret".path;
       realm = "turn.cyperpunk.de";
       cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
       pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";

nixos/roles/matrix/default.nix

@@ -6,7 +6,7 @@
     ./synapse.nix
     ./livekit.nix
     ./clients.nix
-    ./mjolnir.nix
+    ./draupnir.nix
     ./coturn.nix
     ./maubot.nix
     ./discord-bridge.nix

nixos/roles/matrix/discord-bridge.nix

@@ -1,20 +1,29 @@
 { config, lib, ... }:
 {
   sops.secrets = {
-    discord_bot_token = {
+    "matrix/bridges/discord/bot_token" = {
       owner = "mautrix-discord";
       group = "mautrix-discord";
     };
-    discord_client_id = {
+    "matrix/bridges/discord/client_id" = {
       owner = "mautrix-discord";
       group = "mautrix-discord";
     };
-    discord_pickle_key = {
+    "matrix/bridges/discord/pickle_key" = {
       owner = "mautrix-discord";
       group = "mautrix-discord";
     };
   };
 
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/mautrix-discord";
+      user = "mautrix-discord";
+      group = "mautrix-discord";
+      mode = "0750";
+    }
+  ];
+
   systemd = {
     services = {
       mautrix-discord-env = {
@@ -26,9 +35,15 @@
         };
         script = ''
           mkdir -p /run/mautrix-discord
-          echo "DISCORD_BOT_TOKEN=$(cat ${config.sops.secrets.discord_bot_token.path})" > /run/mautrix-discord/env
+          echo "DISCORD_BOT_TOKEN=$(cat ${
-          echo "DISCORD_CLIENT_ID=$(cat ${config.sops.secrets.discord_client_id.path})" >> /run/mautrix-discord/env
+            config.sops.secrets."matrix/bridges/discord/bot_token".path
-          echo "DISCORD_PICKLE_KEY=$(cat ${config.sops.secrets.discord_pickle_key.path})" >> /run/mautrix-discord/env
+          })" > /run/mautrix-discord/env
+          echo "DISCORD_CLIENT_ID=$(cat ${
+            config.sops.secrets."matrix/bridges/discord/client_id".path
+          })" >> /run/mautrix-discord/env
+          echo "DISCORD_PICKLE_KEY=$(cat ${
+            config.sops.secrets."matrix/bridges/discord/pickle_key".path
+          })" >> /run/mautrix-discord/env
           chmod 600 /run/mautrix-discord/env
           chown mautrix-discord:mautrix-discord /run/mautrix-discord/env
         '';

nixos/roles/matrix/draupnir.nix

@@ -0,0 +1,22 @@
+{ config, ... }:
+{
+  sops.secrets."matrix/draupnir_access_token" = { };
+
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/private";
+      user = "root";
+      group = "root";
+      mode = "0700";
+    }
+  ];
+
+  services.draupnir = {
+    enable = true;
+    secrets.accessToken = config.sops.secrets."matrix/draupnir_access_token".path;
+    settings = {
+      homeserverUrl = "https://matrix.cyperpunk.de";
+      managementRoom = "!eErCimyDjLSebHjpJA:cyperpunk.de";
+    };
+  };
+}

nixos/roles/matrix/livekit.nix

@@ -1,18 +1,20 @@
 { config, ... }:
 {
-  sops.secrets.livekit_key_file = { };
+  sops.secrets."matrix/livekit_key_file" = { };
 
-  services.livekit = {
+  services = {
-    enable = true;
+    livekit = {
-    openFirewall = true;
+      enable = true;
-    settings.room.auto_create = false;
+      openFirewall = true;
-    keyFile = config.sops.secrets.livekit_key_file.path;
+      settings.room.auto_create = false;
-  };
+      keyFile = config.sops.secrets."matrix/livekit_key_file".path;
+    };
 
