fix(scripts): correct aichat role syntax

feat(virtualisation): Added waydroid
chore(structure): moved all individual home.packages into their own files

.ignore

@@ -0,0 +1 @@
+*.lock

Makefile

@@ -1,9 +1,9 @@
-.PHONY: darwin home default nixos just
+.PHONY: darwin home default nixos install
 
-default: just
+default: install
 
-just:
+install:
-	just
+	sudo nixos-rebuild switch --flake . --builders '' --max-jobs 1
 
 build:
 	sudo nixos-rebuild build --flake . --show-trace

README.md

@@ -1,6 +1,6 @@
 # Machines
 
-1. Ryu Dektop (Intel i9-14900KS / Nvidia 5090 / DDR5 64GB CL36@6000MTs) 
+1. Ryu Dektop (Intel i9-14900KS / Nvidia RTX 5090 / DDR5 64GB CL36@6000MTs) 
     ```
     deploy -s .#ryu
     ```

darwin/default.nix

@@ -3,6 +3,7 @@
   inputs,
   nix-darwin,
   overlays,
+  nixpkgs,
   ...
 }: (builtins.mapAttrs (
     name: device:
@@ -11,6 +12,7 @@
         specialArgs = {
           inherit device inputs;
           stablePkgs = inputs.nixpkgs-stable.legacyPackages.${device.system};
+          cratesNix = inputs.crates-nix.mkLib {pkgs = nixpkgs.legacyPackages.${device.system};};
         };
         modules = [
           inputs.home-manager.darwinModules.home-manager

darwin/kuro/configuration.nix

@@ -28,7 +28,7 @@
       extra-nix-path = nixpkgs=flake:nixpkgs
       builders-use-substitutes = true
     '';
-    package = pkgs.nixVersions.latest;
+    package = pkgs.nixVersions.nix_2_32;
     buildMachines = [
       ../../builders/tako.nix
       ../../builders/shiro.nix

darwin/kuro/homebrew.nix

@@ -8,11 +8,8 @@
       "lunar"
       "orcaslicer"
       "raycast"
-      "shapr3d"
-      "vlc"
       "zed"
       "zen"
-      "lm-studio"
     ];
   };
 }

darwin/kuro/services/tailscale.nix

@@ -1,6 +1,5 @@
-{stablePkgs, ...}: {
+{...}: {
   services.tailscale = {
     enable = true;
-    package = stablePkgs.tailscale;
   };
 }

darwin/shiro/configuration.nix

@@ -35,7 +35,7 @@
     distributedBuilds = true;
   };
 
-  users.users.servius = {
+  users.users.${device.user} = {
     # isNormalUser = true;
     openssh.authorizedKeys.keyFiles = [
       ../../secrets/id_ed25519.pub

darwin/shiro/homebrew.nix

@@ -5,12 +5,10 @@
       "docker-compose"
     ];
     casks = [
+      "1password"
       "docker"
       "raycast"
       "lunar"
-      "virtual-desktop-streamer"
-      "kicad"
-      "shapr3d"
       "orcaslicer"
       "zed"
       "zen"

flake.nix

@@ -3,7 +3,7 @@
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
     nixpkgs-master.url = "github:nixos/nixpkgs/master";
-    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-25.05";
+    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-25.11";
     flake-utils.url = "github:numtide/flake-utils";
     disko = {
       url = "github:nix-community/disko/latest";
@@ -18,11 +18,11 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     stylix-stable = {
-      url = "github:nix-community/stylix/release-25.05";
+      url = "github:nix-community/stylix/release-25.11";
       inputs.nixpkgs.follows = "nixpkgs-stable";
     };
     home-manager-stable = {
-      url = "github:nix-community/home-manager/release-25.05";
+      url = "github:nix-community/home-manager/release-25.11";
       inputs.nixpkgs.follows = "nixpkgs-stable";
     };
     nix-darwin = {
@@ -189,11 +189,6 @@
       url = "github:uttarayan21/ddcbacklight";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    command-runner = {
-      url = "github:uttarayan21/command-runner";
-      # url = "path:/home/servius/Projects/command-runner";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     hyprmonitors = {
       url = "git+https://git.darksailor.dev/servius/hyprmonitors";
       # url = "path:/home/servius/Projects/hyprmonitors";
@@ -230,7 +225,14 @@
       url = "github:xatuke/handoff";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    crates-nix.url = "github:uttarayan21/crates.nix";
+    crates-io-index = {
+      url = "git+https://github.com/rust-lang/crates.io-index?shallow=1";
+      flake = false;
+    };
+    crates-nix = {
+      url = "github:uttarayan21/crates.nix";
+      inputs.crates-io-index.follows = "crates-io-index";
+    };
     headplane = {
       url = "github:tale/headplane";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -243,6 +245,13 @@
       url = "github:uttarayan21/wivrn?submodules=1";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    eilmeldung = {
+      url = "github:christo-auer/eilmeldung";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    hytale-launcher = {
+      url = "github:JPyke3/hytale-launcher-nix";
+    };
   };
 
   outputs = {
@@ -338,6 +347,14 @@
         if isDarwin
         then "/Users/${device.user}"
         else "/home/${device.user}";
+      uid =
+        if (builtins.hasAttr "uid" device)
+        then device.uid
+        else 1000;
+      gid =
+        if (builtins.hasAttr "gid" device)
+        then device.gid
+        else 1000;
       # output =
       #   if isDarwin
       #   then self.darwinConfigurations."${device.name}"
@@ -419,7 +436,7 @@
         # };
         devShells = {
           default = pkgs.mkShell {
-            packages = with pkgs; [sops just openssl];
+            packages = with pkgs; [sops just openssl ast-grep];
           };
         };
       }

home/accounts/fastmail.nix

@@ -15,6 +15,7 @@
         };
         primary = true;
         address = "email@uttarayan.me";
+        aliases = ["servius@darksailor.dev"];
         userName = address;
         realName = "Uttarayan Mondal";
         imap = {

home/apps/default.nix

@@ -13,10 +13,10 @@ lib.optionalAttrs device.hasGui {
     ./discord.nix
     ./firefox.nix
     ./ghostty.nix
-    ./gimp.nix
+    # ./gimp.nix
     # ./guitarix.nix
     ./hyprpicker.nix
-    ./ida.nix
+    # ./ida.nix
     # ./jellyflix.nix
     # ./kicad.nix
     ./kitty.nix
@@ -30,14 +30,14 @@ lib.optionalAttrs device.hasGui {
     # ./pcsx2.nix
     ./prismlauncher.nix
     # ./rpcs3.nix
-    # ./shadps4.nix
+    ./shadps4.nix
     ./slack.nix
     # ./thunderbird.nix
     # ./tsukimi.nix
     # ./vial.nix
     ./vicinae.nix
     ./vlc.nix
-    ./vscode.nix
+    # ./vscode.nix
     ./wezterm.nix
     ./zathura.nix
     ./zed.nix

home/apps/discord.nix

@@ -4,9 +4,12 @@
   ...
 }: {
   home.packages = lib.optionals pkgs.stdenv.isLinux [
-    pkgs.discord
+    (pkgs.discord.override {
-    pkgs.vesktop
+      withOpenASAR = true;
-    pkgs.discord-canary
+      withVencord = true;
-    pkgs.discord-ptb
+    })
+    # pkgs.vesktop
+    # pkgs.discord-canary
+    # pkgs.discord-ptb
   ];
 }

home/apps/ghostty.nix

@@ -12,10 +12,63 @@
         "Hasklug Nerd Font Mono"
       ];
       window-decoration = false;
-      title = "";
+      title = "ghostty";
       command = "fish";
       background-opacity = 0.8;
       theme = "catppuccin-mocha";
+      custom-shader = "~/.config/ghostty/shader.glsl";
+      # custom-shader = toString (pkgs.writeText "shader.glsl"
+      #   /*
+      #   glsl
+      #   */
+      #   ''
+      #     const float CURSOR_ANIMATION_SPEED = 150.0; // ms
+      #     const float TRAILING_CURSORS = 3.0;
+      #     bool at_pos(vec2 fragCoord, vec2 pos, vec2 size) {
+      #         return (pos.x <= fragCoord.x && fragCoord.x <= pos.x + size.x &&
+      #             pos.y - size.y <= fragCoord.y && fragCoord.y <= pos.y);
+      #     }
+      #     void mainImage(out vec4 fragColor, in vec2 fragCoord) {
+      #         // Normalized pixel coordinates (from 0 to 1)
+      #         vec2 uv = fragCoord / iResolution.xy;
+      #         vec2 current_cursor = iCurrentCursor.xy;
+      #         vec2 previous_cursor = iPreviousCursor.xy;
+      #         float time_passed = (iTime - iTimeCursorChange) * 1000.0; // in ms
+      #
+      #         if (time_passed > CURSOR_ANIMATION_SPEED) {
+      #             // No animation, just render normally
+      #             fragColor = texture(iChannel0, uv);
+      #             return;
+      #         }
+      #         // Animate cursor meovement
+      #         vec4 col = texture(iChannel0, uv);
+      #         // linear interpolation between current and previous cursor position based on time passed
+      #         vec2 animated_cursor_pos = mix(previous_cursor, current_cursor, time_passed / CURSOR_ANIMATION_SPEED);
+      #         // make 3 trailing cursors for smoother animation
+      #         for (int i = 1; i <= int(TRAILING_CURSORS); i++) {
+      #             float t = float(i) / TRAILING_CURSORS;
+      #             vec2 trail_pos = mix(previous_cursor, current_cursor, (time_passed / CURSOR_ANIMATION_SPEED) * t);
+      #             if (at_pos(fragCoord, trail_pos, iCurrentCursor.zw)) {
+      #                 col = mix(col, iCurrentCursorColor, t);
+      #             }
+      #         }
+      #
+      #         // vec4 cursor_color = mix(iPreviousCursorColor, iCurrentCursorColor, time_passed / CURSOR_ANIMATION_SPEED);
+      #         vec4 cursor_color = iCurrentCursorColor; // no color animation for now
+      #         vec2 cursor_size = iCurrentCursor.zw;
+      #         // check if fragCoord is within the animated cursor rectangle
+      #         // y is in the negative direction
+      #         // if (animated_cursor_pos.x <= fragCoord.x && fragCoord.x <= animated_cursor_pos.x + cursor_size.x &&
+      #         //         animated_cursor_pos.y - cursor_size.y <= fragCoord.y && fragCoord.y <= animated_cursor_pos.y) {
+      #         //     col = cursor_color;
+      #         // }
+      #         if (at_pos(fragCoord, animated_cursor_pos, cursor_size)) {
+      #             col = cursor_color;
+      #         }
+      #
+      #         fragColor = col;
+      #     }
+      #   '');
     };
     systemd.enable = true;
     themes = {

home/apps/mpv.nix

@@ -1,6 +1,6 @@
 {pkgs, ...}: {
   programs.mpv = {
-    enable = true;
+    enable = pkgs.stdenv.isLinux;
     config = {
       vo = "gpu-next";
       gpu-api = "vulkan";
@@ -23,10 +23,5 @@
         gamut-mapping = "desaturate";
       };
     };
-
-    package =
-      if pkgs.stdenv.isLinux
-      then pkgs.mpv-unwrapped.wrapper {mpv = pkgs.mpv-unwrapped.override {sixelSupport = true;};}
-      else pkgs.mpv;
   };
 }

