fix certs?

flake.lock

@@ -23,6 +23,27 @@
         "type": "github"
       }
     },
+    "androidPkgs": {
+      "inputs": {
+        "devshell": "devshell",
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs_3"
+      },
+      "locked": {
+        "lastModified": 1750710155,
+        "narHash": "sha256-2lBEwXgclOrSsrhubSfifU91+sXqikC8qbiZ6yFeaEY=",
+        "owner": "tadfisher",
+        "repo": "android-nixpkgs",
+        "rev": "0846fab1f060f646e1017053077ad38dedc5207b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tadfisher",
+        "ref": "stable",
+        "repo": "android-nixpkgs",
+        "type": "github"
+      }
+    },
     "base16": {
       "inputs": {
         "fromYaml": "fromYaml"
@@ -129,6 +150,28 @@
         "type": "github"
       }
     },
+    "devshell": {
+      "inputs": {
+        "nixpkgs": [
+          "robotnix",
+          "androidPkgs",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1741473158,
+        "narHash": "sha256-kWNaq6wQUbUMlPgw8Y+9/9wP0F8SHkjy24/mN3UAppg=",
+        "owner": "numtide",
+        "repo": "devshell",
+        "rev": "7c9e793ebe66bcba8292989a68c0419b737a22a0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "devshell",
+        "type": "github"
+      }
+    },
     "disko": {
       "inputs": {
         "nixpkgs": [
@@ -198,6 +241,21 @@
         "url": "https://git.lix.systems/lix-project/flake-compat.git"
       }
     },
+    "flake-compat_3": {
+      "locked": {
+        "lastModified": 1746162366,
+        "narHash": "sha256-5SSSZ/oQkwfcAz/o/6TlejlVGqeK08wyREBQ5qFFPhM=",
+        "owner": "nix-community",
+        "repo": "flake-compat",
+        "rev": "0f158086a2ecdbb138cd0429410e44994f1b7e4b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-parts": {
       "inputs": {
         "nixpkgs-lib": [
@@ -261,6 +319,24 @@
         "type": "github"
       }
     },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems_3"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "fromYaml": {
       "flake": false,
       "locked": {
@@ -546,11 +622,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1766651565,
+        "lastModified": 1768305791,
-        "narHash": "sha256-QEhk0eXgyIqTpJ/ehZKg9IKS7EtlWxF3N7DXy42zPfU=",
+        "narHash": "sha256-AIdl6WAn9aymeaH/NvBj0H9qM+XuAuYbGMZaP0zcXAQ=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "3e2499d5539c16d0d173ba53552a4ff8547f4539",
+        "rev": "1412caf7bf9e660f2f962917c14b1ea1c3bc695e",
         "type": "github"
       },
       "original": {
@@ -608,6 +684,38 @@
         "type": "github"
       }
     },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1750506804,
+        "narHash": "sha256-VLFNc4egNjovYVxDGyBYTrvVCgDYgENp5bVi9fPTDYc=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "4206c4cb56751df534751b058295ea61357bbbaa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1767313136,
+        "narHash": "sha256-16KkgfdYqjaeRGBaYsNrhPRRENs0qzkQVUooNHtoy2w=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "ac62194c3917d5f474c1a844b6fd6da2db95077d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nmd": {
       "inputs": {
         "nixpkgs": [
@@ -737,23 +845,24 @@
         "type": "github"
       }
     },
-    "phoenix": {
+    "robotnix": {
       "inputs": {
-        "nixpkgs": [
+        "androidPkgs": "androidPkgs",
-          "nixpkgs"