-  services.lk-jwt-service = {
+    lk-jwt-service = {
-    enable = true;
+      enable = true;
-    livekitUrl = "wss://cyperpunk.de/livekit/sfu";
+      livekitUrl = "wss://cyperpunk.de/livekit/sfu";
-    keyFile = config.sops.secrets.livekit_key_file.path;
+      keyFile = config.sops.secrets."matrix/livekit_key_file".path;
+    };
   };
 
   systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = "cyperpunk.de";

nixos/roles/matrix/maubot.nix

@@ -1,8 +1,19 @@
 { config, pkgs, ... }:
 {
-  environment.systemPackages = with pkgs; [
+  environment = {
-    maubot
+    systemPackages = with pkgs; [
-  ];
+      maubot
+    ];
+
+    persistence."/persist".directories = [
+      {
+        directory = "/var/lib/maubot";
+        user = "maubot";
+        group = "maubot";
+        mode = "0750";
+      }
+    ];
+  };
 
   services = {
     maubot = {

nixos/roles/matrix/meta-bridge.nix

@@ -1,24 +1,39 @@
 { config, lib, ... }:
 {
   sops.secrets = {
-    meta_as_token = {
+    "matrix/bridges/meta/as_token" = {
       owner = "mautrix-meta-facebook";
       group = "mautrix-meta";
     };
-    meta_hs_token = {
+    "matrix/bridges/meta/hs_token" = {
       owner = "mautrix-meta-facebook";
       group = "mautrix-meta";
     };
-    instagram_as_token = {
+    "matrix/bridges/instagram/as_token" = {
       owner = "mautrix-meta-instagram";
       group = "mautrix-meta";
     };
-    instagram_hs_token = {
+    "matrix/bridges/instagram/hs_token" = {
       owner = "mautrix-meta-instagram";
       group = "mautrix-meta";
     };
   };
 
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/mautrix-meta-facebook";
+      user = "mautrix-meta-facebook";
+      group = "mautrix-meta";
+      mode = "0750";
+    }
+    {
+      directory = "/var/lib/mautrix-meta-instagram";
+      user = "mautrix-meta-instagram";
+      group = "mautrix-meta";
+      mode = "0750";
+    }
+  ];
+
   systemd.services = {
     mautrix-meta-facebook-env = {
       before = [ "mautrix-meta-facebook-registration.service" ];
@@ -29,8 +44,12 @@
       };
       script = ''
         mkdir -p /run/mautrix-meta-facebook
-        echo "META_AS_TOKEN=$(cat ${config.sops.secrets.meta_as_token.path})" > /run/mautrix-meta-facebook/env
+        echo "META_AS_TOKEN=$(cat ${
-        echo "META_HS_TOKEN=$(cat ${config.sops.secrets.meta_hs_token.path})" >> /run/mautrix-meta-facebook/env
+          config.sops.secrets."matrix/bridges/meta/as_token".path
+        })" > /run/mautrix-meta-facebook/env
+        echo "META_HS_TOKEN=$(cat ${
+          config.sops.secrets."matrix/bridges/meta/hs_token".path
+        })" >> /run/mautrix-meta-facebook/env
         chmod 600 /run/mautrix-meta-facebook/env
         chown mautrix-meta-facebook:mautrix-meta /run/mautrix-meta-facebook/env
       '';
@@ -45,8 +64,12 @@
       };
       script = ''
         mkdir -p /run/mautrix-meta-instagram
-        echo "INSTAGRAM_AS_TOKEN=$(cat ${config.sops.secrets.instagram_as_token.path})" > /run/mautrix-meta-instagram/env
+        echo "INSTAGRAM_AS_TOKEN=$(cat ${
-        echo "INSTAGRAM_HS_TOKEN=$(cat ${config.sops.secrets.instagram_hs_token.path})" >> /run/mautrix-meta-instagram/env
+          config.sops.secrets."matrix/bridges/instagram/as_token".path
+        })" > /run/mautrix-meta-instagram/env
+        echo "INSTAGRAM_HS_TOKEN=$(cat ${
+          config.sops.secrets."matrix/bridges/instagram/hs_token".path
+        })" >> /run/mautrix-meta-instagram/env
         chmod 600 /run/mautrix-meta-instagram/env
         chown mautrix-meta-instagram:mautrix-meta /run/mautrix-meta-instagram/env
       '';