home/apps/shadps4.nix

@@ -2,12 +2,122 @@
   pkgs,
   lib,
   ...
-}: {
+}: let
+  shadps4_qtlauncher = pkgs.fetchFromGitHub {
+    owner = "shadps4-emu";
+    repo = "shadps4-qtlauncher";
+    rev = "1f4e59f6110d5f991cead5a3e9f72671fced2c70";
+    sha256 = "sha256-AAxj3Eqp7iGJgRgJki/93fln5Z6ae8AydJLGZ6Dbb00=";
+    fetchSubmodules = true;
+  };
+  # diegolixShadps4 = pkgs.fetchFromGitHub {
+  #   owner = "diegolix";
+  #   repo = "shadps4-qtlauncher";
+  #   rev = "a1b2c3d4e5f67890123456789abcdef01234567";
+  #   sha256 = "sha256-PLACEHOLDERFORHASHVALUE1234567890ABCDEFGH=";
+  #   fetchSubmodules = true;
+  # };
+  bblauncher = pkgs.fetchFromGitHub {
+    owner = "rainmakerv3";
+    repo = "BB_Launcher";
+    rev = "2280c90974d2d741ce927dfc88f0ecf98c8bd2df";
+    sha256 = "sha256-jPcIQp2EBAEiaTLvC/OBH0BgcfYv3zo2H7akHJSlPaI=";
+    fetchSubmodules = true;
+  };
+in {
   home.packages = lib.optionals pkgs.stdenv.isLinux [
     (pkgs.shadps4.overrideAttrs
       (oldAttrs: {
         nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [pkgs.cudatoolkit];
         buildInputs = oldAttrs.buildInputs ++ [pkgs.cudatoolkit];
       }))
+    (pkgs.stdenv.mkDerivation {
+      pname = "shadps4-qt";
+      version = "1.0.0";
+      src = shadps4_qtlauncher;
+      nativeBuildInputs = [
+        pkgs.cmake
+        pkgs.pkg-config
+        pkgs.qt6.wrapQtAppsHook
+      ];
+      buildInputs = [
+        pkgs.alsa-lib
+        pkgs.ffmpeg
+        pkgs.fmt
+        pkgs.glslang
+        pkgs.jack2
+        pkgs.libedit
+        pkgs.libevdev
+        pkgs.libpng
+        pkgs.libpulseaudio
+        pkgs.libxkbcommon
+        pkgs.openal
+        pkgs.openssl
+        pkgs.qt6.qtbase
+        pkgs.qt6.qtmultimedia
+        pkgs.qt6.qttools
+        pkgs.qt6.qtwayland
+        pkgs.SDL2
+        pkgs.sdl3
+        pkgs.sndio
+        pkgs.stb
+        pkgs.udev
+        pkgs.vulkan-headers
+        pkgs.vulkan-tools
+        pkgs.vulkan-utility-libraries
+        pkgs.wayland
+        pkgs.wayland-protocols
+        pkgs.xorg.libxcb
+        pkgs.xorg.xcbutil
+        pkgs.xorg.xcbutilkeysyms
+        pkgs.xorg.xcbutilwm
+        pkgs.zlib
+      ];
+    })
+
+    (pkgs.stdenv.mkDerivation {
+      pname = "BBLauncher";
+      version = "1.0.0";
+      src = bblauncher;
+      nativeBuildInputs = [
+        pkgs.cmake
+        pkgs.pkg-config
+        pkgs.qt6.wrapQtAppsHook
+      ];
+      buildInputs = [
+        pkgs.alsa-lib
+        pkgs.ffmpeg
+        pkgs.fmt
+        pkgs.glslang
+        pkgs.jack2
+        pkgs.libedit
+        pkgs.libevdev
+        pkgs.libpng
+        pkgs.libpulseaudio
+        pkgs.libxkbcommon
+        pkgs.openal
+        pkgs.openssl
+        pkgs.qt6.qtbase
+        pkgs.qt6.qtmultimedia
+        pkgs.qt6.qttools
+        pkgs.qt6.qtwayland
+        pkgs.qt6.qtwebview
+        pkgs.SDL2
+        pkgs.sdl3
+        pkgs.sndio
+        pkgs.stb
+        pkgs.udev
+        pkgs.vulkan-headers
+        pkgs.vulkan-tools
+        pkgs.vulkan-utility-libraries
+        pkgs.wayland
+        pkgs.wayland-protocols
+        pkgs.xorg.libxcb
+        pkgs.xorg.xcbutil
+        pkgs.xorg.xcbutilkeysyms
+        pkgs.xorg.xcbutilwm
+        pkgs.zlib
+      ];
+    })
   ];
 }

home/apps/vicinae.nix

@@ -7,10 +7,12 @@
   imports = [inputs.vicinae.homeManagerModules.default];
   services.vicinae = {
     enable = device.is "ryu";
-    autoStart = true;
+    systemd = {
-    extensions = [];
+      enable = true;
-    # package = pkgs.vicinae.overrideAttrs (old: {
+      autoStart = true;
-    #   patches = [../../patches/vicinae-ctrl-np.patch];
+    };
-    # });
   };
+  home.packages = with pkgs; [
+    pulseaudio
+  ];
 }

home/apps/zed.nix

@@ -175,7 +175,7 @@
         };
       }
     ];
-    package = stablePkgs.zed-editor;
+    package = pkgs.zed-editor;
     extraPackages = with pkgs; [
       nixd
       nil

home/default.nix

@@ -15,12 +15,12 @@
     ./scripts.nix
     ./services
     ./accounts
+    ./fonts.nix
   ];
 
   xdg.enable = true;
   xdg.userDirs = {
     enable = device.isLinux;
-    # music = "${config.home.homeDirectory}/Nextcloud/Music";
   };
 
   programs = {
@@ -35,26 +35,6 @@
     username = device.user;
     homeDirectory = lib.mkForce device.home;
 
-    file = {
-      ".config/fish/themes".source = pkgs.catppuccinThemes.fish + "/themes";
-      ".cargo/config.toml".text =
-        # toml
-        ''
-          [alias]
-          lldb = ["with", "rust-lldb", "--"]
-          t = ["nextest", "run"]
-
-          [net]
-          git-fetch-with-cli = true
-
-          [registries.catscii]
-          index = "https://git.shipyard.rs/catscii/crate-index.git"
-
-          [http]
-          user-agent = "shipyard J0/QFq2Sa5y6nTxJQAb8t+e/3qLSub1/sa3zn0leZv6LKG/zmQcoikT9U3xPwbzp8hQ="
-        '';
-    };
-
     sessionVariables = {
       EDITOR = "nvim";
       SHELL = "${pkgs.bash}/bin/bash";

home/fonts.nix

@@ -0,0 +1,20 @@
+{
+  pkgs,
+  device,
+  ...
+}: {
+  home.packages = with pkgs;
+    lib.optionals (!device.isServer) [
+      monaspace
+      nerd-fonts.fira-code
+      nerd-fonts.hasklug
+      nerd-fonts.symbols-only
+      noto-fonts
+      noto-fonts-cjk-sans
+      noto-fonts-color-emoji
+      liberation_ttf
+      fira-code
+      fira-code-symbols
+      mplus-outline-fonts.githubRelease
+    ];
+}

home/module.nix

@@ -1,6 +1,7 @@
 {
   device,
   inputs,
+  pkgs,
   ...
 }: {
   nixpkgs.config.allowUnfree = true;
@@ -12,6 +13,7 @@
       inherit inputs;
       inherit device;
       stablePkgs = inputs.nixpkgs-stable.legacyPackages.${device.system};
+      cratesNix = inputs.crates-nix.mkLib {inherit pkgs;};
     };
     users.${device.user}.imports = [
       inputs.nixvim.homeModules.nixvim

home/programs/1password-cli.nix

@@ -0,0 +1,5 @@
+{pkgs, ...}: {
+  home.packages = [
+    pkgs._1password-cli
+  ];
+}

home/programs/aichat.nix

@@ -1,4 +1,8 @@
-{config, ...}: {
+{
+  pkgs,
+  config,
+  ...
+}: {
   sops = {
     secrets."llama/api_key" = {};
     secrets."openai/api_key" = {};
@@ -16,25 +20,30 @@
     enableNushellIntegration = false;
     settings = {
       save_session = true;
-      # model = "openai:gpt-4o";
+      model = "ryu:qwen3:30b-a3b";
-      model = "ryu:qwen3-coder-30b";
+      rag_embedding_model = "ryu:RobinBially/nomic-embed-text-8k";
-      rag_embedding_model = "ollama:RobinBially/nomic-embed-text-8k";
       clients = [
         {
           type = "openai-compatible";
-          name = "mirai";
+          name = "ryu";
           api_base = "https://ollama.darksailor.dev/v1";
           api_key_cmd = "cat ${config.sops.secrets."llama/api_key".path}";
           models = [
-            # {
-            #   name = "RobinBially/nomic-embed-text-8k";
-            #   type = "embedding";
-            #   default_chunk_size = 8000;
-            # }
             {
-              name = "gpt-oss-20b";
+              name = "gpt-oss:20b";
               type = "chat";
             }
+            {
+              name = "qwen3:30b-a3b";
+              type = "chat";
+            }
+            {
+              name = "RobinBially/nomic-embed-text-8k";
+              type = "embedding";
+              default_chunk_size = 1000;
+              max_tokens_per_chunk = 8192;
+              max_batch_size = 100;
+            }
             # {
             #   name = "deepseek-r1:14b";
             #   type = "chat";
@@ -45,42 +54,6 @@
             # }
           ];
         }
-        {
-          type = "openai-compatible";
-          name = "ryu";
-          api_base = "https://llama.ryu.darksailor.dev/v1";
-          models = [
-            {
-              name = "qwen3-coder-30b";
-              type = "chat";
-            }
-            # {
-            #   name = "RobinBially/nomic-embed-text-8k";
-            #   type = "embedding";
-            #   default_chunk_size = 8000;
-            # }
-            # {
-            #   name = "deepseek-r1:7b";
-            #   type = "chat";
-            # }
-            # {
-            #   name = "qwen3:30b-a3b";
-            #   type = "chat";
-            # }
-            # {
-            #   name = "deepseek-r1:14b";
-            #   type = "chat";
-            # }
-            # {
-            #   name = "qwen3:8b";
-            #   type = "chat";
-            # }
-            # {
-            #   name = "qwen3:14b";
-            #   type = "chat";
-            # }
-          ];
-        }
         {
           type = "gemini";
           name = "gemini";
@@ -166,18 +139,29 @@
           };
         }
       ];
+      document_loaders = {
+        git =
+          /*
+          sh
+          */
+          ''sh -c "yek $1 --json | jq '[.[] | { path: .filename, contents: .content }]'"'';
+      };
     };
     roles = {
-      "%git-commit%" =
+      "git-commit" =
         /*
         md
         */
         ''
           ---
-          model: ryu:qwen3-coder-30b
+          model: ryu:gpt-oss:20b
           ---
           Your task is to generate a concise and informative commit message based on the provided diff. Use the conventional commit format, which includes a type (feat, fix, chore, docs, style, refactor, perf, test) and an optional scope. The message should be in the imperative mood and should not exceed 72 characters in the subject line. Do not under any circumstance include any additional text or explanations, just add the commit message.
         '';
     };
+    extraPackages = with pkgs; [
+      jq
+      yek
+    ];
   };
 }

home/programs/alejandra.nix

@@ -0,0 +1 @@
+{pkgs, ...}: {home.packages = [pkgs.alejandra];}

home/programs/aria2.nix

@@ -0,0 +1 @@
+{pkgs, ...}: {home.packages = [pkgs.aria2];}

home/programs/ast-grep.nix

@@ -0,0 +1 @@
+{pkgs, ...}: {home.packages = [pkgs.ast-grep];}

home/programs/atuin.nix

@@ -9,9 +9,49 @@
       auto_sync = true;
       sync_frequency = "1m";
       sync_address = "https://atuin.darksailor.dev";
+      sync = {
+        records = true;
+      };
+      daemon = {
+        enabled = true;
+      };
     };
     enable = true;
     enableFishIntegration = true;
     enableNushellIntegration = true;
   };
+  systemd.user.services.atuin-daemon = {
+    Unit = {
+      Description = "Atuin Daemon";
+      After = ["network.target"];
+    };
+    Install = {
+      WantedBy = ["default.target"];
+    };
+    Service = {
+      ExecStart = "${pkgs.atuin}/bin/atuin daemon";
+      Restart = "on-failure";
+      RestartSec = "10s";
+      # Environment = lib.mkForce "ATUIN_DATA_DIR=${device.home}/.local/share/atuin";
+    };
+  };
+  launchd.agents.atuin-daemon = {
+    enable = true;
+    config = {
+      # A label for the service
+      Label = "dev.darksailor.atuin-daemon";
+      # The command to run
+      ProgramArguments = [
+        "${pkgs.atuin}/bin/atuin"
+        "daemon"
+      ];
+      # Run the service when you log in
+      RunAtLoad = true;
+      # Keep the process alive, or restart if it dies
+      KeepAlive = true;
+      # Log files
+      StandardOutPath = "${device.home}/Library/Logs/atuin-daemon.log";
+      StandardErrorPath = "${device.home}/Library/Logs/atuin-daemon.error.log";
+    };
+  };
 }

home/programs/bat.nix

@@ -1,11 +1,5 @@
-{
+{...}: {
-  pkgs,
+  programs.bat = {
-  lib,
-  device,
-  ...
-}: {
-  programs.
-    bat = {
     enable = true;
     # extraPackages = with pkgs.bat-extras; [batman batgrep batwatch];
   };

home/programs/binwalk.nix

@@ -0,0 +1 @@
+{pkgs, ...}: {home.packages = [pkgs.binwalk];}

home/programs/bottom.nix

@@ -0,0 +1 @@
+{pkgs, ...}: {home.packages = [pkgs.bottom];}

home/programs/btop.nix

@@ -0,0 +1 @@
+{pkgs, ...}: {home.packages = [pkgs.btop];}

home/programs/cachix.nix

@@ -0,0 +1 @@
+{pkgs, ...}: {home.packages = [pkgs.cachix];}

home/programs/cargo.nix

@@ -0,0 +1,27 @@
+{
+  lib,
+  device,
+  cratesNix,
+  ...
+}:
+lib.mkIf (!device.isServer) {
+  home.file.".cargo/config.toml".text =
+    # toml
+    ''
+      [alias]
+      lldb = ["with", "rust-lldb", "--"]
+      t = ["nextest", "run"]
+
+      [net]
+      git-fetch-with-cli = true
+
+      [registries.kellnr]
+      index = "sparse+https://crates.darksailor.dev/api/v1/crates/"
+
+      [registry]
+      global-credential-providers = ["cargo:token", "/etc/profiles/per-user/fs0c131y/bin/cargo-credential-1password --account my.1password.com"]
+    '';
+  home.packages = [
+    (cratesNix.buildCrate "cargo-credential-1password" {})
+  ];
+}

