fix ssh

flake.lock

@@ -129,6 +129,27 @@
         "type": "github"
       }
     },
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1746728054,
+        "narHash": "sha256-eDoSOhxGEm2PykZFa/x9QG5eTH0MJdiJ9aR00VAofXE=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "ff442f5d1425feb86344c028298548024f21256d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "latest",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
@@ -412,6 +433,22 @@
         "type": "github"
       }
     },
+    "nix-zulip": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1764583012,
+        "narHash": "sha256-6ht4dtI1TBDAaB/Tatq+FcPexaZTBWuRiJGnioCDx5c=",
+        "ref": "refs/heads/main",
+        "rev": "a9dd0f80d775745f1d88055f24d944562db97c5e",
+        "revCount": 67,
+        "type": "git",
+        "url": "https://git.afnix.fr/nix-zulip/nix-zulip"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.afnix.fr/nix-zulip/nix-zulip"
+      }
+    },
     "nixos-mailserver": {
       "inputs": {
         "blobs": "blobs",
@@ -581,8 +618,10 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
+        "disko": "disko",
         "home-manager": "home-manager_2",
         "impermanence": "impermanence",
+        "nix-zulip": "nix-zulip",
         "nixos-mailserver": "nixos-mailserver",
         "nixpkgs": "nixpkgs",
         "noshell": "noshell",

flake.nix

@@ -4,6 +4,10 @@
       url = "github:ryantm/agenix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    disko = {
+      url = "github:nix-community/disko/latest";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     home-manager = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -14,6 +18,10 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    nix-zulip = {
+      url = "git+https://git.afnix.fr/nix-zulip/nix-zulip";
+      flake = false;
+    };
     noshell = {
       url = "github:viperML/noshell";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -37,10 +45,12 @@
   };
   outputs = {
     agenix,
+    disko,
     home-manager,
     impermanence,
     nixos-mailserver,
     nixpkgs,
+    nix-zulip,
     noshell,
     nur,
     nvf,
@@ -48,6 +58,7 @@
     stylix,
     ...
   }: let
+    nix-zulip' = (import "${nix-zulip}/nix/default.nix" {}).output;
     machines = import ./machines.nix;
     configuration = machine: modules:
       nixpkgs.lib.nixosSystem {
@@ -56,23 +67,30 @@
         modules =
           modules
           ++ [
-            ./machines/${machine.hostname}/configuration.nix
             ./users.nix
             ./secrets.nix
-            impermanence.nixosModules.impermanence
+            ./modules/nixos/common.nix
             agenix.nixosModules.default
+            disko.nixosModules.disko
+            impermanence.nixosModules.impermanence
             nixos-mailserver.nixosModule
+            noshell.nixosModules.default
             phoenix.nixosModules.default
-          ];
+            nix-zulip'.nixosModules.zulip
+            {
+              nixpkgs.overlays = [
+                agenix.overlays.default
+                nur.overlays.default
+                nix-zulip'.overlays.default
+              ];
+            }
+          ]
+          ++ machine.modules;
       };
     configurationWithHomeManager = machine: (configuration machine
       [
         home-manager.nixosModules.home-manager
         {
-          nixpkgs.overlays = [
-            agenix.overlays.default
-            nur.overlays.default
-          ];
           home-manager.useGlobalPkgs = true;
           home-manager.extraSpecialArgs = {inherit machine;};
           home-manager.users =
@@ -93,7 +111,6 @@
               )
             );
         }
-        noshell.nixosModules.default
       ]);
   in {
     nixosConfigurations =

machines.nix

@@ -2,14 +2,82 @@
   lenovo = {
     hostname = "lenovo";
     system = "x86_64-linux";
-    users = [
+    users = ["andromeda"];
-      "andromeda"
+    modules = [
-      "mtgmonkey"
+      # impermanence
+      ./modules/nixos/impermanence.nix
+      ./modules/nixos/impermanence-ssh.nix
+
+      # hardware configuration
+      # includes `system.stateVersion`
+      ./modules/nixos/machines/lenovo.nix
+
+      # boot process
+      # systemd-boot
+      ./modules/nixos/boot/lenovo.nix
+
+      # networking
+      ./modules/nixos/laptop.nix
+
+      # ly display manager
+      ./modules/nixos/ly.nix
+
+      # sway window manager
+      ./modules/nixos/sway.nix
+
+      # apps
+      ./modules/nixos/steam.nix
     ];
   };
   "109-199-104-83" = {
     hostname = "109-199-104-83";
     system = "x86_64-linux";
     users = [];
+    modules = [
+      # impermanence
+      ./modules/nixos/impermanence.nix
+      ./modules/nixos/impermanence-ssh.nix
+
+      # hardware configuration
+      # verbatim as `nixos-generate-config` AND `system.stateVersion`
+      ./modules/nixos/machines/109-199-104-83.nix
+      ./modules/nixos/disko/remote.nix
+
+      # boot process
+      # grub boot on /dev/sda
+      ./modules/nixos/boot/109-199-104-83.nix
+
+      # networking
+      ./modules/nixos/networking/domains/galaxious.de.nix
+      # uses cloud-init to network
+      ./modules/nixos/networking/networks/109-199-104-83.nix
+
+      # ssh through port 5522 among other things
+      # andromeda@lenovo is the only user allowed access
+      ./modules/nixos/networking/hard-ssh.nix
+      ./modules/nixos/networking/ssh-as-root.nix
+      ({config, ...}: {users.users.root.openssh.authorizedKeys.keys = [config.pub-keys.ssh.andromeda];})
+
+      # TODO add Impermanence to the following services
+
+      # simple-nixos-mailserver email server
+      # mail.domain
+      ./modules/nixos/mailserver.nix
+
+      # roundcube webmail client
+      # webmail.domain
+      ./modules/nixos/roundcube.nix
+
+      # forgejo
+      # git.domain
+      ./modules/nixos/forgejo.nix
+
+      # BROKEN
+      # zulip chat client
+      # chat.domain
+      # zulip chat server
+      # zulip.domain
+      # ./modules/nixos/zulip.nix
+    ];
   };
 }

