bump anki-cli

.gitignore

@@ -0,0 +1,2 @@
+result*
+.gcroots

README.md

@@ -1,3 +1,5 @@
+see TODO.md for my aspirations
+
 ## usage
 
 ### install

TODO.md

@@ -0,0 +1,20 @@
+- add other remote
+- fully automate remote provisioning (remote keys)
+- fix ipv6 on remotes
+- modularize home manager
+- add services?
+    - 0x0
+    - forgejo
+    - matrix homeserver
+    - matrix webclient
+    - radicale
+    - tor relay
+    - wireguard as vpn
+- add home functionality
+    - better term emulator
+    - switch browser?
+        - chromium: much better sandboxing
+        - ladybird: be an early tester, contribute
+        - glide: sexier tridactyl implementation
+        - browsh: the GOAT
+    - get mouse out of here

flake.lock

@@ -10,11 +10,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1762618334,
-        "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=",
+        "lastModified": 1770165109,
+        "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "fcdea223397448d35d9b31f798479227e80183f6",
+        "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb",
         "type": "github"
       },
       "original": {
@@ -23,6 +23,28 @@
         "type": "github"
       }
     },
+    "anki-cli": {
+      "inputs": {
+        "fenix": "fenix",
+        "naersk": "naersk",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1776540672,
+        "narHash": "sha256-D43SN81mM21icdtK/9JDwaXsIhFv+gm4G8KXhJDCxsQ=",
+        "ref": "refs/heads/master",
+        "rev": "bcd83506ea691861562ade66ce23f57b27e57ee2",
+        "revCount": 12,
+        "type": "git",
+        "url": "https://git.mtgmonkey.net/Andromeda/anki-cli.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.mtgmonkey.net/Andromeda/anki-cli.git"
+      }
+    },
     "base16": {
       "inputs": {
         "fromYaml": "fromYaml"
@@ -129,14 +151,59 @@
         "type": "github"
       }
     },
+    "fenix": {
+      "inputs": {
+        "nixpkgs": [
+          "anki-cli",
+          "nixpkgs"
+        ],
+        "rust-analyzer-src": "rust-analyzer-src"
+      },
+      "locked": {
+        "lastModified": 1776153734,
+        "narHash": "sha256-QvkVX4Go+BnNgQQLc5Ma3WNBZOG5Jpdqsy8Ri0/CbSQ=",
+        "owner": "nix-community",
+        "repo": "fenix",
+        "rev": "a8b0e62fb39299fbeb1aa365f4b57e2c258a178e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "fenix",
+        "type": "github"
+      }
+    },
+    "fenix_2": {
+      "inputs": {
+        "nixpkgs": [
+          "anki-cli",
+          "naersk",
+          "nixpkgs"
+        ],
+        "rust-analyzer-src": "rust-analyzer-src_2"
+      },
+      "locked": {
+        "lastModified": 1752475459,
+        "narHash": "sha256-z6QEu4ZFuHiqdOPbYss4/Q8B0BFhacR8ts6jO/F/aOU=",
+        "owner": "nix-community",
+        "repo": "fenix",
+        "rev": "bf0d6f70f4c9a9cf8845f992105652173f4b617f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "fenix",
+        "type": "github"
+      }
+    },
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
-        "lastModified": 1764724327,
-        "narHash": "sha256-OkFLrD3pFR952TrjQi1+Vdj604KLcMnkpa7lkW7XskI=",
+        "lastModified": 1764873433,
+        "narHash": "sha256-1XPewtGMi+9wN9Ispoluxunw/RwozuTRVuuQOmxzt+A=",
         "owner": "rafaelmardojai",
         "repo": "firefox-gnome-theme",
-        "rev": "66b7c635763d8e6eb86bd766de5a1e1fbfcc1047",
+        "rev": "f7ffd917ac0d253dbd6a3bf3da06888f57c69f92",
         "type": "github"
       },
       "original": {
@@ -148,15 +215,15 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1761588595,
-        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
-        "owner": "edolstra",
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
         "repo": "flake-compat",
-        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
         "type": "github"
       },
       "original": {
-        "owner": "edolstra",
+        "owner": "NixOS",
         "repo": "flake-compat",
         "type": "github"
       }
@@ -180,15 +247,58 @@
     "flake-parts": {
       "inputs": {
         "nixpkgs-lib": [
+          "nur",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1765835352,
-        "narHash": "sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw=",
+        "lastModified": 1733312601,
+        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "a34fae9c08a15ad73f295041fec82323541400a9",
+        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "nvf",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1769996383,
+        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_3": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "stylix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1767609335,
+        "narHash": "sha256-feveD98mQpptwrAEggBQKJTYbvwwglSbOv53uCfH9PY=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "250481aafeb741edfe23d29195671c19b36b6dca",
         "type": "github"
       },
       "original": {
@@ -226,11 +336,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763988335,
-        "narHash": "sha256-QlcnByMc8KBjpU37rbq5iP7Cp97HvjRP0ucfdh+M4Qc=",
+        "lastModified": 1772893680,
+        "narHash": "sha256-JDqZMgxUTCq85ObSaFw0HhE+lvdOre1lx9iI6vYyOEs=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "50b9238891e388c9fdc6a5c49e49c42533a1b5ce",
+        "rev": "8baab586afc9c9b57645a734c820e4ac0a604af9",
         "type": "github"
       },
       "original": {
@@ -265,11 +375,11 @@
       "flake": false,
       "locked": {
         "host": "gitlab.gnome.org",
-        "lastModified": 1764524476,
-        "narHash": "sha256-bTmNn3Q4tMQ0J/P0O5BfTQwqEnCiQIzOGef9/aqAZvk=",
+        "lastModified": 1767737596,
+        "narHash": "sha256-eFujfIUQDgWnSJBablOuG+32hCai192yRdrNHTv0a+s=",
         "owner": "GNOME",
         "repo": "gnome-shell",
-        "rev": "c0e1ad9f0f703fd0519033b8f46c3267aab51a22",
+        "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
         "type": "gitlab"
       },
       "original": {
@@ -308,11 +418,32 @@
         ]
       },
       "locked": {
-        "lastModified": 1766980997,
-        "narHash": "sha256-oegDNAvyQwaG3GqSi4U5jpKM7SYHGESGVIuKMRV/lbw=",
+        "lastModified": 1774007980,
+        "narHash": "sha256-FOnZjElEI8pqqCvB6K/1JRHTE8o4rer8driivTpq2uo=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7a7b43c7231a439d248179ba8d561dd6cd81799b",
+        "rev": "9670de2921812bc4e0452f6e3efd8c859696c183",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager_3": {
+      "inputs": {
+        "nixpkgs": [
+          "impermanence",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1768598210,
+        "narHash": "sha256-kkgA32s/f4jaa4UG+2f8C225Qvclxnqs76mf8zvTVPg=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "c47b2cc64a629f8e075de52e4742de688f930dc6",
         "type": "github"
       },
       "original": {
@@ -322,12 +453,16 @@
       }
     },
     "impermanence": {
+      "inputs": {
+        "home-manager": "home-manager_3",
+        "nixpkgs": "nixpkgs"
+      },
       "locked": {
-        "lastModified": 1737831083,
-        "narHash": "sha256-LJggUHbpyeDvNagTUrdhe/pRVp4pnS6wVKALS782gRI=",
+        "lastModified": 1769548169,
+        "narHash": "sha256-03+JxvzmfwRu+5JafM0DLbxgHttOQZkUtDWBmeUkN8Y=",
         "owner": "nix-community",
         "repo": "impermanence",
-        "rev": "4b3e914cdf97a5b536a889e939fb2fd2b043a170",
+        "rev": "7b1d382faf603b6d264f58627330f9faa5cba149",
         "type": "github"
       },
       "original": {
@@ -338,11 +473,11 @@
     },
     "mnw": {
       "locked": {
-        "lastModified": 1758834834,
-        "narHash": "sha256-Y7IvY4F8vajZyp3WGf+KaiIVwondEkMFkt92Cr9NZmg=",
+        "lastModified": 1770419553,
+        "narHash": "sha256-b1XqsH7AtVf2dXmq2iyRr2NC1yG7skY7Z6N2MpWHlK4=",
         "owner": "Gerg-L",
         "repo": "mnw",
-        "rev": "cfbc7d1cc832e318d0863a5fc91d940a96034001",
+        "rev": "2aaffa8030d0b262176146adbb6b0e6374ce2957",
         "type": "github"
       },
       "original": {
@@ -351,24 +486,66 @@
         "type": "github"
       }
     },
-    "ndg": {
+    "naersk": {
       "inputs": {
-        "nixpkgs": "nixpkgs_2"
+        "fenix": "fenix_2",
+        "nixpkgs": [
+          "anki-cli",
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1765720983,
-        "narHash": "sha256-tWtukpABmux6EC/FuCJEgA1kmRjcRPtED44N+GGPq+4=",
+        "lastModified": 1776193198,
+        "narHash": "sha256-U4w4GpgYt72z8pBKMDaqzlnPJRxI9pn+8tr7SOAxocE=",
+        "owner": "nix-community",
+        "repo": "naersk",
+        "rev": "e4e2ee6c9af67ecd4abb102fc32b9e49c70d92ff",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "naersk",
+        "type": "github"
+      }
+    },
+    "ndg": {
+      "inputs": {
+        "nixpkgs": [
+          "nvf",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1768214250,
+        "narHash": "sha256-hnBZDQWUxJV3KbtvyGW5BKLO/fAwydrxm5WHCWMQTbw=",
         "owner": "feel-co",
         "repo": "ndg",
-        "rev": "f399ace8bb8e1f705dd8942b24d207aa4d75c936",
+        "rev": "a6bd3c1ce2668d096e4fdaaa03ad7f03ba1fbca8",
