Added

.gitignore

@@ -2,7 +2,7 @@
 result
 result-*
 *.qcow2
-extra-files/*
+extra_files/*
 
 # Ignore everything in the secrets directory
 secrets/*

darwin/default.nix

@@ -1,7 +1,6 @@
 {
   pkgs,
   primaryUser,
-  lib,
   ...
 }:
 {
@@ -9,7 +8,6 @@
     ./settings.nix
     ./homebrew.nix
     ./yabai.nix
-    ./wireguard.nix
   ];
 
   # nix config
@@ -52,12 +50,6 @@
     info.enable = false; # Skip info pages
   };
 
-  # Mirrored Network conf
-  networking.knownNetworkServices = [
-    "Wi-Fi"
-    "Ethernet"
-  ];
-
   # homebrew installation manager
   nix-homebrew = {
     user = primaryUser;
@@ -67,24 +59,15 @@
 
   # macOS-specific settings
   programs.fish.enable = true;
+  environment.shells = [ pkgs.fish ];
   system.primaryUser = primaryUser;
   users.users.${primaryUser} = {
     home = "/Users/${primaryUser}";
     shell = pkgs.fish;
     openssh.authorizedKeys.keyFiles = [ ../secrets/ssh-key ];
   };
-
   environment = {
-    shells = [ pkgs.fish ];
     systemPath = [ "/opt/homebrew/bin" ];
     pathsToLink = [ "/Applications" ];
-    etc."hosts".text = lib.mkAfter ''
-      10.10.0.1  proxy.cyperpunk.de
-      10.10.0.2  controller.cyperpunk.de
-      10.10.0.3  mac.cyperpunk.de
-      10.10.0.30 node1.cyperpunk.de
-      10.10.0.31 node2.cyperpunk.de
-      10.10.0.40 desktop.cyperpunk.de
-    '';
   };
 }

darwin/wireguard.nix

@@ -1,40 +0,0 @@
-{
-  config,
-  pkgs,
-  hostName,
-  ...
-}:
-{
-  sops.secrets."network/wireguard/${hostName}" = {
-    mode = "0400";
-  };
-
-  launchd.daemons.wireguard = {
-    script = ''
-      set -e
-      mkdir -p /etc/wireguard
-      PRIVATE_KEY=$(cat ${config.sops.secrets."network/wireguard/${hostName}".path})
-      cat > /etc/wireguard/wg0.conf << EOF
-      [Interface]
-      Address = $WG_IP
-      PrivateKey = $PRIVATE_KEY
-
-      [Peer]
-      PublicKey = NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=
-      Endpoint = 178.254.8.35:51820
-      AllowedIPs = 10.10.0.0/24
-      PersistentKeepalive = 25
-      EOF
-      chmod 600 /etc/wireguard/wg0.conf
-      ${pkgs.wireguard-tools}/bin/wg-quick up wg0
-    '';
-    environment.WG_IP = "";
-    serviceConfig = {
-      Label = "org.wireguard.wg0";
-      RunAtLoad = true;
-      KeepAlive = false;
-      StandardOutPath = "/var/log/wireguard.log";
-      StandardErrorPath = "/var/log/wireguard.log";
-    };
-  };
-}

flake.lock

@@ -57,11 +57,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782648384,
+        "lastModified": 1782117778,
-        "narHash": "sha256-OlHdAqdXasZk1U+Zf9n+ivqHL9kj/UD0DFO4yYTNBYc=",
+        "narHash": "sha256-x6vIJpJziw3Hs0JKKDP+AeRPWwqyMDOmK6I26tqbYj4=",
         "owner": "catppuccin",
         "repo": "nix",
-        "rev": "f2c7dd14ecce785c206a39466cbe227ff62e3803",
+        "rev": "e98afe2dfd950bda4e6a8ef32bb563ec2f04505a",
         "type": "github"
       },
       "original": {
@@ -90,48 +90,6 @@
         "type": "github"
       }
     },
-    "disko": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1781152676,
-        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
-        "owner": "nix-community",
-        "repo": "disko",
-        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "disko",
-        "type": "github"
-      }
-    },
-    "disko_2": {
-      "inputs": {
-        "nixpkgs": [
-          "nixos-anywhere",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1781152676,
-        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
-        "owner": "nix-community",
-        "repo": "disko",
-        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "ref": "master",
-        "repo": "disko",
-        "type": "github"
-      }
-    },
     "flake-compat": {
       "flake": false,
       "locked": {
@@ -251,11 +209,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781788787,
+        "lastModified": 1782358560,
-        "narHash": "sha256-YqlTCRRhGvNjcJejPeMuHrYQ/TVhOO2MV/nEGMWb8nk=",
+        "narHash": "sha256-vCcLh9pw3XO/+Lxk8r6xv6QnoCrTfGqiACcI7O637Wg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "d456f483f157d4b706416005da226234b9c116ff",
+        "rev": "3a70e333f2950c302e875c44cfcfaff3f80f36bc",
         "type": "github"
       },
       "original": {
@@ -265,27 +223,6 @@
         "type": "github"
       }
     },
-    "home-manager_2": {
-      "inputs": {
-        "nixpkgs": [
-          "impermanence",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1768598210,
-        "narHash": "sha256-kkgA32s/f4jaa4UG+2f8C225Qvclxnqs76mf8zvTVPg=",
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "rev": "c47b2cc64a629f8e075de52e4742de688f930dc6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "type": "github"
-      }
-    },
     "hyprcursor": {
       "inputs": {
         "hyprlang": "hyprlang",
@@ -383,11 +320,11 @@
         "xdph": "xdph"
       },
       "locked": {
-        "lastModified": 1781796010,
+        "lastModified": 1782366482,
-        "narHash": "sha256-bIqjZgUfp3vba/C1UJLVqTo8zdpfqMDvuwWrHmqDWm4=",
+        "narHash": "sha256-J+yvgoF+zbYZHJkGxfMCPWa8L3i5Nm7Xlgfw2Eky/Xs=",
         "owner": "hyprwm",
         "repo": "Hyprland",
-        "rev": "ae1690c2138313d988c81f5c25a9d0b6fadfd3b1",
+        "rev": "c9e1a6c3a05c0310424f99c6b90af1164340af99",
         "type": "github"
       },
       "original": {
@@ -710,25 +647,6 @@
         "type": "github"
       }
     },
-    "impermanence": {
-      "inputs": {
-        "home-manager": "home-manager_2",
-        "nixpkgs": "nixpkgs_2"
-      },
-      "locked": {
-        "lastModified": 1769548169,
-        "narHash": "sha256-03+JxvzmfwRu+5JafM0DLbxgHttOQZkUtDWBmeUkN8Y=",
-        "owner": "nix-community",
-        "repo": "impermanence",
-        "rev": "7b1d382faf603b6d264f58627330f9faa5cba149",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "impermanence",
-        "type": "github"
-      }
-    },
     "nix-homebrew": {
       "inputs": {
         "brew-src": "brew-src"
@@ -747,27 +665,6 @@
         "type": "github"
       }
     },
-    "nix-vm-test": {
-      "inputs": {
-        "nixpkgs": [
-          "nixos-anywhere",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1781506385,
-        "narHash": "sha256-kvTBHLiqB911yf2D9VThIRfB6Ai/E2H9+mVF0wR+9AY=",
-        "owner": "numtide",
-        "repo": "nix-vm-test",
-        "rev": "2071ebc1f5b2a2e0211a2ca38c4e678092df76a5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "nix-vm-test",
-        "type": "github"
-      }
-    },
     "nixcord": {
       "inputs": {
         "flake-compat": "flake-compat_2",
@@ -778,11 +675,11 @@
         "nixpkgs-nixcord": "nixpkgs-nixcord"
       },
       "locked": {
-        "lastModified": 1781775854,
+        "lastModified": 1782349937,
-        "narHash": "sha256-0eb1+zKSTwgD3qsBm7UiuRabahHQNkTP94Z/s3nMK60=",
+        "narHash": "sha256-2haY6BBTL+yCblUup/P9t3D8sUTMSqIok68n+qGjjYI=",
         "owner": "kaylorben",
         "repo": "nixcord",
-        "rev": "b92ceb7923c87dfcfcf84415407b0ca63e17548b",
+        "rev": "afdacaafb10aa459dfabbb8af99e4b0deb74f1d2",
         "type": "github"
       },
       "original": {
@@ -791,72 +688,6 @@
         "type": "github"
       }
     },
-    "nixos-anywhere": {
-      "inputs": {
-        "disko": "disko_2",
-        "nix-vm-test": "nix-vm-test",
-        "nixos-images": "nixos-images",
-        "nixos-stable": "nixos-stable",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "treefmt-nix": "treefmt-nix"
-      },
-      "locked": {
-        "lastModified": 1782285665,
-        "narHash": "sha256-ISUNn+z9+BIDGRrNAmEfghvzFmDgKtGHGEYqIDvGeWk=",
-        "owner": "nix-community",
-        "repo": "nixos-anywhere",
-        "rev": "4b74194d2927a7741d023b3fd2a0d252059f75ee",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixos-anywhere",
-        "type": "github"
-      }
-    },
-    "nixos-images": {
-      "inputs": {
-        "nixos-stable": [
-          "nixos-anywhere",
-          "nixos-stable"
-        ],
-        "nixos-unstable": [
-          "nixos-anywhere",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1781778781,
-        "narHash": "sha256-CYnhWtKIr0xbxQT6N0X1j0FsmCG+cDV498jyO0xevwQ=",
-        "owner": "nix-community",
-        "repo": "nixos-images",
-        "rev": "94cbd4c8da5f130f188af04293514926a947b380",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixos-images",
-        "type": "github"
-      }
-    },
-    "nixos-stable": {
-      "locked": {
-        "lastModified": 1782116945,
-        "narHash": "sha256-G3tw/IXmaH6IQ2upZvhuN9sG8CkuX+BLuJDpE8hz0Ds=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "34268251cf5547d39063f2c5ea9a196246f7f3a6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-26.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1780749050,
@@ -905,22 +736,6 @@
       }
     },
     "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1768564909,
-        "narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "e4bae1bd10c9c57b2cf517953ab70060a828ee6f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_3": {
       "locked": {
         "lastModified": 1781577229,
         "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=",
@@ -936,13 +751,13 @@
         "type": "github"
       }
     },
-    "nixpkgs_4": {
+    "nixpkgs_3": {
       "locked": {
-        "lastModified": 1782175435,
+        "lastModified": 1781607440,
-        "narHash": "sha256-EMzXKmnOtBQ2MnvpiNOm7E+kOMvdPrIKaeg52Tip2Uk=",
+        "narHash": "sha256-rxO+uc/KFbSJp+pgyXRuAX6QlG9hJdnt0BXpEQRXY+U=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "89570f24e97e614aa34aa9ab1c927b6578a43775",
+        "rev": "3e41b24abd260e8f71dbe2f5737d24122f972158",
         "type": "github"
       },
       "original": {
@@ -955,15 +770,15 @@
     "nixvim": {
       "inputs": {
         "flake-parts": "flake-parts_2",
-        "nixpkgs": "nixpkgs_4",
+        "nixpkgs": "nixpkgs_3",
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1781713417,
+        "lastModified": 1782254890,
-        "narHash": "sha256-Kaj44jTNmnaFhKrcADx8nXmUYPa7l2HYfb7m6lEPy7Q=",
+        "narHash": "sha256-kjsEECqhpPnJWqhooXp6tWh2qGQftCPAo2G1GvZtKdw=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "caee4e5d4161778815f522d9ea1c9e3dc42462b7",
+        "rev": "dbf9550dba8448b03e11d58e5695d6c44a464554",
         "type": "github"
       },
       "original": {
@@ -980,11 +795,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781800183,
+        "lastModified": 1782389847,
-        "narHash": "sha256-NcRZr/JQiAvqC2qCyMxcfx/98Hf1epwdtjcbwKHeMf8=",
+        "narHash": "sha256-eP8eqJcG07GXr/mNOm6xS4ws+7sKw8pPk9xbAf11tb8=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "0559d992b12ee209570bb325d79e90007b13da52",
+        "rev": "a573a709b3b6778499500cdea3ea134faef25218",
         "type": "github"
       },
       "original": {
@@ -1020,16 +835,13 @@
       "inputs": {
         "catppuccin": "catppuccin",
         "darwin": "darwin",
-        "disko": "disko",
         "home-manager": "home-manager",
         "hyprcursor": "hyprcursor",
         "hyprland": "hyprland",
         "hyprland-plugins": "hyprland-plugins",
-        "impermanence": "impermanence",
         "nix-homebrew": "nix-homebrew",
         "nixcord": "nixcord",
-        "nixos-anywhere": "nixos-anywhere",
+        "nixpkgs": "nixpkgs_2",
-        "nixpkgs": "nixpkgs_3",
         "nixvim": "nixvim",
         "nur": "nur",
         "sops-nix": "sops-nix",
@@ -1043,11 +855,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780547341,
+        "lastModified": 1782165805,
-        "narHash": "sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo=",
+        "narHash": "sha256-478kKQBvK6SYTOdN2h9jhKJv94nbXRbFMfuL1WshErg=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "9ed65852b6257fbeae4355bc24ecfea307ca759a",
+        "rev": "56b24064fdcaedca53553b1a6d607fd23b613a24",
         "type": "github"
       },
       "original": {
@@ -1064,11 +876,11 @@
         "systems": "systems_4"
       },
       "locked": {
-        "lastModified": 1781425310,
+        "lastModified": 1782031037,
-        "narHash": "sha256-GTBka4Df/ZOacmisI/DI2LICyNChEqn/giah83LucdM=",
+        "narHash": "sha256-a7oWSyS7SN81UOqVt481yIEMDsMpaJ7GNdV6Eaz5Yqg=",
         "owner": "Gerg-L",
         "repo": "spicetify-nix",
-        "rev": "aeaf7c81a45d3761da61cb05bfc370ac6d1b0441",
+        "rev": "9cb27462cfd20edac174353f1e95bc03aa888863",
         "type": "github"
       },
       "original": {
@@ -1138,27 +950,6 @@
         "type": "github"
       }
     },
-    "treefmt-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "nixos-anywhere",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1780220602,
-        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "type": "github"
-      }
-    },
     "xdph": {
       "inputs": {
         "hyprland-protocols": [

flake.nix

@@ -5,23 +5,6 @@
     # monorepo w/ recipes ("derivations")
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
 