machines/109-199-104-83/configuration.nix

@@ -1,90 +0,0 @@
-{
-  config,
-  modulesPath,
-  machine,
-  ...
-}: {
-  # roundcube config
-  services.roundcube = {
-    enable = true;
-    hostName = "webmail.${config.networking.domain}";
-    extraConfig = ''
-      $config['imap_host'] = "ssl://${config.mailserver.fqdn}";
-      $config['smtp_host'] = "ssl://${config.mailserver.fqdn}";
-      $config['smtp_user'] = "%u";
-      $config['smtp_pass'] = "%p";
-    '';
-  };
-
-  # mailserver config
-  mailserver = {
-    enable = true;
-    stateVersion = 3;
-    fqdn = "mail.${config.networking.domain}";
-    domains = ["${config.networking.domain}"];
-    x509.useACMEHost = config.mailserver.fqdn;
-    loginAccounts = {
-      "test@${config.networking.domain}" = {
-        hashedPasswordFile = builtins.toString config.age.secrets.secret3.path;
-      };
-    };
-  };
-
-  # cert config
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "mtgmonket@gmail.com";
-  };
-  services.nginx = {
-    enable = true;
-    virtualHosts."mail.${config.networking.domain}" = {
-      forceSSL = true;
-      enableACME = true;
-    };
-  };
-
-  # system config
-  system.stateVersion = "25.11";
-  nix.settings.experimental-features = ["flakes" "nix-command"];
-  imports = [(modulesPath + "/profiles/qemu-guest.nix")];
-  fileSystems."/" = {
-    device = "/dev/sda1";
-    fsType = "ext4";
-  };
-  boot.loader.grub.device = "/dev/sda";
-  boot.loader.timeout = 30;
-  boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "xen_blkfront"];
-  boot.initrd.kernelModules = ["nvme"];
-  boot.tmp.cleanOnBoot = true;
-  zramSwap.enable = true;
-  networking = {
-    useNetworkd = true;
-    usePredictableInterfaceNames = true;
-    hostName = machine.hostname;
-    domain = "galaxious.de";
-    firewall = {
-      enable = true;
-      allowedTCPPorts = [80 443];
-      allowedUDPPorts = [80 443];
-    };
-  };
-  systemd.network = {
-    enable = true;
-    networks."40-wan" = {
-      matchConfig.Name = "enx0050565f4fff";
-      address = ["2a02:c207:2299:8419::1/64" "109.199.104.83/20"];
-      routes = [
-        {
-          Gateway = "109.199.96.1";
-          GatewayOnLink = true;
-        }
-        {Gateway = "fe80::1";}
-      ];
-      dns = ["2620:fe::fe" "9.9.9.9"];
-    };
-  };
-  services.openssh.enable = true;
-  users.mutableUsers = false;
-  users.users.root.openssh.authorizedKeys.keys = [config.pub-keys.ssh.andromeda];
-  programs.noshell.enable = true;
-}

modules/nixos/boot/109-199-104-83.nix

@@ -0,0 +1,9 @@
+{
+  boot.loader.grub = {
+    efiSupport = true;
+    efiInstallAsRemovable = true;
+  };
+  age.identityPaths = [
+    "/persist/etc/ssh/ssh_host_ed25519_key"
+  ];
+}

modules/nixos/boot/lenovo.nix

@@ -0,0 +1,6 @@
+{
+  boot.loader = {
+    efi.canTouchEfiVariables = true;
+    systemd-boot.enable = true;
+  };
+}

modules/nixos/common.nix

@@ -0,0 +1,26 @@
+{
+  config,
+  lib,
+  ...
+}: {
+  # flakes usage
+  nix.settings.experimental-features = [
+    "flakes"
+    "nix-command"
+  ];
+
+  # allows users to customize shell in `$XDG_CONFIG_HOME/shell` rather than
+  # needing /etc/shells. Useful for home-manager. Falls back.
+  programs.noshell.enable = true;
+
+  # cleans /tmp to maintain a tidy system
+  boot.tmp.cleanOnBoot = true;
+
+  networking.domain = lib.mkDefault config.networking.hostName;
+
+  # disable lecture
+  security.sudo.extraConfig = ''Defaults lecture="never"'';
+
+  # make users immutable
+  users.mutableUsers = false;
+}

modules/nixos/disko/remote.nix

@@ -0,0 +1,64 @@
+{
+  disko.devices = {
+    disk = {
+      disk1 = {
+        device = "/dev/sda";
+        type = "disk";
+        content = {
+          type = "gpt";
+          partitions = {
+            # legacy boot
+            boot = {
+              name = "boot";
+              size = "1M";
+              type = "EF02";
+            };
+
+            # efi boot
+            esp = {
+              name = "ESP";
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+              };
+            };
+
+            # btrfs
+            # root is on nodev
+            root = {
+              size = "100%";
+              content = {
+                extraArgs = ["-f"]; # internet told me to, works
+                type = "btrfs";
+                subvolumes = {
+                  # nix store
+                  "/nix" = {
+                    mountpoint = "/nix";
+                  };
+
+                  # persistant directory
+                  "/persist" = {
+                    mountpoint = "/persist";
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+    nodev = {
+      # root
+      "/" = {
+        fsType = "tmpfs";
+        mountOptions = [
+          "defaults"
+          "mode=755" # stops security complaints
+        ];
+      };
+    };
+  };
+}

modules/nixos/forgejo.nix

@@ -0,0 +1,27 @@
+{config, ...}: {
+  services.nginx = {
+    virtualHosts.${config.services.forgejo.settings.server.DOMAIN} = {
+      forceSSL = true;
+      enableACME = true;
+      extraConfig = ''
+        client_max_body_size 512M
+      '';
+      locations."/".proxyPass = "https://localhost:${builtins.toString config.services.forgejo.settings.server.HTTP_PORT}";
+    };
+  };
+  services.forgejo = {
+    enable = true;
+    database.type = "postgres";
+    lfs.enable = true;
+    settings = {
+      server = rec {
+        DOMAIN = "git.galaxious.de";
+        ROOT_URL = "https://${DOMAIN}";
+        HTTP_PORT = 4043;
+        SSH_PORT = 4022;
+      };
+      service.DISABLE_REGISTRATION = false;
+    };
+  };
+  services.openssh.ports = [config.services.forgejo.settings.server.SSH_PORT];
+}

modules/nixos/impermanence-ssh.nix

@@ -0,0 +1,4 @@
+{
+  # ONLY include this module AFTER a machine has been provisioned
+  environment.persistence."/persist".directories = ["/etc/ssh"];
+}