home/programs/default.nix

@@ -5,100 +5,75 @@
 }: {
   imports = [
     ../../modules
+    ./1password-cli.nix
     ./aichat.nix
+    ./alejandra.nix
+    ./aria2.nix
+    ./ast-grep.nix
     ./atuin.nix
     ./bat.nix
-    # ./bluetui.nix
+    ./bottom.nix
+    ./btop.nix
+    ./cachix.nix
     ./carapace.nix
     ./ddcbacklight.nix
+    ./deploy-rs.nix
     ./direnv.nix
+    ./dust.nix
+    ./eilmeldung.nix
     ./eza.nix
     ./fastfetch.nix
+    ./fd.nix
+    ./file.nix
     ./fish.nix
     ./fzf.nix
     ./gh.nix
     ./git.nix
+    ./gnupg.nix
     ./himalaya.nix
-    ./mpd.nix
+    ./hyprshade.nix
+    ./jq.nix
+    ./just.nix
     ./ncpamixer.nix
     ./neomutt.nix
     ./neovim.nix
-    ./nh.nix
     ./nix-index.nix
     ./nushell.nix
-    ./omnix.nix
     ./opencode.nix
-    ./retroarch.nix
+    ./p7zip.nix
+    ./pkg-config.nix
+    ./ripgrep.nix
     ./rustup.nix
-    ./ryujinx.nix
+    ./sd.nix
     ./sops.nix
     ./ssh.nix
     ./starship.nix
-    ./sxiv.nix
-    ./tea.nix
     ./television.nix
     ./tmux.nix
-    ./tuifeed.nix
     ./uv.nix
-    ./xh.nix
     ./yazi.nix
     ./yt-dlp.nix
     ./zoxide.nix
-
+    # ./bluetui.nix
     # ./goread.nix
     # ./helix.nix
     # ./magika.nix
+    # ./mpd.nix
     # ./mpris-scrobbler.nix
     # ./ncmpcpp.nix
-    # ./neomutt.nix
-    # ./neovim.nix
     # ./newsboat.nix
+    # ./nh.nix
+    # ./omnix.nix
+    # ./retroarch.nix
+    # ./ryujinx.nix
+    # ./sxiv.nix
+    # ./tea.nix
     # ./template.nix
+    # ./tuifeed.nix
+    # ./xh.nix
     # ./zellij.nix
+    ./dysk.nix
+    ./binwalk.nix
+    ./cargo.nix
   ];
-  home.packages = with pkgs;
-    [
-      _1password-cli
-      asciidoctor
-      alejandra
-      aria2
-      ast-grep
-      bottom
-      btop
-      cachix
-      deploy-rs.deploy-rs
-      dust
-      fd
-      file
-      fzf
-      gnupg
-      gpg-tui
-      jq
-      just
-      macchina
-      nb
-      p7zip
-      pandoc
-      pfetch-rs
-      pkg-config
-      ripgrep
-      sd
-      tldr
-      # vcpkg-tool
-    ]
-    ++ lib.optionals (!device.isServer) [
-      monaspace
-      nerd-fonts.fira-code
-      nerd-fonts.hasklug
-      nerd-fonts.symbols-only
-      noto-fonts
-      noto-fonts-cjk-sans
-      noto-fonts-color-emoji
-      liberation_ttf
-      fira-code
-      fira-code-symbols
-      mplus-outline-fonts.githubRelease
-    ]
-    ++ lib.optionals device.isLinux []
-    ++ lib.optionals device.isDarwin [];
 }

home/programs/deploy-rs.nix

@@ -0,0 +1 @@
+{pkgs, ...}: {home.packages = [pkgs.deploy-rs.deploy-rs];}

home/programs/dust.nix

@@ -0,0 +1 @@
+{pkgs, ...}: {home.packages = [pkgs.dust];}

home/programs/dysk.nix

@@ -0,0 +1 @@
+{pkgs, ...}: {home.packages = [pkgs.dysk];}

home/programs/eilmeldung.nix

@@ -0,0 +1,41 @@
+{
+  inputs,
+  device,
+  ...
+}: {
+  imports = [
+    inputs.eilmeldung.homeManager.default
+  ];
+  programs.eilmeldung = {
+    enable = device.is "ryu";
+
+    settings = {
+      refresh_fps = 60;
+      article_scope = "unread";
+
+      theme = {
+        color_palette = {
+          background = "#1e1e2e";
+          # // ...
+        };
+      };
+
+      input_config.mappings = {
+        "q" = ["quit"];
+        "j" = ["down"];
+        "k" = ["up"];
+        "g g" = ["gotofirst"];
+        "G" = ["gotolast"];
+        "o" = ["open" "read" "nextunread"];
+      };
+
+      feed_list = [
+        "query: \"Today Unread\" today unread"
+        "query: \"Today Marked\" today marked"
+        "feeds"
+        "* categories"
+        "tags"
+      ];
+    };
+  };
+}

home/programs/fd.nix

@@ -0,0 +1 @@
+{pkgs, ...}: {home.packages = [pkgs.fd];}

home/programs/file.nix

@@ -0,0 +1 @@
+{pkgs, ...}: {home.packages = [pkgs.file];}

home/programs/fish.nix

@@ -4,8 +4,11 @@
   device,
   config,
   ...
-}: {
+}:
-  stylix.targets.fish.enable = false;
+{
+  home.file = {
+    ".config/fish/themes".source = pkgs.catppuccinThemes.fish + "/themes";
+  };
   programs.fish = {
     enable = true;
     shellAbbrs = {
@@ -21,21 +24,16 @@
       # t = "zellij a -c --index 0";
       t = "tmux";
     };
-    shellAliases =
+    shellAliases = {
-      {
+      g = "git";
-        g = "git";
+    };
-      }
-      // lib.optionalAttrs pkgs.stdenv.isLinux {
-        kmpv = "mpv --vo-kitty-use-shm=yes --vo=kitty --really-quiet";
-        smpv = "mpv --vo-sixel-buffered=yes --vo=sixel --profile=sw-fast";
-      };
     shellInit = ''
       set fish_greeting
       yes | fish_config theme save "Catppuccin Mocha"
     '';
     # ${pkgs.spotify-player}/bin/spotify_player generate fish | source
     interactiveShellInit = ''
-      ${lib.getExe pkgs.fastfetch}
+      if test -n "$TMUX"; ${lib.getExe pkgs.fastfetch} --logo-type sixel; else ${lib.getExe pkgs.fastfetch}; end
       # ${pkgs.nb}/bin/nb todo undone
       ${lib.optionalString (device.isLinux && !device.isNix) "source /etc/profile.d/nix-daemon.fish"}
       ${lib.optionalString (device.is "ryu") ''
@@ -46,3 +44,6 @@
     '';
   };
 }
+// lib.optionalAttrs (!(device.is "tsuba")) {
+  stylix.targets.fish.enable = false;
+}

home/programs/fzf.nix

@@ -1,13 +1 @@
-{
+{pkgs, ...}: { home.packages = [pkgs.fzf];}
-  pkgs,
-  lib,
-  device,
-  ...
-}: {
-  programs.fzf = {
-    enable = true;
-    package = pkgs.fzf;
-    enableFishIntegration = true;
-    tmux.enableShellIntegration = true;
-  };
-}

home/programs/git.nix

@@ -10,8 +10,8 @@ lib.optionalAttrs (!(device.is "tsuba")) {
     enable = true;
     lfs.enable = true;
     settings = {
-      user.name = "uttarayan21";
+      user.name = "servius";
-      user.email = config.accounts.email.accounts.fastmail.address;
+      user.email = builtins.elemAt config.accounts.email.accounts.fastmail.aliases 0;
       user.signingkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJfKKrX8yeIHUUury0aPwMY6Ha+BJyUR7P0Gqid90ik/";
       color.ui = true;
       core.editor = "nvim";

home/programs/gnupg.nix

@@ -0,0 +1 @@
+{pkgs, ...}: {home.packages = [pkgs.gnupg];}

home/programs/hyprshade.nix

@@ -0,0 +1,10 @@
+{
+  pkgs,
+  device,
+  ...
+}: {
+  home.packages = with pkgs;
+    lib.mkIf (device.is "ryu") [
+      hyprshade
+    ];
+}

home/programs/jq.nix

@@ -0,0 +1 @@
+{pkgs, ...}: {home.packages = [pkgs.jq];}

home/programs/just.nix

@@ -0,0 +1 @@
+{pkgs, ...}: {home.packages = [pkgs.just];}

home/programs/neovim.nix

@@ -4,8 +4,8 @@
   stablePkgs,
   lib,
   ...
-}: {
+}:
-  stylix.targets.nixvim.enable = false;
+{
   programs = lib.optionalAttrs (device.is "ryu" || device.is "kuro" || device.is "mirai" || device.is "tako" || device.is "shiro") {
     nixvim =
       {
@@ -19,3 +19,6 @@
       // (import ./../../neovim {inherit pkgs stablePkgs;});
   };
 }
+// lib.optionalAttrs (!(device.is "tsuba")) {
+  stylix.targets.nixvim.enable = false;
+}

home/programs/p7zip.nix

@@ -0,0 +1 @@
+{pkgs, ...}: {home.packages = [pkgs.p7zip];}

home/programs/pkg-config.nix

@@ -0,0 +1 @@
+{pkgs, ...}: {home.packages = [pkgs.pkg-config];}

home/programs/ripgrep.nix

@@ -0,0 +1 @@
+{pkgs, ...}: {home.packages = [pkgs.ripgrep];}

home/programs/sd.nix

@@ -0,0 +1 @@
+{pkgs, ...}: {home.packages = [pkgs.sd];}

home/programs/sops.nix

@@ -12,4 +12,12 @@
     defaultSopsFormat = "yaml";
     age.keyFile = "${config.home.homeDirectory}/.config/sops/age/keys.txt";
   };
+  launchd.agents.sops-nix = pkgs.lib.mkIf pkgs.stdenv.isDarwin {
+    enable = true;
+    config = {
+      EnvironmentVariables = {
+        PATH = pkgs.lib.mkForce "/usr/bin:/bin:/usr/sbin:/sbin";
+      };
+    };
+  };
 }

home/programs/starship.nix

@@ -3,8 +3,8 @@
   lib,
   device,
   ...
-}: {
+}:
-  stylix.targets.starship.enable = false;
+{
   programs.starship = {
     enable = true;
     enableFishIntegration = true;
@@ -30,3 +30,6 @@
         (pkgs.catppuccinThemes.starship + /palettes/${flavour}.toml));
   };
 }
+// lib.optionalAttrs (!(device.is "tsuba")) {
+  stylix.targets.starship.enable = false;
+}

home/programs/yazi.nix

@@ -1,4 +1,4 @@
-{...}: {
+{config, ...}: {
   programs. yazi = {
     enable = true;
     enableFishIntegration = true;
@@ -13,6 +13,9 @@
           }
         ];
       };
+      preview = {
+        cache_dir = config.home.homeDirectory + "/.cache/yazi/previews";
+      };
     };
   };
 }

home/services/command-runner.nix

@@ -1,31 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  inputs,
-  ...
-}: {
-  imports = [
-    inputs.command-runner.homeManagerModules.command-runner
-  ];
-  services.command-runner = {
-    enable = true;
-    port = 5599;
-    database.path = "${config.home.homeDirectory}/.local/share/command-runner.db";
-    commands = let
-      hyprctl = "${pkgs.hyprland}/bin/hyprctl";
-    in
-      {
-        "display_on" = [hyprctl "-i" "{instance}" "dispatch" "dpms" "on"];
-        "display_off" = [hyprctl "-i" "{instance}" "dispatch" "dpms" "off"];
-        "display_toggle" = [hyprctl "-i" "{instance}" "dispatch" "dpms" "toggle"];
-        "display_status" = [hyprctl "-i" "{instance}" "-j" "monitors"];
-        "hyprland_instance" = [hyprctl "-j" "instances"];
-      }
-      // (builtins.foldl' (acc: elem: acc // elem) {} (lib.map (name: {
-        "display_on_${name}" = [hyprctl "-i" "{instance}" "dispatch" "dpms" "on" name];
-        "display_off_${name}" = [hyprctl "-i" "{instance}" "dispatch" "dpms" "off" name];
-        "display_toggle_${name}" = [hyprctl "-i" "{instance}" "dispatch" "dpms" "toggle" name];
-      }) ["HDMI-A-1" "DP-3" "DP-1"]));
-  };
-}

home/services/default.nix

@@ -4,14 +4,15 @@
     ./swayosd.nix
     ./kdeconnect.nix
     ./gtk.nix
-    ./anyrun.nix
+    # ./anyrun.nix
-    # ./ironbar
+    ./ironbar
     ./gui.nix
-    ./eww.nix
+    # ./eww.nix
     ./xdg.nix
     ./hyprmon.nix
     ./hyprland.nix
     ./hyprpaper.nix
+    ./remmina.nix
     # ./wallpaperengine.nix
   ];
 }

home/services/gui.nix

@@ -2,24 +2,8 @@
   pkgs,
   device,
   lib,
-  inputs,
   ...
 }: {
-  systemd.user.services.onepassword-gui = lib.optionalAttrs (device.is "ryu") {
-    Unit = {
-      Description = "1Password GUI";
-      BindsTo = ["graphical-session.target"];
-      After = ["graphical-session-pre.target"];
-    };
-
-    Service = {
-      ExecStart = "${pkgs._1password-gui}/bin/1password";
-      Restart = "always";
-    };
-    Install = {
-      WantedBy = ["graphical-session.target"];
-    };
-  };
   home.packages = with pkgs;
     lib.optionals (device.is "ryu") [
       nautilus
@@ -28,7 +12,7 @@
       # polkit_gnome
       seahorse
       signal-desktop
-      # sony-headphones-client
+      sony-headphones-client
       spotify
       steam-run
       wl-clipboard

home/services/hyprland.nix

@@ -35,13 +35,15 @@
     settings = {
       # source = "${pkgs.catppuccinThemes.hyprland}/themes/mocha.conf";
       render = {
-        direct_scanout = true;
+        cm_enabled = true;
-        cm_fs_passthrough = 1;
+        direct_scanout = 2; # 0 - off; 1 - on; 2 - auto based on `game`
-        cm_auto_hdr = 1;
+        cm_fs_passthrough = 1; # 0 - off; 1 - always; 2 - hdr only
-      };
+        send_content_type = true; # automatic monitor mode switch
-      experimental = {
+        cm_auto_hdr = 1; # 0 - off; 1 - switch to cm,hdr 2; 2 - switch to cm,hdredid
-        xx_color_management_v4 = true;
       };
+      # experimental = {
+      #   xx_color_management_v4 = true;
+      # };
       monitorv2 = [
         {
           output = device.monitors.primary;
@@ -123,12 +125,12 @@
         bezier = "myBezier, 0.05, 0.9, 0.1, 1.05";
 
         animation = [
-          "windows, 1, 7, myBezier"
+          "windows, 1, 2, myBezier"
-          "windowsOut, 1, 7, default, popin 80%"
+          "windowsOut, 1, 2, default, popin 80%"
           "border, 1, 10, default"
           "borderangle, 1, 8, default"
-          "fade, 1, 7, default"
+          "fade, 1, 2, default"
-          "workspaces, 1, 6, default"
+          "workspaces, 1, 2, default"
         ];
       };
 