-    # declarative disk layout
-    disko = {
-      url = "github:nix-community/disko";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    # declarative impermanence
-    impermanence = {
-      url = "github:nix-community/impermanence";
-    };
-
-    # declarative installer
-    nixos-anywhere = {
-      url = "github:nix-community/nixos-anywhere";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     # declarative Configs
     home-manager = {
       url = "github:nix-community/home-manager/master";
@@ -101,54 +84,86 @@
       hyprland,
       sops-nix,
       nur,
-      impermanence,
-      disko,
-      nixos-anywhere,
       ...
     }@inputs:
     let
       primaryUser = "phil";
 
-      installer = nixpkgs.lib.nixosSystem {
+      /*
-        system = "x86_64-linux";
+        mkIso - Build a NixOS image for a given target.
-        specialArgs = { inherit inputs; };
-        modules = [
-          {
-            nixpkgs = {
-              config.allowUnfree = true;
-              hostPlatform = "x86_64-linux";
-            };
-          }
-          ./hosts/installer/configuration.nix
-        ];
-      };
 
-      mkInstall =
+        Available targets (imageModule → imageBuildAttr):
+        		ISO (minimal)  : "${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"         → "isoImage"
+        		ISO (graphical): "${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix" → "isoImage"
+        		Amazon EC2     : "${nixpkgs}/nixos/modules/virtualisation/amazon-image.nix"                       → "amazonImage"
+        		Linode         : "${nixpkgs}/nixos/modules/virtualisation/linode-image.nix"                       → "linodeImage"
+        		Proxmox LXC    : "${nixpkgs}/nixos/modules/virtualisation/proxmox-lxc.nix"                       → "tarball"
+        		Google Cloud   : "${nixpkgs}/nixos/modules/virtualisation/google-compute-image.nix"               → "googleComputeImage"
+        		Azure          : "${nixpkgs}/nixos/modules/virtualisation/azure-image.nix"                        → "azureImage"
+        		QEMU (runnable): "${nixpkgs}/nixos/modules/virtualisation/qemu-vm.nix"                            → "vm"
+        		QEMU (headless): "${nixpkgs}/nixos/modules/virtualisation/qemu-vm.nix"                            → "vmWithBootLoader"
+        - Claude Sonnet 4.6
+      */
+      mkIso =
         {
           hostName,
-          target ? "192.168.2.99",
+          isDarwin ? false,
+          isServer ? false,
+          imageModule ? "${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix",
+          imageBuildAttr ? "isoImage",
         }:
-        let
+        (nixpkgs.lib.nixosSystem {
-          pkgs = nixpkgs.legacyPackages.x86_64-linux;
+          system = "x86_64-linux";
-        in
+          specialArgs = {
-        {
+            inherit
-          type = "app";
+              inputs
-          program = "${
+              primaryUser
-            pkgs.writeShellApplication {
+              self
-              name = "install-${hostName}";
+              hostName
-              runtimeInputs = [ nixos-anywhere.packages.x86_64-linux.nixos-anywhere ];
+              isDarwin
-              text = ''
+              isServer
-                EXTRA_FILES="''${1:-./extra-files}"
+              ;
-                TARGET="''${2:-${target}}"
+          };
-                nixos-anywhere \
+          modules = [
-                  --flake .#${hostName} \
+            imageModule
-                  --extra-files "$EXTRA_FILES" \
+            {
-                  --chown /persist/secrets/age-key.txt "$(id -u ${primaryUser})":100 \
+              nixpkgs.overlays = [
-                  root@"$TARGET"
+                inputs.nur.overlays.default
-              '';
+                (import ./overlays { inherit (inputs) nur; })
+              ];
             }
-          }/bin/install-${hostName}";
+            { nixpkgs.config.allowUnfree = true; }
-        };
+            { nixpkgs.hostPlatform = "x86_64-linux"; }
+            { networking.hostName = hostName; }
+            ./hosts/${hostName}/configuration.nix
+            ./nixos
+            inputs.sops-nix.nixosModules.sops
+            inputs.home-manager.nixosModules.home-manager
+            {
+              home-manager = {
+                extraSpecialArgs = {
+                  inherit
+                    inputs
+                    primaryUser
+                    self
+                    hostName
+                    isDarwin
+                    isServer
+                    ;
+                };
+                users.${primaryUser} = import ./home;
+                backupFileExtension = "backup";
+                useGlobalPkgs = true;
+                useUserPackages = true;
+                sharedModules = [
+                  {
+                    programs.nixvim.nixpkgs.source = inputs.nixpkgs;
+                  }
+                ];
+              };
+            }
+          ];
+        }).config.system.build.${imageBuildAttr};
 
       mkSystem =
         {
@@ -190,6 +205,11 @@
                 backupFileExtension = "hm-backup";
                 useGlobalPkgs = true;
                 useUserPackages = true;
+                sharedModules = [
+                  {
+                    programs.nixvim.nixpkgs.source = inputs.nixpkgs;
+                  }
+                ];
               };
             }
           ];
@@ -204,8 +224,6 @@
               [
                 { nixpkgs.hostPlatform = system; }
                 ./nixos
-                inputs.impermanence.nixosModules.impermanence
-                inputs.disko.nixosModules.disko
               ];
 
         in
@@ -217,8 +235,6 @@
     in
     {
       nixosConfigurations = {
-        "installer" = installer;
-
         "cyper-desktop" = mkSystem {
           hostName = "cyper-desktop";
           system = "x86_64-linux";
@@ -256,28 +272,25 @@
       };
 
       packages.x86_64-linux = {
-        installer = self.nixosConfigurations.installer.config.system.build.isoImage;
+        cyper-desktop-iso = mkIso { hostName = "cyper-desktop"; };
+        cyper-controller-iso = mkIso {
+          hostName = "cyper-controller";
+          isServer = true;
+        };
+        cyper-proxy-iso = mkIso {
+          hostName = "cyper-proxy";
+          isServer = true;
+        };
+        cyper-node-1-iso = mkIso {
+          hostName = "cyper-node-1";
+          isServer = true;
+        };
+        cyper-node-2-iso = mkIso {
+          hostName = "cyper-node-2";
+          isServer = true;
+        };
       };
 
       formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt-tree;
-
-      apps.x86_64-linux = {
-        install-cyper-node-1 = mkInstall {
-          hostName = "cyper-node-1";
-        };
-        install-cyper-node-2 = mkInstall {
-          hostName = "cyper-node-2";
-        };
-        install-cyper-controller = mkInstall {
-          hostName = "cyper-controller";
-        };
-        install-cyper-proxy = mkInstall {
-          hostName = "cyper-proxy";
-          target = ""; # KVM console IP
-        };
-        install-cyper-desktop = mkInstall {
-          hostName = "cyper-desktop";
-        };
-      };
     };
 }

home/default.nix

@@ -43,8 +43,8 @@
     enableNixpkgsReleaseCheck = false;
     stateVersion = "26.05";
     sessionVariables = lib.mkIf (!isDarwin && !isServer) {
-      GROQ_API_KEY = config.sops.secrets."api_keys/groq".path;
+      GROQ_API_KEY = config.sops.secrets.GROQ_API_KEY.path;
-      OPENWEATHER_API_KEY = config.sops.secrets."api_keys/openweather".path;
+      OPENWEATHER_API_KEY = config.sops.secrets.OPENWEATHER_API_KEY.path;
     };
     file = lib.mkIf (!isServer) {
       "Pictures/Avatar" = {
@@ -65,15 +65,15 @@
       if isDarwin then
         "/Users/${primaryUser}/.config/nix/secrets/keys.txt"
       else
-        "/persist/secrets/age-key.txt";
+        "/home/${primaryUser}/.config/nix/secrets/keys.txt";
     secrets = {
-      "api_keys/groq" = { };
+      GROQ_API_KEY = { };
-      "api_keys/openweather" = { };
+      OPENWEATHER_API_KEY = { };
-      "ssh/private_key" = {
+      ssh_private_key = {
         path = if isDarwin then "/Users/${primaryUser}/.ssh/ssh" else "/home/${primaryUser}/.ssh/ssh";
         mode = "0600";
       };
-      "ssh/github_key" = {
+      ssh_github_key = {
         path = if isDarwin then "/Users/${primaryUser}/.ssh/github" else "/home/${primaryUser}/.ssh/github";
         mode = "0600";
       };

home/desktop/default.nix

@@ -1,4 +1,4 @@
-{
+_: {
   imports = [
     ./hyprland
     ./rofi

home/desktop/gtk.nix

@@ -8,6 +8,12 @@ in
     packages = with pkgs; [
       adwaita-icon-theme
     ];
+    #pointerCursor = {
+    #  gtk.enable = true;
+    #  name = "catppuccin-mocha-sapphire-cursors";
+    #  package = pkgs.catppuccin-cursors.mochaSapphire;
+    #  size = 24;
+    #};
     file = {
       ".config/gtk-4.0/gtk.css".source = "${theme}/share/themes/${theme_name}/gtk-4.0/gtk.css";
       ".config/gtk-4.0/gtk-dark.css".source = "${theme}/share/themes/${theme_name}/gtk-4.0/gtk-dark.css";

home/desktop/hyprland/default.nix

@@ -15,7 +15,6 @@
     pamixer
     brightnessctl
     playerctl
-    waypaper
   ];
 
   systemd.user.targets.hyprland-session.Unit.Wants = [ "xdg-desktop-autostart.target" ];

home/desktop/hyprland/hypridle.nix

@@ -1,4 +1,6 @@
+{ ... }:
 {
+  # Hypridle configuration
   services.hypridle = {
     enable = true;
     settings = {
@@ -6,7 +8,7 @@
         after_sleep_cmd = "hyprctl dispatch dpms on";
         ignore_dbus_inhibit = false;
         lock_cmd = "hyprlock";
-        before_sleep_cmd = "notify-send -u critical \"I'm getting sleepy… I'll see you in my code dreams 💖\" --app-name=Hyprlock";
+        before_sleep_cmd = "notify-send -u critical \"I'm getting sleepy… I'll see you in my code dreams 💖\" --icon=$HOME/.config/hypr/avatar.png --app-name=Hyprlock";
       };
 
       listener = [

home/desktop/hyprland/hyprlock.nix

@@ -1,4 +1,8 @@
+{ ... }:
+
 {
+
+  # Hyprlock configuration
   programs.hyprlock = {
     enable = true;
     settings = {
@@ -14,7 +18,7 @@
 
       background = [
         {
-          path = "$HOME/Pictures/Wallpapers/lucy_with_cat.png";
+          path = "~/Pictures/Wallpapers/lucy_with_cat.png";
           blur_passes = 1;
           blur_size = 5;
         }
@@ -77,7 +81,7 @@
         outline_thickness = 4;
         dots_size = 0.2;
         dots_spacing = 0.2;
-        dots_center = true;
+        dots_center = "true";
         outer_color = "$red";
         inner_color = "$surface0";
         font_color = "$text";
@@ -93,17 +97,16 @@
         valign = "center";
       };
 