+        "flake-compat": "flake-compat_3",
-        ]
+        "nixpkgs": "nixpkgs_4",
+        "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1766543224,
+        "lastModified": 1768481330,
-        "narHash": "sha256-96PBoNqh3sPU9t+IXxcB1OjjuQ8HOv42OOh9UtwFHbU=",
+        "narHash": "sha256-hYKnwFBPI0IyH8YbW3kqci8AS6ZtV7QSEa0E5Wt401M=",
-        "owner": "celenityy",
+        "owner": "nix-community",
-        "repo": "Phoenix",
+        "repo": "robotnix",
-        "rev": "f09568c8a71af4fe42dd43c6f711c67daf605f1e",
+        "rev": "4ee0f9c86c3ae076bcbc41cbeebff054fe3d11a8",
         "type": "github"
       },
       "original": {
-        "owner": "celenityy",
+        "owner": "nix-community",
-        "repo": "Phoenix",
+        "repo": "robotnix",
         "type": "github"
       }
     },
@@ -770,7 +879,7 @@
         "noshell": "noshell",
         "nur": "nur",
         "nvf": "nvf",
-        "phoenix": "phoenix",
+        "robotnix": "robotnix",
         "stylix": "stylix"
       }
     },
@@ -803,7 +912,7 @@
           "nixpkgs"
         ],
         "nur": "nur_2",
-        "systems": "systems_3",
+        "systems": "systems_4",
         "tinted-foot": "tinted-foot",
         "tinted-kitty": "tinted-kitty",
         "tinted-schemes": "tinted-schemes",
@@ -869,6 +978,21 @@
         "type": "github"
       }
     },
+    "systems_4": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "tinted-foot": {
       "flake": false,
       "locked": {
@@ -949,6 +1073,27 @@
         "repo": "base16-zed",
         "type": "github"
       }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "robotnix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1766000401,
+        "narHash": "sha256-+cqN4PJz9y0JQXfAK5J1drd0U05D5fcAGhzhfVrDlsI=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "42d96e75aa56a3f70cab7e7dc4a32868db28e8fd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -38,10 +38,7 @@
       url = "github:notashelf/nvf";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    phoenix = {
+    robotnix.url = "github:nix-community/robotnix";
-      url = "github:celenityy/Phoenix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     stylix = {
       url = "github:nix-community/stylix";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -59,7 +56,7 @@
     noshell,
     nur,
     nvf,
-    phoenix,
+    robotnix,
     stylix,
     ...
   }: let
@@ -80,7 +77,6 @@
             impermanence.nixosModules.impermanence
             nixos-mailserver.nixosModule
             noshell.nixosModules.default
-            phoenix.nixosModules.default
             nix-zulip'.nixosModules.zulip
             {
               nixpkgs.overlays = [
@@ -98,6 +94,7 @@
         {
           home-manager.useGlobalPkgs = true;
           home-manager.extraSpecialArgs = {inherit machine;};
+          home-manager.backupFileExtension = "bak";
           home-manager.users =
             builtins.mapAttrs
             (name: value: value)
@@ -122,6 +119,7 @@
       builtins.mapAttrs
       (hostname: value: configurationWithHomeManager value)
       machines;
+    robotnixConfigurations.payton = robotnix.lib.robotnixSystem ./robotnix/payton.nix;
     nixOnDroidConfigurations.default = nix-on-droid.lib.nixOnDroidConfiguration {
       pkgs = import nixpkgs {system = "aarch64-linux";};
       modules = [

