.helix/languages.toml

@@ -1,11 +1,6 @@
-[language-server.nixd]
+[language-server.nil]
-command = "nixd"
+command = "nil"
-# args = ["--log=debug"]
-[language-server.nixd.config.nixd]
-nixpkgs = { expr = "import (builtins.getFlake (builtins.toString ./.)).inputs.nixpkgs { }" }
-options = { nixos = { expr = "(builtins.getFlake (builtins.toString ./.)).colmenaHive.nodes.theseus.options" }}#, home-manager = { expr = "(builtins.getFlake (builtins.toString ./.)).colmenaHive.nodes.theseus.options.home-manager.users.type.getSubOptions []" } }
-
 [[language]]
 name = "nix"
 formatter = {command = "nixfmt"}
-language-servers = [ "nixd" ]
+language-servers = [ "nil" ]

flake.nix

@@ -15,19 +15,12 @@
     colmena.url = "github:zhaofengli/colmena/release-0.4.x";
     colmena.inputs.nixpkgs.follows = "nixpkgs";
 
-    
-    oldConf.url = "github:thexyno/nixos-config";
     # software
-    rust-overlay = { # https://github.com/nix-community/lanzaboote/issues/485#issuecomment-3466684727
-      url = "github:oxalica/rust-overlay";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     lanzaboote = {
       url = "github:nix-community/lanzaboote/v0.4.2";
 
       # Optional but recommended to limit the size of your system closure.
       inputs.nixpkgs.follows = "nixpkgs";
-      inputs.rust-overlay.follows = "rust-overlay";
     };
 
     zen-browser.url = "github:0xc000022070/zen-browser-flake";
@@ -40,6 +33,10 @@
     niri.inputs.nixpkgs.follows = "nixpkgs-master";
     xwayland-satellite.url = "github:Supreeeme/xwayland-satellite";
     xwayland-satellite.inputs.nixpkgs.follows = "nixpkgs-master";
+    nheko.url = "github:Nheko-Reborn/nheko";
+    nheko.flake = false;
+    mtxclient.url = "github:Nheko-Reborn/mtxclient";
+    mtxclient.flake = false;
     nix-ci.url = "git+https://git.xyno.systems/xyno/nix-ci";
     nix-ci.inputs.nixpkgs.follows = "nixpkgs";
 
@@ -53,22 +50,12 @@
     # csharp-language-server.url = "github:sofusa/csharp-language-server";
     # csharp-language-server.inputs.nixpkgs.follows = "nixpkgs-master";
 
+    # authentik
 
-    # # authentik
+    authentik.url = "github:nix-community/authentik-nix";
-
+    authentik.inputs.nixpkgs.follows = "nixpkgs";
-    # authentik.url = "github:nix-community/authentik-nix";
+    terranix.url = "github:terranix/terranix";
-    # authentik.inputs.nixpkgs.follows = "nixpkgs";
+    terranix.inputs.nixpkgs.follows = "nixpkgs";
-    # terranix.url = "github:terranix/terranix";
-    # terranix.inputs.nixpkgs.follows = "nixpkgs";
-
-    # non flake inputs, maybe use npins in the future?
-    adw-colors.url = "github:lassekongo83/adw-colors"; 
-    adw-colors.flake = false;
-    nheko.url = "github:Nheko-Reborn/nheko";
-    nheko.flake = false;
-    mtxclient.url = "github:Nheko-Reborn/mtxclient";
-    mtxclient.flake = false;
-
 
   };
 
@@ -114,7 +101,7 @@
         inputs.lanzaboote.nixosModules.lanzaboote
         inputs.sops-nix.nixosModules.sops
         inputs.impermanence.nixosModules.impermanence
-        # inputs.authentik.nixosModules.default
+        inputs.authentik.nixosModules.default
         inputs.nix-index-database.nixosModules.nix-index
       ]
       ++ (import ./modules/module-list.nix);
@@ -126,18 +113,10 @@
       importConfigs =
         n:
         map (x: {
-          ${x} =
+          ${x} = {nodes, ...}: {
-            { nodes, pkgs, ... }:
-            {
-              nixpkgs.overlays = overlays;
-              nix.package = pkgs.unstable.lixPackageSets.latest.lix;
             networking.hostName = x;
             imports = modules ++ [ (./instances/${x}) ];
             _module.args.otherNodes = lib.filterAttrs (n: v: n != x) nodes;
-              deployment.privilegeEscalationCommand = [
-                "run0"
-                "--unit=colmena-apply"
-              ];
           };
         }) n;
     in
@@ -151,9 +130,13 @@
                   specialArgs = { inherit inputs; };
                   nixpkgs = genPkgs "x86_64-linux";
                 };
+                deployment.privilegeEscalationCommand = [
+                  "run0"
+                  "--unit=colmena-apply"
+                ];
               }
               (importConfigs [
-                "nemesis"
+                "ds9"
                 "picard"
                 "theseus"
               ])
@@ -195,7 +178,6 @@
           devShells.${system}.default = pkgs.mkShell {
             packages = [
               pkgs.nixfmt-rfc-style
-              pkgs.nixd
               pkgs.nil
               pkgs.sops
               (pkgs.runCommand "nix-config-bin" { } ''

hm-modules/dark-theme.nix

@@ -23,10 +23,10 @@ in
       gtk4.extraConfig.gtk-application-prefer-dark-theme = 1;
       gtk3.extraConfig.gtk-application-prefer-dark-theme = 1;
     };
-    # qt = {
+    qt = {
-    #   enable = true;
+      enable = true;
-    #   style.name = "breeze";
+      style.name = "breeze";
-    # };
+    };
 
   };
 }

hm-modules/firefox.nix

@@ -362,7 +362,7 @@ in
             "user-filters" =
               ''marketplace.visualstudio.com##+js(rpnt, script, /"(DisableVSCodeDownloadButtonEnabled|Microsoft\\.VisualStudio\\.Services\\.Gallery\\.DisableVSCodeDownloadButton)":true/, "$1":false)'';
             "hostnameSwitchesString" =
-              "no-large-media: behind-the-scene false\nno-remote-fonts: * false\nno-csp-reports: * true";
+              "no-large-media: behind-the-scene false\nno-remote-fonts: * true\nno-csp-reports: * true";
 
           };
         };

hm-modules/git.nix

@@ -9,14 +9,13 @@ in
 {
   options.xyno.git.enable = lib.mkEnableOption "xynos git config";
   config = lib.mkIf cfg.enable {
-    programs.difftastic.git.enable = true;
-    programs.difftastic.enable = true;
     programs.git = {
       enable = true;
+      difftastic.enable = true;
       lfs.enable = true;
 
       # Default configs
-      settings = {
+      extraConfig = {
         commit.gpgSign = true;
         gpg.format = "ssh";
 

hm-modules/helix.nix

@@ -22,21 +22,20 @@ in
         # nodePackages_latest.prettier
         dprint
         markdown-oxide
-        # codebook
+        codebook
         ## python
         # ruff-lsp
         # nodePackages_latest.pyright
         # inputs.csharp-language-server.packages.${pkgs.system}.csharp-language-server
       ]
       ++ (optionals cfg.withLargeLSPs [
+        netcoredbg
         nodePackages_latest.typescript-language-server
         nodePackages_latest.vscode-langservers-extracted
         typescript
         # jsonnet-language-server
         # jsonnet
         lazygit
-        ltex-ls-plus # languagetool
-        tinymist # typst lsp
 