-      image = [
+      image = {
-        {
+        monitor = "";
-          monitor = "";
+        path = "~/.config/hypr/avatar/avatar.png";
-          path = "$HOME/Pictures/Avatar/miku_happy_sparkels.png";
+        size = 300;
-          size = 300;
+        border_color = "$teal";
-          border_color = "$teal";
+        position = "0, 75";
-          position = "0, 75";
+        halign = "center";
-          halign = "center";
+        valign = "center";
-          valign = "center";
+      };
-        }
-      ];
     };
   };
+
 }

home/desktop/hyprland/mako.nix

@@ -1,3 +1,4 @@
+{ ... }:
 {
   services.mako = {
     enable = true;

home/desktop/qt.nix

@@ -6,10 +6,10 @@
     platformTheme.name = "kvantum";
   };
   home.packages = lib.mkIf (!pkgs.stdenv.isDarwin) (
-    with pkgs.kdePackages;
+    with pkgs;
     [
-      qt6ct
+      kdePackages.qt6ct
-      qtstyleplugin-kvantum
+      kdePackages.qtstyleplugin-kvantum
     ]
   );
 }

home/desktop/waybar/common.nix

@@ -150,11 +150,11 @@
       format = "{}";
       return-type = "json";
       exec = ''
-        curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/api_keys/openweather)&units=metric&lang=en" | jq -c '{text: "\(.name) \(.main.temp)C°"}'
+        curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/OPENWEATHER_API_KEY)&units=metric&lang=en" | jq -c '{text: "\(.name) \(.main.temp)C°"}'
       '';
       interval = 120;
       on-click = ''
-        data=$(curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/api_keys/openweather)&units=metric&lang=en")
+        data=$(curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/OPENWEATHER_API_KEY)&units=metric&lang=en")
         city=$(echo "$data" | jq -r '.name')
         temp=$(echo "$data" | jq -r '.main.temp')
         feels=$(echo "$data" | jq -r '.main.feels_like')
@@ -163,7 +163,7 @@
         clouds=$(echo "$data" | jq -r '.clouds.all')
         sunrise=$(echo "$data" | jq -r '.sys.sunrise | strftime("%H:%M")')
         sunset=$(echo "$data" | jq -r '.sys.sunset | strftime("%H:%M")')
-        notify-send "$city" "Temperature: $temp °C\nFeels Like: $feels °C\nHumidity: $humidity%\nWind: $wind m/s\nClouds: $clouds%\nSunrise at: $sunrise\nSunset at: $sunset" -u normal --icon="$HOME/Pictures/Avatar/miku_window_no_bg.png"
+        notify-send "$city" "Temperature: $temp °C\nFeels Like: $feels °C\nHumidity: $humidity%\nWind: $wind m/s\nClouds: $clouds%\nSunrise at: $sunrise\nSunset at: $sunset" -u normal --icon="$HOME/Pictures/Avatar/avatar_weather_no_bg.png"
       '';
     };
 

home/desktop/waybar/default.nix

@@ -13,14 +13,12 @@
     // (import ./dual.nix { inherit compositor; })
   );
 
-  home = {
+  home.packages = lib.mkIf (!pkgs.stdenv.isDarwin) (with pkgs; [ cava ]);
-    packages = lib.mkIf (!pkgs.stdenv.isDarwin) (with pkgs; [ cava ]);
 
-    file = lib.mkIf (!pkgs.stdenv.isDarwin) {
+  home.file = lib.mkIf (!pkgs.stdenv.isDarwin) {
-      ".config/waybar" = {
+    ".config/waybar" = {
-        source = ./configs;
+      source = ./configs;
-        recursive = true;
+      recursive = true;
-      };
     };
   };
 }

home/desktop/waybar/niri-wm.nix

@@ -0,0 +1,31 @@
+{
+  widgets = {
+    "niri/workspaces" = {
+      format = "{icon}";
+      format-icons = {
+        default = "";
+        active = "";
+      };
+    };
+    "custom/swaync" = {
+      tooltip = false;
+      format = "{icon}";
+      format-icons = {
+        notification = "<span foreground='red'><sup></sup></span>";
+        none = " ";
+        dnd-notification = "<span foreground='red'><sup></sup></span>";
+        dnd-none = " ";
+        inhibited-notification = "<span foreground='red'><sup></sup></span>";
+        inhibited-none = " ";
+        dnd-inhibited-notification = "<span foreground='red'><sup></sup></span>";
+        dnd-inhibited-none = " ";
+      };
+      return-type = "json";
+      exec-if = "which swaync-client";
+      exec = "swaync-client -swb";
+      on-click = "swaync-client -t -sw";
+      on-click-right = "swaync-client -d -sw";
+      escape = true;
+    };
+  };
+}

home/floorp/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, primaryUser, ... }:
+{ pkgs, ... }:
 let
   addons = pkgs.nur.repos.rycee.firefox-addons;
   readJson = path: builtins.readFile path;
@@ -22,10 +22,6 @@ let
     };
 in
 {
-  home.persistence."/persist/home".directories = [
-    ".mozilla/firefox/${primaryUser}"
-  ];
-
   programs.floorp = {
     enable = true;
 

home/impermanence.nix

@@ -1,11 +0,0 @@
-{
-  home.persistence."/persist/home" = {
-    hideMounts = true;
-    directories = [
-      ".config/nix"
-      "Documents"
-      "Downloads"
-      "Pictures"
-    ];
-  };
-}

home/neovim/avante.nix

@@ -1,4 +1,6 @@
+{ pkgs, ... }:
 {
+  # Avante: AI-powered coding assistant (Cursor-like experience in Neovim)
   programs.nixvim = {
     plugins = {
       markdown-preview.enable = true;
@@ -12,7 +14,7 @@
           providers = {
             groq = {
               __inherited_from = "openai";
-              api_key_name = "cmd:cat /home/phil/.config/sops-nix/secrets/api_keys/groq";
+              api_key_name = "cmd:cat /home/phil/.config/sops-nix/secrets/GROQ_API_KEY";
               endpoint = "https://api.groq.com/openai/v1/";
               model = "qwen/qwen3-32b";
               system_promt = "You are a helpful coding assistant. Always respond in plain markdown format without using tool calls or JSON structures.";
@@ -27,10 +29,10 @@
             };
 
             ollama = {
-              endpoint = "http://10.10.0.2:11434";
+              endpoint = "http://100.86.56.71:11434"; # tailscale IP, no /v1 suffix
-              model = "qwen2.5:3b";
+              model = "qwen2.5:3b"; # swap for "llama3.2:3b" or "deepseek-r1:1.5b"
-              timeout = 60000;
+              timeout = 60000; # local + small model can be slow on first load
-              disable_tools = true;
+              disable_tools = true; # these small models aren't reliable at tool calling
               is_env_set.__raw = ''require("avante.providers.ollama").check_endpoint_alive'';
               extra_request_body = {
                 options = {

home/neovim/conform.nix

@@ -5,6 +5,7 @@
   programs.nixvim = {
     plugins.conform-nvim = {
       enable = true;
+
       settings = {
         formatters_by_ft = {
           lua = [ "stylua" ];
@@ -12,40 +13,6 @@
           python = [ "black" ];
           rust = [ "rustfmt" ];
           rasi = [ "prettierd" ];
-          c = [ "clang_format" ];
-          cpp = [ "clang_format" ];
-        };
-
-        formatters.clang_format = {
-          # If the file has a project .clang-format (walking up from the
-          # file itself, not nvim's cwd), use it - this is how a real
-          # kernel checkout, or any other C/C++ project's own style,
-          # gets respected automatically. Otherwise fall back to an
-          # inline approximation of kernel style instead of plain LLVM,
-          # since that's the sane default for one-off C files.
-          prepend_args = {
-            __raw = ''
-              function(self, ctx)
-                local found = vim.fs.find(
-                  { ".clang-format", "_clang-format" },
-                  { path = ctx.filename, upward = true }
-                )[1]
-                if found then
-                  return { "-style=file" }
-                end
-                return {
-                  "-style={BasedOnStyle: LLVM, IndentWidth: 8, UseTab: Always, "
-                  .. "TabWidth: 8, BreakBeforeBraces: Linux, ColumnLimit: 80, "
-                  .. "IndentCaseLabels: false, PointerAlignment: Right, "
-                  .. "DerivePointerAlignment: false, SpaceBeforeParens: ControlStatements, "
-                  .. "SpacesInParentheses: false, SpaceAfterCStyleCast: false, "
-                  .. "AllowShortIfStatementsOnASingleLine: false, AllowShortBlocksOnASingleLine: false, "
-                  .. "AllowShortFunctionsOnASingleLine: None, AllowShortLoopsOnASingleLine: false, "
-                  .. "ReflowComments: false}"
-                }
-              end
-            '';
-          };
         };
 
         format_on_save = {
@@ -54,6 +21,7 @@
         };
       };
     };
+
     # Install formatters
     extraPackages = with pkgs; [
       stylua
@@ -61,7 +29,6 @@
       black
       rustfmt
       prettierd
-      clang-tools # provides clang-format
     ];
   };
 }

home/neovim/default.nix

@@ -32,8 +32,6 @@
 
   programs.nixvim = {
     enable = true;
-    nixpkgs.source = inputs.nixpkgs;
-
     defaultEditor = true;
     enableMan = false;
 

home/neovim/lsp.nix

@@ -29,7 +29,6 @@
             installRustc = true;
           };
           pylsp.enable = true; # Python language server
-          clangd.enable = true;
         };
 
         # Keymaps for LSP actions
@@ -86,7 +85,6 @@
       lua-language-server
       nil
       rust-analyzer
-      clang-tools
     ];
   };
 }

home/nixcord.nix

@@ -1,17 +1,9 @@
-{
+{ lib, inputs, ... }:
-  lib,
-  inputs,
-  ...
-}:
 {
   imports = [
     inputs.nixcord.homeModules.nixcord
   ];
 
-  home.persistence."/persist/home".directories = [
-    ".config/vesktop"
-  ];
-
   programs.nixcord = {
     enable = true;
     discord = lib.mkForce { enable = false; };

home/obsidian.nix

@@ -2,7 +2,6 @@
   config,
   pkgs,
   lib,
-  primaryUser,
   ...
 }:
 let
@@ -21,32 +20,26 @@ in
     };
   };
 
-  home = {
+  home.packages = with pkgs; [
-    packages = with pkgs; [
+    git
-      git
+    git-lfs
-      git-lfs
+    openssh
-      openssh
+  ];
-    ];
 
-    persistence."/persist/home".directories = [
+  home.activation.obsidianVault = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
-      "Notes"
+    export PATH="${gitBin}:${gitLfsBin}:$PATH"
-    ];
+    export GIT_SSH_COMMAND="${sshBinary} -o StrictHostKeyChecking=accept-new"
+    export GIT_LFS_SKIP_SMUDGE=1
 
-    activation.obsidianVault = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+    if [ ! -d "${vaultPath}/.git" ]; then
-      export PATH="${gitBin}:${gitLfsBin}:$PATH"
+    		echo "Cloning Obsidian vault (LFS objects will be pulled separately)..."
-      export GIT_SSH_COMMAND="${sshBinary} -o StrictHostKeyChecking=accept-new"
+    		${gitBin}/git clone "${vaultRepo}" "${vaultPath}"
-      export GIT_LFS_SKIP_SMUDGE=1
+    		${gitLfsBin}/git-lfs install --local "${vaultPath}"
-
+    		${gitBin}/git -C "${vaultPath}" lfs pull
-      if [ ! -d "${vaultPath}/.git" ]; then
+    else
-      		echo "Cloning Obsidian vault (LFS objects will be pulled separately)..."
+    		echo "Pulling latest changes for Obsidian vault..."
-      		${gitBin}/git clone "${vaultRepo}" "${vaultPath}"
+    		${gitBin}/git -C "${vaultPath}" pull
-      		${gitLfsBin}/git-lfs install --local "${vaultPath}"
+    		${gitBin}/git -C "${vaultPath}" lfs pull
-      		${gitBin}/git -C "${vaultPath}" lfs pull
+    fi
-      else
+  '';
-      		echo "Pulling latest changes for Obsidian vault..."
-      		${gitBin}/git -C "${vaultPath}" pull
-      		${gitBin}/git -C "${vaultPath}" lfs pull
-      fi
-    '';
-  };
 }

home/opencode.nix

@@ -12,7 +12,7 @@ _: {
           npm = "@ai-sdk/openai-compatible";
           name = "Ollama (tailscale)";
           options = {
-            baseURL = "http://10.10.0.2:11434/v1";
+            baseURL = "http://100.86.56.71:11434/v1";
           };
           models = {
             "llama3.2:3b" = {

home/shell.nix

@@ -2,43 +2,26 @@
   pkgs,
   isDarwin,
   lib,
-  primaryUser,
   ...
 }:
 {
-  home = {
+  home.packages = with pkgs; [
-    packages = with pkgs; [
+    eza # ls replacement
-      eza # ls replacement
+    tdf # terminal pdf viewer
-      tdf # terminal pdf viewer
+    jq # json parser
-      jq # json parser
+    fastfetch # system stats
-      fastfetch # system stats
+    tabiew # Table viewer
-      tabiew # Table viewer
+    glow # MD Viewer
-      glow # MD Viewer
+    fd # find alternative
-      fd # find alternative
+    bat # cat alternative
-      bat # cat alternative
+    ripgrep # grep alternative
-      ripgrep # grep alternative
+    dnsutils
-      dnsutils
 