nixos/roles/matrix/mjolnir.nix

@@ -1,17 +0,0 @@
-{ config, ... }:
-{
-  sops.secrets.mjolnir_access_token = { };
-
-  services.draupnir = {
-    enable = true;
-    secrets.accessToken = config.sops.secrets.mjolnir_access_token.path;
-    settings = {
-      homeserverUrl = "https://matrix.cyperpunk.de";
-      managementRoom = "!eErCimyDjLSebHjpJA:cyperpunk.de";
-    };
-  };
-}
-
-#curl -X POST https://matrix.cyperpunk.de/_matrix/client/v3/login \
-#  -H "Content-Type: application/json" \
-#  -d '{"type":"m.login.password ","user":"mjolnir","password":"i318HXBRkt)Lh$nOPwq#6n9z&<W[XJ&2c4$Zf>7jV}-uQCE{<plwk;LZ)10*N<~1"}'

nixos/roles/matrix/postgres-backup.nix

@@ -1,12 +1,11 @@
 {
   config,
   pkgs,
-  lib,
   ...
 }:
 {
   sops.secrets = {
-    pg_replication_password = {
+    "postgres/replication_password" = {
       owner = "root";
       group = "root";
     };
@@ -18,12 +17,10 @@
     description = "PostgreSQL WAL streaming replica (Docker)";
     requires = [
       "docker.service"
-      "tailscaled.service"
       "network-online.target"
     ];
     after = [
       "docker.service"
-      "tailscaled.service"
       "network-online.target"
     ];
     wantedBy = [ "multi-user.target" ];
@@ -32,64 +29,53 @@
       Type = "simple";
       Restart = "on-failure";
       RestartSec = "10s";
+      TimeoutStartSec = "0";
     };
 
     preStart = ''
-            DATADIR="/storage/backup/postgresql-replica"
+      DATADIR="/storage/backup/postgresql-replica"
-            PG_PASS=$(cat ${config.sops.secrets.pg_replication_password.path})
+      PG_PASS=$(cat ${config.sops.secrets."postgres/replication_password".path})
-
+      ${pkgs.docker}/bin/docker pull postgres:17
-            ${pkgs.docker}/bin/docker pull postgres:17
+      if [ ! -f "$DATADIR/PG_VERSION" ]; then
-
+        echo "No data dir found — running pg_basebackup..."
-            if [ ! -f "$DATADIR/PG_VERSION" ]; then
+        rm -rf "$DATADIR"
-              echo "No data dir found — running pg_basebackup..."
+        ${pkgs.docker}/bin/docker run --rm \
-              rm -rf "$DATADIR"
+          -e PGPASSWORD="$PG_PASS" \
-
+          -v "/storage/backup:/out" \
-              ${pkgs.docker}/bin/docker run --rm \
+          --network host \
-                -e PGPASSWORD="$PG_PASS" \
+          postgres:17 \
-                -v "/storage/backup:/out" \
+          pg_basebackup \
-                --network host \
+            --host=10.10.0.1 \
-                postgres:17 \
+            --port=5432 \
-                pg_basebackup \
+            --username=replicator \
-                  --host=100.109.10.91 \
+            --pgdata=/out/postgresql-replica \
-                  --port=5432 \
+            --wal-method=stream \
-                  --username=replicator \
+            --checkpoint=fast \
-                  --pgdata=/out/postgresql-replica \
+            --progress \
-                  --wal-method=stream \
+            --verbose
-                  --checkpoint=fast \
+        touch "$DATADIR/standby.signal"
-                  --progress \
+        cat > "$DATADIR/postgresql.auto.conf" <<EOF
-                  --verbose
+      primary_conninfo = 'host=10.10.0.1 port=5432 user=replicator password=$PG_PASS application_name=cyper-controller sslmode=disable'
-
-              # standby signal
-              touch "$DATADIR/standby.signal"
-
-              # primary conninfo
-              cat > "$DATADIR/postgresql.auto.conf" <<EOF
-      primary_conninfo = 'host=100.109.10.91 port=5432 user=replicator password=$PG_PASS application_name=cyper-controller sslmode=require'
       EOF
-
+        cat > "$DATADIR/postgresql.conf" <<EOF
-              # minimal postgresql.conf
-              cat > "$DATADIR/postgresql.conf" <<EOF
       hot_standby = on
       hot_standby_feedback = on
       wal_receiver_timeout = '60s'
       port = 5434
       listen_addresses = '*'
       EOF
-
+        chown -R 999:999 "$DATADIR"
-              chown -R 999:999 "$DATADIR"
+      fi
-            fi
+      if [ ! -f "$DATADIR/postgresql.conf" ]; then
-
+        cat > "$DATADIR/postgresql.conf" <<EOF
-            # ensure postgresql.conf exists on subsequent starts
-            if [ ! -f "$DATADIR/postgresql.conf" ]; then
-              cat > "$DATADIR/postgresql.conf" <<EOF
       hot_standby = on
       hot_standby_feedback = on
       wal_receiver_timeout = '60s'
       port = 5434
       listen_addresses = '*'
       EOF
-              chown 999:999 "$DATADIR/postgresql.conf"
+        chown 999:999 "$DATADIR/postgresql.conf"
-            fi
+      fi
     '';
 