@@ -188,8 +190,8 @@
       ];
       bind = [
         # Example binds, see https://wiki.hyprland.org/Configuring/Binds/ for more
-        "$mainMod, Return, exec, ${lib.getExe pkgs.wezterm}"
+        "$mainMod, Return, exec, ${lib.getExe pkgs.kitty}"
-        "$mainModShift, Return, exec, ${lib.getExe pkgs.kitty}"
+        "$mainModShift, Return, exec, ${lib.getExe pkgs.ghostty}"
         # "$mainModShift, Return, exec, ${pkgs.foot}/bin/foot"
         "$mainModShift, Q, killactive,"
         "$mainModShift, s, exec, ${lib.getExe pkgs.hyprshot} -m region -o ~/Pictures/Screenshots/"

home/services/hyprpaper.nix

@@ -4,25 +4,31 @@
   config,
   ...
 }: {
-  imports = [
+  services.hyprpaper = let
-    ../../modules/hyprpaper.nix
-  ];
-  programs.hyprpaper = let
     wallpapers = import ../../utils/wallhaven.nix {inherit pkgs;};
     nextcloudWallpapers = name: config.home.homeDirectory + "/Nextcloud/Wallpapers/" + name;
     silksongFleas = nextcloudWallpapers "silksong-fleas.jpg";
     silksongShadeLord = nextcloudWallpapers "silksong-shadelord.jpg";
-  in rec {
+  in {
     enable = device.is "ryu";
-    systemd.enable = true;
+    settings = {
-    systemd.target = "hyprland-session.target";
+      wallpaper = [
-    settings.preload =
+        {
-      wallpapers.all
+          monitor = device.monitors.primary;
-      ++ pkgs.lib.mapAttrsToList (_: value: value) settings.wallpapers;
+          path = silksongShadeLord;
-    settings.wallpapers = {
+          fit_mode = "cover";
-      "${device.monitors.primary}" = silksongShadeLord;
+        }
-      "${device.monitors.secondary}" = wallpapers.frieren_3;
+        {
-      "${device.monitors.tertiary}" = silksongFleas;
+          monitor = device.monitors.secondary;
+          path = wallpapers.frieren_3;
+          fit_mode = "cover";
+        }
+        {
+          monitor = device.monitors.tertiary;
+          path = silksongFleas;
+          fit_mode = "cover";
+        }
+      ];
     };
   };
 }

home/services/remmina.nix

@@ -0,0 +1,7 @@
+{device, ...}: {
+  services.remmina = {
+    enable = device.is "ryu";
+    systemdService.enable = true;
+    addRdpMimeTypeAssoc = true;
+  };
+}

home/services/xdg.nix

@@ -3,12 +3,11 @@
   lib,
   device,
   ...
-}:
+}: {
-lib.optionalAttrs (device.is "ryu") {
   xdg.portal = {
-    enable = pkgs.stdenv.isLinux;
+    enable = device.is "ryu";
     config = {
-      hyprland.default = ["kde" "hyprland"];
+      hyprland.default = ["hyprland"];
       common.default = ["*" "hyprland"];
     };
     extraPortals = with pkgs; [

justfile

@@ -1,12 +1,13 @@
 set dotenv-load
 
+
 [macos]
 install: 
     sudo nix run nix-darwin -- switch --flake .
 
 [linux]
-install:
+install cores='32':
-	sudo nixos-rebuild switch --flake . --builders '' --max-jobs 1
+	sudo nixos-rebuild switch --flake . --builders '' --max-jobs 1 --cores {{cores}}
 
 [macos]
 build:
@@ -30,3 +31,13 @@ nvim:
 [linux]
 rollback:
 	sudo nixos-rebuild switch --rollback --flake .
+
+
+add program:
+    echo '{pkgs, ...}: { home.packages = [pkgs.{{program}}];}' > home/programs/{{program}}.nix
+    # https://ast-grep.github.io/advanced/pattern-parse.html#incomplete-pattern-code
+    # Since the imports doesn't match the whole pattern we need to use the selector binding and the attr expression to match it properly.
+    ast-grep run -p '{ imports = [$$$ITEMS] }' --selector binding --rewrite 'imports = [$$$ITEMS ./{{program}}.nix ]' home/programs/default.nix -i
+    alejandra fmt home/programs/{{program}}.nix home/programs/default.nix
+    git add home/programs/{{program}}.nix 
+

modules/aichat.nix

@@ -81,6 +81,14 @@ in {
         type = lib.types.attrsOf lib.types.str;
         description = "Roles for the AI chat clients";
       };
+      extraPackages = mkOption {
+        type = lib.types.listOf lib.types.package;
+        default = [];
+        example = literalExpression "with pkgs; [ jq yek ];";
+        description = ''
+          Additional packages to install.
+        '';
+      };
     };
   };
 
@@ -99,7 +107,7 @@ in {
       '';
     };
   in {
-    home.packages = mkIf cfg.enable [aichat-wrapped];
+    home.packages = mkIf cfg.enable ([aichat-wrapped] ++ cfg.extraPackages);
 
     programs.fish.interactiveShellInit = mkIf cfg.enableFishIntegration fishIntegration;
     programs.bash.initExtra = mkIf cfg.enableBashIntegration bashIntegration;

modules/default.nix

@@ -4,10 +4,10 @@
   ...
 }: {
   imports = [
-    ./goread.nix
+    # ./goread.nix
-    ./hyprpaper.nix
+    # ./hyprpaper.nix
     # ./aichat.nix
-    ./tuifeed.nix
+    # ./tuifeed.nix
     #./ghostty.nix
     # ./sketchybar.nix
   ];

modules/hyprpaper.nix

@@ -1,104 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.programs.hyprpaper;
-in {
-  options = {
-    programs.hyprpaper = {
-      enable = mkEnableOption "Hyprpaper - Wayland wallpaper utility";
-
-      systemd = {
-        enable = mkEnableOption "autostart service for Hyprpaper";
-
-        target = mkOption {
-          type = types.str;
-          default = "graphical-session.target";
-          example = "hyprland-session.target";
-          description = ''
-            The systemd target that will automatically start the Hyprpaper service.
-          '';
-        };
-      };
-
-      settings = with types; {
-        preload = mkOption {
-          type = listOf path;
-          default = [];
-          description = ''
-            Wallpaper images that should be preloaded into memory
-          '';
-          example = [./wallpapers/tensura.png];
-        };
-
-        wallpapers = mkOption {
-          type = attrsOf str;
-          default = {};
-          example = {"DP-1" = ./wallpapers/tensura.png;};
-          description = ''
-            Wallpaper to monitor mapper
-          '';
-        };
-
-        extraConfig = mkOption {
-          type = str;
-          default = "";
-          description = "Check https://github.com/hyprwm/hyprpaper#usage for info";
-          example = ''
-            newConfigOption = foo,bar
-          '';
-        };
-      };
-    };
-  };
-
-  config = {
-    home.packages = mkIf cfg.enable [pkgs.hyprpaper];
-
-    systemd.user.services.hyprpaper = mkIf cfg.systemd.enable {
-      Unit = {
-        Description = "autostart service for Hyprpaper";
-        Documentation = "https://github.com/hyprwm/hyprpaper";
-        BindsTo = ["graphical-session.target"];
-        After = ["graphical-session-pre.target"];
-      };
-
-      Service = {
-        ExecStart = "${pkgs.hyprpaper}/bin/hyprpaper";
-        ExecReload = "${pkgs.coreutils}/bin/kill -SIGUSR2 $MAINPID";
-        Restart = "on-failure";
-        KillMode = "mixed";
-      };
-
-      Install = {WantedBy = [cfg.systemd.target];};
-    };
-
-    xdg.configFile = mkIf cfg.enable {
-      "hypr/hyprpaper.conf".text = ''
-        # Auto-generated by Nix home-manager module
-
-        # hyprpaper.settings.preload
-        ${(lists.foldl (acc: v:
-          acc
-          + ''
-            preload = ${v}
-          '') ""
-        cfg.settings.preload)}
-
-        # hyprpaper.settings.wallpapers
-        ${(lists.foldl (acc: v:
-          acc
-          + ''
-            wallpaper = ${v}
-          '') "" (pkgs.lib.attrsets.mapAttrsToList (name: val: name + "," + val)
-          cfg.settings.wallpapers))}
-
-        # hyprpaper.settings.extraConfig
-        ${cfg.settings.extraConfig}
-      '';
-    };
-  };
-}

neovim/default.nix

@@ -1,8 +1,4 @@
-{
+{pkgs, ...}: let
-  pkgs,
-  stablePkgs,
-  ...
-}: let
   mkMappings = mappings:
     []
     ++ (pkgs.lib.optionals (builtins.hasAttr "normal" mappings) (mkMode mappings.normal "n"))
@@ -17,16 +13,6 @@
       mode = mode;
     })
     mappings;
-  border = [
-    "╭"
-    "─"
-    "╮"
-    "│"
-    "╯"
-    "─"
-    "╰"
-    "│"
-  ];
   rawLua = lua: {
     "__raw" = ''
       ${lua}
@@ -60,7 +46,20 @@ in {
   colorschemes = {
     catppuccin = {
       enable = true;
-      settings.flavour = "mocha";
+      settings = {
+        flavour = "mocha";
+        integrations = {
+          cmp = true;
+          gitsigns = true;
+          nvimtree = true;
+          treesitter = true;
+          notify = true;
+          mini = {
+            enabled = true;
+            indentscope_color = "";
+          };
+        };
+      };
     };
   };
   keymaps = mkMappings {
@@ -330,10 +329,6 @@ in {
       settings.image_provider = "image.nvim";
     };
 
-    markdown-preview = {
-      enable = true;
-    };
-
     noice = {
       enable = true;
       settings = {
@@ -362,18 +357,18 @@ in {
           additional_vim_regex_highlighting = true;
         };
       };
-      folding = true;
+      folding.enable = true;
-      grammarPackages =
+      # grammarPackages =
-        (with pkgs.tree-sitter-grammars; [
+      #   (with pkgs.tree-sitter-grammars; [
-          tree-sitter-norg
+      #     tree-sitter-norg
-          tree-sitter-norg-meta
+      #     tree-sitter-norg-meta
-          tree-sitter-just
+      #     tree-sitter-just
-          tree-sitter-nu
+      #     tree-sitter-nu
-          tree-sitter-pest
+      #     tree-sitter-pest
-          tree-sitter-slint
+      #     tree-sitter-slint
-        ])
+      #   ])
-        ++ pkgs.vimPlugins.nvim-treesitter.allGrammars;
+      #   ++ pkgs.vimPlugins.nvim-treesitter.allGrammars;
-      nixGrammars = true;
+      # nixGrammars = true;
     };
 
     telescope = {
@@ -407,6 +402,15 @@ in {
       };
     };
 