-      # Fun stuff
+    # Fun stuff
-      zoxide
+    zoxide
-      lolcat
+    lolcat
-      cmatrix
+    cmatrix
-    ];
+  ];
-
-    persistence = lib.mkIf (!isDarwin) {
-      "/persist/home" = {
-        directories = [ ".local/share/zoxide" ];
-        files = [ ".local/share/fish/fish_history" ];
-      };
-    };
-
-    file = {
-      ".config/fastfetch/config.jsonc".source = ./fastfetch.jsonc;
-      ".config/tabiew/theme.toml".source = ./tabiew.toml;
-      ".config/kitty/tab_bar.py".source = ./tab_bar.py;
-      ".hushlogin" = lib.mkIf isDarwin { text = ""; }; # Suppress Login
-    };
-  };
 
   programs = {
     kitty = {
@@ -260,4 +243,30 @@
     };
   };
 
+  home = {
+    file = {
+      ".config/fastfetch/config.jsonc".source = ./fastfetch.jsonc;
+      ".config/tabiew/theme.toml".source = ./tabiew.toml;
+      ".config/kitty/tab_bar.py".source = ./tab_bar.py;
+      ".hushlogin" = lib.mkIf isDarwin { text = ""; }; # Suppress Login
+
+      # Link LLM std template
+      ".config/io.datasette.llm/templates/std.yaml".text = ''
+        system: |
+          You are a concise technical assistant running on an Intel Mac (x86_64-darwin) 
+          with nix-darwin and home-manager.
+          
+          Rules:
+          - Always respond in valid markdown
+          - Be concise and direct, no unnecessary explanation
+          - Prefer code blocks for commands and code
+          - You have access to these tools in the shell: nvim, fish, git, 
+            eza, bat, ripgrep, fzf, yazi, glow, llm, zoxide, fastfetch,
+            nix, darwin-rebuild, brew
+          - When suggesting nix config changes, use the nix language
+          - nix-switch rebuilds the system config
+          - nix-check validates the flake without building
+      '';
+    };
+  };
 }

home/spicetify.nix

@@ -1,17 +1,9 @@
-{
+{ pkgs, inputs, ... }:
-  pkgs,
-  inputs,
-  ...
-}:
 {
   imports = [
     inputs.spicetify-nix.homeManagerModules.default
   ];
 
-  home.persistence."/persist/home".directories = [
-    ".config/spotify"
-  ];
-
   programs.spicetify =
     let
       spicePkgs = inputs.spicetify-nix.legacyPackages.${pkgs.system};

hosts/cyper-controller/configuration.nix

@@ -1,6 +1,5 @@
 {
   imports = [
-    ./disko.nix
     ./hardware-configuration.nix
     ./smb.nix
     ../../nixos/roles/monitoring.nix
@@ -12,6 +11,7 @@
     ../../nixos/roles/gitea.nix
     ../../nixos/roles/vaultwarden.nix
     ../../nixos/roles/frontpage
+    #../../nixos/roles/paperless-ngx.nix
     ../../nixos/roles/octoprint.nix
     ../../nixos/roles/matrix/postgres-backup.nix
     ../../nixos/roles/kanidm.nix
@@ -22,17 +22,6 @@
     useNetworkd = true;
     useDHCP = false;
     firewall.enable = true;
-    wireguard.interfaces.wg0 = {
-      ips = [ "10.10.0.2/24" ];
-      peers = [
-        {
-          publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=";
-          endpoint = "178.254.8.35:51820";
-          allowedIPs = [ "10.10.0.0/24" ];
-          persistentKeepalive = 25;
-        }
-      ];
-    };
   };
 
   systemd.network = {
@@ -56,6 +45,5 @@
     };
     efi.canTouchEfiVariables = true;
   };
-
   system.stateVersion = "26.05";
 }

hosts/cyper-controller/disko.nix

@@ -1,62 +0,0 @@
-{
-  disko.devices.disk.main = {
-    type = "disk";
-    device = "/dev/sda";
-    content = {
-      type = "gpt";
-      partitions = {
-        ESP = {
-          size = "512M";
-          type = "EF00";
-          content = {
-            type = "filesystem";
-            format = "vfat";
-            mountpoint = "/boot";
-            mountOptions = [
-              "fmask=0022"
-              "dmask=0022"
-            ];
-            extraArgs = [
-              "-n"
-              "NIXBOOT"
-            ];
-          };
-        };
-        swap = {
-          size = "8G";
-          content = {
-            type = "swap";
-            extraArgs = [
-              "-L"
-              "NIXSWAP"
-            ];
-          };
-        };
-        nix = {
-          size = "80G";
-          content = {
-            type = "filesystem";
-            format = "ext4";
-            mountpoint = "/nix";
-            extraArgs = [
-              "-L"
-              "NIXSTORE"
-            ];
-          };
-        };
-        persist = {
-          size = "100%";
-          content = {
-            type = "filesystem";
-            format = "ext4";
-            mountpoint = "/persist";
-            extraArgs = [
-              "-L"
-              "NIXPERSIST"
-            ];
-          };
-        };
-      };
-    };
-  };
-}

hosts/cyper-controller/hardware-configuration.nix

@@ -5,6 +5,7 @@
   primaryUser,
   ...
 }:
+
 {
   imports = [
     (modulesPath + "/installer/scan/not-detected.nix")
@@ -16,21 +17,25 @@
       "ahci"
       "usb_storage"
       "sd_mod"
-      "nvme"
     ];
     initrd.kernelModules = [ ];
     kernelModules = [ "kvm-intel" ];
     extraModulePackages = [ ];
+    zfs.forceImportRoot = false;
   };
 
   fileSystems = {
-    "/" = {
+    "/" = lib.mkForce {
-      device = "none";
+      device = "/dev/disk/by-label/NIXROOT";
-      fsType = "tmpfs";
+      fsType = "ext4";
+    };
+
+    "/boot" = lib.mkForce {
+      device = "/dev/disk/by-label/NIXBOOT";
+      fsType = "vfat";
       options = [
-        "defaults"
+        "fmask=0022"
-        "size=6G"
+        "dmask=0022"
-        "mode=755"
       ];
     };
 
@@ -66,8 +71,6 @@
       ];
     };
 
-    "/nix".neededForBoot = true;
-    "/persist".neededForBoot = true;
   };
 
   systemd.tmpfiles.rules = [
@@ -77,7 +80,12 @@
     "d /storage/backup 0755 ${primaryUser} users -"
   ];
 
-  networking.useDHCP = lib.mkDefault true;
+  swapDevices = [
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+    {
+      device = "/swapfile";
+      size = 4096;
+    }
+  ];
+
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/cyper-controller/smb.nix

@@ -1,12 +1,11 @@
 {
   pkgs,
   primaryUser,
-  config,
   ...
 }:
 
 {
-  sops.secrets."network/smb_passwd" = { };
+  sops.secrets.smb_passwd = { };
 
   users.users.${primaryUser}.extraGroups = [ "sambashare" ];
 
@@ -94,7 +93,7 @@
           sleep 1
         done
 
-        PASSWORD=$(cat ${config.sops.secrets."network/smb_passwd".path})
+        PASSWORD=$(cat /run/secrets/smb_passwd)
         (echo "$PASSWORD"; echo "$PASSWORD") | ${pkgs.samba}/bin/smbpasswd -a -s ${primaryUser} || \
         (echo "$PASSWORD"; echo "$PASSWORD") | ${pkgs.samba}/bin/smbpasswd -s ${primaryUser}
       '';

hosts/cyper-desktop/configuration.nix

@@ -1,24 +1,11 @@
+{ ... }:
 {
-  imports = [
+  imports = [ ./hardware-configuration.nix ];
-    ./disko.nix
-    ./hardware-configuration.nix
-  ];
 
   networking = {
     useNetworkd = true;
     useDHCP = false;
     firewall.enable = true;
-    wireguard.interfaces.wg0 = {
-      ips = [ "10.10.0.40/24" ];
-      peers = [
-        {
-          publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=";
-          endpoint = "178.254.8.35:51820";
-          allowedIPs = [ "10.10.0.0/24" ];
-          persistentKeepalive = 25;
-        }
-      ];
-    };
   };
 
   systemd.network = {
@@ -63,6 +50,4 @@
 
   virtualisation.docker.enable = true;
   users.users.phil.extraGroups = [ "docker" ];
-
-  programs.fuse.userAllowOther = true;
 }

hosts/cyper-desktop/disko.nix

@@ -1,68 +0,0 @@
-{
-  disko.devices.disk.main = {
-    type = "disk";
-    device = "/dev/sda";
-    content = {
-      type = "gpt";
-      partitions = {
-
-        ESP = {
-          size = "512M";
-          type = "EF00";
-          content = {
-            type = "filesystem";
-            format = "vfat";
-            mountpoint = "/boot";
-            mountOptions = [
-              "fmask=0022"
-              "dmask=0022"
-            ];
-            extraArgs = [
-              "-n"
-              "NIXBOOT"
-            ];
-          };
-        };
-
-        swap = {
-          size = "4G";
-          content = {
-            type = "swap";
-            extraArgs = [
-              "-L"
-              "NIXSWAP"
-            ];
-          };
-        };
-
-        nix = {
-          size = "110G";
-          content = {
-            type = "filesystem";
-            format = "ext4";
-            mountpoint = "/nix";
-            mountOptions = [ "defaults" ];
-            extraArgs = [
-              "-L"
-              "NIXSTORE"
-            ];
-          };
-        };
-
-        persist = {
-          size = "100%";
-          content = {
-            type = "filesystem";
-            format = "ext4";
-            mountpoint = "/persist";
-            extraArgs = [
-              "-L"
-              "NIXPERSIST"
-            ];
-          };
-        };
-
-      };
-    };
-  };
-}

hosts/cyper-desktop/hardware-configuration.nix

@@ -31,31 +31,34 @@
     extraModprobeConfig = ''
       options v4l2loopback exclusive_caps=1 card_label="Virtual Camera"
     '';
+    zfs.forceImportRoot = false;
   };
 
   sops = {
-    secrets."network/smb_passwd" = { };
+    secrets.smb_passwd = { };
+
     templates.smb_credentials = {
       content = ''
         username=${primaryUser}
-        password=${config.sops.placeholder."network/smb_passwd"}
+        password=${config.sops.placeholder.smb_passwd}
       '';
     };
   };
 
   fileSystems = {
     "/" = {
-      device = "none";
+      device = "/dev/disk/by-label/NIXROOT";
-      fsType = "tmpfs";
+      fsType = "ext4";
-      options = [
-        "defaults"
-        "size=4G"
-        "mode=755"
-      ];
     };
 
-    "/nix".neededForBoot = true;
+    "/boot" = {
-    "/persist".neededForBoot = true;
+      device = "/dev/disk/by-label/NIXBOOT";
+      fsType = "vfat";
+      options = [
+        "fmask=0022"
+        "dmask=0022"
+      ];
+    };
 
     "/storage" = {
       device = "/dev/disk/by-label/STORAGE";
@@ -96,6 +99,8 @@
     "d /shares/storage-backup 0775 ${primaryUser} users -"
   ];
 
+  swapDevices = [ ];
+
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 
   hardware = {

hosts/cyper-mac/configuration.nix

@@ -1,3 +1 @@
-{
+{ ... }: { }
-  launchd.daemons.wireguard.environment.WG_IP = "10.10.0.3/24";
-}

hosts/cyper-node-1/configuration.nix

@@ -1,6 +1,5 @@
 {
   imports = [
-    ./disko.nix
     ./hardware-configuration.nix
   ];
 
@@ -8,17 +7,6 @@
     useNetworkd = true;
     useDHCP = false;
     firewall.enable = true;
-    wireguard.interfaces.wg0 = {
-      ips = [ "10.10.0.30/24" ];
-      peers = [
-        {
-          publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=";
-          endpoint = "178.254.8.35:51820";
-          allowedIPs = [ "10.10.0.0/24" ];
-          persistentKeepalive = 25;
-        }
-      ];
-    };
   };
 
   systemd.network = {

hosts/cyper-node-1/disko.nix

@@ -1,68 +0,0 @@
-{
-  disko.devices.disk.main = {
-    type = "disk";
-    device = "/dev/sda";
-    content = {
-      type = "gpt";
-      partitions = {
-
-        ESP = {
-          size = "512M";
-          type = "EF00";
-          content = {
-            type = "filesystem";
-            format = "vfat";
-            mountpoint = "/boot";
-            mountOptions = [
-              "fmask=0022"
-              "dmask=0022"
-            ];
-            extraArgs = [
-              "-n"
-              "NIXBOOT"
-            ];
-          };
-        };
-
-        swap = {
-          size = "4G";
-          content = {
-            type = "swap";
-            extraArgs = [
-              "-L"
-              "NIXSWAP"
-            ];
-          };
-        };
-
-        nix = {
-          size = "50G";
-          content = {
-            type = "filesystem";
-            format = "ext4";
-            mountpoint = "/nix";
-            mountOptions = [ "defaults" ];
-            extraArgs = [
-              "-L"
-              "NIXSTORE"
-            ];
-          };
-        };
-
-        persist = {
-          size = "100%";
-          content = {
-            type = "filesystem";
-            format = "ext4";
-            mountpoint = "/persist";
-            extraArgs = [
-              "-L"
-              "NIXPERSIST"
-            ];
-          };
-        };
-
-      };
-    };
-  };
-}

hosts/cyper-node-1/hardware-configuration.nix

@@ -4,6 +4,7 @@
   modulesPath,
   ...
 }:
+
 {
   imports = [
     (modulesPath + "/installer/scan/not-detected.nix")
@@ -19,22 +20,34 @@
     initrd.kernelModules = [ ];
     kernelModules = [ "kvm-intel" ];
     extraModulePackages = [ ];
+    zfs.forceImportRoot = false;
   };
 
   fileSystems = {
     "/" = {
-      device = "none";
+      device = "/dev/disk/by-label/NIXROOT";
-      fsType = "tmpfs";
+      fsType = "ext4";
-      options = [
-        "defaults"
-        "size=2G"
-        "mode=755"
-      ];
     };
 