       ]);
     programs.helix = {
@@ -108,7 +107,8 @@ in
         keys = {
           normal = {
             space."=" = ":fmt";
-            "C-g" = ":sh tmux popup -d \"#{pane_current_path}\" -xC -yC -w80%% -h80%% -E lazygit";
+            "C-g" =
+              ":sh tmux popup -d \"#{pane_current_path}\" -xC -yC -w80%% -h80%% -E lazygit";
             "C-t" = ":sh tmux split-window -v -l '35%%'";
             "C-h" = ":sh tmux select-pane -t '{left-of}'";
             "C-l" = ":sh tmux select-pane -t '{right-of}'";
@@ -143,114 +143,34 @@ in
         language-server.csharp = {
           command = "csharp-language-server";
         };
-        language-server.ltex = {
+        language-server.codebook = {
-          command = "ltex-ls-plus";
+          command = "codebook-lsp";
-          config = {
+          args = ["serve"];
-            additionalRules.motherTongue = "de-DE";
-            additionalRules.enablePickyRules = true;
-            language = [
-              "en-US"
-              "de-DE"
-            ];
         };
-        };
+        language = flatten [
-        language-server.tinymist = {
+          (map
-          command = "tinymist";
+            (x: {
-        };
+              name = x;
-        # language-server.nil = {
-        #   command = "nil";
-        #   config.nil.nix = {
-        #     maxMemoryMB = 5120;
-        #     flake = {
-        #       autoEvalInputs = true;
-        #       autoArchive = true;
-        #     };
-        #   };
-        # };
-        language =
-          let
-            applySingleConfig =
-              languages: config:
-              let
-                applied =
-                  foldl'
-                    (
-                      acc: l:
-                      if (any (x: l.name == x) config.languages) then
-                        {
-                          done = acc.done ++ [
-                            (mkMerge [
-                              l
-                              config.conf
-                            ])
-                          ];
-                          notFound = filter (x: x != l.name) acc.notFound;
-                        }
-                      else
-                        {
-                          done = acc.done ++ [ l ];
-                          notFound = acc.notFound;
-                        }
-                    )
-                    {
-                      done = [ ];
-                      notFound = config.languages;
-                    }
-                    languages;
-              in
-              applied.done ++ (map (x: { name = x; } // config.conf) applied.notFound);
-            applyConfs = lspConfs: languages: foldl' applySingleConfig languages lspConfs;
-          in
-          applyConfs
-            [
-              {
-                languages = [
-                  "typescript"
-                  "javascript"
-                  "jsx"
-                  "tsx"
-                ];
-                conf = {
               language-servers = [
                 "typescript-language-server"
                 "eslint"
               ];
-                };
+              #formatter = { command = "dprint"; args = [ "fmt" "--stdin" x ]; };
-              }
+              # formatter = { command = "prettier"; args = [ "--parser" "typescript" ]; };
-              {
+            })
-                languages = [
-                  "markdown"
-                  "typst"
-                  "bibtex"
-                  "comment"
-                  "latex"
-                  "html"
-                ];
-                conf = {
-                  language-servers = [
-                    "ltex"
-                  ];
-                };
-              }
-            ]
             [
+              "typescript"
+              "javascript"
+              "jsx"
+              "tsx"
+            ]
+          )
           {
-                name = "__common__";
+            name = "nix";
-                scope = "source.__common__";
+            formatter = {
-                file-types = [ ];
+              command = "nixpkgs-fmt";
-                language-servers = [
+            };
-                  "ltex"
-                ];
           }
-              # {
-              #   name = "nix";
-              #   language-servers = [
-              #     "nixd"
-              #   ];
-              #   formatter = {
-              #     command = "nixpkgs-fmt";
-              #   };
-              # }
           {
             name = "python";
             language-servers = [
@@ -260,15 +180,7 @@ in
           }
           {
             name = "markdown";
-                language-servers = [
+            language-servers = ["codebook"];
-                  "markdown-oxide"
-                ];
-              }
-              {
-                name = "typst";
-                language-servers = [
-                  "tinymist"
-                ];
           }
           {
             name = "c-sharp";

hm-modules/mpv.nix

@@ -14,11 +14,6 @@ in
     programs.mpv = {
       enable = true;
       scripts = with pkgs.mpvScripts; [ mpv-webm sponsorblock ];
-      config = {
-        profile = "gpu-hq";
-        ytdl-format = "bestvideo[width<=1920]+bestaudio";
-        cache-secs = 1200;
-      };
     };
 
   };

instances/ds9/configuration.nix

@@ -0,0 +1,36 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
+  nixpkgs.system = "x86_64-linux";
+  imports = [
+    ./hardware-configuration.nix
+    ./services/attic.nix
+    ./services/immich.nix
+    ./services/jellyfin.nix
+    ./services/paperless.nix
+    ./services/ytdl-sub.nix
+
+  ];
+  time.timeZone = "Europe/Berlin";
+
+  networking.hostId = "7b4c2932";
+  
+  xyno.presets.cli.enable = true;
+  xyno.presets.server.enable = true;
+  xyno.services.wireguard.enable = true;
+  xyno.services.caddy.enable = true;
+  xyno.services.monitoring.enable = true;
+  xyno.services.authentik.enable = true;
+  xyno.presets.home-manager.enable = true;
+  xyno.system.user.enable = true;
+  xyno.networking.networkd = {
+    enable = true;
+  };
+
+
+  system.stateVersion = "24.11";
+}

instances/ds9/default.nix

@@ -0,0 +1,11 @@
+{
+  imports = [ ./configuration.nix ];
+  xyno.services.monitoring.prometheusServer = true;
+  xyno.meta = {
+    sopsKey = "fada7e7be28e186e463ad745a38d17f36849d8a7";
+  };
+  xyno.services.wireguard.pubKey = "aZvSeAhKG3B5I2My5IqQoSlntMzbCHM6OU92WEScohc=";
+  deployment = {
+    targetHost = "ds9.hailsatan.eu";
+  };
+}