machines.nix

@@ -11,6 +11,7 @@
       # hardware configuration
       # includes `system.stateVersion`
       ./modules/nixos/machines/lenovo.nix
+      ./modules/nixos/zram.nix
 
       # boot process
       # systemd-boot
@@ -20,7 +21,7 @@
       ./modules/nixos/laptop.nix
 
       # vpn
-      ./modules/nixos/openvpn-client.nix
+      # ./modules/nixos/openvpn-client.nix
 
       # ly display manager
       ./modules/nixos/ly.nix
@@ -30,6 +31,7 @@
 
       # apps
       ./modules/nixos/steam.nix
+      ./modules/nixos/phoenix.nix
 
       # substitutors
       ./substitutors.nix
@@ -74,20 +76,16 @@
 
       # matrix homeserver
       # matrix.domain
-      # ./modules/nixos/matrix-conduit.nix
+      ./modules/nixos/matrix-continuwuity.nix
-
-      # matrix homeserver
-      ./modules/nixos/matrix-synapse.nix
 
       # BROKEN
       # forgejo
       # git.domain
       # ./modules/nixos/forgejo.nix
 
-      # BROKEN
       # zulip chat client
       # chat.domain
-      ./modules/nixos/zulip.nix
+      # ./modules/nixos/zulip.nix
     ];
   };
 }

modules/nixos/mailserver.nix

@@ -37,6 +37,14 @@
         forceSSL = true;
         enableACME = true;
       };
+      "matrix.${config.networking.domain}" = {
+        forceSSL = true;
+        enableACME = true;
+      };
+      "${config.networking.domain}" = {
+        forceSSL = true;
+        enableACME = true;
+      };
     };
   };
   security.acme = {

modules/nixos/matrix-conduit.nix

@@ -1,82 +0,0 @@
-{
-  config,
-  pkgs,
-  ...
-}: let
-  well_known_server = pkgs.writeText "well-known-matrix-server" ''
-    {
-      "m.server": "matrix.${config.services.matrix-conduit.settings.global.server_name}"
-    }
-  '';
-  well_known_client = pkgs.writeText "well-known-matrix-client" ''
-    {
-      "m.homeserver": {
-        "base_url": "https://matrix.${config.services.matrix-conduit.settings.global.server_name}"
-      }
-  '';
-in {
-  services.matrix-conduit = {
-    enable = true;
-    settings.global = {
-      server_name = "${config.networking.domain}";
-    };
-  };
-  services.nginx = {
-    enable = true;
-    virtualHosts = {
-      "matrix.${config.services.matrix-conduit.settings.global.server_name}" = {
-        forceSSL = true;
-        enableACME = true;
-        listen = [
-          {
-            addr = "0.0.0.0";
-            port = 443;
-            ssl = true;
-          }
-          {
-            addr = "0.0.0.0";
-            port = 8448;
-            ssl = true;
-          }
-        ];
-        locations."/_matrix/" = {
-          proxyPass = "http://backend_conduit$request_uri";
-          proxyWebsockets = true;
-          extraConfig = ''
-            proxy_set_header Host $host;
-            proxy_buffering off;
-          '';
-        };
-        extraConfig = ''
-          merge_slashes off;
-        '';
-      };
-      "${config.services.matrix-conduit.settings.global.server_name}" = {
-        forceSSL = true;
-        enableACME = true;
-        locations."/.well-known/matrix/server/" = {
-          alias = "${well_known_server}";
-          extraConfig = ''
-            default_type application/json;
-          '';
-        };
-        locations."/.well-known/matrix/client/" = {
-          alias = "${well_known_client}";
-          extraConfig = ''
-            default_type application/json;
-            add_header Access-Control-Allow-Origin "";
-          '';
-        };
-      };
-    };
-    upstreams = {
-      backend-conduit = {
-        servers = {
-          "localhost:${builtins.toString config.services.matrix-conduit.settings.global.port}" = {};
-        };
-      };
-    };
-  };
-  networking.firewall.allowedTCPPorts = [8448];
-  networking.firewall.allowedUDPPorts = [8448];
-}

modules/nixos/matrix-continuwuity.nix

@@ -0,0 +1,26 @@
+{config, ...}: {
+  services = {
+    matrix-continuwuity = {
+      enable = true;
+      settings = {
+        global = {
+          server_name = "${config.networking.domain}";
+          address = ["127.0.0.1"];
+          port = [6167];
+          well_known = {
+            server = "matrix.${config.networking.domain}";
+            client = "https://matrix.${config.networking.domain}";
+          };
+        };
+      };
+    };
+
+    nginx = {
+      upstreams.matrix.servers."127.0.0.1:6167" = {};
+      virtualHosts = {
+        "matrix.${config.networking.domain}".locations."/".proxyPass = "http://matrix";
+        "${config.networking.domain}".locations."/.well-known/matrix".proxyPass = "http://matrix";
+      };
+    };
+  };
+}