-    "/nix".neededForBoot = true;
+    "/boot" = {
-    "/persist".neededForBoot = true;
+      device = "/dev/disk/by-label/NIXBOOT";
+      fsType = "vfat";
+      options = [
+        "fmask=0022"
+        "dmask=0022"
+      ];
+    };
   };
 
+  swapDevices = [
+    {
+      device = "/swapfile";
+      size = 4096;
+    }
+  ];
+
+  networking.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/cyper-node-2/configuration.nix

@@ -1,6 +1,5 @@
 {
   imports = [
-    ./disko.nix
     ./hardware-configuration.nix
   ];
 
@@ -8,17 +7,6 @@
     useNetworkd = true;
     useDHCP = false;
     firewall.enable = true;
-    wireguard.interfaces.wg0 = {
-      ips = [ "10.10.0.31/24" ];
-      peers = [
-        {
-          publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=";
-          endpoint = "178.254.8.35:51820";
-          allowedIPs = [ "10.10.0.0/24" ];
-          persistentKeepalive = 25;
-        }
-      ];
-    };
   };
 
   systemd.network = {

hosts/cyper-node-2/disko.nix

@@ -1,68 +0,0 @@
-{
-  disko.devices.disk.main = {
-    type = "disk";
-    device = "/dev/sda";
-    content = {
-      type = "gpt";
-      partitions = {
-
-        ESP = {
-          size = "512M";
-          type = "EF00";
-          content = {
-            type = "filesystem";
-            format = "vfat";
-            mountpoint = "/boot";
-            mountOptions = [
-              "fmask=0022"
-              "dmask=0022"
-            ];
-            extraArgs = [
-              "-n"
-              "NIXBOOT"
-            ];
-          };
-        };
-
-        swap = {
-          size = "4G";
-          content = {
-            type = "swap";
-            extraArgs = [
-              "-L"
-              "NIXSWAP"
-            ];
-          };
-        };
-
-        nix = {
-          size = "50G";
-          content = {
-            type = "filesystem";
-            format = "ext4";
-            mountpoint = "/nix";
-            mountOptions = [ "defaults" ];
-            extraArgs = [
-              "-L"
-              "NIXSTORE"
-            ];
-          };
-        };
-
-        persist = {
-          size = "100%";
-          content = {
-            type = "filesystem";
-            format = "ext4";
-            mountpoint = "/persist";
-            extraArgs = [
-              "-L"
-              "NIXPERSIST"
-            ];
-          };
-        };
-
-      };
-    };
-  };
-}

hosts/cyper-node-2/hardware-configuration.nix

@@ -4,6 +4,7 @@
   modulesPath,
   ...
 }:
+
 {
   imports = [
     (modulesPath + "/installer/scan/not-detected.nix")
@@ -19,22 +20,34 @@
     initrd.kernelModules = [ ];
     kernelModules = [ "kvm-intel" ];
     extraModulePackages = [ ];
+    zfs.forceImportRoot = false;
   };
 
   fileSystems = {
     "/" = {
-      device = "none";
+      device = "/dev/disk/by-label/NIXROOT";
-      fsType = "tmpfs";
+      fsType = "ext4";
-      options = [
-        "defaults"
-        "size=2G"
-        "mode=755"
-      ];
     };
 
-    "/nix".neededForBoot = true;
+    "/boot" = {
-    "/persist".neededForBoot = true;
+      device = "/dev/disk/by-label/NIXBOOT";
+      fsType = "vfat";
+      options = [
+        "fmask=0022"
+        "dmask=0022"
+      ];
+    };
   };
 
+  swapDevices = [
+    {
+      device = "/swapfile";
+      size = 4096;
+    }
+  ];
+
+  networking.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/cyper-proxy/configuration.nix

@@ -1,7 +1,6 @@
 { ... }:
 {
   imports = [
-    ./disko.nix
     ./hardware-configuration.nix
     ../../nixos/roles/nginx.nix
     #    ../../nixos/roles/jitsi.nix
@@ -14,18 +13,18 @@
     interfaces.ens3 = {
       ipv4.addresses = [
         {
-          address = "195.90.219.9";
+          address = "178.254.8.35";
-          prefixLength = 22;
+          prefixLength = 23;
         }
       ];
       ipv6.addresses = [
         {
-          address = "2a00:6800:3:113e::1";
+          address = "2a00:6800:3:1094::1";
           prefixLength = 64;
         }
       ];
     };
-    defaultGateway = "195.90.216.1";
+    defaultGateway = "178.254.8.1";
 
     defaultGateway6 = {
       address = "2a00:6800:3::1";
@@ -37,46 +36,18 @@
       "178.254.16.141"
     ];
 
-    wireguard.interfaces.wg0 = {
-      ips = [ "10.10.0.1/24" ];
-      listenPort = 51820;
-      peers = [
-        {
-          publicKey = "EvML4de3CReNW8aF+lJAsPZ+p6FICOyjCsAZJBwIwX8=";
-          allowedIPs = [ "10.10.0.2/32" ];
-        }
-        {
-          publicKey = "WkY45tGnNZQuJTf1MPN6I92spxHts/kpzXRSZE9se2c=";
-          allowedIPs = [ "10.10.0.3/32" ];
-        }
-        {
-          publicKey = "oAstNd7Wxpj2PqSyS87q+8y8WtaLK7hZ5Ytfncml9EM=";
-          allowedIPs = [ "10.10.0.40/32" ];
-        }
-        {
-          publicKey = "GrFH3I5QqjRij7Jl+eOL6Ou6zK6MtH5/kAsA5AmGckM=";
-          allowedIPs = [ "10.10.0.30/32" ];
-        }
-        {
-          publicKey = "IddGAijZVCVxGj/aMasjfroIy9r8Owar4MO9xfvNNBY=";
-          allowedIPs = [ "10.10.0.31/32" ];
-        }
-      ];
-    };
-
     firewall.allowedTCPPorts = [
       80
       443
-      51820
     ];
 
     hosts = {
-      "195.90.219.9" = [
+      "178.254.8.35" = [
         "cyperpunk.de"
         "matrix.cyperpunk.de"
       ];
 
-      "2a00:6800:3:113e::1" = [
+      "2a00:6800:3:1094::1" = [
         "cyperpunk.de"
         "matrix.cyperpunk.de"
       ];

hosts/cyper-proxy/disko.nix

@@ -1,65 +0,0 @@
-{
-  disko.devices.disk.main = {
-    type = "disk";
-    device = "/dev/vda";
-    content = {
-      type = "gpt";
-      partitions = {
-        boot = {
-          size = "1M";
-          type = "EF02";
-        };
-        ESP = {
-          size = "512M";
-          content = {
-            type = "filesystem";
-            format = "vfat";
-            mountpoint = "/boot";
-            mountOptions = [
-              "fmask=0022"
-              "dmask=0022"
-            ];
-            extraArgs = [
-              "-n"
-              "NIXBOOT"
-            ];
-          };
-        };
-        swap = {
-          size = "4G";
-          content = {
-            type = "swap";
-            extraArgs = [
-              "-L"
-              "NIXSWAP"
-            ];
-          };
-        };
-        nix = {
-          size = "40G";
-          content = {
-            type = "filesystem";
-            format = "ext4";
-            mountpoint = "/nix";
-            extraArgs = [
-              "-L"
-              "NIXSTORE"
-            ];
-          };
-        };
-        persist = {
-          size = "100%";
-          content = {
-            type = "filesystem";
-            format = "ext4";
-            mountpoint = "/persist";
-            extraArgs = [
-              "-L"
-              "NIXPERSIST"
-            ];
-          };
-        };
-      };
-    };
-  };
-}

hosts/cyper-proxy/hardware-configuration.nix

@@ -5,6 +5,11 @@
   ];
 
   boot = {
+    loader.grub = {
+      enable = true;
+      device = "/dev/vda";
+    };
+
     initrd = {
       availableKernelModules = [
         "ata_piix"
@@ -16,24 +21,26 @@
       ];
       kernelModules = [ ];
     };
-    kernel.sysctl."net.ipv4.ip_forward" = 1;
     kernelModules = [ ];
     extraModulePackages = [ ];
+    zfs.forceImportRoot = false;
   };
 
   fileSystems = {
     "/" = {
-      device = "none";
+      device = "/dev/disk/by-label/NIXROOT";
-      fsType = "tmpfs";
+      fsType = "ext4";
-      options = [
-        "defaults"
-        "size=2G"
-        "mode=755"
-      ];
     };
 
-    "/nix".neededForBoot = true;
+    "/boot" = {
-    "/persist".neededForBoot = true;
+      device = "/dev/disk/by-label/NIXBOOT";
+      fsType = "vfat";
+      options = [
+        "fmask=0022"
+        "dmask=0022"
+      ];
+    };
   };
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+
+  swapDevices = [ ];
 }

hosts/installer/configuration.nix

@@ -1,86 +0,0 @@
-{ modulesPath, pkgs, ... }:
-{
-  imports = [ (modulesPath + "/installer/cd-dvd/installation-cd-minimal.nix") ];
-
-  boot.zfs.forceImportRoot = false;
-
-  time.timeZone = "Europe/Berlin";
-  i18n = {
-    defaultLocale = "en_US.UTF-8";
-    extraLocaleSettings = {
-      LC_ADDRESS = "de_DE.UTF-8";
-      LC_IDENTIFICATION = "de_DE.UTF-8";
-      LC_MEASUREMENT = "de_DE.UTF-8";
-      LC_MONETARY = "de_DE.UTF-8";
-      LC_NAME = "de_DE.UTF-8";
-      LC_NUMERIC = "de_DE.UTF-8";
-      LC_PAPER = "de_DE.UTF-8";
-      LC_TELEPHONE = "de_DE.UTF-8";
-      LC_TIME = "de_DE.UTF-8";
-    };
-  };
-
-  services.openssh = {
-    enable = true;
-    openFirewall = true;
-    settings = {
-      PermitRootLogin = "yes";
-      PasswordAuthentication = false;
-    };
-  };
-
-  users.users = {
-    root.openssh.authorizedKeys.keyFiles = [
-      ../../secrets/ssh-key
-    ];
-
-    phil = {
-      isNormalUser = true;
-      password = "nixos";
-      extraGroups = [ "wheel" ];
-      openssh.authorizedKeys.keyFiles = [
-        ../../secrets/ssh-key
-      ];
-    };
-  };
-
-  security.sudo = {
-    enable = true;
-    wheelNeedsPassword = false;
-  };
-
-  networking = {
-    useNetworkd = true;
-    useDHCP = false;
-    firewall.enable = false;
-  };
-
-  systemd.network = {
-    enable = true;
-    networks."10-ethernet" = {
-      matchConfig.Name = "en*";
-      networkConfig = {
-        #Address = "192.168.2.99/24";
-        #Gateway = "192.168.2.1";
-        #DNS = "192.168.2.2";
-        Address = "195.90.219.9/22";
-        Gateway = "195.90.216.1";
-        DNS = [
-          "178.254.16.151"
-          "178.254.16.141"
-        ];
-        DHCP = "no";
-      };
-    };
-  };
-
-  environment.systemPackages = with pkgs; [
-    htop
-    lsscsi
-    pciutils
-    usbutils
-    nvme-cli
-  ];
-
-  system.stateVersion = "26.05";
-}

nixos/default.nix

@@ -11,9 +11,8 @@
   imports = [
     ./sops.nix
     ./locale.nix
-    ./wireguard.nix
+    ./tailscale.nix
     ./ssh.nix
-    ./impermanence.nix
   ]
   ++ lib.optionals (!isServer) [
     ./regreet.nix
@@ -23,11 +22,9 @@
     ./catppuccin.nix
   ];
 