modules/nixos/impermanence.nix

@@ -1,19 +1,15 @@
 {
-  environment.persistence."/nix/persist" = {
+  fileSystems."/persist".neededForBoot = true;
+  environment.persistence."/persist" = {
     enable = true;
     hideMounts = true;
     directories = [
       "/var/log"
-      "/var/lib/bluetooth"
       "/var/lib/nixos"
       "/var/lib/systemd/coredump"
-      "/etc/NetworkManager/system-connections"
-      "/etc/ssh"
-      "/etc/ly/custom-sessions"
     ];
     files = [
       "/etc/machine-id"
-      "/etc/ly/save.txt"
     ];
   };
 }

modules/nixos/laptop.nix

@@ -0,0 +1,37 @@
+{
+  # bluetooth
+  hardware.bluetooth = {
+    enable = true;
+    powerOnBoot = true;
+  };
+  services.blueman.enable = true;
+
+  # locale
+  i18n.defaultLocale = "de_DE.UTF-8";
+  time.timeZone = "Europe/Berlin";
+
+  # networking
+  networking = {
+    firewall.enable = true;
+    networkmanager.enable = true;
+  };
+
+  # misc
+  services = {
+    printing.enable = true;
+
+    # trackpad
+    libinput.enable = true;
+
+    # ssh
+    openssh.enable = true;
+  };
+
+  # impermanence
+  environment.persistence."/persist".directories = [
+    # bluetooth
+    "/var/lib/bluetooth"
+    # wifi connections
+    "/etc/NetworkManager/system-connections"
+  ];
+}

modules/nixos/ly.nix

@@ -0,0 +1,11 @@
+{
+  services.displayManager = {
+    enable = true;
+    ly.enable = true;
+  };
+  # TODO needs to be manually updated when new users added
+  environment.persistence."/persist" = {
+    directories = ["/etc/ly/custom-sessions"];
+    files = ["/etc/ly/save.txt"];
+  };
+}

modules/nixos/machines/109-199-104-83.nix

@@ -0,0 +1,25 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod"];
+  boot.initrd.kernelModules = [];
+  boot.kernelModules = [];
+  boot.extraModulePackages = [];
+
+  swapDevices = [];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+
+  system.stateVersion = "26.05";
+}

modules/nixos/machines/lenovo.nix

@@ -1,70 +1,17 @@
 {
   config,
   lib,
+  pkgs,
   modulesPath,
-  machine,
   ...
 }: {
-  imports = [
+  imports = [(modulesPath + "/installer/scan/not-detected.nix")];
-    ./impermanence.nix
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-  age.secrets = {
-    secret0.file = ../../secrets/secret0.age;
-    secret1.file = ../../secrets/secret1.age;
-  };
-  boot.loader = {
-    efi.canTouchEfiVariables = true;
-    systemd-boot.enable = true;
-  };
-  hardware.bluetooth = {
-    enable = true;
-    powerOnBoot = true;
-  };
-  i18n.defaultLocale = "de_DE.UTF-8";
-  networking = {
-    dhcpcd.enable = true;
-    firewall.enable = true;
-    hostName = machine.hostname;
-    networkmanager.enable = true;
-  };
-  nix.settings.experimental-features = [
-    "nix-command"
-    "flakes"
-  ];
-  nixpkgs.config.allowUnfreePredicate = pkg:
-    builtins.elem (lib.getName pkg) [
-      "steam"
-      "steam-original"
-      "steam-unwrapped"
-      "steam-run"
-    ];
-  programs = {
-    noshell.enable = true;
-    steam.enable = true;
-    sway.enable = true;
-  };
-  services = {
-    blueman.enable = true;
-    displayManager = {
-      enable = true;
-      ly.enable = true;
-    };
-    libinput.enable = true;
-    openssh.enable = true;
-    printing.enable = true;
-  };
-  system.stateVersion = "26.05";
-  time.timeZone = "Europe/Berlin";
   boot.initrd.availableKernelModules = ["xhci_pci" "nvme" "sdhci_pci"];
   boot.initrd.kernelModules = [];
   boot.kernelModules = ["kvm-intel"];
   boot.extraModulePackages = [];
 
   fileSystems."/" = {
-    #device = "none";
-    #fsType = "tmpfs";
-    #options = ["defaults" "size=60%" "mode=755"];
     device = "/dev/disk/by-uuid/5455cfb4-0efd-4f55-b496-d2cab3f419b7";
     fsType = "btrfs";
     options = ["subvol=root"];
@@ -92,12 +39,12 @@
     done
 
     btrfs subvolume create /btrfs_tmp/root
-    mkdir /btrfs_tmp/root/nix
+    mkdir /btrfs_tmp/root/persist
     mkdir /btrfs_tmp/root/etc
-    mount ${config.fileSystems."/nix".device} /btrfs_tmp/root/nix
+    mount ${config.fileSystems."/persist".device} /btrfs_tmp/root/persist -o subvol=persist
-    cp /btrfs_tmp/root/nix/persist/etc/ssh /btrfs_tmp/root/etc/ssh -r
+    cp /btrfs_tmp/root/persist/etc/ssh /btrfs_tmp/root/etc/ssh -r
-    umount /btrfs_tmp/root/nix
+    umount /btrfs_tmp/root/persist
-    rm -r /btrfs_tmp/root/nix
+    rm -r /btrfs_tmp/root/persist
     umount /btrfs_tmp
   '';
 
@@ -106,6 +53,12 @@
     fsType = "btrfs";
   };
 
+  fileSystems."/persist" = {
+    device = "/dev/disk/by-uuid/5455cfb4-0efd-4f55-b496-d2cab3f419b7";
+    fsType = "btrfs";
+    options = ["subvol=persist"];
+  };
+
   fileSystems."/boot" = {
     device = "/dev/disk/by-uuid/F425-55BA";
     fsType = "vfat";
@@ -116,4 +69,5 @@
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  system.stateVersion = "26.05";
 }

modules/nixos/mailserver.nix

@@ -0,0 +1,39 @@
+{config, ...}: {
+  mailserver = {
+    enable = true;
+    stateVersion = 3;
+    fqdn = "mail.${config.networking.domain}";
+    domains = ["${config.networking.domain}"];
+    x509.useACMEHost = config.mailserver.fqdn;
+    loginAccounts = {
+      "test@${config.networking.domain}" = {
+        hashedPasswordFile = builtins.toString config.age.secrets.mailserver-acc-test-pw.path;
+      };
+      "admin@${config.networking.domain}" = {
+        hashedPasswordFile = builtins.toString config.age.secrets.mailserver-acc-admin-pw.path;
+        aliases = ["@${config.networking.domain}"];
+      };
+    };
+  };
+  services.nginx = {
+    enable = true;
+    virtualHosts = {
+      "mail.${config.networking.domain}" = {
+        forceSSL = true;
+        enableACME = true;
+      };
+    };
+  };
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "mtgmonket@gmail.com";
+  };
+  environment.persistence."/persist" = {
+    directories = [
+      "/var/dkim"
+      "/var/vmail"
+      "/var/lib/redis-rspamd"
+      "/var/lib/acme"
+    ];
+  };
+}