         "type": "github"
       },
       "original": {
         "owner": "feel-co",
+        "ref": "refs/tags/v2.6.0",
         "repo": "ndg",
         "type": "github"
       }
     },
+    "nix-zulip": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1772926346,
+        "narHash": "sha256-fk8lfYmpXtBLzpJb9f97fYzKXcNflA5CYdYEJD1SDoY=",
+        "ref": "refs/heads/main",
+        "rev": "995e67ff510f413bd0d21af2137159c283223985",
+        "revCount": 80,
+        "type": "git",
+        "url": "https://git.afnix.fr/nix-zulip/nix-zulip"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.afnix.fr/nix-zulip/nix-zulip"
+      }
+    },
     "nixos-mailserver": {
       "inputs": {
         "blobs": "blobs",
@@ -379,11 +556,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766321686,
-        "narHash": "sha256-icOWbnD977HXhveirqA10zoqvErczVs3NKx8Bj+ikHY=",
+        "lastModified": 1774001769,
+        "narHash": "sha256-6y8yLrMecnFq21wFlUSxHF7OsabVCCj2p104HEUosvI=",
         "owner": "simple-nixos-mailserver",
         "repo": "nixos-mailserver",
-        "rev": "7d433bf89882f61621f95082e90a4ab91eb0bdd3",
+        "rev": "05968d7978faaa501836d6d2eb7f6cffb4140829",
         "type": "gitlab"
       },
       "original": {
@@ -394,11 +571,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1766651565,
-        "narHash": "sha256-QEhk0eXgyIqTpJ/ehZKg9IKS7EtlWxF3N7DXy42zPfU=",
+        "lastModified": 1768564909,
+        "narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "3e2499d5539c16d0d173ba53552a4ff8547f4539",
+        "rev": "e4bae1bd10c9c57b2cf517953ab70060a828ee6f",
         "type": "github"
       },
       "original": {
@@ -410,55 +587,33 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1764242076,
-        "narHash": "sha256-sKoIWfnijJ0+9e4wRvIgm/HgE27bzwQxcEmo2J/gNpI=",
-        "owner": "NixOS",
+        "lastModified": 1773821835,
+        "narHash": "sha256-TJ3lSQtW0E2JrznGVm8hOQGVpXjJyXY2guAxku2O9A4=",
+        "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "2fad6eac6077f03fe109c4d4eb171cf96791faa4",
+        "rev": "b40629efe5d6ec48dd1efba650c797ddbd39ace0",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
+        "owner": "nixos",
         "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
-    "noshell": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1717396029,
-        "narHash": "sha256-NPIhvnTYkJZqTY+aabbZ6CAaMAgG6IISvh7GZo1MTfQ=",
-        "owner": "viperML",
-        "repo": "noshell",
-        "rev": "4d194d838a50ea106cd0e47c024e47afc154ab42",
-        "type": "github"
-      },
-      "original": {
-        "owner": "viperML",
-        "repo": "noshell",
-        "type": "github"
-      }
-    },
     "nur": {
       "inputs": {
-        "flake-parts": [
-          "flake-parts"
-        ],
+        "flake-parts": "flake-parts",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1767026366,
-        "narHash": "sha256-TqJXPpEPYfeFCbraquNdrB1dJYuEqV474Npv8UcNxrs=",
+        "lastModified": 1774121134,
+        "narHash": "sha256-2rY/WUuZEtQ7St3AcFw6dri4oYyBJvr/dnZdpOPe1oM=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "1f8c02a96c58c0dd90f2de45440b9ef01571abc3",
+        "rev": "4fe0420f495cdcd730969de67f75f44d2a5bb71f",
         "type": "github"
       },
       "original": {
@@ -479,11 +634,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764773531,
-        "narHash": "sha256-mCBl7MD1WZ7yCG6bR9MmpPO2VydpNkWFgnslJRIT1YU=",
+        "lastModified": 1767810917,
+        "narHash": "sha256-ZKqhk772+v/bujjhla9VABwcvz+hB2IaRyeLT6CFnT0=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "1d9616689e98beded059ad0384b9951e967a17fa",
+        "rev": "dead29c804adc928d3a69dfe7f9f12d0eec1f1a4",
         "type": "github"
       },
       "original": {
@@ -495,9 +650,7 @@
     "nvf": {
       "inputs": {
         "flake-compat": "flake-compat_2",
-        "flake-parts": [
-          "flake-parts"
-        ],
+        "flake-parts": "flake-parts_2",
         "mnw": "mnw",
         "ndg": "ndg",
         "nixpkgs": [
@@ -506,11 +659,11 @@
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1766596669,
-        "narHash": "sha256-9C72hpMDa99n4MbqZqsBkrBQZe+HEN9lnu7Sme67nmU=",
+        "lastModified": 1774109759,
+        "narHash": "sha256-Ksvw+R+kwCr+liA4h+TtQaYSW/0Jl+NDMThU5TBsJIY=",
         "owner": "notashelf",
         "repo": "nvf",
-        "rev": "ef1f22efaf4aa37ba9382a7d1807fa8ac9c097fd",
+        "rev": "4f1074084eb86e8d8a32e19e78f3cf2adba0213e",
         "type": "github"
       },
       "original": {
@@ -526,11 +679,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766543224,
-        "narHash": "sha256-96PBoNqh3sPU9t+IXxcB1OjjuQ8HOv42OOh9UtwFHbU=",
+        "lastModified": 1774120611,
+        "narHash": "sha256-QZ09cfZnPiF62BgNqVTxEbFtnBjYaBVuhZNdos9ggnE=",
         "owner": "celenityy",
         "repo": "Phoenix",
-        "rev": "f09568c8a71af4fe42dd43c6f711c67daf605f1e",
+        "rev": "df5a6d30c792c0b17017510b35db93e94fb9e6a1",
         "type": "github"
       },
       "original": {
@@ -542,18 +695,52 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
-        "flake-parts": "flake-parts",
+        "anki-cli": "anki-cli",
         "home-manager": "home-manager_2",
         "impermanence": "impermanence",
+        "nix-zulip": "nix-zulip",
         "nixos-mailserver": "nixos-mailserver",
-        "nixpkgs": "nixpkgs",
-        "noshell": "noshell",
+        "nixpkgs": "nixpkgs_2",
         "nur": "nur",
         "nvf": "nvf",
         "phoenix": "phoenix",
         "stylix": "stylix"
       }
     },
+    "rust-analyzer-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1776115521,
+        "narHash": "sha256-N/R1//Xd8vr84LtyTy8CVz7V2n9NJXXlJEODSunLE9c=",
+        "owner": "rust-lang",
+        "repo": "rust-analyzer",
+        "rev": "5205b52ea60dd49c7e33dd2ad1a3e7ef55bb30ec",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rust-lang",
+        "ref": "nightly",
+        "repo": "rust-analyzer",
+        "type": "github"
+      }
+    },
+    "rust-analyzer-src_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1752428706,
+        "narHash": "sha256-EJcdxw3aXfP8Ex1Nm3s0awyH9egQvB2Gu+QEnJn2Sfg=",
+        "owner": "rust-lang",
+        "repo": "rust-analyzer",
+        "rev": "591e3b7624be97e4443ea7b5542c191311aa141d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rust-lang",
+        "ref": "nightly",
+        "repo": "rust-analyzer",
+        "type": "github"
+      }
+    },
     "stylix": {
       "inputs": {
         "base16": "base16",
@@ -561,9 +748,7 @@
         "base16-helix": "base16-helix",
         "base16-vim": "base16-vim",
         "firefox-gnome-theme": "firefox-gnome-theme",
-        "flake-parts": [
-          "flake-parts"
-        ],
+        "flake-parts": "flake-parts_3",
         "gnome-shell": "gnome-shell",
         "nixpkgs": [
           "nixpkgs"
@@ -577,11 +762,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1766603026,
-        "narHash": "sha256-J2DDdRqSU4w9NNgkMfmMeaLIof5PXtS9RG7y6ckDvQE=",
+        "lastModified": 1773792048,
+        "narHash": "sha256-Oy9PCLG3vtflFBWcJd8c/EB3h5RU7ABAIDWn6JrGf6o=",
         "owner": "nix-community",
         "repo": "stylix",
-        "rev": "551df12ee3ebac52c5712058bd97fd9faa4c3430",
+        "rev": "3f2f9d307fe58c6abe2a16eb9b62c42d53ef5ee1",
         "type": "github"
       },
       "original": {
@@ -671,11 +856,11 @@
     "tinted-schemes": {
       "flake": false,
       "locked": {
-        "lastModified": 1763914658,
-        "narHash": "sha256-Hju0WtMf3iForxtOwXqGp3Ynipo0EYx1AqMKLPp9BJw=",
+        "lastModified": 1767710407,
+        "narHash": "sha256-+W1EB79Jl0/gm4JqmO0Nuc5C7hRdp4vfsV/VdzI+des=",
         "owner": "tinted-theming",
         "repo": "schemes",
-        "rev": "0f6be815d258e435c9b137befe5ef4ff24bea32c",
+        "rev": "2800e2b8ac90f678d7e4acebe4fa253f602e05b2",
         "type": "github"
       },
       "original": {
@@ -687,11 +872,11 @@
     "tinted-tmux": {
       "flake": false,
       "locked": {
-        "lastModified": 1764465359,
-        "narHash": "sha256-lbSVPqLEk2SqMrnpvWuKYGCaAlfWFMA6MVmcOFJjdjE=",
+        "lastModified": 1767489635,
+        "narHash": "sha256-e6nnFnWXKBCJjCv4QG4bbcouJ6y3yeT70V9MofL32lU=",
         "owner": "tinted-theming",
         "repo": "tinted-tmux",
-        "rev": "edf89a780e239263cc691a987721f786ddc4f6aa",
+        "rev": "3c32729ccae99be44fe8a125d20be06f8d7d8184",
         "type": "github"
       },
       "original": {
@@ -703,11 +888,11 @@
     "tinted-zed": {
       "flake": false,
       "locked": {
-        "lastModified": 1764464512,
-        "narHash": "sha256-rCD/pAhkMdCx6blsFwxIyvBJbPZZ1oL2sVFrH07lmqg=",
+        "lastModified": 1767488740,
+        "narHash": "sha256-wVOj0qyil8m+ouSsVZcNjl5ZR+1GdOOAooAatQXHbuU=",
         "owner": "tinted-theming",
         "repo": "base16-zed",
-        "rev": "907dbba5fb8cf69ebfd90b00813418a412d0a29a",
+        "rev": "11abb0b282ad3786a2aae088d3a01c60916f2e40",
         "type": "github"
       },
       "original": {