instances/ds9/hardware-configuration.nix

@@ -0,0 +1,59 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports = [ "${modulesPath}/installer/scan/not-detected.nix" ];
+
+  boot.lanzaboote = {
+    enable = true;
+    pkiBundle = "/var/lib/sbctl";
+  };
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+
+
+
+  boot.initrd.availableKernelModules = [ "r8169" "ahci" "vfio-pci" "xhci_pci" "ehci_pci" "nvme" "usbhid" "sd_mod" "sr_mod" ];
+  boot.kernelModules = [ "kvm-amd" ];
+  nix.settings.max-jobs = lib.mkDefault 12;
+  powerManagement.powertop.enable = true;
+  powerManagement.cpuFreqGovernor = "powersave";
+  powerManagement.scsiLinkPolicy = "min_power";
+
+  services.zfs.autoScrub.enable = true;
+
+  services.sanoid.datasets."rpool/content/safe/data/media" = { };
+  services.sanoid.enable = true;
+  services.sanoid.interval = "0/8:00:00";
+
+  swapDevices = [{ device = "/dev/disk/by-id/nvme-eui.000000000000000100a075202c247839-part1"; randomEncryption = true; }];
+  fileSystems."/boot".device = "/dev/disk/by-uuid/149F-23AA";
+
+
+  fileSystems."/" = {
+    device = "spool/safe/persist";
+    fsType = "zfs";
+  };
+  fileSystems."/nix" = {
+    device = "spool/local/nix";
+    fsType = "zfs";
+  };
+  fileSystems."/var/log" = {
+    device = "spool/local/journal";
+    fsType = "zfs";
+  };
+  fileSystems."/data" = {
+    device = "rpool/content/safe/data";
+    fsType = "zfs";
+  };
+  fileSystems."/data/media" = {
+    device = "rpool/content/safe/data/media";
+    fsType = "zfs";
+  };
+  fileSystems."/backups" = {
+    device = "rpool/content/local/backups";
+    fsType = "zfs";
+  };
+
+}

instances/nemesis/configuration.nix

@@ -1,79 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  inputs,
-  ...
-}:
-{
-  nixpkgs.system = "x86_64-linux";
-  imports = [
-    ./hardware-configuration.nix
-    # ./services/attic.nix
-    # ./services/immich.nix
-    # ./services/jellyfin.nix
-    # ./services/paperless.nix
-    # ./services/ytdl-sub.nix
-
-  ];
-  time.timeZone = "Europe/Berlin";
-  networking.hostId = "7b4c2932";
-
-  containers.ds9 = {
-    autoStart = true;
-    privateNetwork = true;
-    enableTun = true;
-    additionalCapabilities = [
-      "CAP_NET_ADMIN"
-      "CAP_MKNOD"
-      "CAP_BPF"
-      "CAP_DAC_READ_SEARCH"
-      "CAP_SYS_RESOURCE"
-      "CAP_SYS_ADMIN"
-    ];
-    hostAddress = "192.168.100.10";
-    localAddress = "192.168.100.11";
-
-    path = inputs.oldConf.nixosConfigurations.ds9.config.system.build.toplevel;
-    
-    bindMounts = {
-      "/data" = {
-        hostPath = "/data";
-        isReadOnly = false;
-      };
-      "/backup" = {
-        hostPath = "/backup";
-        isReadOnly = false;
-      };
-      "/persistent" = {
-        hostPath = "/oldds9/persistent";
-        isReadOnly = false;
-      };
-    };
-  };
-  networking.nat.enable = true;
-  networking.nat.internalInterfaces = [ "ve-+" ];
-  networking.nat.externalInterface = "enp1s0f1"; # TODO: changeme
-
-  xyno.services.traefik = {
-    enable = true;
-    simpleProxy.oldds9 = {
-      host = "*.hailsatan.eu";
-      internal = "http://192.168.100.11";
-    };
-  };
-
-  xyno.presets.cli.enable = true;
-  xyno.presets.server.enable = true;
-  # xyno.services.wireguard.enable = true;
-  # xyno.services.caddy.enable = true;
-  # xyno.services.monitoring.enable = true;
-  # xyno.services.authentik.enable = true;
-  xyno.presets.home-manager.enable = true;
-  xyno.system.user.enable = true;
-  xyno.networking.networkd = {
-    enable = true;
-  };
-
-  system.stateVersion = "25.11";
-}

instances/nemesis/default.nix

@@ -1,11 +0,0 @@
-{
-  imports = [ ./configuration.nix ];
-  # xyno.services.monitoring.prometheusServer = true;
-  xyno.meta = {
-    sopsKey = "fada7e7be28e186e463ad745a38d17f36849d8a7";
-  };
-  # xyno.services.wireguard.pubKey = "aZvSeAhKG3B5I2My5IqQoSlntMzbCHM6OU92WEScohc=";
-  deployment = {
-    targetHost = "nemesis.xyno.systems";
-  };
-}

instances/nemesis/hardware-configuration.nix

@@ -1,128 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [ "${modulesPath}/installer/scan/not-detected.nix" ];
-
-  boot.lanzaboote = {
-    enable = true;
-    pkiBundle = "/var/lib/sbctl";
-  };
-  boot.loader.systemd-boot.enable = lib.mkForce false;
-
-  boot.initrd.availableKernelModules = [
-    "r8169"
-    "ahci"
-    "vfio-pci"
-    "xhci_pci"
-    "ehci_pci"
-    "nvme"
-    "usbhid"
-    "sd_mod"
-    "sr_mod"
-  ];
-  boot.kernelModules = [ "kvm-amd" ];
-  nix.settings.max-jobs = lib.mkDefault 12;
-  powerManagement.powertop.enable = true;
-  powerManagement.cpuFreqGovernor = "powersave";
-  powerManagement.scsiLinkPolicy = "min_power";
-
-  services.zfs.autoScrub.enable = true;
-
-  services.sanoid.datasets."rpool/content/safe/data/media" = { };
-  services.sanoid.datasets."rpool/content/safe/data" = { };
-  services.sanoid.datasets."spool/nemesis/persistent" = { };
-  services.sanoid.enable = true;
-  services.sanoid.interval = "0/8:00:00";
-
-  boot.initrd.systemd = {
-    enable = true;
-  };
-  boot.initrd.network = {
-    enable = true;
-    postCommands = ''
-      zpool import rpool
-      zpool import spool
-      echo "zfs load-key -a; killall zfs" >> /root/.profile
-    '';
-    ssh = {
-      enable = true;
-      port = 2222;
-      hostKeys = [
-        "/persistent/initrd/ssh_host_rsa_key"
-        "/persistent/initrd/ssh_host_ed25519_key"
-      ];
-      authorizedKeys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID/oMAi5jyQsNohfhcSH2ItisTpBGB0WtYTVxJYKKqhj" # TODO
-      ];
-
-    };
-
-  };
-
-  # swapDevices = [
-  #   {
-  #     device = "/dev/disk/by-id/nvme-eui.000000000000000100a075202c247839-part1";
-  #     randomEncryption = true;
-  #   }
-  # ];
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/149F-23AA";
-    fsType = "vfat";
-    options = [
-      "noauto"
-      "x-systemd.automount"
-    ];
-  };
-
-  zramSwap.enable = true;
-  zramSwap.writebackDevice = "/dev/zvol/spool/nemesis/zswap";
-
-  fileSystems."/persistent/var/lib/postgres" = { # has things of https://wiki.archlinux.org/title/ZFS#Databases set
-    device = "spool/nemesis/postgres";
-    fsType = "zfs";
-  };
-  fileSystems."/persistent" = {
-    device = "spool/nemesis/persistent";
-    fsType = "zfs";
-  };
-  fileSystems."/var/log" = {
-    device = "spool/nemesis/varlog";
-    fsType = "zfs";
-  };
-  fileSystems."/nix" = {
-    device = "spool/local/nix";
-    fsType = "zfs";
-  };
-
-  fileSystems."/data" = {
-    device = "rpool/content/safe/data";
-    fsType = "zfs";
-  };
-  fileSystems."/data/media" = {
-    device = "rpool/content/safe/data/media";
-    fsType = "zfs";
-  };
-  fileSystems."/backups" = {
-    device = "rpool/content/local/backups";
-    fsType = "zfs";
-  };
-
-  fileSystems."/oldds9/persistent" = {
-    device = "spool/safe/persist";
-    fsType = "zfs";
-  };
-  fileSystems."/oldds9/varlog" = {
-    device = "spool/local/journal";
-    fsType = "zfs";
-  };
-
-}