-  sops.secrets = {
+  sops.secrets."nix_cache_priv_key" = {
-    "nix/cache_priv_key" = {
+
-      mode = "0400";
+    mode = "0400";
-    };
-    "nix/cachix_auth_token" = { };
   };
 
   nix = {
@@ -50,7 +47,7 @@
         "https://nix-community.cachix.org"
         "https://cyper-cache.cachix.org"
       ];
-      secret-key-files = [ config.sops.secrets."nix/cache_priv_key".path ];
+      secret-key-files = [ config.sops.secrets."nix_cache_priv_key".path ];
       trusted-public-keys = [
         "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
         "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
@@ -115,6 +112,8 @@
     };
   };
 
+  sops.secrets.cachix_auth_token = { };
+
   systemd.services.cachix-push = {
     description = "Push new store paths to Cachix";
     after = [ "multi-user.target" ];
@@ -122,28 +121,14 @@
     serviceConfig = {
       Type = "oneshot";
       RemainAfterExit = true;
-      ExecStart = "${pkgs.bash}/bin/bash -c 'CACHIX_AUTH_TOKEN=$(cat ${
+      ExecStart = "${pkgs.bash}/bin/bash -c 'CACHIX_AUTH_TOKEN=$(cat ${config.sops.secrets.cachix_auth_token.path}) ${pkgs.nix}/bin/nix path-info --recursive /run/current-system | CACHIX_AUTH_TOKEN=$(cat ${config.sops.secrets.cachix_auth_token.path}) ${pkgs.cachix}/bin/cachix push cyper-cache'";
-        config.sops.secrets."nix/cachix_auth_token".path
-      }) ${pkgs.nix}/bin/nix path-info --recursive /run/current-system | CACHIX_AUTH_TOKEN=$(cat ${
-        config.sops.secrets."nix/cachix_auth_token".path
-      }) ${pkgs.cachix}/bin/cachix push cyper-cache'";
     };
   };
 
-  networking = {
+  networking.firewall.allowedTCPPorts = [
-    hosts = {
+    9002
-      "10.10.0.1" = [ "proxy.cyperpunk.de" ];
+    3100
-      "10.10.0.2" = [ "controller.cyperpunk.de" ];
+  ];
-      "10.10.0.3" = [ "mac.cyperpunk.de" ];
-      "10.10.0.30" = [ "node1.cyperpunk.de" ];
-      "10.10.0.31" = [ "node2.cyperpunk.de" ];
-      "10.10.0.40" = [ "desktop.cyperpunk.de" ];
-    };
-    firewall.allowedTCPPorts = [
-      9002
-      3100
-    ];
-  };
 
   users.users.${primaryUser} = {
     home = "/home/${primaryUser}";

nixos/impermanence.nix

@@ -1,18 +0,0 @@
-_: {
-  environment.persistence."/persist" = {
-    hideMounts = true;
-    files = [
-      "/etc/machine-id"
-      "/etc/ssh/ssh_host_ed25519_key"
-      "/etc/ssh/ssh_host_ed25519_key.pub"
-      "/etc/ssh/ssh_host_rsa_key"
-      "/etc/ssh/ssh_host_rsa_key.pub"
-    ];
-    directories = [
-      "/var/lib/nixos"
-      "/var/lib/systemd"
-      "/var/log"
-      "/var/lib/tailscale"
-    ];
-  };
-}

nixos/regreet.nix

@@ -1,7 +1,6 @@
 {
   lib,
   pkgs,
-  primaryUser,
   ...
 }:
 {
@@ -9,46 +8,35 @@
     "greetd/background.png".source = ../assets/wallpapers/lucy_with_cat.png;
     "greetd/environments".text = ''
       Hyprland
+      niri-session
       fish
     '';
   };
 
   programs.regreet = {
-    enable = true;
+    enable = false;
+
     cageArgs = [
       "-s"
       "-m"
       "last"
     ];
-    theme = {
+
-      name = "catppuccin-mocha-standard-sky-dark";
-      package = pkgs.catppuccin-gtk;
-    };
-    cursorTheme = {
-      name = "catppuccin-mocha-sapphire-cursors";
-      package = pkgs.catppuccin-cursors.mochaSapphire;
-    };
-    iconTheme = {
-      name = "Papirus-Dark";
-      package = pkgs.papirus-icon-theme;
-    };
-    font = {
-      name = "FiraCode Nerd Font Propo";
-      size = 12;
-      package = pkgs.nerd-fonts.fira-code;
-    };
     settings = {
+
       background = {
         path = "/etc/greetd/background.png";
         fit = "Fill";
       };
+
       GTK = {
         application_prefer_dark_theme = true;
-        cursor_theme_name = lib.mkForce "catppuccin-mocha-sapphire-cursors";
+        cursor_theme_name = lib.mkForce "catppuccin-mocha-dark-cursors";
         font_name = lib.mkForce "FiraCode Nerd Font Propo 12";
         icon_theme_name = lib.mkForce "Papirus-Dark";
-        theme_name = lib.mkForce "catppuccin-mocha-standard-sky-dark";
+        theme_name = lib.mkForce "catppuccin-mocha-standard-mauve-dark";
       };
+
       commands = {
         reboot = [
           "systemctl"
@@ -58,10 +46,16 @@
           "systemctl"
           "poweroff"
         ];
+        x11_prefix = [
+          "startx"
+          "/usr/bin/env"
+        ];
       };
+
       appearance = {
         greeting_msg = "Hey there!";
       };
+
       widget.clock = {
         format = "%A %d.%m.%Y %T";
         resolution = "500ms";
@@ -75,12 +69,12 @@
     enable = true;
     settings = {
       default_session = {
-        command = "${pkgs.greetd.regreet}/bin/regreet";
+        command = "${pkgs.tuigreet}/bin/tuigreet --cmd start-hyprland";
         user = "greeter";
       };
       initial_session = {
-        command = "start-hyprland";
+        command = "Hyprland";
-        user = primaryUser;
+        user = "phil";
       };
     };
   };

nixos/roles/filebrowser.nix

@@ -1,13 +1,5 @@
+{ ... }:
 {
-  environment.persistence."/persist".directories = [
-    {
-      directory = "/var/lib/filebrowser";
-      user = "filebrowser";
-      group = "filebrowser";
-      mode = "0750";
-    }
-  ];
-
   services.filebrowser = {
     enable = true;
 

nixos/roles/frontpage/frontpage.nix

@@ -13,7 +13,7 @@ let
         "/var/lib/flame-${name}:/app/data"
       ]
       ++ extraVolumes;
-      environmentFiles = [ config.sops.secrets."services/flame/${name}_password".path ];
+      environmentFiles = [ config.sops.secrets."flame_${name}_password".path ];
     };
 
   instances = [
@@ -29,35 +29,8 @@ let
   ];
 in
 {
-  environment.persistence."/persist".directories = [
-    {
-      directory = "/var/lib/flame-phil";
-      user = "root";
-      group = "root";
-      mode = "0755";
-    }
-    {
-      directory = "/var/lib/flame-calvin";
-      user = "root";
-      group = "root";
-      mode = "0755";
-    }
-    {
-      directory = "/var/lib/docker";
-      user = "root";
-      group = "root";
-      mode = "0710";
-    }
-    {
-      directory = "/var/lib/private";
-      user = "root";
-      group = "root";
-      mode = "0700";
-    }
-  ];
-
   sops.secrets = lib.listToAttrs (
-    map ({ name, ... }: lib.nameValuePair "services/flame/${name}_password" { }) instances
+    map ({ name, ... }: lib.nameValuePair "flame_${name}_password" { }) instances
   );
 
   virtualisation = {

nixos/roles/gitea.nix

@@ -2,6 +2,7 @@
   pkgs,
   lib,
   config,
+  primaryUser,
   ...
 }:
 
@@ -19,48 +20,33 @@ let
 in
 {
   sops.secrets = {
-    "services/gitea/db_password" = {
+    "gitea/dbPassword" = {
       owner = "gitea";
       group = "gitea";
       mode = "0444";
     };
-    "services/gitea/internal_token" = {
+    "gitea/internalToken" = {
       owner = "gitea";
       group = "gitea";
     };
-    "services/gitea/lfs_jwt_secret" = {
+    "gitea/lfsJwtSecret" = {
       owner = "gitea";
       group = "gitea";
     };
-    "services/gitea/mailer_password" = {
+    "gitea/mailerPassword" = {
       owner = "gitea";
       group = "gitea";
     };
-    "services/gitea/runner_token" = {
+    "gitea/runnerToken" = {
       mode = "0444";
     };
-    "kanidm/gitea_secret" = {
+    "kanidm_gitea_secret" = {
       owner = "gitea";
       group = "gitea";
       mode = "0444";
     };
   };
 
-  environment.persistence."/persist".directories = [
-    {
-      directory = "/var/lib/gitea";
-      user = "gitea";
-      group = "gitea";
-      mode = "0750";
-    }
-    {
-      directory = "/var/lib/postgresql";
-      user = "postgres";
-      group = "postgres";
-      mode = "0750";
-    }
-  ];
-
   systemd.services = {
     gitea-db-password = {
       description = "Set gitea postgres user password";
@@ -74,7 +60,7 @@ in
         RemainAfterExit = true;
       };
       script = ''
-        pass=$(cat ${config.sops.secrets."services/gitea/db_password".path})
+        pass=$(cat ${config.sops.secrets."gitea/dbPassword".path})
         ${pkgs.postgresql_14}/bin/psql -c \
           "ALTER USER gitea WITH PASSWORD '$pass';"
       '';
@@ -125,7 +111,7 @@ in
         port = 5432;
         name = "gitea";
         user = "gitea";
-        passwordFile = config.sops.secrets."services/gitea/db_password".path;
+        passwordFile = config.sops.secrets."gitea/dbPassword".path;
       };
 
       settings = {
@@ -221,7 +207,7 @@ in
     gitea-actions-runner.instances."cyper_nix" = {
       enable = true;
       url = "https://git.cyperpunk.de";
-      tokenFile = config.sops.secrets."services/gitea/runner_token".path;
+      tokenFile = config.sops.secrets."gitea/runnerToken".path;
       name = "cyper-controller";
       labels = [ "nix:host" ];
 

nixos/roles/kanidm.nix

@@ -5,15 +5,6 @@ let
   certDir = "/var/lib/kanidm/tls";
 in
 {
-  environment.persistence."/persist".directories = [
-    {
-      directory = "/var/lib/kanidm";
-      user = "kanidm";
-      group = "kanidm";
-      mode = "0750";
-    }
-  ];
-
   systemd.services.kanidm-selfsigned-cert = {
     description = "Generate self-signed TLS certificate for Kanidm";
     wantedBy = [ "kanidm.service" ];

nixos/roles/matrix/clients.nix

@@ -149,15 +149,6 @@ let
 
 in
 {
-  environment.persistence."/persist".directories = [
-    {
-      directory = "/var/lib/containers";
-      user = "root";
-      group = "root";
-      mode = "0700";
-    }
-  ];
-
   services.nginx.virtualHosts = {
     "cinny.cyperpunk.de" = {
       forceSSL = true;

nixos/roles/matrix/coturn.nix

@@ -1,14 +1,15 @@
 { config, lib, ... }:
 {
   sops.secrets = {
-    "matrix/coturn_static_auth_secret" = {
+    coturn_static_auth_secret = {
       owner = "turnserver";
       group = "turnserver";
     };
+
     coturn_static_auth_secret_synapse = {
       owner = "matrix-synapse";
       group = "matrix-synapse";
-      key = "matrix/coturn_static_auth_secret";
+      key = "coturn_static_auth_secret";
     };
   };
 
@@ -20,7 +21,7 @@
       min-port = 49000;
       max-port = 50000;
       use-auth-secret = true;
-      static-auth-secret-file = config.sops.secrets."matrix/coturn_static_auth_secret".path;
+      static-auth-secret-file = config.sops.secrets.coturn_static_auth_secret.path;
       realm = "turn.cyperpunk.de";
       cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
       pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";

nixos/roles/matrix/default.nix

@@ -6,7 +6,7 @@
     ./synapse.nix
     ./livekit.nix
     ./clients.nix
-    ./draupnir.nix
+    ./mjolnir.nix
     ./coturn.nix
     ./maubot.nix
     ./discord-bridge.nix

nixos/roles/matrix/discord-bridge.nix

@@ -1,29 +1,20 @@
 { config, lib, ... }:
 {
   sops.secrets = {
-    "matrix/bridges/discord/bot_token" = {
+    discord_bot_token = {
       owner = "mautrix-discord";
       group = "mautrix-discord";
     };
-    "matrix/bridges/discord/client_id" = {
+    discord_client_id = {
       owner = "mautrix-discord";
       group = "mautrix-discord";
     };
-    "matrix/bridges/discord/pickle_key" = {
+    discord_pickle_key = {
       owner = "mautrix-discord";
       group = "mautrix-discord";
     };
   };
 