flake.nix

@@ -4,9 +4,9 @@
       url = "github:ryantm/agenix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    flake-parts = {
-      url = "github:hercules-ci/flake-parts";
-      inputs.nixpkgs-lib.follows = "nixpkgs";
+    anki-cli = {
+      url = "git+https://git.mtgmonkey.net/Andromeda/anki-cli.git";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
     home-manager = {
       url = "github:nix-community/home-manager";
@@ -18,19 +18,17 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
-    noshell = {
-      url = "github:viperML/noshell";
-      inputs.nixpkgs.follows = "nixpkgs";
+    nix-zulip = {
+      url = "git+https://git.afnix.fr/nix-zulip/nix-zulip";
+      flake = false;
     };
     nur = {
       url = "github:nix-community/NUR";
       inputs.nixpkgs.follows = "nixpkgs";
-      inputs.flake-parts.follows = "flake-parts";
     };
     nvf = {
       url = "github:notashelf/nvf";
       inputs.nixpkgs.follows = "nixpkgs";
-      inputs.flake-parts.follows = "flake-parts";
     };
     phoenix = {
       url = "github:celenityy/Phoenix";
@@ -39,23 +37,23 @@
     stylix = {
       url = "github:nix-community/stylix";
       inputs.nixpkgs.follows = "nixpkgs";
-      inputs.flake-parts.follows = "flake-parts";
     };
   };
-  outputs = inputs @ {
+  outputs = {
     agenix,
-    flake-parts,
+    anki-cli,
     home-manager,
     impermanence,
     nixos-mailserver,
     nixpkgs,
-    noshell,
+    nix-zulip,
     nur,
     nvf,
     phoenix,
     stylix,
     ...
   }: let
+    nix-zulip' = (import "${nix-zulip}/nix/default.nix" {}).output;
     machines = import ./machines.nix;
     configuration = machine: modules:
       nixpkgs.lib.nixosSystem {
@@ -64,25 +62,34 @@
         modules =
           modules
           ++ [
-            ./machines/${machine.hostname}/configuration.nix
             ./users.nix
             ./secrets.nix
-            impermanence.nixosModules.impermanence
+            ./modules/nixos/common.nix
             agenix.nixosModules.default
+            impermanence.nixosModules.impermanence
             nixos-mailserver.nixosModule
+            nix-zulip'.nixosModules.zulip
             phoenix.nixosModules.default
+            ({pkgs, ...}: {
+              nixpkgs.overlays = [
+                agenix.overlays.default
+                nur.overlays.default
+                nix-zulip'.overlays.default
+                (self: super: {
+                  anki-cli = anki-cli.packages.${machine.system}.default;
+                })
               ];
+            })
+          ]
+          ++ machine.modules;
       };
     configurationWithHomeManager = machine: (configuration machine
       [
         home-manager.nixosModules.home-manager
         {
-          nixpkgs.overlays = [
-            agenix.overlays.default
-            nur.overlays.default
-          ];
           home-manager.useGlobalPkgs = true;
           home-manager.extraSpecialArgs = {inherit machine;};
+          home-manager.backupFileExtension = "bak";
           home-manager.users =
             builtins.mapAttrs
             (name: value: value)
@@ -101,19 +108,11 @@
               )
             );
         }
-        noshell.nixosModules.default
       ]);
-  in
-    flake-parts.lib.mkFlake {inherit inputs;} (top @ {
-      config,
-      withSystem,
-      moduleWithSystem,
-      ...
-    }: {
-      systems = ["x86_64-linux"];
-      flake.nixosConfigurations =
+  in {
+    nixosConfigurations =
       builtins.mapAttrs
       (hostname: value: configurationWithHomeManager value)
       machines;
-    });
+  };
 }

hardware-configuration.nix

@@ -0,0 +1,24 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

machines.nix

@@ -2,14 +2,81 @@
   lenovo = {
     hostname = "lenovo";
     system = "x86_64-linux";
-    users = [
-      "andromeda"
-      "mtgmonkey"
+    users = ["andromeda"];
+    modules = [
+      # impermanence
+      ./modules/nixos/impermanence.nix
+      ./modules/nixos/impermanence-ssh.nix
+
+      # hardware configuration
+      # includes `system.stateVersion`
+      ./modules/nixos/machines/lenovo.nix
+      ./modules/nixos/zram.nix
+
+      # boot process
+      # systemd-boot
+      ./modules/nixos/boot/lenovo.nix
+
+      # networking
+      ./modules/nixos/laptop.nix
+
+      # vpn
+      # ./modules/nixos/openvpn-client.nix
+
+      # ly display manager
+      ./modules/nixos/ly.nix
+
+      # sway window manager
+      ./modules/nixos/sway.nix
+
+      # apps
+      # UNFREE
+      ./modules/nixos/steam.nix
+
+      # substitutors
+      ./substitutors.nix
+
+      {
+        services.guix = {
+          enable = true;
+          stateDir = "/gnu/var";
+        };
+      }
     ];
   };
   "109-199-104-83" = {
     hostname = "109-199-104-83";
     system = "x86_64-linux";
     users = [];
+    modules = [
+      # hardware configuration
+      # from gitlab:whitequark/nixos-bite
+      ./modules/nixos/machines/109-199-104-83.nix
+
+      # networking
+      ./modules/nixos/networking/domains/galaxious.de.nix
+
+      # ssh through port 5522 among other things
+      # andromeda@lenovo is the only user allowed access
+      ./modules/nixos/networking/hard-ssh.nix
+      ({config, ...}: {users.users.root.openssh.authorizedKeys.keys = [config.pub-keys.ssh.andromeda];})
+
+      # simple-nixos-mailserver email server
+      # mail.domain
+      ./modules/nixos/mailserver.nix
+
+      # roundcube webmail client
+      # webmail.domain
+      ./modules/nixos/roundcube.nix
+
+      # BROKEN
+      # forgejo
+      # git.domain
+      # ./modules/nixos/forgejo.nix
+
+      # zulip chat client
+      # chat.domain
+      # ./modules/nixos/zulip.nix
+    ];
   };
 }

machines/109-199-104-83/configuration.nix

@@ -1,90 +0,0 @@
-{
-  config,
-  modulesPath,
-  machine,
-  ...
-}: {
-  # roundcube config
-  services.roundcube = {
-    enable = true;
-    hostName = "webmail.${config.networking.domain}";
-    extraConfig = ''
-      $config['imap_host'] = "ssl://${config.mailserver.fqdn}";
-      $config['smtp_host'] = "ssl://${config.mailserver.fqdn}";
-      $config['smtp_user'] = "%u";
-      $config['smtp_pass'] = "%p";
-    '';
-  };
-
-  # mailserver config
-  mailserver = {
-    enable = true;
-    stateVersion = 3;
-    fqdn = "mail.${config.networking.domain}";
-    domains = ["${config.networking.domain}"];
-    x509.useACMEHost = config.mailserver.fqdn;
-    loginAccounts = {
-      "test@${config.networking.domain}" = {
-        hashedPasswordFile = builtins.toString config.age.secrets.secret3.path;
-      };
-    };
-  };
-
-  # cert config
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "mtgmonket@gmail.com";
-  };
-  services.nginx = {
-    enable = true;
-    virtualHosts."mail.${config.networking.domain}" = {
-      forceSSL = true;
-      enableACME = true;
-    };
-  };
-
-  # system config
-  system.stateVersion = "25.11";
-  nix.settings.experimental-features = ["flakes" "nix-command"];
-  imports = [(modulesPath + "/profiles/qemu-guest.nix")];
-  fileSystems."/" = {
-    device = "/dev/sda1";
-    fsType = "ext4";
-  };
-  boot.loader.grub.device = "/dev/sda";
-  boot.loader.timeout = 30;
-  boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "xen_blkfront"];
-  boot.initrd.kernelModules = ["nvme"];
-  boot.tmp.cleanOnBoot = true;
-  zramSwap.enable = true;
-  networking = {
-    useNetworkd = true;
-    usePredictableInterfaceNames = true;
-    hostName = machine.hostname;
-    domain = "galaxious.de";
-    firewall = {
-      enable = true;
-      allowedTCPPorts = [80 443];
-      allowedUDPPorts = [80 443];
-    };
-  };
-  systemd.network = {
-    enable = true;
-    networks."40-wan" = {
-      matchConfig.Name = "enx0050565f4fff";
-      address = ["2a02:c207:2299:8419::1/64" "109.199.104.83/20"];
-      routes = [
-        {
-          Gateway = "109.199.96.1";
-          GatewayOnLink = true;
-        }
-        {Gateway = "fe80::1";}
-      ];
-      dns = ["2620:fe::fe" "9.9.9.9"];
-    };
-  };
-  services.openssh.enable = true;
-  users.mutableUsers = false;
-  users.users.root.openssh.authorizedKeys.keys = [config.pub-keys.ssh.andromeda];
-  programs.noshell.enable = true;
-}