instances/theseus/configuration.nix

@@ -12,35 +12,6 @@ let
   '';
 in
 {
-  # containers.podmantest = {
-  #   privateNetwork = true;
-  #   enableTun = true;
-  #   additionalCapabilities = [
-  #     "CAP_NET_ADMIN"
-  #     "CAP_MKNOD"
-  #     "CAP_BPF"
-  #     "CAP_DAC_READ_SEARCH"
-  #     "CAP_SYS_RESOURCE"
-  #     "CAP_SYS_ADMIN"
-  #   ];
-  #   hostAddress = "192.168.100.10";
-  #   localAddress = "192.168.100.11";
-  #   config =
-  #     { ... }:
-  #     {
-  #       virtualisation.oci-containers.containers.test = {
-  #         image = "docker.io/library/nginx";
-  #         ports = [
-  #           "80:80"
-  #           "443:443"
-  #         ];
-  #       };
-  #     };
-  # };
-  # networking.nat.enable = true;
-  # networking.nat.internalInterfaces = [ "ve-+" ];
-  # networking.nat.externalInterface = "enp195s0f4u1u3";
-
   nixpkgs.system = "x86_64-linux";
   imports = [ ./hardware-configuration.nix ];
   boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
@@ -77,7 +48,7 @@ in
     pandoc
     tectonic
     rquickshare
-    unstable.supersonic-wayland
+    supersonic-wayland
     nheko
     anki-bin
     gimp3
@@ -93,15 +64,14 @@ in
 
   time.timeZone = "Europe/Berlin";
 
+
   # orcaslicer
   networking.firewall.allowedTCPPorts = [
     1880
     2021
-    4711
   ];
   networking.firewall.allowedUDPPorts = [
     1880
-    5353
     2021
   ];
 

instances/theseus/hardware-configuration.nix

@@ -16,7 +16,7 @@
     "${inputs.nixos-hardware}/framework/13-inch/7040-amd"
   ];
   hardware.framework.laptop13.audioEnhancement.enable = true;
-  hardware.framework.laptop13.audioEnhancement.hideRawDevice = false;
+  # hardware.framework.laptop13.audioEnhancement.hideRawDevice = false;
   services.fwupd.enable = true;
 
   boot.initrd.availableKernelModules = [

modules/desktop/audio.nix

@@ -229,39 +229,9 @@ in
           ];
         };
       };
-      configPackages = [
-        (pkgs.writeTextDir "share/pipewire/pipewire.conf.d/snapcast-discover.conf" ''
-          context.modules = [
-    {
-        name = libpipewire-module-snapcast-discover
-        args = {
-             snapcast.discover-local = true
-             stream.rules = [
-                 {
-                     matches = [
-                        {
-                            snapcast.ip = "~.*"
-                        }
-                     ]
-                     actions = {
-                         create-stream = {
-                             # node.name = "Snapcast"
-                             # snapcast.stream-name = "default"
-                         }
-                     }
-                 }
-             ]
-        }
-    }
-]
-
-        '')
-
-      ];
       wireplumber.extraConfig."98-bluetooth"."wireplumber.settings"."bluetooth.autoswitch-to-headset-profile" =
         false;
-      wireplumber.configPackages = mapAttrsToList (n: v: eqPkg v) cfg.eq ++ [
+      wireplumber.configPackages = mapAttrsToList (n: v: eqPkg v) cfg.eq;
-      ];
     };
 
   };

modules/desktop/fcitx5.nix

@@ -0,0 +1,27 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.xyno.desktop.fcitx5;
+in
+{
+  options.xyno.desktop.fcitx5.enable = lib.mkEnableOption "enable fcitx5 input daemon thing";
+  config = lib.mkIf cfg.enable {
+    i18n.inputMethod = {
+      type = "fcitx5";
+      enable = true;
+      fcitx5.addons = with pkgs; [
+        fcitx5-table-other
+      ];
+      fcitx5.waylandFrontend = true;
+      fcitx5.quickPhrase = {
+        ":pleading:" = "🥺";
+        ":pointing_right:" = "👉";
+        ":pointing_left:" = "👈";
+      };
+    };
+  };
+}

modules/desktop/ibus.nix

@@ -1,81 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}:
-with lib;
-let
-  cfg = config.xyno.desktop.ibus;
-in
-{
-  options.xyno.desktop.ibus.enable = mkEnableOption "enable ibus input daemon thing";
-  options.xyno.desktop.ibus.wantedBy = mkOption {
-    type = types.str;
-    default = "niri.service";
-  };
-  config = mkIf cfg.enable {
-    services.libinput.enable = true;
-
-    # just... enable ibus as input method and maybe now we have consistent unicode input everywhere
-    # fuck qt tbh
-    i18n.inputMethod = {
-      enable = true;
-      package = pkgs.ibus-patched;
-      # ibus.engines = with pkgs.ibus-engines; [ uniemoji ];
-    };
-    # home-manager.sharedModules = [
-    #   (
-    #     { lib, ... }:
-    #     {
-    #       dconf.settings = {
-    #         "org/gnome/desktop/input-sources" = {
-    #           sources = [
-    #             (lib.hm.gvariant.mkTuple [
-    #               "xkb"
-    #               "us"
-    #             ])
-    #             (lib.hm.gvariant.mkTuple [
-    #               "ibus"
-    #               "libpinyin"
-    #             ])
-    #             (lib.hm.gvariant.mkTuple [
-    #               "ibus"
-    #               "mozc-jp"
-    #             ])
-    #           ];
-    #         };
-    #       };
-    #     }
-    #   )
-    # ];
-
-    systemd.user.services."org.freedesktop.IBus.session.generic".wantedBy = [ cfg.wantedBy ];
-    systemd.packages = [ pkgs.ibus-patched ];
-    # systemd.user.services.ibus =
-    #   let
-    #     ibusPackage = config.i18n.inputMethod.package;
-    #   in
-    #   assert hasPrefix "ibus-with-plugins" ibusPackage.name;
-    #   {
-    #     # panel is weird...
-    #     # default is ${ibusPackage}/libexec/ibus-ui-gtk3 which works but sends a notification that it's misconfigured
-    #     # wayland support can be enabled with --enable-wayland-im but that segfaults (possible due to zwp_input_method_v1 not being available?)
-    #     script = ''
-    #       exec ${ibusPackage}/bin/ibus-daemon --xim --replace --panel '${ibusPackage}/libexec/ibus-ui-gtk3'
-    #     '';
-    #     serviceConfig = {
-    #       Type = "dbus";
-    #       BusName = "org.freedesktop.IBus";
-    #       Restart = "on-abnormal";
-    #     };
-    #     unitConfig = {
-    #       CollectMode = "inactive-or-failed";
-    #     };
-    #     # yeah we hardcoding this now, fuck it
-    #     wantedBy = [ cfg.wantedBy ];
-    #     partOf = [ "graphical-session.target" ];
-    #   };
-
-  };
-}