     script = ''

nixos/roles/matrix/synapse.nix

@@ -34,45 +34,59 @@ let
 in
 {
   sops.secrets = {
-    matrix_macaroon_secret = { };
+    "matrix/macaroon_secret" = { };
-    matrix_registration_secret = {
+    "matrix/registration_secret" = {
       owner = "matrix-synapse";
       group = "matrix-synapse";
     };
-    pg_replication_password = {
+    "postgres/replication_password" = {
       owner = "postgres";
       group = "postgres";
     };
-    kanidm_synapse_secret = {
+    "kanidm/synapse_secret" = {
       owner = "matrix-synapse";
       group = "matrix-synapse";
     };
   };
 
-  systemd.tmpfiles.rules = [
+  environment.persistence."/persist".directories = [
-    "d /var/www/matrix            0755 nginx nginx -"
+    {
-    "L+ /var/www/matrix/index.html   0644 nginx nginx - ${matrixIndexHtml}"
+      directory = "/var/lib/matrix-synapse";
-    "L+ /var/www/matrix/register.php 0644 nginx nginx - ${matrixRegisterPhp}"
+      user = "matrix-synapse";
-    "L+ /var/www/matrix/style.css  0644 nginx nginx - ${matrixStyleCss}"
+      group = "matrix-synapse";
-    "L+ /var/www/matrix/app.js     0644 nginx nginx - ${matrixAppJs}"
+      mode = "0700";
+    }
+    {
+      directory = "/var/lib/postgresql";
+      user = "postgres";
+      group = "postgres";
+      mode = "0750";
+    }
+    {
+      directory = "/var/lib/acme";
+      user = "acme";
+      group = "acme";
+      mode = "0755";
+    }
   ];
 