modules/nixos/networking/domains/galaxious.de.nix

@@ -0,0 +1,3 @@
+{
+  networking.domain = "galaxious.de";
+}

modules/nixos/networking/hard-ssh.nix

@@ -0,0 +1,19 @@
+{
+  services.openssh = {
+    enable = true;
+    allowSFTP = false;
+    ports = [5522];
+    settings = {
+      PermitRootLogin = "no";
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = true;
+    };
+    extraConfig = ''
+      AllowTcpForwarding no
+      AllowAgentForwarding no
+      MaxAuthTries 3
+      MaxSessions 4
+      TCPKeepAlive no
+    '';
+  };
+}

modules/nixos/networking/networks/109-199-104-83.nix

@@ -0,0 +1,15 @@
+{
+  networking = {
+    useDHCP = false;
+    hostName = "109-199-104-83";
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [80 443];
+      allowedUDPPorts = [80 443];
+    };
+  };
+  services.cloud-init = {
+    enable = true;
+    network.enable = true;
+  };
+}

modules/nixos/networking/ssh-as-root.nix

@@ -0,0 +1,3 @@
+{lib, ...}: {
+  services.openssh.settings.PermitRootLogin = lib.mkForce "yes";
+}

modules/nixos/roundcube.nix

@@ -0,0 +1,16 @@
+{config, ...}: {
+  services.roundcube = {
+    enable = true;
+    hostName = "webmail.${config.networking.domain}";
+    extraConfig = ''
+      $config['imap_host'] = "ssl://${config.mailserver.fqdn}";
+      $config['smtp_host'] = "ssl://${config.mailserver.fqdn}";
+      $config['smtp_user'] = "%u";
+      $config['smtp_pass'] = "%p";
+    '';
+  };
+  environment.persistence."/persist".directories = [
+    "/var/lib/roundcube"
+    "/var/lib/postgresql"
+  ];
+}

modules/nixos/steam.nix

@@ -0,0 +1,10 @@
+{lib, ...}: {
+  nixpkgs.config.allowUnfreePredicate = pkg:
+    builtins.elem (lib.getName pkg) [
+      "steam"
+      "steam-original"
+      "steam-unwrapped"
+      "steam-run"
+    ];
+  programs.steam.enable = true;
+}

modules/nixos/sway.nix

@@ -0,0 +1,3 @@
+{
+  programs.sway.enable = true;
+}

modules/nixos/zulip.nix

@@ -0,0 +1,32 @@
+{config, ...}: {
+  services.zulip = {
+    enable = true;
+
+    # lets it set up my postgresql for me
+    enablePostgresqlLocally = true;
+
+    # host domain
+    host = "chat.${config.networking.domain}";
+
+    # secrets
+    camoKeyFile = builtins.toString config.age.secrets.zulip-camoKey.path;
+    rabbitmqPasswordFile = builtins.toString config.age.secrets.zulip-rabbitmqPassword.path;
+    secretKeyFile = builtins.toString config.age.secrets.zulip-secretKey.path;
+    sharedSecretKeyFile = builtins.toString config.age.secrets.zulip-sharedSecretKey.path;
+    avatarSaltKeyFile = builtins.toString config.age.secrets.zulip-avatarSaltKey.path;
+    extraSecrets = {
+      email_password = builtins.toString config.age.secrets.zulip-extraSecrets-email_password.path;
+    };
+
+    # settings
+    zulipSettings = rec {
+      EMAIL_USE_TLS = true;
+      EMAIL_PORT = 587;
+      ADD_TOKENS_TO_NOREPLY_ADDRESS = false;
+      NOREPLY_EMAIL_ADDRESS = ZULIP_ADMINISTRATOR;
+      OPEN_REALM_CREATION = true;
+      EXTERNAL_HOST = config.services.zulip.host;
+      ZULIP_ADMINISTRATOR = "admin@${config.networking.domain}";
+    };
+  };
+}

modules/template.nix

@@ -0,0 +1,11 @@
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [];
+  options = {};
+  config = {};
+}

pub-keys.nix

@@ -1,15 +1,22 @@
 {
   age.secrets = {
-    secret0.file = ./secrets/secret0.age;
+    andromeda-pw.file = ./secrets/andromeda-pw.age;
-    secret1.file = ./secrets/secret1.age;
+    mtgmonkey-pw.file = ./secrets/mtgmonkey-pw.age;
-    secret2.file = ./secrets/secret2.age;
+    mailserver-acc-test-pw.file = ./secrets/mailserver-acc-test-pw.age;
-    secret3.file = ./secrets/secret3.age;
+    mailserver-acc-admin-pw.file = ./secrets/mailserver-acc-admin-pw.age;
+    "mailserver-acc-zulip+admin-pw".file = ./secrets + "/mailserver-acc-zulip+admin-pw.age";
+    zulip-avatarSaltKey.file = ./secrets/zulip-avatarSaltKey.age;
+    zulip-camoKey.file = ./secrets/zulip-camoKey.age;
+    zulip-extraSecrets-email_password.file = ./secrets/zulip-extraSecrets-email_password.age;
+    zulip-rabbitmqPassword.file = ./secrets/zulip-rabbitmqPassword.age;
+    zulip-secretKey.file = ./secrets/zulip-secretKey.age;
+    zulip-sharedSecretKey.file = ./secrets/zulip-sharedSecretKey.age;
   };
   pub-keys = {
     ssh = {
       andromeda = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJy2VD362wUcu0lKj2d6OIU8dbAna0Lu/NaAYIj8gdIA andromeda@lenovo";
       lenovo = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHG4eqsLTq2os2mxfwhys3BpVnowcJrqt2CbRFzN2pJb root@lenovo";
-      _109-199-104-83 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJe5ol56yC23fivSEKeK4HZQm934ROX46AM7o0aE2hMq root@vmi2998419";
+      _109-199-104-83 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFD4kO9MhIHUiwYvX3VoFmDDTfWGesimrxUwFTmxTZ0D root@109-199-104-83";
     };
   };
 }