modules/nixos/boot/lenovo.nix

@@ -0,0 +1,6 @@
+{
+  boot.loader = {
+    efi.canTouchEfiVariables = true;
+    systemd-boot.enable = true;
+  };
+}

modules/nixos/common.nix

@@ -0,0 +1,26 @@
+{
+  config,
+  lib,
+  ...
+}: {
+  # flakes usage
+  nix.settings.experimental-features = [
+    "flakes"
+    "nix-command"
+  ];
+
+  # allows users to customize shell in `$XDG_CONFIG_HOME/shell` rather than
+  # needing /etc/shells. Useful for home-manager.
+  # programs.noshell.enable = true;
+
+  # cleans /tmp to maintain a tidy system
+  boot.tmp.cleanOnBoot = true;
+
+  networking.domain = lib.mkDefault config.networking.hostName;
+
+  # disable lecture
+  security.sudo.extraConfig = ''Defaults lecture="never"'';
+
+  # make users immutable
+  users.mutableUsers = false;
+}

modules/nixos/forgejo.nix

@@ -0,0 +1,27 @@
+{config, ...}: {
+  services.nginx = {
+    virtualHosts.${config.services.forgejo.settings.server.DOMAIN} = {
+      forceSSL = true;
+      enableACME = true;
+      extraConfig = ''
+        client_max_body_size 512M
+      '';
+      locations."/".proxyPass = "https://localhost:${builtins.toString config.services.forgejo.settings.server.HTTP_PORT}";
+    };
+  };
+  services.forgejo = {
+    enable = true;
+    database.type = "postgres";
+    lfs.enable = true;
+    settings = {
+      server = rec {
+        DOMAIN = "git.galaxious.de";
+        ROOT_URL = "https://${DOMAIN}";
+        HTTP_PORT = 4043;
+        SSH_PORT = 4022;
+      };
+      service.DISABLE_REGISTRATION = false;
+    };
+  };
+  services.openssh.ports = [config.services.forgejo.settings.server.SSH_PORT];
+}

modules/nixos/impermanence-ssh.nix

@@ -0,0 +1,4 @@
+{
+  # ONLY include this module AFTER a machine has been provisioned
+  environment.persistence."/persist".directories = ["/etc/ssh"];
+}

modules/nixos/impermanence.nix

@@ -1,19 +1,16 @@
 {
-  environment.persistence."/nix/persist" = {
+  fileSystems."/persist".neededForBoot = true;
+  environment.persistence."/persist" = {
     enable = true;
     hideMounts = true;
     directories = [
       "/var/log"
-      "/var/lib/bluetooth"
       "/var/lib/nixos"
       "/var/lib/systemd/coredump"
-      "/etc/NetworkManager/system-connections"
-      "/etc/ssh"
-      "/etc/ly/custom-sessions"
+      "/gnu"
     ];
     files = [
       "/etc/machine-id"
-      "/etc/ly/save.txt"
     ];
   };
 }

modules/nixos/laptop.nix

@@ -0,0 +1,37 @@
+{
+  # bluetooth
+  hardware.bluetooth = {
+    enable = true;
+    powerOnBoot = true;
+  };
+  services.blueman.enable = true;
+
+  # locale
+  i18n.defaultLocale = "en_US.UTF-8";
+  time.timeZone = "Europe/Berlin";
+
+  # networking
+  networking = {
+    firewall.enable = true;
+    networkmanager.enable = true;
+  };
+
+  # misc
+  services = {
+    printing.enable = true;
+
+    # trackpad
+    libinput.enable = true;
+
+    # ssh
+    openssh.enable = true;
+  };
+
+  # impermanence
+  environment.persistence."/persist".directories = [
+    # bluetooth
+    "/var/lib/bluetooth"
+    # wifi connections
+    "/etc/NetworkManager/system-connections"
+  ];
+}

modules/nixos/ly.nix

@@ -0,0 +1,11 @@
+{
+  services.displayManager = {
+    enable = true;
+    ly.enable = true;
+  };
+  # TODO needs to be manually updated when new users added
+  environment.persistence."/persist" = {
+    directories = ["/etc/ly/custom-sessions"];
+    files = ["/etc/ly/save.txt"];
+  };
+}

modules/nixos/machines/109-199-104-83.nix

@@ -0,0 +1,38 @@
+{modulesPath, ...}: {
+  system.stateVersion = "25.11";
+
+  # Hardware
+  imports = [(modulesPath + "/profiles/qemu-guest.nix")];
+  fileSystems."/" = {
+    device = "/dev/sda1";
+    fsType = "ext4";
+  };
+  boot.loader.grub.device = "/dev/sda";
+  boot.loader.timeout = 30;
+  boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "xen_blkfront"];
+  boot.initrd.kernelModules = ["nvme"];
+  boot.tmp.cleanOnBoot = true;
+
+  zramSwap.enable = true;
+
+  # Networking
+  networking = {
+    useNetworkd = true;
+    usePredictableInterfaceNames = true;
+  };
+  systemd.network = {
+    enable = true;
+    networks."40-wan" = {
+      matchConfig.Name = "enx0050565f4fff";
+      address = ["2a02:c207:2299:8419::1/64" "109.199.104.83/20"];
+      routes = [
+        {
+          Gateway = "109.199.96.1";
+          GatewayOnLink = true;
+        }
+        {Gateway = "fe80::1";}
+      ];
+      dns = ["2020:fe::10" "9.9.9.10"];
+    };
+  };
+}

modules/nixos/machines/lenovo.nix

@@ -1,70 +1,17 @@
 {
   config,
   lib,
+  pkgs,
   modulesPath,
-  machine,
   ...
 }: {
-  imports = [
-    ./impermanence.nix
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-  age.secrets = {
-    secret0.file = ../../secrets/secret0.age;
-    secret1.file = ../../secrets/secret1.age;
-  };
-  boot.loader = {
-    efi.canTouchEfiVariables = true;
-    systemd-boot.enable = true;
-  };
-  hardware.bluetooth = {
-    enable = true;
-    powerOnBoot = true;
-  };
-  i18n.defaultLocale = "de_DE.UTF-8";
-  networking = {
-    dhcpcd.enable = true;
-    firewall.enable = true;
-    hostName = machine.hostname;
-    networkmanager.enable = true;
-  };
-  nix.settings.experimental-features = [
-    "nix-command"
-    "flakes"
-  ];
-  nixpkgs.config.allowUnfreePredicate = pkg:
-    builtins.elem (lib.getName pkg) [
-      "steam"
-      "steam-original"
-      "steam-unwrapped"
-      "steam-run"
-    ];
-  programs = {
-    noshell.enable = true;
-    steam.enable = true;
-    sway.enable = true;
-  };
-  services = {
-    blueman.enable = true;
-    displayManager = {
-      enable = true;
-      ly.enable = true;
-    };
-    libinput.enable = true;
-    openssh.enable = true;
-    printing.enable = true;
-  };
-  system.stateVersion = "26.05";
-  time.timeZone = "Europe/Berlin";
+  imports = [(modulesPath + "/installer/scan/not-detected.nix")];
   boot.initrd.availableKernelModules = ["xhci_pci" "nvme" "sdhci_pci"];
   boot.initrd.kernelModules = [];
   boot.kernelModules = ["kvm-intel"];
   boot.extraModulePackages = [];
 
   fileSystems."/" = {
-    #device = "none";
-    #fsType = "tmpfs";
-    #options = ["defaults" "size=60%" "mode=755"];
     device = "/dev/disk/by-uuid/5455cfb4-0efd-4f55-b496-d2cab3f419b7";
     fsType = "btrfs";
     options = ["subvol=root"];
@@ -92,12 +39,12 @@
     done
 
     btrfs subvolume create /btrfs_tmp/root
-    mkdir /btrfs_tmp/root/nix
+    mkdir /btrfs_tmp/root/persist
     mkdir /btrfs_tmp/root/etc
-    mount ${config.fileSystems."/nix".device} /btrfs_tmp/root/nix
-    cp /btrfs_tmp/root/nix/persist/etc/ssh /btrfs_tmp/root/etc/ssh -r
-    umount /btrfs_tmp/root/nix
-    rm -r /btrfs_tmp/root/nix
+    mount ${config.fileSystems."/persist".device} /btrfs_tmp/root/persist -o subvol=persist
+    cp /btrfs_tmp/root/persist/etc/ssh /btrfs_tmp/root/etc/ssh -r
+    umount /btrfs_tmp/root/persist
+    rm -r /btrfs_tmp/root/persist
     umount /btrfs_tmp
   '';
 
@@ -106,6 +53,12 @@
     fsType = "btrfs";
   };
 