-  environment.persistence."/persist".directories = [
-    {
-      directory = "/var/lib/mautrix-discord";
-      user = "mautrix-discord";
-      group = "mautrix-discord";
-      mode = "0750";
-    }
-  ];
-
   systemd = {
     services = {
       mautrix-discord-env = {
@@ -35,15 +26,9 @@
         };
         script = ''
           mkdir -p /run/mautrix-discord
-          echo "DISCORD_BOT_TOKEN=$(cat ${
+          echo "DISCORD_BOT_TOKEN=$(cat ${config.sops.secrets.discord_bot_token.path})" > /run/mautrix-discord/env
-            config.sops.secrets."matrix/bridges/discord/bot_token".path
+          echo "DISCORD_CLIENT_ID=$(cat ${config.sops.secrets.discord_client_id.path})" >> /run/mautrix-discord/env
-          })" > /run/mautrix-discord/env
+          echo "DISCORD_PICKLE_KEY=$(cat ${config.sops.secrets.discord_pickle_key.path})" >> /run/mautrix-discord/env
-          echo "DISCORD_CLIENT_ID=$(cat ${
-            config.sops.secrets."matrix/bridges/discord/client_id".path
-          })" >> /run/mautrix-discord/env
-          echo "DISCORD_PICKLE_KEY=$(cat ${
-            config.sops.secrets."matrix/bridges/discord/pickle_key".path
-          })" >> /run/mautrix-discord/env
           chmod 600 /run/mautrix-discord/env
           chown mautrix-discord:mautrix-discord /run/mautrix-discord/env
         '';

nixos/roles/matrix/draupnir.nix

@@ -1,22 +0,0 @@
-{ config, ... }:
-{
-  sops.secrets."matrix/draupnir_access_token" = { };
-
-  environment.persistence."/persist".directories = [
-    {
-      directory = "/var/lib/private";
-      user = "root";
-      group = "root";
-      mode = "0700";
-    }
-  ];
-
-  services.draupnir = {
-    enable = true;
-    secrets.accessToken = config.sops.secrets."matrix/draupnir_access_token".path;
-    settings = {
-      homeserverUrl = "https://matrix.cyperpunk.de";
-      managementRoom = "!eErCimyDjLSebHjpJA:cyperpunk.de";
-    };
-  };
-}

nixos/roles/matrix/livekit.nix

@@ -1,20 +1,18 @@
 { config, ... }:
 {
-  sops.secrets."matrix/livekit_key_file" = { };
+  sops.secrets.livekit_key_file = { };
 
-  services = {
+  services.livekit = {
-    livekit = {
+    enable = true;
-      enable = true;
+    openFirewall = true;
-      openFirewall = true;
+    settings.room.auto_create = false;
-      settings.room.auto_create = false;
+    keyFile = config.sops.secrets.livekit_key_file.path;
-      keyFile = config.sops.secrets."matrix/livekit_key_file".path;
+  };
-    };
 
-    lk-jwt-service = {
+  services.lk-jwt-service = {
-      enable = true;
+    enable = true;
-      livekitUrl = "wss://cyperpunk.de/livekit/sfu";
+    livekitUrl = "wss://cyperpunk.de/livekit/sfu";
-      keyFile = config.sops.secrets."matrix/livekit_key_file".path;
+    keyFile = config.sops.secrets.livekit_key_file.path;
-    };
   };
 
   systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = "cyperpunk.de";

nixos/roles/matrix/maubot.nix

@@ -1,19 +1,8 @@
 { config, pkgs, ... }:
 {
-  environment = {
+  environment.systemPackages = with pkgs; [
-    systemPackages = with pkgs; [
+    maubot
-      maubot
+  ];
-    ];
-
-    persistence."/persist".directories = [
-      {
-        directory = "/var/lib/maubot";
-        user = "maubot";
-        group = "maubot";
-        mode = "0750";
-      }
-    ];
-  };
 
   services = {
     maubot = {

nixos/roles/matrix/meta-bridge.nix

@@ -1,39 +1,24 @@
 { config, lib, ... }:
 {
   sops.secrets = {
-    "matrix/bridges/meta/as_token" = {
+    meta_as_token = {
       owner = "mautrix-meta-facebook";
       group = "mautrix-meta";
     };
-    "matrix/bridges/meta/hs_token" = {
+    meta_hs_token = {
       owner = "mautrix-meta-facebook";
       group = "mautrix-meta";
     };
-    "matrix/bridges/instagram/as_token" = {
+    instagram_as_token = {
       owner = "mautrix-meta-instagram";
       group = "mautrix-meta";
     };
-    "matrix/bridges/instagram/hs_token" = {
+    instagram_hs_token = {
       owner = "mautrix-meta-instagram";
       group = "mautrix-meta";
     };
   };
 
-  environment.persistence."/persist".directories = [
-    {
-      directory = "/var/lib/mautrix-meta-facebook";
-      user = "mautrix-meta-facebook";
-      group = "mautrix-meta";
-      mode = "0750";
-    }
-    {
-      directory = "/var/lib/mautrix-meta-instagram";
-      user = "mautrix-meta-instagram";
-      group = "mautrix-meta";
-      mode = "0750";
-    }
-  ];
-
   systemd.services = {
     mautrix-meta-facebook-env = {
       before = [ "mautrix-meta-facebook-registration.service" ];
@@ -44,12 +29,8 @@
       };
       script = ''
         mkdir -p /run/mautrix-meta-facebook
-        echo "META_AS_TOKEN=$(cat ${
+        echo "META_AS_TOKEN=$(cat ${config.sops.secrets.meta_as_token.path})" > /run/mautrix-meta-facebook/env
-          config.sops.secrets."matrix/bridges/meta/as_token".path
+        echo "META_HS_TOKEN=$(cat ${config.sops.secrets.meta_hs_token.path})" >> /run/mautrix-meta-facebook/env
-        })" > /run/mautrix-meta-facebook/env
-        echo "META_HS_TOKEN=$(cat ${
-          config.sops.secrets."matrix/bridges/meta/hs_token".path
-        })" >> /run/mautrix-meta-facebook/env
         chmod 600 /run/mautrix-meta-facebook/env
         chown mautrix-meta-facebook:mautrix-meta /run/mautrix-meta-facebook/env
       '';
@@ -64,12 +45,8 @@
       };
       script = ''
         mkdir -p /run/mautrix-meta-instagram
-        echo "INSTAGRAM_AS_TOKEN=$(cat ${
+        echo "INSTAGRAM_AS_TOKEN=$(cat ${config.sops.secrets.instagram_as_token.path})" > /run/mautrix-meta-instagram/env
-          config.sops.secrets."matrix/bridges/instagram/as_token".path
+        echo "INSTAGRAM_HS_TOKEN=$(cat ${config.sops.secrets.instagram_hs_token.path})" >> /run/mautrix-meta-instagram/env
-        })" > /run/mautrix-meta-instagram/env
-        echo "INSTAGRAM_HS_TOKEN=$(cat ${
-          config.sops.secrets."matrix/bridges/instagram/hs_token".path
-        })" >> /run/mautrix-meta-instagram/env
         chmod 600 /run/mautrix-meta-instagram/env
         chown mautrix-meta-instagram:mautrix-meta /run/mautrix-meta-instagram/env
       '';

nixos/roles/matrix/mjolnir.nix

@@ -0,0 +1,17 @@
+{ config, ... }:
+{
+  sops.secrets.mjolnir_access_token = { };
+
+  services.draupnir = {
+    enable = true;
+    secrets.accessToken = config.sops.secrets.mjolnir_access_token.path;
+    settings = {
+      homeserverUrl = "https://matrix.cyperpunk.de";
+      managementRoom = "!eErCimyDjLSebHjpJA:cyperpunk.de";
+    };
+  };
+}
+
+#curl -X POST https://matrix.cyperpunk.de/_matrix/client/v3/login \
+#  -H "Content-Type: application/json" \
+#  -d '{"type":"m.login.password ","user":"mjolnir","password":"i318HXBRkt)Lh$nOPwq#6n9z&<W[XJ&2c4$Zf>7jV}-uQCE{<plwk;LZ)10*N<~1"}'

nixos/roles/matrix/postgres-backup.nix

@@ -1,11 +1,12 @@
 {
   config,
   pkgs,
+  lib,
   ...
 }:
 {
   sops.secrets = {
-    "postgres/replication_password" = {
+    pg_replication_password = {
       owner = "root";
       group = "root";
     };
@@ -17,10 +18,12 @@
     description = "PostgreSQL WAL streaming replica (Docker)";
     requires = [
       "docker.service"
+      "tailscaled.service"
       "network-online.target"
     ];
     after = [
       "docker.service"
+      "tailscaled.service"
       "network-online.target"
     ];
     wantedBy = [ "multi-user.target" ];
@@ -29,53 +32,64 @@
       Type = "simple";
       Restart = "on-failure";
       RestartSec = "10s";
-      TimeoutStartSec = "0";
     };
 
     preStart = ''
-      DATADIR="/storage/backup/postgresql-replica"
+            DATADIR="/storage/backup/postgresql-replica"
-      PG_PASS=$(cat ${config.sops.secrets."postgres/replication_password".path})
+            PG_PASS=$(cat ${config.sops.secrets.pg_replication_password.path})
-      ${pkgs.docker}/bin/docker pull postgres:17
+
-      if [ ! -f "$DATADIR/PG_VERSION" ]; then
+            ${pkgs.docker}/bin/docker pull postgres:17
-        echo "No data dir found — running pg_basebackup..."
+
-        rm -rf "$DATADIR"
+            if [ ! -f "$DATADIR/PG_VERSION" ]; then
-        ${pkgs.docker}/bin/docker run --rm \
+              echo "No data dir found — running pg_basebackup..."
-          -e PGPASSWORD="$PG_PASS" \
+              rm -rf "$DATADIR"
-          -v "/storage/backup:/out" \
+
-          --network host \
+              ${pkgs.docker}/bin/docker run --rm \
-          postgres:17 \
+                -e PGPASSWORD="$PG_PASS" \
-          pg_basebackup \
+                -v "/storage/backup:/out" \
-            --host=10.10.0.1 \
+                --network host \
-            --port=5432 \
+                postgres:17 \
-            --username=replicator \
+                pg_basebackup \
-            --pgdata=/out/postgresql-replica \
+                  --host=100.109.10.91 \
-            --wal-method=stream \
+                  --port=5432 \
-            --checkpoint=fast \
+                  --username=replicator \
-            --progress \
+                  --pgdata=/out/postgresql-replica \
-            --verbose
+                  --wal-method=stream \
-        touch "$DATADIR/standby.signal"
+                  --checkpoint=fast \
-        cat > "$DATADIR/postgresql.auto.conf" <<EOF
+                  --progress \
-      primary_conninfo = 'host=10.10.0.1 port=5432 user=replicator password=$PG_PASS application_name=cyper-controller sslmode=disable'
+                  --verbose
+
+              # standby signal
+              touch "$DATADIR/standby.signal"
+
+              # primary conninfo
+              cat > "$DATADIR/postgresql.auto.conf" <<EOF
+      primary_conninfo = 'host=100.109.10.91 port=5432 user=replicator password=$PG_PASS application_name=cyper-controller sslmode=require'
       EOF
-        cat > "$DATADIR/postgresql.conf" <<EOF
+
+              # minimal postgresql.conf
+              cat > "$DATADIR/postgresql.conf" <<EOF
       hot_standby = on
       hot_standby_feedback = on
       wal_receiver_timeout = '60s'
       port = 5434
       listen_addresses = '*'
       EOF
-        chown -R 999:999 "$DATADIR"
+
-      fi
+              chown -R 999:999 "$DATADIR"
-      if [ ! -f "$DATADIR/postgresql.conf" ]; then
+            fi
-        cat > "$DATADIR/postgresql.conf" <<EOF
+
+            # ensure postgresql.conf exists on subsequent starts
+            if [ ! -f "$DATADIR/postgresql.conf" ]; then
+              cat > "$DATADIR/postgresql.conf" <<EOF
       hot_standby = on
       hot_standby_feedback = on
       wal_receiver_timeout = '60s'
       port = 5434
       listen_addresses = '*'
       EOF
-        chown 999:999 "$DATADIR/postgresql.conf"
+              chown 999:999 "$DATADIR/postgresql.conf"
-      fi
+            fi
     '';
 
     script = ''

nixos/roles/matrix/synapse.nix

@@ -34,59 +34,45 @@ let
 in
 {
   sops.secrets = {
-    "matrix/macaroon_secret" = { };
+    matrix_macaroon_secret = { };
-    "matrix/registration_secret" = {
+    matrix_registration_secret = {
       owner = "matrix-synapse";
       group = "matrix-synapse";
     };
-    "postgres/replication_password" = {
+    pg_replication_password = {
       owner = "postgres";
       group = "postgres";
     };
-    "kanidm/synapse_secret" = {
+    kanidm_synapse_secret = {
       owner = "matrix-synapse";
       group = "matrix-synapse";
     };
   };
 