-  services.phpfpm.pools.matrix = {
-    user = "nginx";
-    group = "nginx";
-    settings = {
-      "listen.owner" = "nginx";
-      "listen.group" = "nginx";
-      "pm" = "dynamic";
-      "pm.max_children" = 10;
-      "pm.start_servers" = 2;
-      "pm.min_spare_servers" = 1;
-      "pm.max_spare_servers" = 3;
-    };
-    phpPackage = pkgs.php.withExtensions ({ enabled, all }: enabled ++ [ all.curl ]);
-  };
-
   services = {
+
+    phpfpm.pools.matrix = {
+      user = "nginx";
+      group = "nginx";
+      settings = {
+        "listen.owner" = "nginx";
+        "listen.group" = "nginx";
+        "pm" = "dynamic";
+        "pm.max_children" = 10;
+        "pm.start_servers" = 2;
+        "pm.min_spare_servers" = 1;
+        "pm.max_spare_servers" = 3;
+      };
+      phpPackage = pkgs.php.withExtensions ({ enabled, all }: enabled ++ [ all.curl ]);
+    };
+
     matrix-synapse = {
       enable = true;
       settings = {
@@ -81,8 +95,8 @@ in
         enable_registration = false;
         trusted_key_servers = [ { server_name = "matrix.org"; } ];
         suppress_key_server_warning = true;
-        registration_shared_secret_path = config.sops.secrets.matrix_registration_secret.path;
+        registration_shared_secret_path = config.sops.secrets."matrix/registration_secret".path;
-        macaroon_secret_key = "$__file{${config.sops.secrets.matrix_macaroon_secret.path}}";
+        macaroon_secret_key = "$__file{${config.sops.secrets."matrix/macaroon_secret".path}}";
         matrix_rtc = {
           enabled = true;
           transports = [
@@ -135,7 +149,7 @@ in
             type = "metrics";
             bind_addresses = [
               "127.0.0.1"
-              "100.109.10.91"
+              "10.10.0.1"
             ];
             resources = [ ];
           }
@@ -148,7 +162,7 @@ in
             idp_name = "Kanidm";
             issuer = "https://auth.cyperpunk.de/oauth2/openid/synapse";
             client_id = "synapse";
-            client_secret_path = config.sops.secrets.kanidm_synapse_secret.path;
+            client_secret_path = config.sops.secrets."kanidm/synapse_secret".path;
             scopes = [
               "openid"
               "profile"
@@ -236,10 +250,11 @@ in
         wal_level = "replica";
         max_wal_senders = 5;
         wal_keep_size = "512MB";
-        listen_addresses = lib.mkForce "127.0.0.1,100.109.10.91";
+        listen_addresses = lib.mkForce "127.0.0.1,10.10.0.1";
+        ssl = true;
       };
       authentication = lib.mkAfter ''
-        host replication replicator 100.0.0.0/8 scram-sha-256
+        hostssl replication replicator 10.10.0.2/32 scram-sha-256
       '';
     };
 
@@ -251,15 +266,26 @@ in
     };
   };
 
-  systemd.services = {
+  systemd = {
-    matrix-synapse.serviceConfig.ReadOnlyPaths = [
+    services = {
-      "/var/lib/mautrix-discord"
+      matrix-synapse.serviceConfig.ReadOnlyPaths = [
-      "/var/lib/mautrix-whatsapp"
+        "/var/lib/mautrix-discord"
+        "/var/lib/mautrix-whatsapp"
+      ];
+      postgresql.postStart = lib.mkAfter ''
+        PG_PASS=$(cat ${config.sops.secrets."postgres/replication_password".path})
+        ${config.services.postgresql.package}/bin/psql -U postgres -c \
+          "ALTER ROLE replicator WITH PASSWORD '$PG_PASS';"
+      '';
+    };
+
+    tmpfiles.rules = [
+      "d /var/www/matrix            0755 nginx nginx -"
+      "L+ /var/www/matrix/index.html   0644 nginx nginx - ${matrixIndexHtml}"
+      "L+ /var/www/matrix/register.php 0644 nginx nginx - ${matrixRegisterPhp}"
+      "L+ /var/www/matrix/style.css  0644 nginx nginx - ${matrixStyleCss}"
+      "L+ /var/www/matrix/app.js     0644 nginx nginx - ${matrixAppJs}"
     ];
-    postgresql.postStart = lib.mkAfter ''
-      PG_PASS=$(cat ${config.sops.secrets.pg_replication_password.path})
-      ${config.services.postgresql.package}/bin/psql -U postgres -c \
-        "ALTER ROLE replicator WITH PASSWORD '$PG_PASS';"
-    '';
   };
+
 }

nixos/roles/matrix/whatsapp-bridge.nix

@@ -1,29 +1,40 @@
-{ ... }:
 {
-  services.postgresql = {
-    ensureUsers = [
-      {
-        name = "mautrix-whatsapp";
-        ensureDBOwnership = true;
-      }
-    ];
-    ensureDatabases = [ "mautrix-whatsapp" ];
-  };
 