+  fileSystems."/persist" = {
+    device = "/dev/disk/by-uuid/5455cfb4-0efd-4f55-b496-d2cab3f419b7";
+    fsType = "btrfs";
+    options = ["subvol=persist"];
+  };
+
   fileSystems."/boot" = {
     device = "/dev/disk/by-uuid/F425-55BA";
     fsType = "vfat";
@@ -116,4 +69,5 @@
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  system.stateVersion = "26.05";
 }

modules/nixos/mailserver.nix

@@ -0,0 +1,50 @@
+{config, ...}: {
+  mailserver = {
+    enable = true;
+    stateVersion = 3;
+
+    # domain bs
+    fqdn = "mail.${config.networking.domain}";
+    domains = ["${config.networking.domain}"];
+    x509.useACMEHost = config.mailserver.fqdn;
+
+    loginAccounts = {
+      # test acc
+      "test@${config.networking.domain}" = {
+        hashedPasswordFile = builtins.toString config.age.secrets.mailserver-acc-test-pw.path;
+      };
+      "admin@${config.networking.domain}" = {
+        hashedPasswordFile = builtins.toString config.age.secrets.mailserver-acc-admin-pw.path;
+        aliases = ["@${config.networking.domain}"];
+      };
+    };
+  };
+
+  # put dkim key into /etc for declarability
+  mailserver.dkimKeyDirectory = "/etc/dkim";
+  environment.etc."dkim/${config.networking.domain}.${config.mailserver.dkimSelector}.key" = {
+    source = config.age.secrets."dkim-${config.networking.domain}.${config.mailserver.dkimSelector}.key".path;
+    mode = "600";
+    user = config.services.rspamd.user;
+    group = config.services.rspamd.group;
+  };
+
+  # does acme for me
+  services.nginx = {
+    enable = true;
+    virtualHosts = {
+      "mail.${config.networking.domain}" = {
+        forceSSL = true;
+        enableACME = true;
+      };
+      "${config.networking.domain}" = {
+        forceSSL = true;
+        enableACME = true;
+      };
+    };
+  };
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "mtgmonket@gmail.com";
+  };
+}

modules/nixos/networking/domains/galaxious.de.nix

@@ -0,0 +1,3 @@
+{
+  networking.domain = "galaxious.de";
+}

modules/nixos/networking/hard-ssh.nix

@@ -0,0 +1,18 @@
+{
+  services.openssh = {
+    enable = true;
+    allowSFTP = false;
+    ports = [5522];
+    settings = {
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = true;
+    };
+    extraConfig = ''
+      AllowTcpForwarding no
+      AllowAgentForwarding no
+      MaxAuthTries 3
+      MaxSessions 4
+      TCPKeepAlive no
+    '';
+  };
+}

modules/nixos/networking/ssh-as-root.nix

@@ -0,0 +1,3 @@
+{lib, ...}: {
+  services.openssh.settings.PermitRootLogin = lib.mkForce "yes";
+}

modules/nixos/roundcube.nix

@@ -0,0 +1,12 @@
+{config, ...}: {
+  services.roundcube = {
+    enable = true;
+    hostName = "webmail.${config.networking.domain}";
+    extraConfig = ''
+      $config['imap_host'] = "ssl://${config.mailserver.fqdn}";
+      $config['smtp_host'] = "ssl://${config.mailserver.fqdn}";
+      $config['smtp_user'] = "%u";
+      $config['smtp_pass'] = "%p";
+    '';
+  };
+}

modules/nixos/steam.nix

@@ -0,0 +1,10 @@
+{lib, ...}: {
+  nixpkgs.config.allowUnfreePredicate = pkg:
+    builtins.elem (lib.getName pkg) [
+      "steam"
+      "steam-original"
+      "steam-unwrapped"
+      "steam-run"
+    ];
+  programs.steam.enable = true;
+}

modules/nixos/sway.nix

@@ -0,0 +1,3 @@
+{
+  programs.sway.enable = true;
+}

modules/nixos/zram.nix

@@ -0,0 +1,8 @@
+{
+  zramSwap = {
+    enable = true;
+    priority = 100;
+    algorithm = "zstd";
+    memoryPercent = 75;
+  };
+}

modules/nixos/zulip.nix

@@ -0,0 +1,54 @@
+{config, ...}: {
+  services.zulip = {
+    enable = true;
+
+    # lets it set up my postgresql for me
+    enablePostgresqlLocally = true;
+
+    # host domain
+    host = "chat.${config.networking.domain}";
+
+    # secrets; head rolled on keyboard for all :)
+    camoKeyFile = builtins.toString config.age.secrets.zulip-camoKey.path;
+    rabbitmqPasswordFile = builtins.toString config.age.secrets.zulip-rabbitmqPassword.path;
+    secretKeyFile = builtins.toString config.age.secrets.zulip-secretKey.path;
+    sharedSecretKeyFile = builtins.toString config.age.secrets.zulip-sharedSecretKey.path;
+    avatarSaltKeyFile = builtins.toString config.age.secrets.zulip-avatarSaltKey.path;
+
+    # TODO check for parity with `mailserver-acc-admin-pw.age`
+    extraSecrets.email_password = builtins.toString config.age.secrets.zulip-extraSecrets-email_password.path;
+
+    # settings
+    zulipSettings = rec {
+      # email users
+      ZULIP_ADMINISTRATOR = "admin@${config.networking.domain}";
+      EMAIL_HOST_USER = ZULIP_ADMINISTRATOR;
+
+      # configure mailserver port
+      EMAIL_HOST = config.mailserver.fqdn;
+      EMAIL_USE_SSL = true;
+      EMAIL_PORT = 465;
+
+      # setting to allow realm creation; probably unsafe, might delete later :3
+      OPEN_REALM_CREATION = true;
+
+      # send all noreply emails from `admin@galaxious.de`
+      # TODO configure admin to send from any address
+      ADD_TOKENS_TO_NOREPLY_ADDRESS = false;
+      NOREPLY_EMAIL_ADDRESS = ZULIP_ADMINISTRATOR;
+
+      # domain name
+      EXTERNAL_HOST = config.services.zulip.host;
+    };
+  };
+  # persist
+  environment.persistence."/persist".directories = [
+    # messages
+    "/var/lib/rabbitmq"
+    # uploads
+    "/var/lib/zulip"
+
+    # contrived, but in the store a couple layers down
+    # "/var/lib/redis-zulip"
+  ];
+}

modules/template.nix

@@ -0,0 +1,11 @@
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [];
+  options = {};
+  config = {};
+}

pub-keys.nix

@@ -1,15 +1,24 @@
 {
   age.secrets = {
-    secret0.file = ./secrets/secret0.age;
-    secret1.file = ./secrets/secret1.age;
-    secret2.file = ./secrets/secret2.age;
-    secret3.file = ./secrets/secret3.age;
+    andromeda-pw.file = ./secrets/andromeda-pw.age;
+    conduit-secretFile.file = ./secrets/conduit-secretFile.age;
+    "dkim-galaxious.de.mail.key".file = ./secrets/dkim-galaxious.de.mail.key.age;
+    mtgmonkey-pw.file = ./secrets/mtgmonkey-pw.age;
+    mailserver-acc-test-pw.file = ./secrets/mailserver-acc-test-pw.age;
+    mailserver-acc-admin-pw.file = ./secrets/mailserver-acc-admin-pw.age;
+    "mailserver-acc-zulip+admin-pw".file = "${./secrets}/mailserver-acc-zulip+admin-pw.age";
+    zulip-avatarSaltKey.file = ./secrets/zulip-avatarSaltKey.age;
+    zulip-camoKey.file = ./secrets/zulip-camoKey.age;
+    zulip-extraSecrets-email_password.file = ./secrets/zulip-extraSecrets-email_password.age;
+    zulip-rabbitmqPassword.file = ./secrets/zulip-rabbitmqPassword.age;
+    zulip-secretKey.file = ./secrets/zulip-secretKey.age;
+    zulip-sharedSecretKey.file = ./secrets/zulip-sharedSecretKey.age;
   };
   pub-keys = {
     ssh = {
       andromeda = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJy2VD362wUcu0lKj2d6OIU8dbAna0Lu/NaAYIj8gdIA andromeda@lenovo";
       lenovo = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHG4eqsLTq2os2mxfwhys3BpVnowcJrqt2CbRFzN2pJb root@lenovo";
-      _109-199-104-83 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJe5ol56yC23fivSEKeK4HZQm934ROX46AM7o0aE2hMq root@vmi2998419";
+      _109-199-104-83 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPkg4vbyGDxrAtKFK7Pecr/qDK9cUjv+kfhQMjO6M/Ft root@vmi2998419";
     };
   };
 }

secrets/andromeda-pw.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg geMV+A9hasvKDnYiQMQWpz2o9mkUhX/Qmc1m4uvKIBs
+3vYZmwZPDVwqYRe2GHmxPXXx4qSWa3eqcWuH+sKWEYw
+-> ssh-ed25519 UHxfvA FzNzq3yYNeDZ5x/g3cRVEaRu0txR3RORSeNFssrVuyc
+dRQGhtVRMC65sHqlmxSXjwpsxtCqhifkVNWvBrrB4b8
+--- bHi+Q07PCpmPzalAkbaN+/H1tXLyJNbpBs3VMpDnSnU
++y¾2‚µÊZ4å<34>'RÔ”ÅÍPX—òR;HŠ”ÞHÆÏw‡éF7dÎñÖO¥<>߀•ïs«.„ó<E2809E>J<EFBFBD>èärXqB¬ûPÉ¢™XÖ<58>ËÈE‘£»%¿¡Öè+(ä^=øÙöeugïêS;“2