secrets/mailserver-acc-admin-pw.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg buCWpIVMGywNNngFQANXWWwzPCefsKayl1UHS3AY0Wc
+DHaaAaFg7CA09npMxqdMPtGb/0IviAZyFYXD5ALsdgk
+-> ssh-ed25519 UHxfvA 9YSvbT4oL7BjoFHVqO0rZgqmPl+bKX7peEYRdptAO3E
+OFyyFmYIXYyRVoVWYrQgjZ0mz66Cr1nwVeriAGAqsPo
+-> ssh-ed25519 ZES6hg DKddux+yxF4N1dXATOT4hhZXIs1+ajE4yvzNR0ZUQlI
+0e23BqxD/LrfMdbJPHuDfVnSbcnvEUHYDSlX60k/BoQ
+--- yRcytWZZF7qHGvO5Na0fjMFzeDUdaVRgpLomcN0bKsE
+<EFBFBD><EFBFBD><EFBFBD>%-<2D>kf32]<5D><><EFBFBD>j<0C>I<EFBFBD>i'<04>^]<5D><07><><EFBFBD><10>gF<67>V<EFBFBD>r<>j<19><03><>&<26><>BI5P<><50><EFBFBD>1<EFBFBD><31>F<EFBFBD>[<5B><><EFBFBD>BG<42><16><>l<EFBFBD>j%<25>*<2A><0F>p{<7B><><02>p<EFBFBD>6<17>r	^<5E><>p<EFBFBD>v<EFBFBD><76>

secrets/mailserver-acc-test-pw.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg xKR9bPGrd4bpdJEiP2n51SrEsG7ylsS5/ewD9WBr2WM
+WMyKGvjzZlNRsujnuFU1oklcd+IZD4gv1C7/5reMnLY
+-> ssh-ed25519 UHxfvA IWgm1Vn8nQEan2i9shbX8tSez/uIXTHDEO5eGXhLrSo
+e5uHHcdHru0zfhByA15AvOjhgoMqte/oaI1zkoUjjgg
+-> ssh-ed25519 ZES6hg sy+1upJggjItuGBgOZmXQwmF7joSAw8JSzH90UYIIng
+GS9GAZMT3hc+IfbUUquFaTM7Q57LSzxEUS95CjqB1Yg
+--- 4pW1Y7aE72Adf8Ru9YSB35gaTA0eoamnpyFlRLkBS3M
+4V8 b<>Z<EFBFBD>@<0C><><EFBFBD>D6<44>eE;<3B><>P<EFBFBD>a)<29>	C<>P<>Љ<EFBFBD><EFBFBD><7F>?<3F>BUQ<55>V#u<><75><0E>hgd<67><64><EFBFBD><EFBFBD>~Nm<4E><6D>&J<><4A><EFBFBD><EFBFBD><12><>^SH<>{<7B>M<EFBFBD>RF<52><46>Tx<54><78>g<EFBFBD>ή<EFBFBD>y,<2C>ͣ<EFBFBD>O

secrets/mailserver-acc-zulip+admin-pw.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg FckDPvAO+2LoXSeSdk98iOtLYddEJMdCuzUWHOuRn3Y
+gDxYp3LbyHuRIJRRr8Ax1nEbZvyzOFRYD22JuAZm91k
+-> ssh-ed25519 UHxfvA Cbu32dAgNSi6rHk9sfmPkSB1TGDZipxlXO+G5mz9SQA
+oU67uMNnAnrmFaC+IRuFykN05R3zfd1gvwKgt+BjA20
+-> ssh-ed25519 ZES6hg zovj1v3RgqL7ZzWvi9E4NN5ugdyNLXweC4z/F6544lI
+MnV7cWUcPxvckPbbwi+DsFokWPCuw83pWu1Zz4pHftQ
+--- zSHop8M98qVi6eCboZWh6j7zZCRNVQyJK3y+751Nd90
+<EFBFBD><02>K<EFBFBD>t<EFBFBD>w<EFBFBD>1<EFBFBD>
<01><><EFBFBD><EFBFBD>3<0B><19><>l<EFBFBD><6C><EFBFBD>1S̾<53>>P<16><>2<EFBFBD><32>#<23><><EFBFBD><0B>EpK<08><>E<EFBFBD>{Y<><59>J<EFBFBD><06>^<5E><>z<EFBFBD><1F><>V)@<0F>V^<5E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<EFBFBD><70><EFBFBD><EFBFBD><12><><EFBFBD><EFBFBD><EFBFBD>-(P<>O<EFBFBD>H<EFBFBD>$h<>

secrets/secret0.age

@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 mT2fyg 4fCTrNibFdjnVfsIbXi6plbd56K8ZDDqtgryXPk2SUA
-vKlbDi+HpyYlSsN39GRh6GRwdHRSjypCEqguOaHPFDM
--> ssh-ed25519 UHxfvA RqrDa4xJoAy1Gdzvq6Z5eTSNTDtHzUmzRoLC+j+HxiI
-+5CohUFSDB9oiLU0T25FKrQrz07DCviVuzZsVcUltOc
---- SQ5zQx9lL5UdNinOgP6yG5WWiBdhSwFqJVt6u3SNpLA
-<EFBFBD>6<EFBFBD><16><0B><>U<><55><EFBFBD>p<70><EE9087><EFBFBD><EFBFBD>Q<>]<5D>N<EFBFBD>;K;1y<31><79><EFBFBD>

secrets/secret3.age

@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 mT2fyg slLOkD/9TAYOuZ/g5U4NvPWUlmYZeie12xzggioviw0
-E0uAj4RMgv7DTJpvtEO54G9XHNLFOgFflR54Cl6/X8g
--> ssh-ed25519 UHxfvA xHFujOdegur0PLNHZP+h5RxHhVD2K906NZx7nprMkUs
-PdDxzD5QBdE/yWPMnF+CDGROEpE4nYvg12v1G3QK9XI
--> ssh-ed25519 Xoin5w YWsO9HtEFB79+aKr6eWi5Sg5geKfzT+IrDy2L5qEmx4
-sXLRmcRDyAv64nSGs8QXcHmKYO+F11Pzea1EVGmpEys
---- Sjg8SqkkEEL4X0G1GOUoHO702ZtrM0hMniIdS7yIsDA
-'<27>B<EFBFBD><42>(<28><>7Dϓ=<3D><>h<EFBFBD><10><>h	f<>ɮ<13>xT<78><54>!K.<2E><1D><>~س<>,<2C>ߓ<>D|<7C><>+p<><70><EFBFBD>"<22>t<EFBFBD><74>G<EFBFBD>y<EFBFBD>Q<EFBFBD><51>RcP<63>Q<EFBFBD><51>Q<><51>