modules/nixos/matrix-synapse.nix

@@ -1,65 +0,0 @@
-{
-  pkgs,
-  lib,
-  config,
-  ...
-}: let
-  fqdn = "${config.networking.hostName}.${config.networking.domain}";
-  baseUrl = "https://${fqdn}";
-  clientConfig."m.homeserver".base_url = baseUrl;
-  serverConfig."m.server" = "${fqdn}:443";
-  mkWellKnown = data: ''
-    default_type application/json;
-    add_header Access-Control-Allow-Origin *;
-    return 200 '${builtins.toJSON data}';
-  '';
-in {
-  services.postgresql.enable = true;
-  services.nginx = {
-    enable = true;
-    recommendedTlsSettings = true;
-    recommendedOptimisation = true;
-    recommendedGzipSettings = true;
-    recommendedProxySettings = true;
-    virtualHosts = {
-      "${config.networking.domain}" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."= /.well-known/matrix/server".extraConfig = mkWellKnown serverConfig;
-        locations."= /.well-known/matrix/client".extraConfig = mkWellKnown clientConfig;
-      };
-      "${fqdn}" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/".extraConfig = ''
-          return 404;
-        '';
-        locations."/_matrix".proxyPass = "http://[::1]:8008";
-        locations."/_synapse/client".proxyPass = "http://[::1]:8008";
-      };
-    };
-  };
-  services.matrix-synapse = {
-    enable = true;
-    settings.server_name = config.networking.domain;
-    settings.public_baseurl = baseUrl;
-    settings.listeners = [
-      {
-        port = 8008;
-        bind_addresses = ["::1"];
-        type = "http";
-        tls = false;
-        x_forwarded = true;
-        resources = [
-          {
-            names = [
-              "client"
-              "federation"
-            ];
-            compress = true;
-          }
-        ];
-      }
-    ];
-  };
-}

modules/nixos/phoenix.nix

@@ -0,0 +1,45 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: {
+  options.programs.firefox.phoenix = {
+    enable =
+      lib.mkEnableOption "Enable privacy & security hardening of Firefox using the Phoenix configs"
+      // {
+        default = true;
+      };
+    firefoxPackages = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = ["firefox"];
+      description = "The name of Firefox packages of current pkgs to patch with phoenix config and policy.";
+    };
+  };
+  config = let
+    cfg = config.programs.firefox.phoenix;
+  in
+    lib.mkIf cfg.enable {
+      assertions = [
+        {
+          assertion = !pkgs.stdenv.isDarwin;
+          message = "Phoenix module has not been ported to nix-darwin yet. Contributions welcomed.";
+        }
+      ];
+      environment.etc."firefox/defaults/pref/phoenix-desktop.js".source = "${pkgs.phoenix}/pref/phoenix-desktop.js";
+      environment.etc."firefox/phoenix/userjs".source = "${pkgs.phoenix}/userjs";
+      environment.etc."firefox/phoenix/configs".source = "${pkgs.phoenix}/configs";
+      environment.etc."firefox/phoenix/assets".source = "${pkgs.phoenix}/assets";
+      programs.firefox.policies =
+        (builtins.fromJSON (builtins.readFile "${pkgs.phoenix}/policies.json")).policies;
+      nixpkgs.overlays = [
+        (import ../../overlays/phoenix.nix)
+        (
+          final: prev:
+            builtins.listToAttrs (
+              map (p: lib.nameValuePair p (final.withPhoenix prev.${p})) cfg.firefoxPackages
+            )
+        )
+      ];
+    };
+}

modules/nixos/zram.nix

@@ -0,0 +1,8 @@
+{
+  zramSwap = {
+    enable = true;
+    priority = 100;
+    algorithm = "zstd";
+    memoryPercent = 75;
+  };
+}

overlays/phoenix.nix

@@ -0,0 +1,21 @@
+final: prev: let
+  phoenix-src = prev.fetchFromGitHub {
+    owner = "celenityy";
+    repo = "Phoenix";
+    rev = "07d9be8cbf938962f9847b0970274b885ff48792";
+    hash = "sha256-I9pKhfhAz3JsGBLIqr9MNycTEQn0Bc3jzf0mKeWLlsE=";
+  };
+in {
+  phoenix = (final.callPackage (import "${phoenix-src}/nix/package.nix")
+    {
+    }).overrideAttrs {
+    patches = [
+      ../patches/0001-autoDisableScopes-unlocked.patch
+    ];
+  };
+  withPhoenix = firefoxPackage:
+    firefoxPackage.override {
+      extraPoliciesFiles = ["${final.phoenix}/policies.json"];
+      extraPrefsFiles = ["${final.phoenix}/phoenix.cfg"];
+    };
+}