-  services.mautrix-whatsapp = {
+  environment.persistence."/persist".directories = [
-    enable = true;
+    {
-    settings = {
+      directory = "/var/lib/mautrix-whatsapp";
-      homeserver = {
+      user = "mautrix-whatsapp";
-        address = "http://127.0.0.1:8008";
+      group = "mautrix-whatsapp";
-        domain = "cyperpunk.de";
+      mode = "0750";
-      };
+    }
-      database = {
+  ];
-        type = "postgres";
+
-        uri = "postgres:///mautrix-whatsapp?host=/run/postgresql&sslmode=disable";
+  services = {
-      };
+    postgresql = {
-      bridge.permissions = {
+      ensureUsers = [
-        "cyperpunk.de" = "user";
+        {
-        "@dergrumpf:cyperpunk.de" = "admin";
+          name = "mautrix-whatsapp";
+          ensureDBOwnership = true;
+        }
+      ];
+      ensureDatabases = [ "mautrix-whatsapp" ];
+    };
+
+    mautrix-whatsapp = {
+      enable = true;
+      settings = {
+        homeserver = {
+          address = "http://127.0.0.1:8008";
+          domain = "cyperpunk.de";
+        };
+        database = {
+          type = "postgres";
+          uri = "postgres:///mautrix-whatsapp?host=/run/postgresql&sslmode=disable";
+        };
+        bridge.permissions = {
+          "cyperpunk.de" = "user";
+          "@dergrumpf:cyperpunk.de" = "admin";
+        };
       };
     };
   };

nixos/roles/monitoring.nix

@@ -27,20 +27,29 @@ in
   imports = [ ./gs-exporter.nix ];
 
   sops.secrets = {
-    grafana_secret_key = {
+    "services/grafana/secret_key" = {
       owner = "grafana";
       group = "grafana";
     };
-    kanidm_grafana_secret = {
+    "kanidm/grafana_secret" = {
       owner = "grafana";
       group = "grafana";
     };
-    zyxel_pass = {
+    "network/zyxel_pass" = {
       group = "gs1200-exporter";
       mode = "0440";
     };
   };
 
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/grafana";
+      user = "grafana";
+      group = "grafana";
+      mode = "0750";
+    }
+  ];
+
   users.groups.gs1200-exporter = { };
 
   services = {
@@ -69,7 +78,7 @@ in
           serve_from_sub_path = true;
         };
         security = {
-          secret_key = "$__file{${config.sops.secrets.grafana_secret_key.path}}";
+          secret_key = "$__file{${config.sops.secrets."services/grafana/secret_key".path}}";
           allow_embedding = true;
           cookie_samesite = "none";
           cookie_secure = true;
@@ -82,7 +91,7 @@ in
           enabled = true;
           name = "Kanidm";
           client_id = "grafana";
-          client_secret = "$__file{${config.sops.secrets.kanidm_grafana_secret.path}}";
+          client_secret = "$__file{${config.sops.secrets."kanidm/grafana_secret".path}}";
           scopes = "openid profile email";
           auth_url = "https://auth.cyperpunk.de/ui/oauth2";
           token_url = "https://auth.cyperpunk.de/oauth2/token";
@@ -125,7 +134,7 @@ in
           metrics_path = "/_synapse/metrics";
           static_configs = [
             {
-              targets = [ "100.109.10.91:9009" ];
+              targets = [ "10.10.0.1:9009" ];
               labels = {
                 instance = "cyper-proxy";
                 job = "master";
@@ -149,7 +158,7 @@ in
           job_name = "postgresql-proxy";
           static_configs = [
             {
-              targets = [ "100.109.10.91:9188" ];
+              targets = [ "10.10.0.1:9188" ];
               labels = {
                 instance = "cyper-proxy";
               };
@@ -172,13 +181,13 @@ in
       zyxel1 = {
         address = "192.168.2.3";
         port = 9934;
-        passwordFile = config.sops.secrets.zyxel_pass.path;
+        passwordFile = config.sops.secrets."network/zyxel_pass".path;
         group = "gs1200-exporter";
       };
       zyxel2 = {
         address = "192.168.2.4";
         port = 9935;
-        passwordFile = config.sops.secrets.zyxel_pass.path;
+        passwordFile = config.sops.secrets."network/zyxel_pass".path;
         group = "gs1200-exporter";
       };
     };