modules/desktop/niri.nix

@@ -14,8 +14,6 @@ let
     "KeePassXC"
     "org.gnome.NautilusPreviewer"
     "io.github.Qalculate.qalculate-qt"
-    "ibus-ui-emojier"
-    "ibus-ui-gtk3"
   ];
   matchFloat = concatStringsSep "\n" (
     map (x: ''
@@ -54,8 +52,7 @@ in
         value = 1;
       }
     ];
-    home-manager.sharedModules = [
+    home-manager.users.${config.xyno.system.user.name} = mkIf config.xyno.presets.home-manager.enable (
-      (
       { ... }:
       {
         xyno.dark-theme.enable = true;
@@ -68,8 +65,7 @@ in
         #   save_mode = suggested
         # '';
       }
-      )
+    );
-    ];
 
     xdg.portal = {
       extraPortals = [
@@ -92,16 +88,7 @@ in
     environment.systemPackages = with pkgs; [
       playerctl
       xwayland-satellite
-      nirius
     ];
-    systemd.user.services.niriusd = {
-      unitConfig.PartOf = "graphical-session.target";
-      unitConfig.After = "graphical-session.target";
-      unitConfig.Requisite = "graphical-session.target";
-      serviceConfig.Restart = "on-failure";
-      wantedBy = [ "niri.service" ];
-      script = "exec ${pkgs.nirius}/bin/niriusd";
-    };
     programs.niri.enable = true;
     environment.etc."niri/config.kdl".mode = "444"; # copy file so niri detects changes
     environment.etc."niri/config.kdl".text = ''
@@ -118,15 +105,11 @@ in
         Mod+T { spawn "${cfg.term}" "tmux" "new-session" "-t" "main"; }
         Mod+Shift+T { spawn "${cfg.term}"; }
         Mod+Y { spawn "${cfg.term}" "--app-id" "floating-alacritty" "-W" "120x37" "yazi"; }
-        Mod+Shift+M { spawn "sh" "-c" "notify-send -t 3000 -a umpv umpv-paste $(wl-paste); umpv $(wl-paste)"; }
         Mod+P { spawn "keepassxc"; }
         Mod+S { spawn "qalculate-qt"; }
         Mod+Shift+N { spawn "makoctl" "dismiss" "-a"; }
         Mod+N { spawn "makoctl" "dismiss"; }
         Mod+E { spawn "makoctl" "menu" "fuzzel -d"; }
-        Mod+G { spawn "nirius" "toggle-follow-mode"; }
-        Mod+Shift+bracketleft { spawn "nirius" "scratchpad-show"; }
-        Mod+Shift+bracketright { spawn "nirius" "scratchpad-toggle"; }
         XF86AudioRaiseVolume allow-when-locked=true { spawn "wpctl" "set-volume" "@DEFAULT_AUDIO_SINK@" "0.03+"; }
         XF86AudioLowerVolume allow-when-locked=true { spawn "wpctl" "set-volume" "@DEFAULT_AUDIO_SINK@" "0.03-"; }
         XF86AudioMute        allow-when-locked=true { spawn "wpctl" "set-mute" "@DEFAULT_AUDIO_SINK@" "toggle"; }

modules/desktop/waybar/cal.nix

@@ -24,14 +24,13 @@ let
           UNTIL="1d"
 
           EVENT="$(
-            (khal list "$SINCE" "$UNTIL" \
+            khal list "$SINCE" "$UNTIL" \
               --day-format 'SKIPME' \
               --format "{start-end-time-style} {title:.31}{repeat-symbol}" |
               grep -v SKIPME |  # filter out headers
               grep -v -P '↦|↔ |⇥' |  # filter out continuing all day events
               grep -v '^ ' |  # exclude full-day events
               head -n 1  # show just the first
-              ) || echo ""
           )"
 
           if [ -z "$EVENT" ]; then

modules/module-list.nix

@@ -5,9 +5,9 @@
   ./desktop/audio.nix
   ./desktop/common-programs.nix
   ./desktop/easyeffects.nix
+  ./desktop/fcitx5.nix
   ./desktop/foot.nix
   ./desktop/fuzzel.nix
-  ./desktop/ibus.nix
   ./desktop/mako.nix
   ./desktop/niri.nix
   ./desktop/shikane.nix
@@ -21,18 +21,17 @@
   ./presets/common.nix
   ./presets/development.nix
   ./presets/gui.nix
-  ./presets/home-manager.nix
   ./presets/server.nix
-  # ./services/authentik
+  ./presets/home-manager.nix
-  # ./services/caddy
+  ./services/authentik
-  ./services/traefik.nix
+  ./services/caddy
   ./services/monitoring.nix
   ./services/wireguard.nix
   ./system/impermanence.nix
   ./system/meta.nix
   ./system/user.nix
-  ./to-upstream/fido2-hid-bridge.nix
   ./user-services/khal.nix
   ./user-services/syncthing.nix
+  ./to-upstream/fido2-hid-bridge.nix
 ]
 

modules/presets/cli.nix

@@ -1,6 +1,5 @@
 {
   config,
-  inputs,
   lib,
   pkgs,
   ...
@@ -45,11 +44,6 @@ in
       LC_COLLATE = "de_DE.UTF-8";
     };
 
-    nix.channel.enable = false;
-    nix.nixPath = [
-      "nixpkgs=${inputs.nixpkgs}"
-      "nixpkgs-master=${inputs.nixpkgs-master}"
-    ];
     nix.settings = {
       substituters = [
         # "https://cache.lix.systems"
@@ -61,7 +55,6 @@ in
         # "cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o="
         # "helix.cachix.org-1:ejp9KQpR1FBI2onstMQ34yogDm4OgU2ru6lIwPvuCVs="
       ];
-      
       trusted-users = lib.mkDefault [
         "root"
         "@wheel"
@@ -137,7 +130,7 @@ in
       imagemagick
       jq
       lm_sensors
-      moor
+      moar
       neofetch
       nix-output-monitor
       poppler
@@ -152,7 +145,7 @@ in
     programs.mosh.enable = true;
     environment.variables.EDITOR = "hx";
     environment.variables.VISUAL = "hx";
-    environment.variables.PAGER = "moor";
+    environment.variables.PAGER = "moar";
 
     environment.shellAliases = {
       l = "ls -alh";
@@ -168,7 +161,7 @@ in
       p = "cd ~/proj";
       ytl = ''yt-dlp -f "bv*+mergeall[vcodec=none]" --audio-multistreams'';
       sudo = "run0";
-      less = "moor";
+      less = "moar";
     };
   };
 }

modules/presets/gui.nix

@@ -1,7 +1,6 @@
 {
   pkgs,
   config,
-  inputs,
   lib,
   ...
 }:
@@ -22,7 +21,6 @@ in
       pkgs.yubikey-personalization
     ];
     xyno.desktop.niri.enable = true;
-    xyno.desktop.ibus.enable = true;
     xyno.desktop.audio.enable = mkDefault true;
     xyno.user-services.khal.enable = true;
     boot.kernelPackages = mkDefault pkgs.linuxPackages_zen;
@@ -42,60 +40,9 @@ in
 