patches/0001-autoDisableScopes-unlocked.patch

@@ -0,0 +1,25 @@
+From 1eeab7cf3b5d41e3e10959ef2ff5298eac86c9fa Mon Sep 17 00:00:00 2001
+From: andromeda <andromeda@lenovo>
+Date: Sun, 25 Jan 2026 10:41:03 +0100
+Subject: [PATCH] autoDisableScopes unlocked
+
+---
+ build/phoenix-unified.js | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/build/phoenix-unified.js b/build/phoenix-unified.js
+index e183890e..fd58b176 100644
+--- a/build/phoenix-unified.js
++++ b/build/phoenix-unified.js
+@@ -2204,7 +2204,7 @@ pref("xpinstall.whitelist.add.NoScript.PBM", "https://noscript.net^privateBrowsi
+ // https://archive.is/DYjAM
+ // https://support.mozilla.org/kb/deploying-firefox-with-extensions
+ // https://searchfox.org/firefox-main/rev/82e2435f/toolkit/mozapps/extensions/internal/AddonSettings.sys.mjs#125
+-pref("extensions.autoDisableScopes", 15, locked); // [DEFAULT - non-Thunderbird] Defense in depth, ensures sideloaded extensions are always disabled by default...
++pref("extensions.autoDisableScopes", 15); // [DEFAULT - non-Thunderbird] Defense in depth, ensures sideloaded extensions are always disabled by default...
+ pref("extensions.enabledScopes", 5); // [HIDDEN]
+ pref("extensions.installDistroAddons", false); // [HIDDEN - non-Android] [DEFAULT - Android]
+ pref("extensions.sideloadScopes", 0); // [HIDDEN]
+-- 
+2.52.0
+

robotnix/payton.nix

@@ -0,0 +1,13 @@
+{...}: {
+  flavor = "lineageos";
+
+  # motorola moto x4 (payton)
+  device = "payton";
+
+  # latest supported version:
+  # check https://download.lineageos.org/devices/payton/builds
+  flavorVersion = "22.2";
+
+  apps.fdroid.enable = true;
+  microg.enable = true;
+}

users/andromeda/home.nix

@@ -39,6 +39,7 @@ in {
       pkgs.grim
       pkgs.jmtpfs
       pkgs.nix-output-monitor
+      pkgs.npins
       pkgs.ranger
       pkgs.rip2
       pkgs.ripgrep
@@ -97,69 +98,18 @@ in {
         cfg.enableTridactylNative = true;
       };
       profiles.${config.home.username} = {
-        extensions.packages = [
+        extensions = {
+          force = true;
+          packages = [
             pkgs.nur.repos.rycee.firefox-addons.tridactyl
           ];
+        };
         search = {
-          default = "ddghtml";
+          default = "DuckDuckGo (HTML)";
-          privateDefault = "ddghtml";
+          privateDefault = "DuckDuckGo (HTML)";
           order = [
-            "wiki"
+            "DuckDuckGo (HTML)"
-            "options"
-            "packages"
-            "repos"
           ];
-          engines = {
-            "packages" = {
-              urls = [
-                {
-                  template = "https://search.nixos.org/packages";
-                  params = [
-                    {
-                      name = "channel";
-                      value = "unstable";
-                    }
-                    {
-                      name = "query";
-                      value = "{searchTerms}";
-                    }
-                  ];
-                }
-              ];
-            };
-
-            "options" = {
-              urls = [
-                {
-                  template = "https://search.nixos.org/options";
-                  params = [
-                    {
-                      name = "channel";
-                      value = "unstable";
-                    }
-                    {
-                      name = "query";
-                      value = "{searchTerms}";
-                    }
-                  ];
-                }
-              ];
-            };
-
-            "wiki" = {
-              urls = [
-                {
-                  template = "https://wiki.nixos.org/w/index.php";
-                  params = [
-                    {
-                      name = "search";
-                      value = "{searchTerms}";
-                    }
-                  ];
-                }
-              ];
-            };
-          };
         };
         settings = {
           "extensions.autoDisableScopes" = 0;