secrets/secrets.nix

@@ -4,8 +4,22 @@ let
   lenovo = pub-keys.ssh.lenovo;
   _109-199-104-83 = pub-keys.ssh._109-199-104-83;
 in {
-  "secret0.age".publicKeys = [andromeda lenovo];
+  # user passwords
-  "secret1.age".publicKeys = [andromeda lenovo];
+  "andromeda-pw.age".publicKeys = [andromeda lenovo];
-  "secret2.age".publicKeys = [andromeda lenovo _109-199-104-83];
+  "mtgmonkey-pw.age".publicKeys = [andromeda lenovo];
-  "secret3.age".publicKeys = [andromeda lenovo _109-199-104-83];
+
+  # mail account passwords
+  "mailserver-acc-test-pw.age".publicKeys = [andromeda lenovo _109-199-104-83];
+  "mailserver-acc-admin-pw.age".publicKeys = [andromeda lenovo _109-199-104-83];
+  "mailserver-acc-zulip+admin-pw.age".publicKeys = [andromeda lenovo _109-199-104-83];
+
+  # zulip keys
+  "zulip-avatarSaltKey.age".publicKeys = [andromeda lenovo _109-199-104-83];
+  "zulip-camoKey.age".publicKeys = [andromeda lenovo _109-199-104-83];
+  "zulip-rabbitmqPassword.age".publicKeys = [andromeda lenovo _109-199-104-83];
+  "zulip-secretKey.age".publicKeys = [andromeda lenovo _109-199-104-83];
+  "zulip-sharedSecretKey.age".publicKeys = [andromeda lenovo _109-199-104-83];
+
+  # zulip-secrets.conf values
+  "zulip-extraSecrets-email_password.age".publicKeys = [andromeda lenovo _109-199-104-83];
 }

secrets/zulip-camoKey.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg WRvospjFKe1OruLGih6656ci9xufMEH4Rx0kva8/gQg
+e1b4rePZCaUG2Za47DYVVGvXAAR+llIlllZiiHzgBsU
+-> ssh-ed25519 UHxfvA 5P33StVyzPB+CTYHY5hHUfPN0sBzgIeFeWrc/VWBekg
+nqcbiVZFgC+3dcpbC7OHT7XFDdZymWx9d3uLUrvVvi4
+-> ssh-ed25519 ZES6hg wOuYIeGPeRa1uEcdsUfNEs2XepAPfKIHhPJNUx6ZPg0
+gVwyYcpH/LwXmhPHGLUXcre/FR2MTqAue1Azf5jESUc
+--- 3CMHIF8A8YAKdSfyYOsGqk/BcotL9o8WzM7ZHlqcQuM
+<EFBFBD>DF
l<><11><><EFBFBD>iY<69><59><EFBFBD><EFBFBD><EFBFBD><<10>S<EFBFBD><53>L<EFBFBD><4C><05><>jj<6A><6A>PЦ<10>Z<EFBFBD><5A><EFBFBD>t<EFBFBD><74><EFBFBD>xp<78>5<EFBFBD>
<P<><50><EFBFBD><EFBFBD><EFBFBD>g<EFBFBD><67>!<21><12><>GƂǻ

secrets/zulip-extraSecrets-email_password.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg CQp4TiQ6BcTSooH+LitGEl1sM/fVioJYwldMOf8zmmM
+54sVzmMwQcl88oldP6GO3Ow0EjTAVYbKT5OpPN7FvE0
+-> ssh-ed25519 UHxfvA mReulyDzGyiUDawgAphxmsalWlEMXEsn0Se6bFPKKko
+eWbx/QCT1P61UK5rKafpVCNf0zTKDQG+laK+FRbn+gY
+-> ssh-ed25519 ZES6hg 2Aca/70YNAiqM9Rxhq9kYap90zYfwiXDNL+FIupbyjs
+26GBrhF7aIMWnW5ndm64QLOXBbu04usQnQJ0GQKbgxc
+--- vKsAZM3qvpU0NSm98JcnGHBYIRIiP7bXBRliRnUdB8g
+<EFBFBD>

secrets/zulip-rabbitmqPassword.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg ql8WbEb0upNb8vi67sdsCHoU4AqGyUnDDv8uTJowTnc
+miQpsxN7uJAgvbzDV92zNE+iYJlfCzhiUSR6YlYv6Bc
+-> ssh-ed25519 UHxfvA c0B/trTLxmBtHjC/XXvdLVxG8ipAuy/SPtR3RJKK5wQ
+EbeCJJAlNZJD28V0if2hNfKrx+b5L3ry3neO9bCiEVs
+-> ssh-ed25519 ZES6hg a+efiHUVOHQOSH4xbAO4QL0OfKxbGtrpLAA/+/9xkGY
+rG7U16hCSG/i3O6hhzqgWezJfHKntfvB7CpTTaz3818
+--- +UoSwrL5gRW146WmG0fN6MbcFDnOw4LXka49DM0G8iQ
+<EFBFBD>,<2C>:<3A><><EFBFBD>J<EFBFBD><4A><EFBFBD>h#٘<>~y2<79>l<EFBFBD>o<EFBFBD><6F><EFBFBD><EFBFBD>]<17>w<>'jޫ<6A>n<EFBFBD><6E>,=k7<16>_<EFBFBD><5F><EFBFBD>o<1D>I<EFBFBD>,{e<><1B>uO˵
3<><33><EFBFBD><EFBFBD>