     qt = {
       enable = true;
-      platformTheme = "qt5ct";
+      style = "breeze";
+      # platformTheme = "gnome";
     };
-    home-manager.sharedModules =
-      let
-        gruvboxDarkColors = pkgs.writeText "gruvbox-dark.conf" ''
-          [ColorScheme]
-          active_colors=#ffebdbb2, #ff1d2021, #ffbdae93, #ffa89984, #ff3c3836, #ff504945, #ffebdbb2, #ffebdbb2, #ffebdbb2, #ff282828, #ff1d2021, #ff504945, #ff458588, #ff282828, #ff458588, #ffcc241d, #ff282828, #ffebdbb2, #ff1d2021, #ffebdbb2, #ffbdae93
-          disabled_colors=#ffbdae93, #ff1d2021, #ffbdae93, #ffa89984, #ff3c3836, #ff504945, #ffbdae93, #ffbdae93, #ffbdae93, #ff282828, #ff1d2021, #ff504945, #ff438184, #ff3c3836, #ff458588, #ffcc241d, #ff282828, #ffebdbb2, #ff1d2021, #ffebdbb2, #ffbdae93
-          inactive_colors=#ffebdbb2, #ff1d2021, #ffbdae93, #ffa89984, #ff3c3836, #ff504945, #ffebdbb2, #ffebdbb2, #ffebdbb2, #ff282828, #ff1d2021, #ff504945, #ff438184, #ffa89984, #ff458588, #ffcc241d, #ff282828, #ffebdbb2, #ff1d2021, #ffebdbb2, #ffbdae93
-        '';
-        qt5ctConf = pkgs.writeText "qt5ct.conf" ''
-          [Appearance]
-          color_scheme_path=${gruvboxDarkColors}
-          custom_palette=true
-          icon_theme=breeze-dark
-          standard_dialogs=xdgdesktopportal
-          style=Breeze
-
-          [Fonts]
-          fixed="Source Sans 3,12,-1,5,50,0,0,0,0,0"
-          general="Source Sans 3,12,-1,5,50,0,0,0,0,0"
-        '';
-      in
-      [
-        {
-          home.file.".config/qt5ct/qt5ct.conf".source = qt5ctConf;
-          home.file.".config/qt6ct/qt6ct.conf".source = qt5ctConf;
-          dconf = {
-            settings = {
-              "org/gnome/desktop/interface" = {
-                color-scheme = "prefer-dark";
-                gtk-theme = "adw-gtk3-dark";
-              };
-            };
-          };
-          gtk = {
-            enable = true;
-            iconTheme.name = "breeze-dark";
-            gtk4.extraConfig.gtk-application-prefer-dark-theme = 1;
-            gtk3.extraConfig.gtk-application-prefer-dark-theme = 1;
-            gtk3.theme.package = pkgs.adw-gtk3;
-            gtk3.theme.name = "adw-gtk3-dark";
-
-            gtk3.extraCss = ''
-              @import url("${inputs.adw-colors}/themes/adw-gruvbox/gtk3-dark.css");
-            '';
-            gtk4.extraCss = ''
-              @import url("${inputs.adw-colors}/themes/adw-gruvbox/gtk4-dark.css");
-            '';
-
-          };
-
-        }
-      ];
 
     programs.yazi = {
       settings.keymap.mgr.prepend_keymap = [
@@ -123,34 +70,11 @@ in
     # enable the gnome shit
     services.gnome.gnome-keyring.enable = true;
     services.gnome.gnome-online-accounts.enable = true;
-    environment.systemPackages = with pkgs; [
+    services.gnome.core-apps.enable = true;
-      gnome-calendar
-      gnome-clocks
-      gnome-font-viewer
-      mate.engrampa
-      papirus-folders
-      kdePackages.gwenview
-      kdePackages.skanlite
-      kdePackages.okular
-      kdePackages.breeze-gtk
-      kdePackages.breeze.qt5
-      kdePackages.breeze
-      kdePackages.breeze-icons
-      nautilus # for xdg portal
-    ];
     services.gnome.gcr-ssh-agent.enable = mkForce false;
-    # services.gnome.sushi.enable = true;
+    services.gnome.sushi.enable = true;
     services.gnome.gnome-settings-daemon.enable = true;
-
+    services.gvfs.enable = true;
-    programs.thunar = {
-      enable = true;
-      plugins = with pkgs.xfce; [
-        thunar-archive-plugin
-        thunar-volman
-      ];
-    };
-    services.tumbler.enable = true; # thunar image preview
-    services.gvfs.enable = true; # thunar network device mount
 
     xdg.terminal-exec = {
       enable = true;
@@ -186,6 +110,13 @@ in
     #     };
       };
 
+    environment.systemPackages = with pkgs; [
+      kdePackages.breeze-gtk
+      kdePackages.breeze.qt5
+      kdePackages.breeze
+      kdePackages.breeze-icons
+    ];
+
     # fonts
     fonts.fontconfig.defaultFonts = {
       sansSerif = [