-  environment.persistence."/persist".directories = [
+  systemd.tmpfiles.rules = [
-    {
+    "d /var/www/matrix            0755 nginx nginx -"
-      directory = "/var/lib/matrix-synapse";
+    "L+ /var/www/matrix/index.html   0644 nginx nginx - ${matrixIndexHtml}"
-      user = "matrix-synapse";
+    "L+ /var/www/matrix/register.php 0644 nginx nginx - ${matrixRegisterPhp}"
-      group = "matrix-synapse";
+    "L+ /var/www/matrix/style.css  0644 nginx nginx - ${matrixStyleCss}"
-      mode = "0700";
+    "L+ /var/www/matrix/app.js     0644 nginx nginx - ${matrixAppJs}"
-    }
-    {
-      directory = "/var/lib/postgresql";
-      user = "postgres";
-      group = "postgres";
-      mode = "0750";
-    }
-    {
-      directory = "/var/lib/acme";
-      user = "acme";
-      group = "acme";
-      mode = "0755";
-    }
   ];
 
-  services = {
+  services.phpfpm.pools.matrix = {
-
+    user = "nginx";
-    phpfpm.pools.matrix = {
+    group = "nginx";
-      user = "nginx";
+    settings = {
-      group = "nginx";
+      "listen.owner" = "nginx";
-      settings = {
+      "listen.group" = "nginx";
-        "listen.owner" = "nginx";
+      "pm" = "dynamic";
-        "listen.group" = "nginx";
+      "pm.max_children" = 10;
-        "pm" = "dynamic";
+      "pm.start_servers" = 2;
-        "pm.max_children" = 10;
+      "pm.min_spare_servers" = 1;
-        "pm.start_servers" = 2;
+      "pm.max_spare_servers" = 3;
-        "pm.min_spare_servers" = 1;
-        "pm.max_spare_servers" = 3;
-      };
-      phpPackage = pkgs.php.withExtensions ({ enabled, all }: enabled ++ [ all.curl ]);
     };
+    phpPackage = pkgs.php.withExtensions ({ enabled, all }: enabled ++ [ all.curl ]);
+  };
 
+  services = {
     matrix-synapse = {
       enable = true;
       settings = {
@@ -95,8 +81,8 @@ in
         enable_registration = false;
         trusted_key_servers = [ { server_name = "matrix.org"; } ];
         suppress_key_server_warning = true;
-        registration_shared_secret_path = config.sops.secrets."matrix/registration_secret".path;
+        registration_shared_secret_path = config.sops.secrets.matrix_registration_secret.path;
-        macaroon_secret_key = "$__file{${config.sops.secrets."matrix/macaroon_secret".path}}";
+        macaroon_secret_key = "$__file{${config.sops.secrets.matrix_macaroon_secret.path}}";
         matrix_rtc = {
           enabled = true;
           transports = [
@@ -149,7 +135,7 @@ in
             type = "metrics";
             bind_addresses = [
               "127.0.0.1"
-              "10.10.0.1"
+              "100.109.10.91"
             ];
             resources = [ ];
           }
@@ -162,7 +148,7 @@ in
             idp_name = "Kanidm";
             issuer = "https://auth.cyperpunk.de/oauth2/openid/synapse";
             client_id = "synapse";
-            client_secret_path = config.sops.secrets."kanidm/synapse_secret".path;
+            client_secret_path = config.sops.secrets.kanidm_synapse_secret.path;
             scopes = [
               "openid"
               "profile"
@@ -250,11 +236,10 @@ in
         wal_level = "replica";
         max_wal_senders = 5;
         wal_keep_size = "512MB";
-        listen_addresses = lib.mkForce "127.0.0.1,10.10.0.1";
+        listen_addresses = lib.mkForce "127.0.0.1,100.109.10.91";
-        ssl = true;
       };
       authentication = lib.mkAfter ''
-        hostssl replication replicator 10.10.0.2/32 scram-sha-256
+        host replication replicator 100.0.0.0/8 scram-sha-256
       '';
     };
 
@@ -266,26 +251,15 @@ in
     };
   };
 
-  systemd = {
+  systemd.services = {
-    services = {
+    matrix-synapse.serviceConfig.ReadOnlyPaths = [
-      matrix-synapse.serviceConfig.ReadOnlyPaths = [
+      "/var/lib/mautrix-discord"
-        "/var/lib/mautrix-discord"
+      "/var/lib/mautrix-whatsapp"
-        "/var/lib/mautrix-whatsapp"
-      ];
-      postgresql.postStart = lib.mkAfter ''
-        PG_PASS=$(cat ${config.sops.secrets."postgres/replication_password".path})
-        ${config.services.postgresql.package}/bin/psql -U postgres -c \
-          "ALTER ROLE replicator WITH PASSWORD '$PG_PASS';"
-      '';
-    };
-
-    tmpfiles.rules = [
-      "d /var/www/matrix            0755 nginx nginx -"
-      "L+ /var/www/matrix/index.html   0644 nginx nginx - ${matrixIndexHtml}"
-      "L+ /var/www/matrix/register.php 0644 nginx nginx - ${matrixRegisterPhp}"
-      "L+ /var/www/matrix/style.css  0644 nginx nginx - ${matrixStyleCss}"
-      "L+ /var/www/matrix/app.js     0644 nginx nginx - ${matrixAppJs}"
     ];
+    postgresql.postStart = lib.mkAfter ''
+      PG_PASS=$(cat ${config.sops.secrets.pg_replication_password.path})
+      ${config.services.postgresql.package}/bin/psql -U postgres -c \
+        "ALTER ROLE replicator WITH PASSWORD '$PG_PASS';"
+    '';
   };
-
 }

nixos/roles/matrix/whatsapp-bridge.nix

@@ -1,40 +1,29 @@
+{ ... }:
 {
+  services.postgresql = {
+    ensureUsers = [
+      {
+        name = "mautrix-whatsapp";
+        ensureDBOwnership = true;
+      }
+    ];
+    ensureDatabases = [ "mautrix-whatsapp" ];
+  };
 
-  environment.persistence."/persist".directories = [
+  services.mautrix-whatsapp = {
-    {
+    enable = true;
-      directory = "/var/lib/mautrix-whatsapp";
+    settings = {
-      user = "mautrix-whatsapp";
+      homeserver = {
-      group = "mautrix-whatsapp";
+        address = "http://127.0.0.1:8008";
-      mode = "0750";
+        domain = "cyperpunk.de";
-    }
+      };
-  ];
+      database = {
-
+        type = "postgres";
-  services = {
+        uri = "postgres:///mautrix-whatsapp?host=/run/postgresql&sslmode=disable";
-    postgresql = {
+      };
-      ensureUsers = [
+      bridge.permissions = {
-        {
+        "cyperpunk.de" = "user";
-          name = "mautrix-whatsapp";
+        "@dergrumpf:cyperpunk.de" = "admin";
-          ensureDBOwnership = true;
-        }
-      ];
-      ensureDatabases = [ "mautrix-whatsapp" ];
-    };
-
-    mautrix-whatsapp = {
-      enable = true;
-      settings = {
-        homeserver = {
-          address = "http://127.0.0.1:8008";
-          domain = "cyperpunk.de";
-        };
-        database = {
-          type = "postgres";
-          uri = "postgres:///mautrix-whatsapp?host=/run/postgresql&sslmode=disable";
-        };
-        bridge.permissions = {
-          "cyperpunk.de" = "user";
-          "@dergrumpf:cyperpunk.de" = "admin";
-        };
       };
     };
   };

nixos/roles/monitoring.nix

@@ -27,29 +27,20 @@ in
   imports = [ ./gs-exporter.nix ];
 
   sops.secrets = {
-    "services/grafana/secret_key" = {
+    grafana_secret_key = {
       owner = "grafana";
       group = "grafana";
     };
-    "kanidm/grafana_secret" = {
+    kanidm_grafana_secret = {
       owner = "grafana";
       group = "grafana";
     };
-    "network/zyxel_pass" = {
+    zyxel_pass = {
       group = "gs1200-exporter";
       mode = "0440";
     };
   };
 
-  environment.persistence."/persist".directories = [
-    {
-      directory = "/var/lib/grafana";
-      user = "grafana";
-      group = "grafana";
-      mode = "0750";
-    }
-  ];
-
   users.groups.gs1200-exporter = { };
 
   services = {
@@ -78,7 +69,7 @@ in
           serve_from_sub_path = true;
         };
         security = {
-          secret_key = "$__file{${config.sops.secrets."services/grafana/secret_key".path}}";
+          secret_key = "$__file{${config.sops.secrets.grafana_secret_key.path}}";
           allow_embedding = true;
           cookie_samesite = "none";
           cookie_secure = true;
@@ -91,7 +82,7 @@ in
           enabled = true;
           name = "Kanidm";
           client_id = "grafana";
-          client_secret = "$__file{${config.sops.secrets."kanidm/grafana_secret".path}}";
+          client_secret = "$__file{${config.sops.secrets.kanidm_grafana_secret.path}}";
           scopes = "openid profile email";
           auth_url = "https://auth.cyperpunk.de/ui/oauth2";
           token_url = "https://auth.cyperpunk.de/oauth2/token";
@@ -134,7 +125,7 @@ in
           metrics_path = "/_synapse/metrics";
           static_configs = [
             {
-              targets = [ "10.10.0.1:9009" ];
+              targets = [ "100.109.10.91:9009" ];
               labels = {
                 instance = "cyper-proxy";
                 job = "master";
@@ -158,7 +149,7 @@ in
           job_name = "postgresql-proxy";
           static_configs = [
             {
-              targets = [ "10.10.0.1:9188" ];
+              targets = [ "100.109.10.91:9188" ];
               labels = {
                 instance = "cyper-proxy";
               };
@@ -181,13 +172,13 @@ in
       zyxel1 = {
         address = "192.168.2.3";
         port = 9934;
-        passwordFile = config.sops.secrets."network/zyxel_pass".path;
+        passwordFile = config.sops.secrets.zyxel_pass.path;
         group = "gs1200-exporter";
       };
       zyxel2 = {
         address = "192.168.2.4";
         port = 9935;
-        passwordFile = config.sops.secrets."network/zyxel_pass".path;
+        passwordFile = config.sops.secrets.zyxel_pass.path;
         group = "gs1200-exporter";
       };
     };

nixos/roles/nginx.nix

@@ -1,6 +1,7 @@
 _:
 let
-  upstream = "10.10.0.2";
+
+  upstream = "100.86.56.71";
 
   mkProxy = port: {
     forceSSL = true;

nixos/roles/octoprint.nix

@@ -48,16 +48,6 @@ let
 in
 {
   nixpkgs.overlays = [ octoprint-overlay ];
-
-  environment.persistence."/persist".directories = [
-    {
-      directory = "/var/lib/octoprint";
-      user = "octoprint";
-      group = "octoprint";
-      mode = "0750";
-    }
-  ];
-
   services.octoprint = {
     enable = true;
     host = "0.0.0.0";

nixos/roles/paperless-ngx.nix

@@ -1,10 +1,11 @@
 { config, ... }:
 {
+
   sops.secrets = {
-    "services/paperless/admin" = {
+    paperless_admin = {
       owner = "paperless";
     };
-    "services/paperless/oidc_secret" = {
+    paperless_oidc_secret = {
       owner = "paperless";
     };
   };
@@ -17,14 +18,14 @@
     consumptionDir = "/storage/fast/paperless/consume";
     dataDir = "/storage/fast/paperless";
     configureTika = true;
-    passwordFile = config.sops.secrets."services/paperless/admin".path;
+    passwordFile = config.sops.secrets.paperless_admin.path;
     settings = {
       PAPERLESS_USE_X_FORWARDED_HOST = true;
       PAPERLESS_USE_X_FORWARDED_PORT = true;
-      PAPERLESS_ALLOWED_HOSTS = "ngx.cyperpunk.de,10.10.0.2,localhost";
+      PAPERLESS_ALLOWED_HOSTS = "ngx.cyperpunk.de,100.109.179.25,localhost";
       PAPERLESS_CSRF_TRUSTED_ORIGINS = [
         "https://ngx.cyperpunk.de"
-        "http://10.10.0.2:28101"
+        "http://100.109.179.25:28101"
       ];
       PAPERLESS_OCR_LANGUAGE = "deu+eng";
       PAPERLESS_CONSUMER_POLLING = 60;
@@ -53,7 +54,7 @@
         requires = [ "systemd-tmpfiles-setup.service" ];
       };
       paperless-web = {
-        serviceConfig.EnvironmentFiles = [ config.sops.secrets."services/paperless/oidc_secret".path ];
+        serviceConfig.EnvironmentFiles = [ config.sops.secrets.paperless_oidc_secret.path ];
       };
     };
   };

nixos/roles/searxng.nix

@@ -11,6 +11,8 @@ let
   port = 11080;
 in
 {
+  boot.kernel.sysctl."vm.overcommit_memory" = lib.mkForce "1";
+
   services.searx = {
     enable = true;
     package = pkgs.searxng;

nixos/roles/unifi.nix

@@ -1,15 +1,6 @@
 { pkgs, ... }:
 
 {
-  environment.persistence."/persist".directories = [
-    {
-      directory = "/var/lib/unifi";
-      user = "unifi";
-      group = "unifi";
-      mode = "0750";
-    }
-  ];
-
   services.unifi = {
     enable = true;
     unifiPackage = pkgs.unifi;