secrets/zulip-secretKey.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg jU25ilZ9AIrS/WpbsBxU/kN8EcithKE6Z7jB8dNLmXk
+oYckdlcxWhdg/StBGzdV97Ujjc2ktltwXMRy0o10dt0
+-> ssh-ed25519 UHxfvA P4pYzHg9i+7SaTZZy59ircTrqiddDXRMZ+JbYjh0/xM
+nKSlJxK4T5Fm58FZOBHXRY1tBNimCFzrao/iEcxhh7Q
+-> ssh-ed25519 ZES6hg vfktXc5T5AD5gBls5lTFjlTfiRQixjdsC/8EDpdIt0M
+bLlWaLTp4lfbeXXYC/1fZyZmxzVYzitN9z1aHJLRWTU
+--- jM21NUVJP6HhbWtaYJJYDN3fQqA+bCYqB+C1NP74lZ4
+<EFBFBD>f<EFBFBD><13>
<1D>f<EFBFBD>klHq
<19>P:<10><><EFBFBD>bü<62><C3BC><EFBFBD>d<EFBFBD><64>۔<EFBFBD>
+\^<5E>,|<7C><><EFBFBD>*<2A>U"qa<71>Ú<EFBFBD>e)<29>9E<39>/\<5C>s,&\<07>^q<19><><EFBFBD>;fF6̵Ղ\ou<6F>.<2E>]dqƱ<71><C6B1><EFBFBD>

secrets/zulip-sharedSecretKey.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg ioFu/NKHKDtMHDbBB+C9RnsTfC7XNAGivomvwxdJpyg
+wbQgZJ5sp1J/Lv+MNVs1zdMCfo6jo6tEorRNTCW8TsQ
+-> ssh-ed25519 UHxfvA 21tOMm30A/uKvcBNlrJnth2+uR1Kqt4T3BtYBCW8Nh0
+ud8I5kQKh9mAqWuyGMVhTRN6GCfsDSCPHqB9DMXPiJA
+-> ssh-ed25519 ZES6hg dmY4019lEjff3ojGTNudeHv9QObI2EhINzi+xPeOPn8
+6TN6K5m6deDOMHPSyBXJvyqRHyOmgr9g0HaKFquA5pU
+--- 6lDuIjLGhP1jd87YBKuQ3yV7Fh4oUfyjxFn/Wc0195M
+! <20>	|<7C>S<EFBFBD>o<EFBFBD>W%_R<5F>%HR<48><52><EFBFBD><EFBFBD>޷o<1A><><EFBFBD><EFBFBD>Z<EFBFBD>ֈb(<0C><><EFBFBD><EFBFBD><EFBFBD>9b<39>X<EFBFBD>J<EFBFBD>^<5E>{w<><77>3<EFBFBD><33><EFBFBD>P<EFBFBD>M~k<><6B><EFBFBD><EFBFBD>ڢ~<7E>Gȉ<47><C889>k~<7E>

users.nix

@@ -13,30 +13,14 @@ in {
       "andromeda" = {
         isNormalUser = true;
         description = "andromeda";
-        hashedPasswordFile = builtins.toString config.age.secrets.secret0.path;
+        hashedPasswordFile = builtins.toString config.age.secrets.andromeda-pw.path;
         extraGroups = [
           "networkmanager"
           "wheel"
         ];
       };
-      "mtgmonkey" = {
-        isNormalUser = true;
-        description = "mtgmonkey";
-        hashedPasswordFile = builtins.toString config.age.secrets.secret1.path;
-        extraGroups = [
-          (lib.mkIf
-            (machine == machines.lenovo)
-            "networkmanager")
-          "wheel"
-        ];
-        openssh.authorizedKeys.keys = [
-          (lib.mkIf
-            (machine == machines."109-199-104-83")
-            config.pub-keys.ssh.andromeda)
-        ];
-      };
     };
-  environment.persistence."/nix/persist".users = lib.mkIf config.environment.persistence."/nix/persist".enable (
+  environment.persistence."/persist".users = lib.mkIf config.environment.persistence."/persist".enable (
     builtins.mapAttrs
     (name: value: lib.mkIf (builtins.elem name machine.users) value)
     {
@@ -45,7 +29,7 @@ in {
           ".backups"
           ".local/share/Anki2"
           ".local/share/chat.fluffy.fluffychat"
-          ".local/share.zoxide"
+          ".local/share/zoxide"
           ".ssh"
           "conf"
           "Downloads"
@@ -56,16 +40,6 @@ in {
           ".brush_history"
         ];
       };
-      "mtgmonkey" = {
-        directories = [
-          ".local/share/zoxide"
-          ".ssh"
-        ];
-        files = [
-          ".bash_history"
-          ".brush_history"
-        ];
-      };
     }
   );
 }

users/andromeda/home.nix

@@ -16,82 +16,6 @@
         "${config.home.homeDirectory}/${background-path}"
       ];
     };
-  sway_config' = builtins.toFile "sway_config" ''
-    set $mod Mod4
-    set $left h
-    set $down j
-    set $up k
-    set $right l
-    set $term alacritty
-    set $menu wmenu-run
-    set $screenshot grim -g "$(slurp)"
-    floating_modifier $mod normal
-
-    workspace_layout stacking
-    output * bg ${config.home.homeDirectory}/${background-path} fill
-
-    # launch programs
-    bindsym $mod+Shift+Return exec $term
-    bindsym $mod+Shift+d exec $menu
-    bindsym $mod+Shift+a exec anki
-    bindsym $mod+Shift+q exec librewolf
-    bindsym $mod+Shift+s exec $screenshot
-
-    bindsym $mod+Shift+c kill
-
-    bindsym $mod+Shift+r reload
-
-    bindsym $mod+Shift+Alt+q exit
-
-    bindsym $mod+$left focus left
-    bindsym $mod+$down focus down
-    bindsym $mod+$up focus up
-    bindsym $mod+$right focus right
-
-    bindsym $mod+Shift+$left move left
-    bindsym $mod+Shift+$down move down
-    bindsym $mod+Shift+$up move up
-    bindsym $mod+Shift+$right move right
-
-    bindsym $mod+1 workspace number 1
-    bindsym $mod+2 workspace number 2
-    bindsym $mod+3 workspace number 3
-    bindsym $mod+4 workspace number 4
-    bindsym $mod+5 workspace number 5
-    bindsym $mod+6 workspace number 6
-    bindsym $mod+7 workspace number 7
-    bindsym $mod+8 workspace number 8
-    bindsym $mod+9 workspace number 9
-    bindsym $mod+0 workspace number 0
-
-    bindsym $mod+Shift+1 move container to workspace number 1
-    bindsym $mod+Shift+2 move container to workspace number 2
-    bindsym $mod+Shift+3 move container to workspace number 3
-    bindsym $mod+Shift+4 move container to workspace number 4
-    bindsym $mod+Shift+5 move container to workspace number 5
-    bindsym $mod+Shift+6 move container to workspace number 6
-    bindsym $mod+Shift+7 move container to workspace number 7
-    bindsym $mod+Shift+8 move container to workspace number 8
-    bindsym $mod+Shift+9 move container to workspace number 9
-    bindsym $mod+Shift+0 move container to workspace number 0
-
-    bindsym $mod+f fullscreen
-    bindsym $mod+Shift+space floating toggle
-    bindsym $mod+Shift+minus move scratchpad
-    bindsym $mod+minus scratchpad show
-
-    bindsym --locked XF86AudioMute exec pactl set-sink-mute \@DEFAULT_SINK@ toggle
-    bindsym --locked XF86AudioLowerVolume exec pactl set-sink-volume \@DEFAULT_SINK@ -5%
-    bindsym --locked XF86AudioRaiseVolume exec pactl set-sink-volume \@DEFAULT_SINK@ +5%
-    bindsym --locked XF86AudioMicMute exec pact set-source-mute \@DEFAULT_SOURCE@ toggle
-    bindsym --locked XF86MonBrightnessDown exec brightnessctl set 5%-
-    bindsym --locked XF86MonbrightnessUp exec brightnessctl set 5%+
-
-    default_border none
-    font pango:monospace 0.001
-    titlebar_border_thickness 0
-    titlebar_padding 0
-  '';
 in {
   imports = [./stylix.nix];
   xdg.configFile."shell".source = lib.getExe pkgs.brush;