modules/services/caddy/default.nix

@@ -7,49 +7,106 @@
 with lib;
 let
   cfg = config.xyno.services.caddy;
-  schema = import ./json-schema.nix {
+  wildcardMatcherStr = wildcard: hostName: content: ''
-    inherit pkgs lib;
+    @${hostName} host ${hostName}.${wildcard}
-    schema = builtins.fromJSON (builtins.readFile ./caddy_schema.json);
+    handle @${hostName} {
+      ${content.extraConfig}
+    }
+
+  '';
+  genOneWildcard = wildcard: host: {
+    extraConfig = ''
+      # extra pre
+      ${host.extraConfigPre}
+      # block bots
+      ${optionalString host.blockBots "import blockBots"}
+      # hosts handler
+      ${concatStrings (mapAttrsToList (n: v: wildcardMatcherStr wildcard n v) host.hosts)}
+      # extra post
+      ${host.extraConfigPost}
+      abort
+    '';
   };
+  genVHostsFromWildcard = mapAttrs' (
+    n: v: nameValuePair "*.${n}" (genOneWildcard n v)
+  ) cfg.wildcardHosts;
+  schema = import ./json-schema.nix { inherit pkgs lib; schema = builtins.fromJSON (builtins.readFile ./caddy_schema.json); };
 in
 {
   options.xyno.services.caddy.enable = mkEnableOption "enables caddy with the desec plugin";
   options.xyno.services.caddy.config = mkOption {
-    default = { };
+    default = {};
     type = schema.type;
   }; 
+  options.xyno.services.caddy.wildcardHosts = mkOption {
+    example = {
+      "hailsatan.eu" = {
+        blockBots = true;
+        hosts.md.extraConfig = ''reverse_proxy ...'';
+      };
+    };
+    default = { };
+    type =
+      with types;
+      attrsOf (submodule {
+        options = {
+          blockBots = mkOption {
+            type = bool;
+            default = false;
+          };
+          extraConfigPre = mkOption {
+            type = str;
+            default = "";
+          };
+          extraConfigPost = mkOption {
+            type = str;
+            default = "";
+          };
+          hosts = mkOption {
+            default = {};
+            type = attrsOf (submodule {
+              options = {
+                extraConfig = mkOption { type = lines; };
+              };
+            });
+          };
+        };
+      });
+  };
   config = lib.mkIf cfg.enable {
     networking.firewall.allowedTCPPorts = [
       80
       443
     ];
     networking.firewall.allowedUDPPorts = [ 443 ];
-    xyno.services.caddy.config = {
-      apps = {
-        http.metrics.per_host = true;
-        tls.automation.policies = [
-          {
-            issuers = [
-              {
-                ca = "https://acme-v02.api.letsencrypt.org/directory";
-                challenges.dns.provider = {
-                  name = "desec";
-                  token.path = ""; # TODO
-
-                };
-              }
-            ];
-            module = "acme";
-          }
-        ];
-      };
-    };
-
     services.caddy = {
       enable = true;
       package = pkgs.caddy-desec;
       adapter = "json";
       configFile = json.generate "caddy-config.json" cfg.config;
+      # virtualHosts = genVHostsFromWildcard;
+      # email = mkDefault "ssl@xyno.systems";
+      # acmeCA = mkDefault "https://acme-v02.api.letsencrypt.org/directory";
+      # globalConfig = ''
+      #   metrics {
+      #     per_host
+      #   }
+      # '';
+      # extraConfig = ''
+      #   (blockBots) {
+      #     @botForbidden header_regexp User-Agent "(?i)AdsBot-Google|Amazonbot|anthropic-ai|Applebot|Applebot-Extended|AwarioRssBot|AwarioSmartBot|Bytespider|CCBot|ChatGPT|ChatGPT-User|Claude-Web|ClaudeBot|cohere-ai|DataForSeoBot|Diffbot|FacebookBot|Google-Extended|GPTBot|ImagesiftBot|magpie-crawler|omgili|Omgilibot|peer39_crawler|PerplexityBot|YouBot"
+
+      #     handle @botForbidden   {
+      #       redir https://hil-speed.hetzner.com/10GB.bin
+      #     }
+      #     handle /robots.txt {
+      #       respond <<TXT
+      #       User-Agent: *
+      #       Disallow: /
+      #       TXT 200
+      #     }
+      #   }
+      # '';
     };
     xyno.services.monitoring.exporters.caddy = 2019;
 

modules/services/caddy/json-schema.nix

@@ -36,11 +36,6 @@ let
     in
     result;
   deref = x: if x ? "$ref" then getRef x."$ref" else x;
-  fileSubmod = types.submodule {
-    options.path = mkOption {
-      type = types.pathWith { inStore = false; absolute = true; };
-    };
-  };
   buildOptionType =
     {
       spec,
@@ -48,8 +43,7 @@ let
       ...
     }:
     let
-      
+      strType = if spec ? enum then types.enum spec.enum else types.str;
-      strType = if spec ? enum then types.enum spec.enum else (types.either types.str fileSubmod);
       objType = types.submodule {
         freeformType = json.type;
         options = submoduleOptions { inherit spec depth; };

modules/services/monitoring.nix

@@ -9,11 +9,7 @@ with lib;
 let
   cfg = config.xyno.services.monitoring;
 
-  firstInstanceWithPromServer =
+  firstInstanceWithPromServer = if cfg.prometheusServer then config.networking.hostName else (builtins.head (
-    if cfg.prometheusServer then
-      config.networking.hostName
-    else
-      (builtins.head (
     attrValues (filterAttrs (n: v: v.config.xyno.services.monitoring.prometheusServer) (otherNodes))
   )).config.networking.hostName;
   vmBasicAuthUsername = "xyno-monitoring";
@@ -88,9 +84,7 @@ in
         ];
       };
 
-      services.grafana.declarativePlugins = with pkgs.grafanaPlugins; [
+      services.grafana.declarativePlugins = with pkgs.grafanaPlugins; [ victoriametrics-metrics-datasource ];
-        victoriametrics-metrics-datasource
-      ];
 
     })
   ];

modules/services/traefik.nix

@@ -1,178 +0,0 @@
-{
-  pkgs,
-  lib,
-  config,
-  ...
-}:
-let
-  cfg = config.xyno.services.traefik;
-  simpleProxyOpts = lib.mapAttrsToList (
-    n: v:
-    let
-      router = "simpleproxy-${n}-router";
-      service = "simpleproxy-${n}-service";
-      spl = lib.splitString "." v.host;
-      certDomain =
-        if (builtins.length spl) > 2 then lib.concatStringsSep "." (builtins.tail spl) else spl;
-    in
-    {
-      routers."${router}-robotstxt" = {
-        service = "robotstxt";
-        rule = "Host(`${v.host}`) && Path(`/robots.txt`)";
-        tls.domains = [
-          {
-            main = certDomain;
-            sans = [ "*.${certDomain}" ];
-          }
-        ];
-        
-      };
-      routers.${router} = {
-        inherit service;
-        rule = "Host(`${v.host}`)";
-        tls.domains = [
-          {
-            main = certDomain;
-            sans = [ "*.${certDomain}" ];
-          }
-        ];
-      };
-      services.${service} = {
-        loadBalancer.servers = [
-          { url = v.internal; }
-        ];
-      };
-      services.robotstxt = {
-        loadBalancer.servers = [
-          { url = "http://127.0.0.2"; }
-        ];
-      };
-    }
-  ) cfg.simpleProxy;
-in
-{
-  options.xyno.services.traefik.enable = lib.mkEnableOption "enables traefik";
-  options.xyno.services.traefik.noBots = lib.mkOption {
-    type = lib.types.bool;
-    default = true;
-  };
-  options.xyno.services.traefik.simpleProxy = lib.mkOption {
-    example = {
-      "example" = {
-        host = "example.org";
-        middlewares = [ "meow" ];
-        internal = "http://127.0.0.1:8080";
-      };
-    };
-    default = { };
-    type = lib.types.attrsOf (
-      lib.types.submodule {
-        options = {
-          middlewares = lib.mkOption {
-            type = lib.types.nullOr (lib.types.listOf lib.types.str);
-          };
-          internal = lib.mkOption {
-            type = lib.types.str;
-          };
-          host = lib.mkOption {
-            type = lib.types.str;
-          };
-          
-        };
-      }
-    );
-
-  };
-  config = lib.mkIf cfg.enable {
-    services.nginx = {
-      enable = lib.mkIf cfg.noBots true;
-      defaultListenAddresses = lib.mkIf cfg.noBots [ "127.0.0.2" ];
-      virtualHosts.localhost.locations."/".root = pkgs.runCommand "nginx-robots" ''
-        mkdir $out
-        echo "User-Agent: *\nDisallow: /" > $out/robots.txt
-      '';
-    };
-    services.traefik = {
-      enable = true;
-      environmentFiles = [
-        config.sops.templates."traefik.env".path
-      ];
-      staticConfigOptions = {
-        metrics = lib.mkIf config.xyno.services.monitoring.enable {
-          otlp.http.endpoint = "http://localhost:8429/v1/metrics";
-        };
-        entryponts.web = {
-          address = ":80";
-          redirections.entryPoint = {
-            to = "websecure";
-            scheme = "https";
-            permanent = true;
-          };
-        };
-        entryponts.websecure = {
-          address = ":443";
-          tls.certResolver = "letsencrypt";
-          http3 = { };
-
-        };
-        log.level = "INFO";
-        certificatesResolvers.letsencrypt.acme = {
-          email = "ssl@xyno.systems";
-          caServer = "https://acme-v02.api.letsencrypt.org/directory";
-          dnsChallenge = {
-            provider = "desec";
-          };
-        };
-      };
-      dynamicConfigOptions = {
-        http = lib.mkMerge simpleProxyOpts;
-        tls.options.default = {
-          # mozilla modern
-          minVersion = "VersionTLS13";
-          curvePreferences = [
-            "X25519"
-            "CurveP256"
-            "CurveP384"
-          ];
-        };
-        tls.options.old = {
-          # mozilla intermediate
-          minVersion = "VersionTLS12";
-          curvePreferences = [
-            "X25519"
-            "CurveP256"
-            "CurveP384"
-          ];
-          cipherSuites = [
-            "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
-            "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
-            "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
-            "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
-            "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305"
-            "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"
-          ];
-
-        };
-      };
-    };
-    networking.firewall.allowedTCPPorts = [
-      80
-      443
-    ];
-    networking.firewall.allowedUDPPorts = [ 443 ];
-    xyno.impermanence.directories = [ config.services.traefik.dataDir ];
-    sops.secrets."desec_token" = {
-    };
-    sops.templates."traefik.env".content = ''
-      DESEC_TOKEN=${config.sops.placeholder.desec_token}
-      DESEC_PROPAGATION_TIMEOUT=1200
-    '';
-    sops.templates."traefik.env".reloadUnits = [ "traefik.service" ];
-    # services.borgmatic.settings.traefikql_databases = [
-    #   {
-    #     name = "all"; # gets run as root anyways so can log in
-    #   }
-    # ];
-
-  };
-}