secrets/conduit-secretFile.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg k+ePDybTbw1Pwy6P8+5HlGg6oCWQsTKVT4j/WUpZcCI
+F2ySmW8tJ1BDBvLbqtrTMrnPkESAtwXBgzcQ7nVh8+A
+-> ssh-ed25519 UHxfvA /RzKa63+zOkHudFPCS1hLxj4PjGZCtZ2UIIK0mdItBQ
+TqdH3kQgMCEtG+rxx+dR+5/tcw05s63Dc1UFflRkoMA
+-> ssh-ed25519 ZwF9sQ FvquxZ8PsmsoV06o4dBsKZOq46S08Rn1aT3Aco9TuDg
+UnBKQCYXPa897ahVsj90XsVPuU4RKQ8RmMStY8BuubQ
+--- MbfHHesbaIlXIg5jziBe4YG95I85ZuikuJLc9F/TEeQ
+L("Ùß%DYÅ$°Ový¤:G5ÏzèWsœ¡šÏ‹pï<>/ËúðV¹}ëû2xˆ«gRT‰Ã3|Pµ°/§n¼•òÆcIq(7Q-W[ä»ÐØL]ØE¥LS%y3w}¶Œµ°€°“Ütµ/£¿äO /<<3C>þm ÜfþCôn’4”ºÑPyÚ'%+NY´à›B@>œF<>ÐÒ	è`,æ-–¯0Ox)<1D>á
+Ä)kT”ÍVòBxYì‹ 

secrets/mailserver-acc-test-pw.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg gUoqW4Oc/4kGV97GqzjBgoAGbDlPr30HQjCSi95IakU
+WLqdKLGAY//HKMhiWeOEbRkVTUm+bNcGCRwvZ+jxFiQ
+-> ssh-ed25519 UHxfvA w82yDFitNUAnKzT/0mPNIm4Od9YLwDK+JIHBd6qRsSQ
+uHYX5DugH0tLqLR1phnyYBNiP2XOV2Hj9tw63+MD1JI
+-> ssh-ed25519 ZwF9sQ 6dTsOKixioy+ypnpWm1YtKYPrHcS/RSKsoq3o2bnjk8
+WYED7jkCVNLBaputl0JcfEz8GOX4doUNEihj6ZHx8Eo
+--- XOUmVi4QpCXDy4yVCZuwiv8Sg+LOsX9vfydM6OqGfTM
+»?A³Ý'©p…@¶cUØ£Ì8º“1&9aXgÔyj°(óýz+$P36£<36>#ºîƒÊrçRDÊŒ7ªß¥.óÖ\:Ãþ­pcß<63>œÇp¯Ø€GÓ&+”Öb¢|ž’ß<E28099>6¢ é’Ý»YŽ

secrets/mailserver-acc-zulip+admin-pw.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg vcICwHDjTfVHh0+Ip1XKs/6Fo0H1i5lTjBAw1M4NSHA
+ZzxDjKEUdmyhFjPivAslXxr7tZnj7CVTcffuIhVdekI
+-> ssh-ed25519 UHxfvA UPc1hBrbx37a4wn/XBxjwQLOk1M0HnHbHpqAQFUhnn8
+girao3TUDhFe1knuCUtYOh39ukXumjd7s1qzXXLGPjQ
+-> ssh-ed25519 ZwF9sQ O2QJh1Zsdu0tIA90pTv5NrfcXDAcYFyduq8AtTG7Ujs
+ahnpyUSFuSwW1Zx7WzqDXFJtYCaUfwJdCyyr5enLz5I
+--- fYyjQduWvTrenIiJtljSkEZXuyTRWJOvx9LeWoI3ew0
+…ußߘLÒ8ïÎ:ÂT·$…<10> ñJë´+LÄ?„zÇÍü5rL(MìýÁÑiÀý˜<C3BD>ˆFÀ’N‚±.W+ß·U28Èd$µ<>¯<EFBFBD>Á£‘8Üõm¡4:‘N´<g)©Š‰Ä&Í$Jþ=‚Ævœ

secrets/secret0.age

@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 mT2fyg 4fCTrNibFdjnVfsIbXi6plbd56K8ZDDqtgryXPk2SUA
-vKlbDi+HpyYlSsN39GRh6GRwdHRSjypCEqguOaHPFDM
--> ssh-ed25519 UHxfvA RqrDa4xJoAy1Gdzvq6Z5eTSNTDtHzUmzRoLC+j+HxiI
-+5CohUFSDB9oiLU0T25FKrQrz07DCviVuzZsVcUltOc
---- SQ5zQx9lL5UdNinOgP6yG5WWiBdhSwFqJVt6u3SNpLA
-î6<EFBFBD>©ç¥UÛð¦pî<70>‡„øÚúQÙ]ÜNû;K;1yœµ™

secrets/secret3.age

@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 mT2fyg slLOkD/9TAYOuZ/g5U4NvPWUlmYZeie12xzggioviw0
-E0uAj4RMgv7DTJpvtEO54G9XHNLFOgFflR54Cl6/X8g
--> ssh-ed25519 UHxfvA xHFujOdegur0PLNHZP+h5RxHhVD2K906NZx7nprMkUs
-PdDxzD5QBdE/yWPMnF+CDGROEpE4nYvg12v1G3QK9XI
--> ssh-ed25519 Xoin5w YWsO9HtEFB79+aKr6eWi5Sg5geKfzT+IrDy2L5qEmx4
-sXLRmcRDyAv64nSGs8QXcHmKYO+F11Pzea1EVGmpEys
---- Sjg8SqkkEEL4X0G1GOUoHO702ZtrM0hMniIdS7yIsDA
-'ÏBâÉ(<28>–7DÏ“=ù³h•áÊh	fëÉ®×xT Ž!K.»‰‚~سò,…ß“<C39F>D|éä+pû<70>ü"Òt‚ÝG¢yñQ¬ÏRcPÁQüúQßÐ

secrets/secrets.nix

@@ -4,8 +4,30 @@ let
   lenovo = pub-keys.ssh.lenovo;
   _109-199-104-83 = pub-keys.ssh._109-199-104-83;
 in {
-  "secret0.age".publicKeys = [andromeda lenovo];
-  "secret1.age".publicKeys = [andromeda lenovo];
-  "secret2.age".publicKeys = [andromeda lenovo _109-199-104-83];
-  "secret3.age".publicKeys = [andromeda lenovo _109-199-104-83];
+  # user passwords
+  "andromeda-pw.age".publicKeys = [andromeda lenovo];
+  "mtgmonkey-pw.age".publicKeys = [andromeda lenovo];
+
+  # contains the following env
+  # CONDUIT_JWT_SECRET
+  # CONDUIT_TURN_SECRET
+  "conduit-secretFile.age".publicKeys = [andromeda lenovo _109-199-104-83];
+
+  # dkim private keys
+  "dkim-galaxious.de.mail.key.age".publicKeys = [andromeda lenovo _109-199-104-83];
+
+  # mail account passwords
+  "mailserver-acc-test-pw.age".publicKeys = [andromeda lenovo _109-199-104-83];
+  "mailserver-acc-admin-pw.age".publicKeys = [andromeda lenovo _109-199-104-83];
+  "mailserver-acc-zulip+admin-pw.age".publicKeys = [andromeda lenovo _109-199-104-83];
+
+  # zulip keys
+  "zulip-avatarSaltKey.age".publicKeys = [andromeda lenovo _109-199-104-83];
+  "zulip-camoKey.age".publicKeys = [andromeda lenovo _109-199-104-83];
+  "zulip-rabbitmqPassword.age".publicKeys = [andromeda lenovo _109-199-104-83];
+  "zulip-secretKey.age".publicKeys = [andromeda lenovo _109-199-104-83];
+  "zulip-sharedSecretKey.age".publicKeys = [andromeda lenovo _109-199-104-83];
+
+  # zulip-secrets.conf values
+  "zulip-extraSecrets-email_password.age".publicKeys = [andromeda lenovo _109-199-104-83];
 }

secrets/zulip-camoKey.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg cz2kWYGsZU08Sh3+mJHqhTC9lhqHvwzmgIHu+SUkVxU
+bDFcYokAEj4UulAtYNvW9inoRJzoD+z1lSCQRcpyd7o
+-> ssh-ed25519 UHxfvA 0npgMgYOhrxSgprdVNXIRFtrkeMWL5xEoaOjg0MAu0M
+53VyXcDQxM7hoGt1deuJfKuOkKwz0P++JvUHOW7PxpQ
+-> ssh-ed25519 ZwF9sQ F+Hx3aJDjCAPe4wEhBg8kjZla/iF92kzFWfdh1ll0BU
+yUFzyxm40BVyIKLR/LfB2mTwNzIpPxJ0Ix1/x6vYVjg
+--- PMzNF3mxVzePmAZBtX36NtPf04L7x30kCjv69G6nMSQ
+¼¡žˆÈ

secrets/zulip-extraSecrets-email_password.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg eVTpn6pJgpLbIqorjaLhK+VRCcVIjYZEWkUqSmSWQQU
+j5C4x3gBgVoVmOZicfNu6r7QVebx8jFcWlvy0/Ku4jI
+-> ssh-ed25519 UHxfvA Hnf8ZGN4cpyeR4VVEaQbatDP3mDj7XsfoTrpzYmLjDA
+2lCD8WzjiIxYhSa69Jb1QO2tjFBikffBuMszpD2W1y0
+-> ssh-ed25519 ZwF9sQ 9Z6NdJ1Aeexe4NZmV/PO6ChB1B36U4MZura/jHgaxns
+V/xIoskMZQIIZGNwWK0THfhWX1dKk0cG8stawVJfCZo
+--- FNvKumqiJ1HBogji3Orpzo+gr0ug4ZxJUqBjaBuMgj8
+uó*àaPj"µ2wÔ6Þø<C39E>C§_p=;$œ%²‡Sœ
ˆkÏžE¾oª-8