users/mtgmonkey/home.nix

@@ -1,172 +0,0 @@
-{
-  config,
-  lib,
-  machine,
-  pkgs,
-  ...
-}: {
-  imports = [./stylix.nix];
-  xdg.configFile."shell".source = lib.getExe pkgs.brush;
-  home = {
-    username = "mtgmonkey";
-    homeDirectory = "/home/${config.home.username}";
-    stateVersion = "26.05";
-    packages = [
-      pkgs.acpi
-      pkgs.brightnessctl
-      pkgs.brush
-      pkgs.dust
-      pkgs.fzf
-      pkgs.glow
-      pkgs.jmtpfs
-      pkgs.nix-output-monitor
-      pkgs.ranger
-      pkgs.rip2
-      pkgs.ripgrep
-      pkgs.tree
-      pkgs.zoxide
-    ];
-  };
-  programs = {
-    bash = {
-      enable = true;
-      shellAliases = {
-        neofetch = "fastfetch";
-        ls = lib.mkForce "lsd";
-        ll = lib.mkForce "lsd -l";
-        l = "lsd -la";
-        cd = "z";
-        gg = "git log --oneline --abbrev-commit --all --graph --decorate --color";
-        md = "glow";
-      };
-      bashrcExtra = ''
-        PS1="\u@\h:\w$"
-        eval "$(zoxide init bash)"
-      '';
-    };
-    btop = {
-      enable = true;
-      settings = {
-        theme_background = false;
-        vim_keys = true;
-        rounded_corners = false;
-        graph_symbol = "braille";
-        update_ms = 150;
-        proc_sorting = "cpu lazy";
-        proc_gradient = false;
-        proc_left = true;
-        cpu_single_graph = true;
-        cpu_bottom = true;
-        clock_format = "/user@/host:/uptime@%H:%M";
-        background_update = true;
-        mem_graphs = false;
-        mem_below_net = true;
-        show_swap = false;
-        only_physical = true;
-        show_io_stat = true;
-        io_mode = false;
-        io_graph_combined = false;
-      };
-    };
-    fastfetch.enable = true;
-    git = {
-      enable = true;
-      settings = {
-        user = {
-          name = config.home.username;
-          email = "${config.home.username}@${machine.hostname}";
-        };
-        init.defaultBranch = "master";
-      };
-    };
-    gh.enable = true;
-    home-manager.enable = true;
-    lsd.enable = true;
-    nvf = {
-      enable = true;
-      settings.vim = {
-        autocomplete.nvim-cmp.enable = false;
-        formatter.conform-nvim = {
-          enable = true;
-          setupOpts.format_on_save = {
-            lsp_format = "fallback";
-            timeout_ms = 5000;
-          };
-        };
-        lsp.otter-nvim.enable = true;
-        git.enable = true;
-        keymaps = [
-          {
-            key = "<Down>";
-            mode = ["i" "n" "v" "c"];
-            action = "<NOP>";
-          }
-          {
-            key = "<Up>";
-            mode = ["i" "n" "v" "c"];
-            action = "<NOP>";
-          }
-          {
-            key = "<Left>";
-            mode = ["i" "n" "v" "c"];
-            action = "<NOP>";
-          }
-          {
-            key = "<Right>";
-            mode = ["i" "n" "v" "c"];
-            action = "<NOP>";
-          }
-          {
-            key = "jj";
-            mode = ["i"];
-            action = "<Esc>";
-          }
-          {
-            key = "kk";
-            mode = ["i"];
-            action = "<Esc>";
-          }
-          {
-            key = "jk";
-            mode = ["i"];
-            action = "<Esc>";
-          }
-          {
-            key = "kj";
-            mode = ["i"];
-            action = "<Esc>";
-          }
-          {
-            key = "<Esc>";
-            mode = ["i"];
-            action = "<Nop>";
-          }
-        ];
-        languages = {
-          nix = {
-            enable = true;
-            format.enable = true;
-            lsp.enable = true;
-          };
-          haskell = {
-            enable = true;
-            lsp.enable = true;
-          };
-        };
-        lineNumberMode = "relative";
-        options = {
-          tabstop = 2;
-          shiftwidth = 2;
-          expandtab = true;
-          smarttab = true;
-          foldmethod = "indent";
-          number = true;
-          colorcolumn = "80";
-        };
-        statusline.lualine.enable = true;
-        syntaxHighlighting = true;
-      };
-    };
-    ssh.enable = true;
-  };
-}

users/mtgmonkey/stylix.nix

@@ -1,29 +0,0 @@
-{
-  pkgs,
-  config,
-  ...
-}: {
-  stylix = {
-    enable = true;
-    # rebecca has lavener bkg
-    # tube has dark gray bkg
-    # silk-light is light theme
-    base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-material-dark-hard.yaml";
-    polarity = "dark";
-    fonts = {
-      monospace = {
-        package = pkgs.miracode;
-        name = "Miracode";
-      };
-      serif = config.stylix.fonts.sansSerif;
-      emoji = {
-        package = pkgs.noto-fonts-color-emoji;
-        name = "Noto Color Emoji";
-      };
-      sizes = {
-        applications = 12;
-        terminal = 10;
-      };
-    };
-  };
-}