overlays/default.nix

@@ -27,16 +27,16 @@ inputs: self: super: {
   fido2-hid-bridge = super.callPackage ../packages/fido2-hid-bridge.nix {};
   python-uhid = super.callPackage ../packages/uhid.nix {};
   caddy-desec = super.callPackage ../packages/caddy-desec.nix {};
-  ibus-patched = super.unstable.ibus.overrideAttrs (old: {
+
-    patches = old.patches ++ [
+  # todo: remove on next supersonic release
-      # (builtins.head old.patches)
+  supersonic-wayland = super.supersonic-wayland.overrideAttrs (old: {
-      # (builtins.head (builtins.tail old.patches))
+    patches = (if old?patches then old.patches else []) ++ [
       (self.fetchpatch2 {
-        url = "https://github.com/ibus/ibus/commit/dde00b1b689037e70d79a703aa028f7c3de289e2.patch";
+        url = "https://github.com/dweymouth/supersonic/commit/ee742cf34ef7225d345c16354d9c21d72a41bf4a.patch";
-        hash = "sha256-Q5XANWsN7f9Kcno8Icgn8wlXL489YlcrlUrqeA67nWU=";
+        hash = "sha256-kSeEbzrfJ4Pe8JC4rIWlSmADOcjrCRBNWlcO8VfVnn4=";
       })
     ];
+    vendorHash = "sha256-Sh3PxRwb6ElSeWzdvIQ+nD9VVGlpUDwxG7nAoGWPTRQ=";
   });
 
-
 }

secrets/common.yaml

@@ -1,6 +1,5 @@
 victoriametrics:
     basicAuthPassword: ENC[AES256_GCM,data:5QuhkQ344qDYzhGZBJimaX94C6oxgYBRZw4MSlycdgs6zRAudMIu/HF1gpjythQpait81jMpFhIn57w433s7QQ==,iv:gytJ63cBaJseCis7gEPmOX6LeddNloQsTjc1SnS56jo=,tag:Jn6TevGsBEeHxYmVHy896w==,type:str]
-desec_token: ENC[AES256_GCM,data:3aqlfpAEMyOSNGdLXm4lc0VZajduPkTYkYd+WA==,iv:sktNkKWaD/hjsQpSJzAZeCvwYXfvkhQ2A44BKedCZRg=,tag:XbxIr09c60V0PMDitSOD/w==,type:str]
 wg:
     psk: ENC[AES256_GCM,data:Anpe6IxtzsqZyvas+ddV3yjJozdZgZOl2KG/Z4YtWUB5gAVLtxsQKc/WA/M=,iv:j/A5k2VXbdqUDXEd1WRfJYdb3DsUZ1B9gPHCpDpRjmw=,tag:KQGi1O5iP2+nQccgBzytSQ==,type:str]
 msmtp:
@@ -11,8 +10,8 @@ msmtp:
     password: ENC[AES256_GCM,data:mAgsvDPzt8f/RB/2T8nrd+KUcuxUGIdCBDs5sFla5x0=,iv:qndiiKTuSpbf/gtNXPaZ6AnHHwzZ7IPJrDFriM7bKwE=,tag:5j+gjpaxIu03x1lBkRMLhQ==,type:str]
     aliases: ENC[AES256_GCM,data:fOZRYZ8rVs3IXhiS+VaP54gF4bir66oIZvb7ZfKV,iv:bsmh1ZCwERZuHrvORP68hj5Gz7j3+K6ZW8BR3/IQVQg=,tag:jWozmXpjk3JHCINSgP4KGg==,type:str]
 sops:
-    lastmodified: "2025-11-19T16:17:02Z"
+    lastmodified: "2025-09-06T16:50:17Z"
-    mac: ENC[AES256_GCM,data:dt2iRLTxfPWpYlxsZnOQgtUAvU/MWoXp6eLOJgP/uWLe5ooeU5K868I7PQNVGEnqkJGZTiiENpY7mkmt0niKn2nw7nD5KzRPMvFZ0/JXrLkzCScBfJDlbcuTtKFVqlDkPpz7kgF+fQy1cg5KiDyc9bsJAi/9qHhQHF3wFbeG5rI=,iv:E6YtLKZdnqgVZKx/goxdvn41p+hfMpkSbc7FJ/3yXQA=,tag:6iW9vkEsEuXOhptGdDwpdw==,type:str]
+    mac: ENC[AES256_GCM,data:QdWLok9IBqTaO3StKRiAXcMIZSV5YJQoYY+3cZZ7xARbmvn5cDqnapv3HIJju7v5V48tNG3aXy1nJHG4kKVuDIMd7s7PPjLL1k0dEsnTs4YwE8XugZX86nXuSUZeUuQNfnR9sFOKho/o/I9W5hCp0IcEgo+Bs1dD3IvYxuv6Nzk=,iv:IHEDtI6lo76qPgBvBETg/SiT/tfFivN8r8J7tt93IbQ=,tag:ifW8UVaf5r8Y9HUUtCkAQQ==,type:str]
     pgp:
         - created_at: "2025-09-06T16:37:33Z"
           enc: |-
@@ -64,4 +63,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: b730b2bf54eb792a14bfd3e68c14c08894376c5f
     unencrypted_suffix: _unencrypted
-    version: 3.11.0
+    version: 3.10.2