+    tv = {
+      enable = true;
+      settings = {
+        global_keybindings = {
+          channels = "<leader>tv";
+        };
+      };
+    };
+
     fidget = {
       enable = true;
       settings.notification.override_vim_notify = true;
@@ -543,6 +547,8 @@ in {
         sqls.enable = true;
         pyright.enable = true;
         slint_lsp.enable = true;
+        wgsl_analyzer.enable = true;
+        glsl_analyzer.enable = true;
         # sourcekit.enable = true;
         openscad_lsp.enable = true;
         tinymist.enable = true;
@@ -851,6 +857,5 @@ in {
     pkgs.lua
     pkgs.ripgrep
     pkgs.nodejs-slim
-    pkgs.qwen-code
   ];
 }

neovim/overlays.nix

@@ -47,36 +47,3 @@ in [
   vimPlugins
   tree-sitter-grammars
 ]
-# tree-sitter-grammars = final: prev: {
-#   tree-sitter-grammars =
-#     prev.tree-sitter-grammars
-#     // {
-#       # tree-sitter-just = final.pkgs.tree-sitter.buildGrammar {
-#       #   language = "just";
-#       #   version = "1";
-#       #   src = inputs.tree-sitter-just;
-#       # };
-#       # tree-sitter-nu = final.pkgs.tree-sitter.buildGrammar {
-#       #   language = "nu";
-#       #   version = "1";
-#       #   src = inputs.tree-sitter-nu;
-#       # };
-#       tree-sitter-d2 = final.pkgs.tree-sitter.buildGrammar {
-#         language = "d2";
-#         version = "1";
-#         src = inputs.tree-sitter-d2;
-#       };
-#     };
-# };
-# vimPlugins = final: prev: {
-#   vimPlugins =
-#     prev.vimPlugins
-#     // {
-#       d2 = final.pkgs.vimUtils.buildVimPlugin {
-#         name = "d2";
-#         version = "1";
-#         src = inputs.d2;
-#       };
-#     };
-# };
-

nixos/ryu/apps/vr.nix

@@ -1,8 +1,9 @@
 {pkgs, ...}: {
   environment.systemPackages = with pkgs; [
-    wlx-overlay-s
+    wayvr
-    wayvr-dashboard
+    # wlx-overlay-s
-    bs-manager
+    # wayvr-dashboard
+    # bs-manager
     monado-vulkan-layers
     # envision
   ];

nixos/ryu/configuration.nix

@@ -10,7 +10,8 @@
     ./programs
     ./containers
     ./apps
-    # ./vms
+    ./vms
+    ./games
   ];
 
   security.tpm2 = {
@@ -25,6 +26,7 @@
       withUWSM = true;
       xwayland.enable = true;
     };
+    uwsm.enable = true;
   };
 
   systemd.services.NetworkManager-wait-online.enable = lib.mkForce false;
@@ -67,7 +69,7 @@
       dates = "daily";
       options = "--delete-older-than +5";
     };
-    package = pkgs.nixVersions.latest; # deploy-rs doesn't work with nix >= 2.32
+    package = pkgs.nixVersions.nix_2_32; # deploy-rs doesn't work with nix >= 2.33
     buildMachines = [
       ../../builders/tako.nix
       ../../builders/shiro.nix
@@ -77,6 +79,7 @@
   };
 
   users.users.${device.user} = {
+    uid = device.uid;
     isNormalUser = true;
     extraGroups = ["wheel" "audio" "i2c" "media" "video" "tss"];
     openssh.authorizedKeys.keyFiles = [
@@ -86,6 +89,10 @@
   };
   users.groups.i2c = {};
   users.groups.media = {};
+  users.groups.${device.user} = {
+    gid = device.gid;
+    members = [device.user];
+  };
 
   services = {
     devmon.enable = true;
@@ -176,7 +183,7 @@
     };
     hostName = "ryu"; # Define your hostname.
     # nameservers = ["1.1.1.1" "8.8.8.8"];
-    nameservers = ["1.1.1.1#one.one.one.one" "1.0.0.1#one.one.one.one"];
+    # nameservers = ["1.1.1.1#one.one.one.one" "1.0.0.1#one.one.one.one"];
 
     # Configure network proxy if necessary
     # proxy.default = "http://user:password@proxy:port/";
@@ -187,14 +194,37 @@
     hostId = "1349f9f0";
     # Enable networking
     networkmanager.enable = true;
-
+    nftables = {
-    # Open ports in the firewall.
+      # Open ports in the firewall.
-    # firewall.allowedTCPPorts = [ ... ];
+      # firewall.allowedTCPPorts = [ ... ];
-    # firewall.allowedUDPPorts = [ ... ];
+      # firewall.allowedUDPPorts = [ ... ];
-    # firewall.enable = false;
+      # firewall.enable = false;
-    nftables.enable = true;
+      enable = true;
+      flushRuleset = true;
+      tables = {
+        "mullvad_tailscale" = {
+          enable = true;
+          family = "inet";
+          content = ''
+            chain output {
+              type route hook output priority 0; policy accept;
+              ip daddr 100.64.0.0/10 ct mark set 0x00000f41 meta mark set 0x6d6f6c65;
+            }
+          '';
+        };
+      };
+      # ruleset = ''
+      #   table inet mullvad_tailscale {
+      #     chain output {
+      #       type route hook output priority 0; policy accept;
+      #       ip daddr 100.64.0.0/10 ct mark set 0x00000f41 meta mark set 0x6d6f6c65;
+      #     }
+      #   }
+      #
+      # '';
+    };
     firewall = {
-      enable = false;
+      enable = true;
       trustedInterfaces = [
         "tailscale0"
       ];
@@ -202,7 +232,10 @@
         9 # Wake on LAN
         4950 # Warframe
         4955 # Warframe
-        3113 # Other
+      ];
+      allowedTCPPorts = [
+        3113 # Hyprmonitors
+        11345 # lmstudio
       ];
       allowedTCPPortRanges = [
         {
@@ -216,14 +249,6 @@
           to = 1764;
         }
       ];
-      # extraInputRules = ''
-      #   table inet mullvad_tailscale {
-      #     chain output {
-      #       type route hook output priority 0; policy accept;
-      #       ip daddr 100.64.0.0/10 ct mark set 0x00000f41 meta mark set 0x6d6f6c65;
-      #     }
-      #   }
-      # '';
     };
   };
 

nixos/ryu/containers/default.nix

@@ -1,6 +1,6 @@
 {device, ...}: {
   imports = [
-    ./immich-machine-learning.nix
+    # ./immich-machine-learning.nix
   ];
   virtualisation = {
     docker.enable = true;

nixos/ryu/containers/immich-machine-learning.nix

@@ -2,12 +2,11 @@
   port = 3003;
 in {
   virtualisation.oci-containers = {
-    backend = "docker";
     containers = {
       immich-machine-learning = {
         image = "ghcr.io/immich-app/immich-machine-learning:v${pkgs.immich.version}-cuda";
         ports = [
-          "0.0.0.0:${toString port}:3003"
+          "127.0.0.1:${toString port}:3003"
         ];
         volumes = [
           "model-cache:/cache"
@@ -20,7 +19,4 @@ in {
     nvidia-docker
     nvidia-container-toolkit
   ];
-  # services.caddy.virtualHosts."ml.ryu.darksailor.dev".extraConfig = ''
-  #   reverse_proxy localhost:${toString port}
-  # '';
 }