secrets/zulip-rabbitmqPassword.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg uUrI8E1hJ4i9HvhuiIOkS1mq3ndb0+XGKt28QxykWFo
+pfgscE+abzJJCebpnwbJqwX44hpEalpAXqaxpFFZxZA
+-> ssh-ed25519 UHxfvA PHnGkUxtgDq7Ga+ncROQm9SL3Nuc1TsbMY6ygi8GHQ4
+oqkbG58Ic498g/WXAEyyqF3KiP/+3gHWPhq6YjE678w
+-> ssh-ed25519 ZwF9sQ FI2MOOEgVUKaNh5kVzcB47uWkbVpqFEXguw9K+qER38
+t0TkUx2KcGh0VWs9rpWTEcQtDcnzFvf9JPtzi+xaJWI
+--- kaUIyFhjX4STKsMWF895pyYy8x2Jec4nkPJaZfm1hb0
+äí…'ñ*—9.°‰|¿¢ÚÛQ°ÔØ›‡gr”ê†@Û
*Λۅ`O)Ëœp'Z2Õ³W!Ž
Ì÷a!²Þ?VäIÓ(€õ±zæ˜

secrets/zulip-sharedSecretKey.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg 4WzB2cKVeTprMRbzzeWqvUieOAqmge52lLEVJXg8tGA
+RH32zi4PfJKPycdps995m8AX6WuVMVERYrMqJzQwim8
+-> ssh-ed25519 UHxfvA OQCGh+cRuROC9FxKYGQy4dZSXcTkMdR4UAslUDnIxEs
+wTxR9650mpxfuDlfcRXUJ/Gk5K1N0HQAfvhpEQIBLHY
+-> ssh-ed25519 ZwF9sQ PlG426CbQYbRwM7NqMtXIyMnZzucT/lgLqkmznIM9EM
+3Xgy9OoejdHtU7aiXFz3xm1JLMY6gJMGqUq93yLKxS4
+--- G7bINjEQ5e6AAYex0W9GPc4Djn9yd0+J1lmSYYNBwz0
+é#1†Eu¥˜ý³UGnÚCA›¬4ã]¸nÞõóIãŸI­8a/w„KõF©b‘÷Éø<C389>S+OªÚ…a`ð€.>†Žiç¿« Ëï’ÃÔØ]

substitutors.nix

@@ -0,0 +1,8 @@
+{
+  # spectrum
+  nix.settings.substituters = ["https://cache.dataaturservice.se/spectrum/"];
+  nix.settings.trusted-public-keys = [
+    "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+    "spectrum-os.org-2:foQk3r7t2VpRx92CaXb5ROyy/NBdRJQG2uX2XJMYZfU="
+  ];
+}

users.nix

@@ -3,9 +3,7 @@
   lib,
   machine,
   ...
-}: let
-  machines = import ./machines.nix;
-in {
+}: {
   users.users =
     builtins.mapAttrs
     (name: value: lib.mkIf (builtins.elem name machine.users) value)
@@ -13,57 +11,37 @@ in {
       "andromeda" = {
         isNormalUser = true;
         description = "andromeda";
-        hashedPasswordFile = builtins.toString config.age.secrets.secret0.path;
+        hashedPasswordFile = builtins.toString config.age.secrets.andromeda-pw.path;
         extraGroups = [
-          "networkmanager"
-          "wheel"
-        ];
-      };
-      "mtgmonkey" = {
-        isNormalUser = true;
-        description = "mtgmonkey";
-        hashedPasswordFile = builtins.toString config.age.secrets.secret1.path;
-        extraGroups = [
-          (lib.mkIf
-            (machine == machines.lenovo)
-            "networkmanager")
-          "wheel"
-        ];
-        openssh.authorizedKeys.keys = [
-          (lib.mkIf
-            (machine == machines."109-199-104-83")
-            config.pub-keys.ssh.andromeda)
+          "networkmanager" # network configuration
+          "wheel" # serial
+          "dialout" # access to serial ports
         ];
       };
     };
-  environment.persistence."/nix/persist".users = lib.mkIf config.environment.persistence."/nix/persist".enable (
+  environment.persistence."/persist".users = lib.mkIf config.environment.persistence."/persist".enable (
     builtins.mapAttrs
     (name: value: lib.mkIf (builtins.elem name machine.users) value)
     {
       "andromeda" = {
         directories = [
           ".backups"
+          ".gnupg"
+          ".local/share/AAAAXY"
           ".local/share/Anki2"
           ".local/share/chat.fluffy.fluffychat"
-          ".local/share.zoxide"
+          ".local/share/Mindustry"
+          ".local/share/Steam"
+          ".local/share/zoxide"
           ".ssh"
+          ".steam"
           "conf"
           "Downloads"
+          "conf_v1"
           "pp"
         ];
         files = [
           ".bash_history"
-          ".brush_history"
-        ];
-      };
-      "mtgmonkey" = {
-        directories = [
-          ".local/share/zoxide"
-          ".ssh"
-        ];
-        files = [
-          ".bash_history"
-          ".brush_history"
         ];
       };
     }

users/andromeda/home.nix

@@ -16,85 +16,8 @@
         "${config.home.homeDirectory}/${background-path}"
       ];
     };
-  sway_config' = builtins.toFile "sway_config" ''
-    set $mod Mod4
-    set $left h
-    set $down j
-    set $up k
-    set $right l
-    set $term alacritty
-    set $menu wmenu-run
-    set $screenshot grim -g "$(slurp)"
-    floating_modifier $mod normal
-
-    workspace_layout stacking
-    output * bg ${config.home.homeDirectory}/${background-path} fill
-
-    # launch programs
-    bindsym $mod+Shift+Return exec $term
-    bindsym $mod+Shift+d exec $menu
-    bindsym $mod+Shift+a exec anki
-    bindsym $mod+Shift+q exec librewolf
-    bindsym $mod+Shift+s exec $screenshot
-
-    bindsym $mod+Shift+c kill
-
-    bindsym $mod+Shift+r reload
-
-    bindsym $mod+Shift+Alt+q exit
-
-    bindsym $mod+$left focus left
-    bindsym $mod+$down focus down
-    bindsym $mod+$up focus up
-    bindsym $mod+$right focus right
-
-    bindsym $mod+Shift+$left move left
-    bindsym $mod+Shift+$down move down
-    bindsym $mod+Shift+$up move up
-    bindsym $mod+Shift+$right move right
-
-    bindsym $mod+1 workspace number 1
-    bindsym $mod+2 workspace number 2
-    bindsym $mod+3 workspace number 3
-    bindsym $mod+4 workspace number 4
-    bindsym $mod+5 workspace number 5
-    bindsym $mod+6 workspace number 6
-    bindsym $mod+7 workspace number 7
-    bindsym $mod+8 workspace number 8
-    bindsym $mod+9 workspace number 9
-    bindsym $mod+0 workspace number 0
-
-    bindsym $mod+Shift+1 move container to workspace number 1
-    bindsym $mod+Shift+2 move container to workspace number 2
-    bindsym $mod+Shift+3 move container to workspace number 3
-    bindsym $mod+Shift+4 move container to workspace number 4
-    bindsym $mod+Shift+5 move container to workspace number 5
-    bindsym $mod+Shift+6 move container to workspace number 6
-    bindsym $mod+Shift+7 move container to workspace number 7
-    bindsym $mod+Shift+8 move container to workspace number 8
-    bindsym $mod+Shift+9 move container to workspace number 9
-    bindsym $mod+Shift+0 move container to workspace number 0
-
-    bindsym $mod+f fullscreen
-    bindsym $mod+Shift+space floating toggle
-    bindsym $mod+Shift+minus move scratchpad
-    bindsym $mod+minus scratchpad show
-
-    bindsym --locked XF86AudioMute exec pactl set-sink-mute \@DEFAULT_SINK@ toggle
-    bindsym --locked XF86AudioLowerVolume exec pactl set-sink-volume \@DEFAULT_SINK@ -5%
-    bindsym --locked XF86AudioRaiseVolume exec pactl set-sink-volume \@DEFAULT_SINK@ +5%
-    bindsym --locked XF86AudioMicMute exec pact set-source-mute \@DEFAULT_SOURCE@ toggle
-    bindsym --locked XF86MonBrightnessDown exec brightnessctl set 5%-
-    bindsym --locked XF86MonbrightnessUp exec brightnessctl set 5%+
-
-    default_border none
-    font pango:monospace 0.001
-    titlebar_border_thickness 0
-    titlebar_padding 0
-  '';
 in {
   imports = [./stylix.nix];
-  xdg.configFile."shell".source = lib.getExe pkgs.brush;
   xdg.configFile."sway/config".source = lib.mkForce sway_config;
   wayland.windowManager.sway.enable = true;
   home = {
@@ -102,25 +25,35 @@ in {
     homeDirectory = "/home/${config.home.username}";
     stateVersion = "26.05";
     packages = [
+      pkgs.aaaaxy
       pkgs.acpi
       pkgs.agenix
       pkgs.alacritty
       pkgs.anki
+      pkgs.anki-cli
       pkgs.brightnessctl
-      pkgs.brush
       pkgs.dust
       pkgs.fluffychat
       pkgs.fzf
+      pkgs.gdb
+      pkgs.geeqie
       pkgs.glow
       pkgs.grim
+      pkgs.hexdump
+      pkgs.http-server
       pkgs.jmtpfs
+      pkgs.mindustry-wayland
+      pkgs.nasm
       pkgs.nix-output-monitor
+      pkgs.npins
       pkgs.ranger
       pkgs.rip2
       pkgs.ripgrep
       pkgs.slurp
+      pkgs.tokei
       pkgs.tree
-      pkgs.zoxide
+      pkgs.wget
+      pkgs.xxd
     ];
     file.${background-path}.source = config.stylix.image;
   };
@@ -128,6 +61,7 @@ in {
     alacritty.enable = true;
     bash = {
       enable = true;
+      enableCompletion = false;
       shellAliases = {
         neofetch = "fastfetch";
         ls = lib.mkForce "lsd";
@@ -139,7 +73,6 @@ in {
       };
       bashrcExtra = ''
         PS1="\u@\h:\w$"
-        eval "$(zoxide init bash)"
       '';
     };
     btop = {
@@ -167,6 +100,30 @@ in {
       };
     };
     fastfetch.enable = true;
+    firefox = {
+      enable = true;
+      package = pkgs.firefox.override {
+        cfg.enableTridactylNative = true;
+      };
+      profiles.${config.home.username} = {
+        extensions = {
+          force = true;
+          packages = [
+            pkgs.nur.repos.rycee.firefox-addons.tridactyl
+          ];
+        };
+        search = {
+          default = "DuckDuckGo (HTML)";
+          privateDefault = "DuckDuckGo (HTML)";
+          order = [
+            "DuckDuckGo (HTML)"
+          ];
+        };
+        settings = {
+          "extensions.autoDisableScopes" = 0;
+        };
+      };
+    };
     git = {
       enable = true;
       settings = {
@@ -178,20 +135,15 @@ in {
       };
     };
     gh.enable = true;
-    home-manager.enable = true;
-    firefox = {
+    gpg = {
       enable = true;
-      package = pkgs.firefox.override {
-        cfg.enableTridactylNative = true;
-      };
-      profiles.${config.home.username}.extensions.packages = [
-        pkgs.nur.repos.rycee.firefox-addons.tridactyl
-      ];
     };
+    home-manager.enable = true;
     lsd.enable = true;
     nvf = {
       enable = true;
       settings.vim = {
+        startPlugins = [pkgs.vimPlugins.parinfer-rust];
         autocomplete.nvim-cmp.enable = false;
         formatter.conform-nvim = {
           enable = true;
@@ -259,6 +211,12 @@ in {
             enable = true;
             lsp.enable = true;
           };
+          rust = {
+            enable = true;
+            format.enable = true;
+            lsp.enable = true;
+            treesitter.enable = true;
+          };
         };
         lineNumberMode = "relative";
         options = {
@@ -275,5 +233,13 @@ in {
       };
     };
     ssh.enable = true;
+    zoxide = {
+      enable = true;
+      enableBashIntegration = true;
+    };
+  };
+  services.gpg-agent = {
+    enable = true;
+    pinentry.package = pkgs.pinentry-curses;
   };
 }