nixos/roles/nginx.nix

@@ -1,7 +1,6 @@
 _:
 let
-
+  upstream = "10.10.0.2";
-  upstream = "100.86.56.71";
 
   mkProxy = port: {
     forceSSL = true;

nixos/roles/octoprint.nix

@@ -48,6 +48,16 @@ let
 in
 {
   nixpkgs.overlays = [ octoprint-overlay ];
+
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/octoprint";
+      user = "octoprint";
+      group = "octoprint";
+      mode = "0750";
+    }
+  ];
+
   services.octoprint = {
     enable = true;
     host = "0.0.0.0";

nixos/roles/paperless-ngx.nix

@@ -1,11 +1,10 @@
 { config, ... }:
 {
-
   sops.secrets = {
-    paperless_admin = {
+    "services/paperless/admin" = {
       owner = "paperless";
     };
-    paperless_oidc_secret = {
+    "services/paperless/oidc_secret" = {
       owner = "paperless";
     };
   };
@@ -18,14 +17,14 @@
     consumptionDir = "/storage/fast/paperless/consume";
     dataDir = "/storage/fast/paperless";
     configureTika = true;
-    passwordFile = config.sops.secrets.paperless_admin.path;
+    passwordFile = config.sops.secrets."services/paperless/admin".path;
     settings = {
       PAPERLESS_USE_X_FORWARDED_HOST = true;
       PAPERLESS_USE_X_FORWARDED_PORT = true;
-      PAPERLESS_ALLOWED_HOSTS = "ngx.cyperpunk.de,100.109.179.25,localhost";
+      PAPERLESS_ALLOWED_HOSTS = "ngx.cyperpunk.de,10.10.0.2,localhost";
       PAPERLESS_CSRF_TRUSTED_ORIGINS = [
         "https://ngx.cyperpunk.de"
-        "http://100.109.179.25:28101"
+        "http://10.10.0.2:28101"
       ];
       PAPERLESS_OCR_LANGUAGE = "deu+eng";
       PAPERLESS_CONSUMER_POLLING = 60;
@@ -54,7 +53,7 @@
         requires = [ "systemd-tmpfiles-setup.service" ];
       };
       paperless-web = {
-        serviceConfig.EnvironmentFiles = [ config.sops.secrets.paperless_oidc_secret.path ];
+        serviceConfig.EnvironmentFiles = [ config.sops.secrets."services/paperless/oidc_secret".path ];
       };
     };
   };

nixos/roles/searxng.nix

@@ -11,8 +11,6 @@ let
   port = 11080;
 in
 {
-  boot.kernel.sysctl."vm.overcommit_memory" = lib.mkForce "1";
-
   services.searx = {
     enable = true;
     package = pkgs.searxng;

nixos/roles/unifi.nix

@@ -1,6 +1,15 @@
 { pkgs, ... }:
 
 {
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/unifi";
+      user = "unifi";
+      group = "unifi";
+      mode = "0750";
+    }
+  ];
+
   services.unifi = {
     enable = true;
     unifiPackage = pkgs.unifi;