nixos/ryu/games/default.nix

@@ -0,0 +1,5 @@
+{...}: {
+  imports = [
+    ./hytale.nix
+  ];
+}

nixos/ryu/games/hytale.nix

@@ -0,0 +1,499 @@
+# {pkgs, ...}: let
+#   version = "2026.01.21-11273a4";
+#   hytale-launcher = pkgs.fetchzip {
+#     url = "https://launcher.hytale.com/builds/release/linux/amd64/hytale-launcher-${version}.zip";
+#     sha256 = "sha256-PPdYmLxAVyqSkhulZXLcaEuhofCHZ4JcDJXIQ+lBhFg=";
+#   };
+# in {
+#   environment.systemPackages = with pkgs; [
+#     # (pkgs.buildFHSEnv {
+#     #   pname = "hytale";
+#     #   inherit version;
+#     #   targetPkgs = p:
+#     #     with p; [
+#     #       # Launcher
+#     #       libsoup_3
+#     #       gdk-pixbuf
+#     #       glib
+#     #       gtk3
+#     #       webkitgtk_4_1
+#     #
+#     #       # Game
+#     #       alsa-lib
+#     #       icu
+#     #       libGL
+#     #       openssl
+#     #       udev
+#     #       xorg.libX11
+#     #       xorg.libXcursor
+#     #       xorg.libXrandr
+#     #       xorg.libXi
+#     #     ];
+#     #   runScript = "${hytale-launcher}/hytale-launcher";
+#     # })
+#     hytale-launcher
+#   ];
+# }
+#
+# { pkgs }:
+#
+# let
+#   # === AUTO-UPDATE MARKERS - DO NOT MODIFY FORMAT ===
+#   version = "2026.01.24-997c2cb";
+#   sha256 = "sha256-G+FFMOtLVPH2zaWQ87jymf6+JUAVFEKA4SMyuYE9MZ0=";
+#   # === END AUTO-UPDATE MARKERS ===
+#
+#   pname = "hytale-launcher";
+#   downloadUrl = "https://launcher.hytale.com/builds/release/linux/amd64/hytale-launcher-${version}.zip";
+#
+#   # Unwrapped derivation - extracts and patches the binary
+#   hytale-launcher-unwrapped = pkgs.stdenv.mkDerivation {
+#     pname = "${pname}-unwrapped";
+#     inherit version;
+#
+#     src = pkgs.fetchurl {
+#       url = downloadUrl;
+#       inherit sha256;
+#     };
+#
+#     nativeBuildInputs = with pkgs; [
+#       autoPatchelfHook
+#       unzip
+#     ];
+#
+#     unpackPhase = ''
+#       runHook preUnpack
+#       unzip $src -d .
+#       runHook postUnpack
+#     '';
+#
+#     buildInputs = with pkgs; [
+#       webkitgtk_4_1
+#       gtk3
+#       glib
+#       gdk-pixbuf
+#       libsoup_3
+#       cairo
+#       pango
+#       at-spi2-atk
+#       harfbuzz
+#       glibc
+#     ];
+#
+#     runtimeDependencies = with pkgs; [
+#       libGL
+#       libxkbcommon
+#       xorg.libX11
+#       xorg.libXcomposite
+#       xorg.libXdamage
+#       xorg.libXext
+#       xorg.libXfixes
+#       xorg.libXrandr
+#     ];
+#
+#     # No build phase needed - just unpack and install
+#     dontBuild = true;
+#
+#     installPhase = ''
+#       runHook preInstall
+#
+#       mkdir -p $out/lib/hytale-launcher
+#       install -m755 hytale-launcher $out/lib/hytale-launcher/
+#
+#       runHook postInstall
+#     '';
+#
+#     meta = with pkgs.lib; {
+#       description = "Official launcher for Hytale game (unwrapped)";
+#       homepage = "https://hytale.com";
+#       license = licenses.unfree;
+#       sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+#       maintainers = [{
+#         name = "Jacob Pyke";
+#         email = "github@pyk.ee";
+#         github = "JPyke3";
+#         githubId = 13283054;
+#       }];
+#       platforms = [ "x86_64-linux" ];
+#     };
+#   };
+#
+#   # FHS-wrapped derivation - allows self-updates to work
+#   hytale-launcher = pkgs.buildFHSEnv {
+#     name = "hytale-launcher";
+#     inherit version;
+#
+#     targetPkgs = pkgs: with pkgs; [
+#       # Core dependencies
+#       hytale-launcher-unwrapped
+#
+#       # WebKit/GTK stack (for launcher UI)
+#       webkitgtk_4_1
+#       gtk3
+#       glib
+#       gdk-pixbuf
+#       libsoup_3
+#       cairo
+#       pango
+#       at-spi2-atk
+#       harfbuzz
+#
+#       # Graphics - OpenGL/Vulkan/EGL (for game client via SDL3)
+#       libGL
+#       libGLU
+#       libglvnd
+#       mesa
+#       vulkan-loader
+#       egl-wayland
+#
+#       # X11 (SDL3 dlopens these)
+#       xorg.libX11
+#       xorg.libXcomposite
+#       xorg.libXdamage
+#       xorg.libXext
+#       xorg.libXfixes
+#       xorg.libXrandr
+#       xorg.libXcursor
+#       xorg.libXi
+#       xorg.libxcb
+#       xorg.libXScrnSaver
+#       xorg.libXinerama
+#       xorg.libXxf86vm
+#
+#       # Wayland (SDL3 can use Wayland backend)
+#       wayland
+#       libxkbcommon
+#
+#       # Audio (for game client via bundled OpenAL)
+#       alsa-lib
+#       pipewire
+#       pulseaudio
+#
+#       # System libraries
+#       dbus
+#       fontconfig
+#       freetype
+#       glibc
+#       nspr
+#       nss
+#       systemd
+#       zlib
+#
+#       # C++ runtime (needed by libNoesis.so, libopenal.so in game client)
+#       stdenv.cc.cc.lib
+#
+#       # .NET runtime dependencies (HytaleClient is a .NET application)
+#       icu
+#       openssl
+#       krb5
+#
+#       # TLS/SSL support for GLib networking (launcher)
+#       glib-networking
+#       cacert
+#     ];
+#
+#     runScript = pkgs.writeShellScript "hytale-launcher-wrapper" ''
+#       # Hytale data directory
+#       LAUNCHER_DIR="''${XDG_DATA_HOME:-$HOME/.local/share}/Hytale"
+#       LAUNCHER_BIN="$LAUNCHER_DIR/hytale-launcher"
+#       BUNDLED_HASH_FILE="$LAUNCHER_DIR/.bundled_hash"
+#       BUNDLED_BIN="${hytale-launcher-unwrapped}/lib/hytale-launcher/hytale-launcher"
+#
+#       mkdir -p "$LAUNCHER_DIR"
+#
+#       # Compute hash of bundled binary to detect Nix package updates
+#       BUNDLED_HASH=$(sha256sum "$BUNDLED_BIN" | cut -d" " -f1)
+#
+#       # Copy bundled binary if needed (new install or Nix package update)
+#       if [ ! -x "$LAUNCHER_BIN" ] || [ ! -f "$BUNDLED_HASH_FILE" ] || [ "$(cat "$BUNDLED_HASH_FILE")" != "$BUNDLED_HASH" ]; then
+#         install -m755 "$BUNDLED_BIN" "$LAUNCHER_BIN"
+#         echo "$BUNDLED_HASH" > "$BUNDLED_HASH_FILE"
+#       fi
+#
+#       # Required environment variable from Flatpak metadata
+#       export WEBKIT_DISABLE_COMPOSITING_MODE=1
+#
+#       # Enable GLib TLS backend (glib-networking)
+#       export GIO_MODULE_DIR=/usr/lib/gio/modules
+#
+#       # SSL certificates
+#       export SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
+#
+#       exec "$LAUNCHER_BIN" "$@"
+#     '';
+#
+#     extraInstallCommands = ''
+#       # Install desktop file
+#       mkdir -p $out/share/applications
+#       cat > $out/share/applications/hytale-launcher.desktop << EOF
+# [Desktop Entry]
+# Name=Hytale Launcher
+# Comment=Official launcher for Hytale
+# Exec=$out/bin/hytale-launcher
+# Icon=hytale-launcher
+# Terminal=false
+# Type=Application
+# Categories=Game;
+# Keywords=hytale;game;launcher;hypixel;
+# StartupWMClass=com.hypixel.HytaleLauncher
+# EOF
+#
+#     '';
+#
+#     meta = with pkgs.lib; {
+#       description = "Official launcher for Hytale game";
+#       longDescription = ''
+#         The official launcher for Hytale, developed by Hypixel Studios.
+#         This package wraps the launcher from the official distribution,
+#         providing FHS compatibility for self-updates.
+#       '';
+#       homepage = "https://hytale.com";
+#       license = licenses.unfree;
+#       sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+#       maintainers = [{
+#         name = "Jacob Pyke";
+#         email = "github@pyk.ee";
+#         github = "JPyke3";
+#         githubId = 13283054;
+#       }];
+#       platforms = [ "x86_64-linux" ];
+#       mainProgram = "hytale-launcher";
+#     };
+#   };
+#
+# in {
+#   inherit hytale-launcher hytale-launcher-unwrapped;
+# }
+{pkgs, ...}: let
+  # === AUTO-UPDATE MARKERS - DO NOT MODIFY FORMAT ===
+  version = "2026.01.24-997c2cb";
+  sha256 = "sha256-G+FFMOtLVPH2zaWQ87jymf6+JUAVFEKA4SMyuYE9MZ0=";
+  # === END AUTO-UPDATE MARKERS ===
+
+  pname = "hytale-launcher";
+  downloadUrl = "https://launcher.hytale.com/builds/release/linux/amd64/hytale-launcher-${version}.zip";
+
+  # Unwrapped derivation - extracts and patches the binary
+  hytale-launcher-unwrapped = pkgs.stdenv.mkDerivation {
+    pname = "${pname}-unwrapped";
+    inherit version;
+
+    src = pkgs.fetchurl {
+      url = downloadUrl;
+      inherit sha256;
+    };
+
+    nativeBuildInputs = with pkgs; [
+      autoPatchelfHook
+      unzip
+    ];
+
+    unpackPhase = ''
+      runHook preUnpack
+      unzip $src -d .
+      runHook postUnpack
+    '';
+
+    buildInputs = with pkgs; [
+      webkitgtk_4_1
+      gtk3
+      glib
+      gdk-pixbuf
+      libsoup_3
+      cairo
+      pango
+      at-spi2-atk
+      harfbuzz
+      glibc
+    ];
+
+    runtimeDependencies = with pkgs; [
+      libGL
+      libxkbcommon
+      # xorg.libX11
+      # xorg.libXcomposite
+      # xorg.libXdamage
+      # xorg.libXext
+      # xorg.libXfixes
+      # xorg.libXrandr
+    ];
+
+    # No build phase needed - just unpack and install
+    dontBuild = true;
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/lib/hytale-launcher
+      install -m755 hytale-launcher $out/lib/hytale-launcher/
+
+      runHook postInstall
+    '';
+
+    meta = with pkgs.lib; {
+      description = "Official launcher for Hytale game (unwrapped)";
+      homepage = "https://hytale.com";
+      license = licenses.unfree;
+      sourceProvenance = with sourceTypes; [binaryNativeCode];
+      maintainers = [
+        {
+          name = "Jacob Pyke";
+          email = "github@pyk.ee";
+          github = "JPyke3";
+          githubId = 13283054;
+        }
+      ];
+      platforms = ["x86_64-linux"];
+    };
+  };
+
+  # FHS-wrapped derivation - allows self-updates to work
+  hytale-launcher = pkgs.buildFHSEnv {
+    name = "hytale-launcher";
+    inherit version;
+
+    targetPkgs = pkgs:
+      with pkgs; [
+        # Core dependencies
+        hytale-launcher-unwrapped
+
+        # WebKit/GTK stack (for launcher UI)
+        webkitgtk_4_1
+        gtk3
+        glib
+        gdk-pixbuf
+        libsoup_3
+        cairo
+        pango
+        at-spi2-atk
+        harfbuzz
+
+        # Graphics - OpenGL/Vulkan/EGL (for game client via SDL3)
+        libGL
+        libGLU
+        libglvnd
+        mesa
+        vulkan-loader
+        egl-wayland
+
+        # X11 (SDL3 dlopens these)
+        # xorg.libX11
+        # xorg.libXcomposite
+        # xorg.libXdamage
+        # xorg.libXext
+        # xorg.libXfixes
+        # xorg.libXrandr
+        # xorg.libXcursor
+        # xorg.libXi
+        # xorg.libxcb
+        # xorg.libXScrnSaver
+        # xorg.libXinerama
+        # xorg.libXxf86vm
+
+        # Wayland (SDL3 can use Wayland backend)
+        wayland
+        libxkbcommon
+
+        # Audio (for game client via bundled OpenAL)
+        alsa-lib
+        pipewire
+        pulseaudio
+
+        # System libraries
+        dbus
+        fontconfig
+        freetype
+        glibc
+        nspr
+        nss
+        systemd
+        zlib
+
+        # C++ runtime (needed by libNoesis.so, libopenal.so in game client)
+        stdenv.cc.cc.lib
+
+        # .NET runtime dependencies (HytaleClient is a .NET application)
+        icu
+        openssl
+        krb5
+
+        # TLS/SSL support for GLib networking (launcher)
+        glib-networking
+        cacert
+      ];
+
+    runScript = pkgs.writeShellScript "hytale-launcher-wrapper" ''
+      # Hytale data directory
+      LAUNCHER_DIR="''${XDG_DATA_HOME:-$HOME/.local/share}/Hytale"
+      LAUNCHER_BIN="$LAUNCHER_DIR/hytale-launcher"
+      BUNDLED_HASH_FILE="$LAUNCHER_DIR/.bundled_hash"
+      BUNDLED_BIN="${hytale-launcher-unwrapped}/lib/hytale-launcher/hytale-launcher"
+
+      mkdir -p "$LAUNCHER_DIR"
+
+      # Compute hash of bundled binary to detect Nix package updates
+      BUNDLED_HASH=$(sha256sum "$BUNDLED_BIN" | cut -d" " -f1)
+
+      # Copy bundled binary if needed (new install or Nix package update)
+      if [ ! -x "$LAUNCHER_BIN" ] || [ ! -f "$BUNDLED_HASH_FILE" ] || [ "$(cat "$BUNDLED_HASH_FILE")" != "$BUNDLED_HASH" ]; then
+        install -m755 "$BUNDLED_BIN" "$LAUNCHER_BIN"
+        echo "$BUNDLED_HASH" > "$BUNDLED_HASH_FILE"
+      fi
+
+      # Required environment variable from Flatpak metadata
+      export WEBKIT_DISABLE_COMPOSITING_MODE=1
+
+      # Enable GLib TLS backend (glib-networking)
+      export GIO_MODULE_DIR=/usr/lib/gio/modules
+
+      # SSL certificates
+      export SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
+
+      exec "$LAUNCHER_BIN" "$@"
+    '';
+
+    extraInstallCommands = ''
+            # Install desktop file
+            mkdir -p $out/share/applications
+            cat > $out/share/applications/hytale-launcher.desktop << EOF
+      [Desktop Entry]
+      Name=Hytale Launcher
+      Comment=Official launcher for Hytale
+      Exec=$out/bin/hytale-launcher
+      Icon=hytale-launcher
+      Terminal=false
+      Type=Application
+      Categories=Game;
+      Keywords=hytale;game;launcher;hypixel;
+      StartupWMClass=com.hypixel.HytaleLauncher
+      EOF
+
+    '';
+
+    meta = with pkgs.lib; {
+      description = "Official launcher for Hytale game";
+      longDescription = ''
+        The official launcher for Hytale, developed by Hypixel Studios.
+        This package wraps the launcher from the official distribution,
+        providing FHS compatibility for self-updates.
+      '';
+      homepage = "https://hytale.com";
+      license = licenses.unfree;
+      sourceProvenance = with sourceTypes; [binaryNativeCode];
+      maintainers = [
+        {
+          name = "Jacob Pyke";
+          email = "github@pyk.ee";
+          github = "JPyke3";
+          githubId = 13283054;
+        }
+      ];
+      platforms = ["x86_64-linux"];
+      mainProgram = "hytale-launcher";
+    };
+  };
+in {
+  environment.systemPackages = with pkgs; [
+    hytale-launcher
+  ];
+}

nixos/ryu/programs/adb.nix

@@ -1,3 +1,5 @@
-{...}: {
+{pkgs, ...}: {
-  programs.adb.enable = true;
+  environment.systemPackages = [
+    pkgs.android-tools
+  ];
 }

nixos/ryu/programs/default.nix

@@ -10,5 +10,7 @@
     ./nix-ld.nix
     ./gamemode.nix
     ./droidcam.nix
+    ./wireshark.nix
+    ./flatpak.nix
   ];
 }

nixos/ryu/programs/flatpak.nix

@@ -0,0 +1,5 @@
+{...}: {
+  services.flatpak = {
+    enable = true;
+  };
+}

nixos/ryu/programs/steam.nix

@@ -8,7 +8,9 @@
     extraCompatPackages = [
       pkgs.proton-ge-bin
       pkgs.gamescope
+      pkgs.gamescope-wsi
       pkgs.mangohud
+      pkgs.vulkan-tools
     ];
   };
   programs.gamescope = {
@@ -17,5 +19,8 @@
   };
   environment.systemPackages = [
     pkgs.protonup-qt
+    pkgs.vulkan-tools
+    pkgs.gamescope
+    pkgs.gamescope-wsi
   ];
 }

nixos/ryu/programs/wireshark.nix

@@ -0,0 +1,14 @@
+{
+  pkgs,
+  device,
+  ...
+}: {
+  programs.wireshark = {
+    enable = true;
+    dumpcap.enable = true;
+  };
+  environment.systemPackages = with pkgs; [
+    wireshark-qt
+  ];
+  users.users.${device.user}.extraGroups = ["wireshark"];
+}

nixos/ryu/ryu.nix

@@ -5,6 +5,7 @@
   config,
   lib,
   modulesPath,
+  device,
   pkgs,
   ...
 }: {
@@ -51,6 +52,8 @@
   # nixpkgs.crossSystem = {system = "aarch64-linux";};
   boot.binfmt.emulatedSystems = ["aarch64-linux"];
   boot.loader.systemd-boot.consoleMode = "max";
+  boot.loader.systemd-boot.netbootxyz.enable = true;
+  boot.loader.systemd-boot.memtest86.enable = true;
 
   environment.sessionVariables = {
     LIBVA_DRIVER_NAME = "nvidia";
@@ -59,7 +62,7 @@
     NIXOS_OZONE_WL = "1";
   };
 
-  users.extraUsers.servius.extraGroups = ["libvirtd" "adbusers" "kvm"];
+  users.extraUsers.${device.user}.extraGroups = ["libvirtd" "adbusers" "kvm"];
 
   boot.extraModprobeConfig = ''
     options kvm_intel nested=1
@@ -127,13 +130,18 @@
     options = ["nofail"];
   };
 
-  fileSystems."/volumes/windows-games" = {
+  # fileSystems."/volumes/windows-games" = {
-    device = "/dev/disk/by-partuuid/56359fb7-7d33-44d2-bebd-b0c53daeeb73";
+  #   device = "/dev/disk/by-partuuid/56359fb7-7d33-44d2-bebd-b0c53daeeb73";
-    fsType = "ntfs3";
+  #   fsType = "ntfs3";
-    options = ["nofail"];
+  #   options = ["nofail"];
-  };
+  # };
 