users/andromeda/sway_config

@@ -55,6 +55,12 @@ bindsym $mod+Shift+8 move container to workspace number 8
 bindsym $mod+Shift+9 move container to workspace number 9
 bindsym $mod+Shift+0 move container to workspace number 0
 
+seat * hide_cursor 100
+input type:touchpad events disabled
+
+bindsym $mod+r exec 'swaymsg "seat * hide_cursor 100"; swaymsg "input type:touchpad events disabled"'
+bindsym $mod+t exec 'swaymsg "seat * hide_cursor 0"; swaymsg "input type:touchpad events enabled"'
+
 bindsym $mod+f fullscreen
 bindsym $mod+Shift+space floating toggle
 bindsym $mod+Shift+minus move scratchpad
@@ -64,8 +70,8 @@ bindsym --locked XF86AudioMute exec pactl set-sink-mute \@DEFAULT_SINK@ toggle
 bindsym --locked XF86AudioLowerVolume exec pactl set-sink-volume \@DEFAULT_SINK@ -5%
 bindsym --locked XF86AudioRaiseVolume exec pactl set-sink-volume \@DEFAULT_SINK@ +5%
 bindsym --locked XF86AudioMicMute exec pact set-source-mute \@DEFAULT_SOURCE@ toggle
-bindsym --locked XF86MonBrightnessDown exec brightnessctl set 5%-
-bindsym --locked XF86MonbrightnessUp exec brightnessctl set 5%+
+bindsym --locked XF86MonBrightnessDown exec brightnessctl set 2%-
+bindsym --locked XF86MonbrightnessUp exec brightnessctl set 2%+
 
 default_border none
 font pango:monospace 0.001

users/mtgmonkey/home.nix

@@ -1,172 +0,0 @@
-{
-  config,
-  lib,
-  machine,
-  pkgs,
-  ...
-}: {
-  imports = [./stylix.nix];
-  xdg.configFile."shell".source = lib.getExe pkgs.brush;
-  home = {
-    username = "mtgmonkey";
-    homeDirectory = "/home/${config.home.username}";
-    stateVersion = "26.05";
-    packages = [
-      pkgs.acpi
-      pkgs.brightnessctl
-      pkgs.brush
-      pkgs.dust
-      pkgs.fzf
-      pkgs.glow
-      pkgs.jmtpfs
-      pkgs.nix-output-monitor
-      pkgs.ranger
-      pkgs.rip2
-      pkgs.ripgrep
-      pkgs.tree
-      pkgs.zoxide
-    ];
-  };
-  programs = {
-    bash = {
-      enable = true;
-      shellAliases = {
-        neofetch = "fastfetch";
-        ls = lib.mkForce "lsd";
-        ll = lib.mkForce "lsd -l";
-        l = "lsd -la";
-        cd = "z";
-        gg = "git log --oneline --abbrev-commit --all --graph --decorate --color";
-        md = "glow";
-      };
-      bashrcExtra = ''
-        PS1="\u@\h:\w$"
-        eval "$(zoxide init bash)"
-      '';
-    };
-    btop = {
-      enable = true;
-      settings = {
-        theme_background = false;
-        vim_keys = true;
-        rounded_corners = false;
-        graph_symbol = "braille";
-        update_ms = 150;
-        proc_sorting = "cpu lazy";
-        proc_gradient = false;
-        proc_left = true;
-        cpu_single_graph = true;
-        cpu_bottom = true;
-        clock_format = "/user@/host:/uptime@%H:%M";
-        background_update = true;
-        mem_graphs = false;
-        mem_below_net = true;
-        show_swap = false;
-        only_physical = true;
-        show_io_stat = true;
-        io_mode = false;
-        io_graph_combined = false;
-      };
-    };
-    fastfetch.enable = true;
-    git = {
-      enable = true;
-      settings = {
-        user = {
-          name = config.home.username;
-          email = "${config.home.username}@${machine.hostname}";
-        };
-        init.defaultBranch = "master";
-      };
-    };
-    gh.enable = true;
-    home-manager.enable = true;
-    lsd.enable = true;
-    nvf = {
-      enable = true;
-      settings.vim = {
-        autocomplete.nvim-cmp.enable = false;
-        formatter.conform-nvim = {
-          enable = true;
-          setupOpts.format_on_save = {
-            lsp_format = "fallback";
-            timeout_ms = 5000;
-          };
-        };
-        lsp.otter-nvim.enable = true;
-        git.enable = true;
-        keymaps = [
-          {
-            key = "<Down>";
-            mode = ["i" "n" "v" "c"];
-            action = "<NOP>";
-          }
-          {
-            key = "<Up>";
-            mode = ["i" "n" "v" "c"];
-            action = "<NOP>";
-          }
-          {
-            key = "<Left>";
-            mode = ["i" "n" "v" "c"];
-            action = "<NOP>";
-          }
-          {
-            key = "<Right>";
-            mode = ["i" "n" "v" "c"];
-            action = "<NOP>";
-          }
-          {
-            key = "jj";
-            mode = ["i"];
-            action = "<Esc>";
-          }
-          {
-            key = "kk";
-            mode = ["i"];
-            action = "<Esc>";
-          }
-          {
-            key = "jk";
-            mode = ["i"];
-            action = "<Esc>";
-          }
-          {
-            key = "kj";
-            mode = ["i"];
-            action = "<Esc>";
-          }
-          {
-            key = "<Esc>";
-            mode = ["i"];
-            action = "<Nop>";
-          }
-        ];
-        languages = {
-          nix = {
-            enable = true;
-            format.enable = true;
-            lsp.enable = true;
-          };
-          haskell = {
-            enable = true;
-            lsp.enable = true;
-          };
-        };
-        lineNumberMode = "relative";
-        options = {
-          tabstop = 2;
-          shiftwidth = 2;
-          expandtab = true;
-          smarttab = true;
-          foldmethod = "indent";
-          number = true;
-          colorcolumn = "80";
-        };
-        statusline.lualine.enable = true;
-        syntaxHighlighting = true;
-      };
-    };
-    ssh.enable = true;
-  };
-}

users/mtgmonkey/stylix.nix

@@ -1,29 +0,0 @@
-{
-  pkgs,
-  config,
-  ...
-}: {
-  stylix = {
-    enable = true;
-    # rebecca has lavener bkg
-    # tube has dark gray bkg
-    # silk-light is light theme
-    base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-material-dark-hard.yaml";
-    polarity = "dark";
-    fonts = {
-      monospace = {
-        package = pkgs.miracode;
-        name = "Miracode";
-      };
-      serif = config.stylix.fonts.sansSerif;
-      emoji = {
-        package = pkgs.noto-fonts-color-emoji;
-        name = "Noto Color Emoji";
-      };
-      sizes = {
-        applications = 12;
-        terminal = 10;
-      };
-    };
-  };
-}