-  swapDevices = [];
+  swapDevices = [
+    {
+      device = "/home/swapfile";
+      size = 64 * 1024;
+    }
+  ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's

nixos/ryu/services/default.nix

@@ -1,27 +1,26 @@
 {...}: {
   imports = [
     # ./rsyncd.nix
-    # ./sunshine.nix
     # ./zerotier.nix
     # ./dnscrypt.nix
-    ./llama.nix
-    ./ollama.nix
-    ./tailscale.nix
-    ./samba.nix
-    ./mullvad.nix
-    ./openrgb.nix
-    ./command-runner.nix
-    ./resolved.nix
-    ./minecraft.nix
-    ./fwupd.nix
     ./caddy.nix
-    ./monitoring.nix
+    ./command-runner.nix
-    ./wivrn.nix
-    ./sshd.nix
-    ./fprintd.nix
-    ./handoff.nix
-    ./gstreamer.nix
     ./dualsense.nix
+    ./fprintd.nix
+    ./fwupd.nix
+    ./gstreamer.nix
+    ./handoff.nix
+    ./minecraft.nix
+    ./monitoring.nix
+    ./mullvad.nix
+    ./ollama.nix
+    ./openrgb.nix
     ./openssh.nix
+    ./resolved.nix
+    ./samba.nix
+    ./sshd.nix
+    # ./sunshine.nix
+    ./tailscale.nix
+    ./wivrn.nix
   ];
 }

nixos/ryu/services/llama.nix

@@ -1,35 +0,0 @@
-{
-  pkgs,
-  config,
-  inputs,
-  ...
-}: {
-  #   llama-cpp = {
-  #     enable = false;
-  #     port = 11345;
-  #     # model = "/nix/store/ch6z9di3l0k54ad29pzv8k3zv47q30d1-Qwen3-Coder-30B-A3B-Instruct-Q4_K_M.gguf";
-  #     model = pkgs.fetchurl {
-  #       # url = "https://huggingface.co/lmstudio-community/gpt-oss-20b-GGUF/resolve/main/gpt-oss-20b-MXFP4.gguf";
-  #       # sha256 = "65d06d31a3977d553cb3af137b5c26b5f1e9297a6aaa29ae7caa98788cde53ab";
-  #       url = "https://huggingface.co/lmstudio-community/Qwen3-Coder-30B-A3B-Instruct-GGUF/resolve/main/Qwen3-Coder-30B-A3B-Instruct-Q4_K_M.gguf";
-  #       sha256 = "79ad15a5ee3caddc3f4ff0db33a14454a5a3eb503d7fa1c1e35feafc579de486";
-  #     };
-  #     extraFlags = [
-  #       "-c"
-  #       "98304"
-  #       "--jinja"
-  #       "--chat-template-file"
-  #       "${../../../assets/chat.hbs}"
-  #       # "/nix/store/4zk1p50hrzghp3jzzysz96pa64i2kmjl-promp.hbs"
-  #     ];
-  #     # package = inputs.llama-cpp.packages.${pkgs.system}.cuda;
-  #   };
-  services = {
-    caddy = {
-      virtualHosts."llama.ryu.darksailor.dev".extraConfig = ''
-        import cloudflare
-        reverse_proxy localhost:11345
-      '';
-    };
-  };
-}

nixos/ryu/services/ollama.nix

@@ -4,43 +4,55 @@
   config,
   ...
 }: {
+  sops = {
+    secrets."openai/api_key" = {};
+    secrets."llama/api_key".owner = config.services.caddy.user;
+    templates = {
+      "LLAMA_API_KEY.env".content = ''
+        LLAMA_API_KEY=${config.sops.placeholder."llama/api_key"}
+      '';
+    };
+  };
   services = {
     ollama = {
       enable = true;
       host = "0.0.0.0";
       # loadModels = ["deepseek-r1:7b" "deepseek-r1:14b" "RobinBially/nomic-embed-text-8k" "qwen3:8b" "qwen3:14b"];
-      # loadModels = ["deepseek-r1:7b" "deepseek-r1:14b" "RobinBially/nomic-embed-text-8k" "qwen3:8b" "qwen3:14b"];
       port = 11434;
       # acceleration = "cuda";
       environmentVariables = {
         OLLAMA_ORIGINS = "*";
         OLLAMA_LLM_LIBRARY = "cuda";
         LD_LIBRARY_PATH = "run/opengl-driver/lib";
-        HTTP_PROXY = "https://ollama.ryu.darksailor.dev";
+        HTTP_PROXY = "https://ollama.darksailor.dev";
+        OLLAMA_CONTEXT_LENGTH = "32000";
+        OLLAMA_KEEP_ALIVE = "30m";
       };
       package = pkgs.ollama-cuda;
     };
-    # open-webui = {
-    #   enable = false;
-    #   environment = {
-    #     OLLAMA_BASE_URL = "http://127.0.0.1:11434";
-    #     WEBUI_AUTH = "False";
-    #     ENABLE_LOGIN_FORM = "False";
-    #   };
-    # };
     caddy = {
-      # virtualHosts."llama.ryu.darksailor.dev".extraConfig = ''
+      virtualHosts."ollama.darksailor.dev".extraConfig = ''
-      #   import cloudflare
-      #   forward_auth tako:5555 {
-      #       uri /api/authz/forward-auth
-      #       copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
-      #   }
-      #   reverse_proxy localhost:${builtins.toString config.services.open-webui.port}
-      # '';
-      virtualHosts."ollama.ryu.darksailor.dev".extraConfig = ''
         import cloudflare
-        reverse_proxy localhost:${builtins.toString config.services.ollama.port}
+        @apikey {
+            header Authorization "Bearer {env.LLAMA_API_KEY}"
+        }
+
+        handle @apikey {
+          header {
+            # Set response headers or proxy to a different service if API key is valid
+            Access-Control-Allow-Origin *
+            -Authorization "Bearer {env.LLAMA_API_KEY}"  # Remove the header after validation
+          }
+          reverse_proxy localhost:${builtins.toString config.services.ollama.port}
+        }
+
+        respond "Unauthorized" 403
       '';
     };
   };
+  systemd.services.caddy = {
+    serviceConfig = {
+      EnvironmentFile = config.sops.templates."LLAMA_API_KEY.env".path;
+    };
+  };
 }

nixos/ryu/services/resolved.nix

@@ -1,9 +1,11 @@
 {...}: {
+  # Disable all the dns stuff in favour of tailscale's DNS
   services.resolved = {
     enable = true;
     dnssec = "true";
     dnsovertls = "true";
     domains = ["lemur-newton.ts.net"];
-    fallbackDns = ["1.1.1.1"];
+    fallbackDns = [];
   };
+  networking.nameservers = [];
 }

nixos/ryu/services/samba.nix

@@ -1,36 +1,30 @@
-{...}: {
+{
-  # services = {
+  lib,
-  #   samba = {
+  config,
-  #     enable = false;
+  device,
-  #     openFirewall = true;
+  ...
-  #     settings = {
+}: {
-  #       global = {
+  # networking.firewall.allowPing = true;
-  #         "workgroup" = "WORKGROUP";
+  sops = {
-  #         "server string" = "smbnix";
+    secrets."nas/password" = {};
-  #         "netbios name" = "smbnix";
+    templates."nas-credentials".content = ''
-  #         "security" = "user";
+      username=${device.user}
-  #         "hosts allow" = "192.168.11. 127.0.0.1 localhost";
+      domain=WORKGROUP
-  #         "hosts deny" = "0.0.0.0/0";
+      password=${config.sops.placeholder."nas/password"}
-  #         "guest account" = "nobody";
+    '';
-  #         "map to guest" = "bad user";
+  };
-  #       };
+  fileSystems."/volumes/nas" = {
-  #
+    device = "//tsuba.darksailor.dev/nas";
-  #       public = {
+    fsType = "cifs";
-  #         "path" = "/media";
+
-  #         "browseable" = "yes";
+    options = let
-  #         "read only" = "no";
+      options = "nofail,x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
-  #         "guest ok" = "yes";
+      uid = toString config.users.users.servius.uid;
-  #         "create mask" = "0644";
+      gid = toString config.users.groups.servius.gid;
-  #         "directory mask" = "0755";
+      check = lib.asserts.assertMsg (
-  #         # "force user" = "username";
+        uid != "" && gid != ""
-  #         # "force group" = "groupname";
+      ) "User ${device.user} must have uid ang gid set to mount NAS as user.";
-  #       };
+    in
-  #     };
+      lib.optionals check ["${options},credentials=${config.sops.templates."nas-credentials".path},uid=${uid},gid=${gid}"];
-  #   };
+  };
-  #   samba-wsdd = {
-  #     enable = true;
-  #     openFirewall = true;
-  #   };
-  # };
-  networking.firewall.allowPing = true;
 }

nixos/ryu/vms/default.nix

@@ -1,17 +1,21 @@
-{
+{pkgs, ...}: {
   virtualisation = {
-    libvirtd = {
+    # libvirtd = {
+    #   enable = true;
+    #   qemu = {
+    #     runAsRoot = true;
+    #     swtpm.enable = true;
+    #     # ovmf = {
+    #     #   enable = true;
+    #     # };
+    #   };
+    # };
+    waydroid = {
       enable = true;
-      qemu = {
+      package = pkgs.waydroid-nftables;
-        runAsRoot = true;
-        swtpm.enable = true;
-        # ovmf = {
-        #   enable = true;
-        # };
-      };
     };
   };
-  imports = [
+  # imports = [
-    ./win11.nix
+  #   ./win11.nix
-  ];
+  # ];
 }

nixos/tako/configuration.nix

@@ -65,7 +65,7 @@
       dates = "daily";
       options = "--delete-older-than 5d";
     };
-    package = pkgs.nixVersions.latest; # deploy-rs doesn't work with nix >= 2.32
+    package = pkgs.nixVersions.nix_2_32; # deploy-rs doesn't work with nix >= 2.32
     distributedBuilds = true;
   };
 
@@ -159,6 +159,7 @@
 
   # Open ports in the firewall.
   networking.firewall.allowedTCPPorts = [22 80 443];
+  networking.firewall.allowedUDPPorts = [8766 27016 9700];
 
   # Copy the NixOS configuration file and link it from the resulting system
   # (/run/current-system/configuration.nix). This is useful in case you

nixos/tako/services/blocky.nix

@@ -0,0 +1,19 @@
+{
+  device,
+  config,
+  ...
+}: {
+  services = {
+    blocky = {
+      enable = true;
+      settings = {
+        ports.dns = 53;
+        ports.http = 83838;
+        ports.dohPath = "/dns-query";
+      };
+    };
+    caddy.virtualHosts."blocky.${device.domain}".extraConfig = ''
+      reverse_proxy localhost:83838
+    '';
+  };
+}

nixos/tako/services/default.nix

@@ -2,9 +2,10 @@
   imports = [
     ./games
     # ./headscale.nix
-    # ./llama.nix
+    ./llms.nix
     # ./monitoring.nix
     # ./paperless.nix
+    ./navidrome.nix
     ./shitpost.nix
     ./atuin.nix
     ./authelia.nix
@@ -22,6 +23,7 @@
     ./resolved.nix
     ./searxng.nix
     ./tailscale.nix
+    ./kellnr.nix
   ];
   services = {
     nix-serve = {

nixos/tako/services/games/default.nix

@@ -1,7 +1,12 @@
-{...}: {
+{pkgs, ...}: {
   imports = [
     # ./minecraft.nix
     # ./satisfactory.nix
     ./terraria.nix
   ];
+
+  environment.systemPackages = with pkgs; [
+    steamcmd
+    steam-tui
+  ];
 }

nixos/tako/services/homepage.nix

@@ -24,6 +24,7 @@
                 icon = "jellyfin.png";
                 description = "Jellyfin Media Server";
                 href = "https://jellyfin.tsuba.darksailor.dev";
+                siteMonitor = "https://jellyfin.tsuba.darksailor.dev";
               };
             }
             {
@@ -31,6 +32,7 @@
                 icon = "sonarr.png";
                 description = "Sonarr: TV Series Management";
                 href = "https://sonarr.tsuba.darksailor.dev";
+                siteMonitor = "https://sonarr.tsuba.darksailor.dev";
               };
             }
             {
@@ -38,6 +40,7 @@
                 icon = "bazarr.png";
                 description = "Bazarr: Subtitles and Metadata";
                 href = "https://bazarr.tsuba.darksailor.dev";
+                siteMonitor = "https://bazarr.tsuba.darksailor.dev";
               };
             }
             {
@@ -45,6 +48,7 @@
                 icon = "radarr.png";
                 description = "Radarr: Movie Management";
                 href = "https://radarr.tsuba.darksailor.dev";
+                siteMonitor = "https://radarr.tsuba.darksailor.dev";
               };
             }
             {
@@ -52,13 +56,7 @@
                 icon = "deluge.png";
                 description = "Deluge: Torrent Client";
                 href = "https://deluge.tsuba.darksailor.dev";
-              };
+                siteMonitor = "https://deluge.tsuba.darksailor.dev";
-            }
-            {
-              "Prowlarr" = {
-                icon = "prowlarr.png";
-                description = "Prowlarr: Indexer Manager";
-                href = "https://prowlarr.tsuba.darksailor.dev";
               };
             }
             {
@@ -66,6 +64,15 @@
                 icon = "home-assistant.png";
                 description = "Home Automation";
                 href = "https://home.darksailor.dev";
+                siteMonitor = "https://home.darksailor.dev";
+              };
+            }
+            {
+              "Pi Hole" = {
+                icon = "pi-hole.png";
+                description = "Pi-hole: Network-wide Ad Blocker";
+                href = "https://pihole.darksailor.dev";
+                siteMonitor = "https://pihole.darksailor.dev";
               };
             }
           ];
@@ -77,6 +84,7 @@
                 icon = "gitea.png";
                 description = "Gitea Code Hosting";
                 href = "https://git.darksailor.dev";
+                siteMonitor = "https://git.darksailor.dev";
               };
             }
             {
@@ -84,27 +92,47 @@
                 icon = "nextcloud.png";
                 description = "Nextcloud Suite";
                 href = "https://cloud.darksailor.dev";
+                siteMonitor = "https://cloud.darksailor.dev";
               };
             }
-            # {
-            #   "Open WebUI" = {
-            #     icon = "open-webui.png";
-            #     description = "Open WebUI for self hosted llms";
-            #     href = "https://llama.darksailor.dev";
-            #   };
-            # }
             {
               "Immich" = {
                 icon = "immich.png";
                 description = "Immich: Self-hosted Photo and Video Backup";
                 href = "https://photos.darksailor.dev";
+                siteMonitor = "https://photos.darksailor.dev";
               };
             }
             {
               "Excalidraw" = {
                 icon = "excalidraw.png";
-                description = "Excalidraw: Self-hosted Collaborative Whiteboard";
+                description = "Excalidraw: Self-hosted Whiteboard";
                 href = "https://draw.darksailor.dev";
+                siteMonitor = "https://draw.darksailor.dev";
+              };
+            }
+            {
+              "Navidrome" = {
+                icon = "navidrome.png";
+                description = "A self-hosted music server and streamer.";
+                href = "https://music.darksailor.dev";
+                siteMonitor = "https://music.darksailor.dev";
+              };
+            }
+            {
+              "OpenwebUI" = {
+                icon = "open-webui.png";
+                description = "OpenwebUI: Self-hosted AI chat interface";
+                href = "https://chat.darksailor.dev";
+                siteMonitor = "https://chat.darksailor.dev";
+              };
+            }
+            {
+              "Prowlarr" = {
+                icon = "prowlarr.png";
+                description = "Prowlarr: Indexer Manager";
+                href = "https://prowlarr.darksailor.dev";
+                siteMonitor = "https://prowlarr.darksailor.dev";
               };
             }
           ];
@@ -159,23 +187,22 @@
     };
     caddy = {
       virtualHosts."dashboard.darksailor.dev".extraConfig = ''
-        # import auth
         reverse_proxy localhost:${builtins.toString config.services.homepage-dashboard.listenPort}
       '';
     };
-    authelia = {
+    # authelia = {
-      instances.darksailor = {
+    #   instances.darksailor = {
-        settings = {
+    #     settings = {
-          access_control = {
+    #       access_control = {
-            rules = [
+    #         rules = [
-              {
+    #           {
-                domain = "dashboard.darksailor.dev";
+    #             domain = "dashboard.darksailor.dev";
-                policy = "one_factor";
+    #             policy = "one_factor";
-              }
+    #           }
-            ];
+    #         ];
-          };
+    #       };
-        };
+    #     };
-      };
+    #   };
-    };
+    # };
   };
 }

nixos/tako/services/kellnr.nix

@@ -0,0 +1,57 @@
+# docker run --rm -it \
+# -p 8000:8000 \
+# -e "KELLNR_ORIGIN__HOSTNAME=kellnr.example.com" \
+# -v $(pwd):/opt/kdata ghcr.io/kellnr/kellnr:5
+# E.g. docker run -v /path/to/config.toml:/usr/local/cargo/config.toml:ro ghcr.io/kellnr/kellnr:5.2.4
+{config, ...}: let
+  port = 8899;
+  domain = "crates.darksailor.dev";
+in {
+  sops = {
+    secrets."kellnr/password" = {};
+    secrets."kellnr/token" = {};
+    templates."kellnr.env".content = ''
+      KELLNR_SETUP__ADMIN_PWD=${config.sops.placeholder."kellnr/password"}
+      KELLNR_SETUP__ADMIN_TOKEN=${config.sops.placeholder."kellnr/token"}
+    '';
+  };
+  virtualisation.oci-containers = {
+    backend = "docker";
+    containers = {
+      kellnr = {
+        image = "ghcr.io/kellnr/kellnr:5";
+        ports = ["127.0.0.1:${toString port}:8000"];
+        volumes = [
+          "/var/lib/kellnr:/opt/kdata"
+        ];
+        environment = {
+          KELLNR_ORIGIN__HOSTNAME = domain;
+          KELLNR_DOCS__ENABLED = "true";
+          KELLNR_ORIGIN__PROTOCOL = "https";
+          KELLNR_ORIGIN__PORT = "443";
+        };
+        environmentFiles = [
+          config.sops.templates."kellnr.env".path
+        ];
+      };
+    };
+  };
+  services.caddy.virtualHosts."${domain}".extraConfig = ''
+    # import auth
+    reverse_proxy localhost:${toString port}
+  '';
+  # services.authelia = {
+  #   instances.darksailor = {
+  #     settings = {
+  #       access_control = {
+  #         rules = [
+  #           {
+  #             inherit domain;
+  #             policy = "one_factor";
+  #           }
+  #         ];
+  #       };
+  #     };
+  #   };
+  # };
+}

nixos/tako/services/llama.nix

@@ -1,103 +0,0 @@
-{
-  config,
-  pkgs,
-  inputs,
-  ...
-}: {
-  sops = {
-    secrets."llama/api_key".owner = config.services.caddy.user;
-    secrets."llama/user".owner = config.services.caddy.user;
-    secrets."openai/api_key" = {};
-    templates = {
-      "LLAMA_API_KEY.env".content = ''
-        LLAMA_API_KEY=${config.sops.placeholder."llama/api_key"}
-      '';
-      api_key_env.owner = config.services.caddy.user;
-      "OPENAI_API_KEY.env".content = ''
-        OPENAI_API_KEY="${config.sops.placeholder."openai/api_key"}"
-      '';
-    };
-  };
-  services = {
-    llama-cpp = {
-      enable = false;
-      port = 11435;
-      model = pkgs.fetchurl {
-        url = "https://huggingface.co/lmstudio-community/gpt-oss-20b-GGUF/resolve/main/gpt-oss-20b-MXFP4.gguf";
-        sha256 = "65d06d31a3977d553cb3af137b5c26b5f1e9297a6aaa29ae7caa98788cde53ab";
-      };
-      # package = pkgs.ik_llama;
-    };
-    ollama = {
-      enable = false;
-      loadModels = [
-        "deepseek-r1:7b"
-        "deepseek-r1:14b"
-        "RobinBially/nomic-embed-text-8k"
-        "qwen3:8b"
-      ];
-      port = 11434;
-      host = "0.0.0.0";
-      environmentVariables = {
-        OLLAMA_ORIGINS = "*";
-      };
-    };
-    open-webui = {
-      enable = false;
-      port = 7070;
-      environment = {
-        SCARF_NO_ANALYTICS = "True";
-        DO_NOT_TRACK = "True";
-        ANONYMIZED_TELEMETRY = "False";
-        WEBUI_AUTH = "False";
-        ENABLE_LOGIN_FORM = "False";
-        WEBUI_URL = "https://llama.darksailor.dev";
-        OPENAI_BASE_URL = "https://ollama.darksailor.dev/v1";
-        OLLAMA_API_BASE_URL = "https://ollama.ryu.darksailor.dev";
-      };
-      environmentFile = "${config.sops.templates."LLAMA_API_KEY.env".path}";
-    };
-
-    caddy = {
-      virtualHosts."llama.darksailor.dev".extraConfig = ''
-        import auth
-        reverse_proxy localhost:${builtins.toString config.services.open-webui.port}
-      '';
-      virtualHosts."ollama.darksailor.dev".extraConfig = ''
-        @apikey {
-            header Authorization "Bearer {env.LLAMA_API_KEY}"
-        }
-
-        handle @apikey {
-          header {
-            # Set response headers or proxy to a different service if API key is valid
-            Access-Control-Allow-Origin *
-            -Authorization "Bearer {env.LLAMA_API_KEY}"  # Remove the header after validation
-          }
-          reverse_proxy localhost:${builtins.toString config.services.llama-cpp.port}
-        }
-
-        respond "Unauthorized" 403
-      '';
-    };
-    authelia = {
-      instances.darksailor = {
-        settings = {
-          access_control = {
-            rules = [
-              {
-                domain = "llama.darksailor.dev";
-                policy = "one_factor";
-              }
-            ];
-          };
-        };
-      };
-    };
-  };
-  systemd.services.caddy = {
-    serviceConfig = {
-      EnvironmentFile = config.sops.templates."LLAMA_API_KEY.env".path;
-    };
-  };
-}

nixos/tako/services/llms.nix

@@ -0,0 +1,54 @@
+{config, ...}: {
+  sops = {
+    secrets."llama/api_key".owner = config.services.caddy.user;
+    secrets."openai/api_key" = {};
+    templates = {
+      "ollama.env".content = ''
+        LLAMA_API_KEY=${config.sops.placeholder."llama/api_key"}
+        OPENAI_API_KEYS=${config.sops.placeholder."openai/api_key"}
+      '';
+    };
+  };
+  services = {
+    open-webui = {
+      enable = true;
+      port = 7070;
+      environment = {
+        SCARF_NO_ANALYTICS = "True";
+        DO_NOT_TRACK = "True";
+        ANONYMIZED_TELEMETRY = "False";
+        WEBUI_AUTH = "False";
+        ENABLE_LOGIN_FORM = "False";
+        WEBUI_URL = "https://chat.darksailor.dev";
+        OLLAMA_BASE_URL = "https://ollama.darksailor.dev";
+      };
+      environmentFile = "${config.sops.templates."ollama.env".path}";
+    };
+
+    caddy = {
+      virtualHosts."chat.darksailor.dev".extraConfig = ''
+        import auth
+        reverse_proxy localhost:${builtins.toString config.services.open-webui.port}
+      '';
+    };
+    authelia = {
+      instances.darksailor = {
+        settings = {
+          access_control = {
+            rules = [
+              {
+                domain = "chat.darksailor.dev";
+                policy = "one_factor";
+              }
+            ];
+          };
+        };
+      };
+    };
+  };
+  systemd.services.caddy = {
+    serviceConfig = {
+      EnvironmentFile = config.sops.templates."ollama.env".path;
+    };
+  };
+}

nixos/tako/services/navidrome.nix

@@ -1,18 +1,72 @@
-{...}: {
+{
+  device,
+  config,
+  ...
+}: let
+  socket = "/run/navidrome/navidrome.sock";
+in {
+  sops = {
+    secrets."lastfm/api_key" = {};
+    secrets."lastfm/shared_secret" = {};
+    templates."lastfm.env".content = ''
+      ND_LASTFM_APIKEY=${config.sops.placeholder."lastfm/api_key"}
+      ND_LASTFM_SECRET=${config.sops.placeholder."lastfm/shared_secret"}
+    '';
+  };
   services = {
     navidrome = {
       enable = true;
       settings = {
         MusicFolder = "/media/music";
         ReverseProxyUserHeader = "Remote-User";
-        ReverseProxyWhitelist = "127.0.0.1/32";
+        ReverseProxyWhitelist = "@";
+        Address = "unix:${socket}";
+        BaseUrl = "https://music.darksailor.dev";
       };
+      environmentFile = config.sops.templates."lastfm.env".path;
     };
     caddy = {
       virtualHosts."music.darksailor.dev".extraConfig = ''
         import auth
-        reverse_proxy localhost:4533
+        reverse_proxy unix/${socket}
       '';
     };
+    authelia = {
+      instances.darksailor = {
+        settings = {
+          access_control = {
+            rules = [
+              {
+                domain = "music.darksailor.dev";
+                policy = "bypass";
+                resources = [
+                  "^/(rest|share)([/?].*)?$"
+                ];
+              }
+              {
+                domain = "music.darksailor.dev";
+                policy = "one_factor";
+              }
+            ];
+          };
+        };
+      };
+    };
+  };
+  systemd.services.navidrome.requires = ["systemd-tmpfiles-setup.service"];
+  systemd.tmpfiles.settings = {
+    navidromeDirs = {
+      "/run/navidrome".d = {
+        mode = "775";
+        user = "navidrome";
+        group = "navidrome";
+      };
+    };
+  };
+  users.users.${device.user} = {
+    extraGroups = ["navidrome"];
+  };
+  users.users.caddy = {
+    extraGroups = ["navidrome"];
   };
 }

nixos/tsuba/configuration.nix

@@ -5,8 +5,6 @@
   device,
   ...
 }: {
-  virtualisation.docker.enable = true;
-  virtualisation.oci-containers.backend = "docker";
   users.extraUsers.servius.extraGroups = ["docker"];
   networking.firewall.enable = false;
   services.openssh.enable = true;

nixos/tsuba/default.nix

@@ -3,6 +3,7 @@
   inputs,
   overlays,
   home-manager-stable,
+  nixpkgs,
   nur,
   nixos-raspberrypi,
   ...
@@ -15,13 +16,14 @@
             inherit device;
             unstablePkgs = inputs.nixpkgs.legacyPackages.${device.system};
             masterPkgs = inputs.nixpkgs-master.legacyPackages.${device.system};
+            cratesNix = inputs.crates-nix.mkLib {pkgs = nixpkgs.legacyPackages.${device.system};};
           };
         system = device.system;
         modules = [
           inputs.arion.nixosModules.arion
           inputs.disko.nixosModules.disko
           inputs.sops-nix.nixosModules.sops
-          inputs.stylix-stable.nixosModules.stylix
+          # inputs.stylix-stable.nixosModules.stylix
           inputs.nix-minecraft.nixosModules.minecraft-servers
           nur.modules.nixos.default
           home-manager-stable.nixosModules.home-manager
@@ -40,6 +42,7 @@
                 inherit inputs;
                 inherit device;
                 stablePkgs = inputs.nixpkgs-stable.legacyPackages.${device.system};
+                cratesNix = inputs.crates-nix.mkLib {pkgs = nixpkgs.legacyPackages.${device.system};};
               };
               users.${device.user}.imports = [
                 inputs.nixvim.homeModules.nixvim
@@ -53,7 +56,7 @@
           ./disk-config.nix
           ./${name}.nix
           ../../sops.nix
-          ../../stylix.nix
+          # ../../stylix.nix
         ];
       }
   )

nixos/tsuba/services/default.nix

@@ -10,5 +10,8 @@
     ./flaresolverr.nix
     ./caddy.nix
     ./monitoring.nix
+    ./pihole.nix
+    ./resolved.nix
+    ./docker.nix
   ];
 }