feat: re-enable affine service

refactor(matrix): simplify LiveKit configuration to use services.livekit and services.lk-jwt-service
refactor(affine): use Docker network option instead of --network flag
2026-02-23 17:05:03 +05:30 · 2026-02-23 16:32:14 +05:30 · 2026-02-23 16:05:09 +05:30 · 2026-02-23 15:49:50 +05:30 · 2026-02-23 14:43:49 +05:30 · 2026-02-22 15:32:38 +05:30
72 changed files with 1306 additions and 1052 deletions
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -162,6 +162,11 @@ sessionVariables.BROWSER = if device.isDarwin then "open" else "xdg-open";
 just add program myprogram  # Creates home/programs/myprogram.nix and adds import
 ```

+### Adding a new dns entry
+```bash
+cfcli add --type A foobar.bazbar.biz 192.168.0.1
+```
+
 ### Creating a Module

 1. Determine location: `modules/nixos/`, `modules/darwin/`, or `modules/home/`
--- a/deploy.nix
+++ b/deploy.nix
@@ -55,13 +55,13 @@
        user = "root";
      };
    };
-    # deck = {
-    #   hostname = "steamdeck";
-    #   profiles.system = {
-    #     sshUser = "deck";
-    #     path = deploy-rs.lib.x86_64-linux.activate.home-manager self.homeConfigurations.deck;
-    #     user = "deck";
-    #   };
-    # };
+    deck = {
+      hostname = "sdeck";
+      profiles.system = {
+        sshUser = "deck";
+        path = deploy-rs.lib.x86_64-linux.activate.home-manager self.homeConfigurations.deck;
+        user = "deck";
+      };
+    };
  };
 }
--- a/flake.lock
+++ b/flake.lock
@@ -90,11 +90,11 @@
        "systems": "systems"
      },
      "locked": {
-        "lastModified": 1769348268,
-        "narHash": "sha256-CS36Qbh7kEJ1Skwc/Npy1JdjoW1eVLFAR8+hKChsS/Q=",
+        "lastModified": 1770224382,
+        "narHash": "sha256-lGX0Nl7UgoG3P60/oYfbhRjDZ2+4flLC42vhUP8tLrs=",
        "owner": "anyrun-org",
        "repo": "anyrun",
-        "rev": "7b8e5f1f650e435c01e322cbda653afcb06920f8",
+        "rev": "07fead6d3f272b672b71dc8daf54b64817b50000",
        "type": "github"
      },
      "original": {
@@ -217,11 +217,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769428758,
-        "narHash": "sha256-0G/GzF7lkWs/yl82bXuisSqPn6sf8YGTnbEdFOXvOfU=",
+        "lastModified": 1770895474,
+        "narHash": "sha256-JBcrq1Y0uw87VZdYsByVbv+GBuT6ECaCNb9txLX9UuU=",
        "owner": "hyprwm",
        "repo": "aquamarine",
-        "rev": "def5e74c97370f15949a67c62e61f1459fcb0e15",
+        "rev": "a494d50d32b5567956b558437ceaa58a380712f7",
        "type": "github"
      },
      "original": {
@@ -255,11 +255,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1767581175,
-        "narHash": "sha256-d9ztdDD4EIbsGbERzXhg6Vlo7zMChjpZci4IrS0hSAY=",
+        "lastModified": 1770259557,
+        "narHash": "sha256-EvZ09k9+mzXAngPzU2K7oLLUDlKoT1numb4bDb3Gtl4=",
        "owner": "hercules-ci",
        "repo": "arion",
-        "rev": "3534dd9d0f32c7dbee4f87378d4c95ffcd8838c5",
+        "rev": "9b24cf65c72cb0e9616e437d55e1ac8e5c6bc715",
        "type": "github"
      },
      "original": {
@@ -436,11 +436,11 @@
    },
    "crane_3": {
      "locked": {
-        "lastModified": 1769737823,
-        "narHash": "sha256-DrBaNpZ+sJ4stXm+0nBX7zqZT9t9P22zbk6m5YhQxS4=",
+        "lastModified": 1771121070,
+        "narHash": "sha256-aIlv7FRXF9q70DNJPI237dEDAznSKaXmL5lfK/Id/bI=",
        "owner": "ipetkov",
        "repo": "crane",
-        "rev": "b2f45c3830aa96b7456a4c4bc327d04d7a43e1ba",
+        "rev": "a2812c19f1ed2e5ed5ce2ef7109798b575c180e1",
        "type": "github"
      },
      "original": {
@@ -521,10 +521,10 @@
    "crates-io-index": {
      "flake": false,
      "locked": {
-        "lastModified": 1770225473,
-        "narHash": "sha256-OPGUxZFg04yAzxSsAtQ6pWZ2RR7jmCRQaFw2q3ukQWM=",
+        "lastModified": 1771515523,
+        "narHash": "sha256-5S4n9alO7MVlHawzeX0d7vpWzTIULWic3+1MPNUcqVM=",
        "ref": "refs/heads/master",
-        "rev": "8deef1ef1404f748b62bb9b544ec2fcf81124272",
+        "rev": "bba640d9c272da3c4ad7e8050ee072703cf99567",
        "shallow": true,
        "type": "git",
        "url": "https://github.com/rust-lang/crates.io-index"
@@ -558,11 +558,11 @@
    "csshacks": {
      "flake": false,
      "locked": {
-        "lastModified": 1768572660,
-        "narHash": "sha256-VlxdEeMqgRclKQqnKDhBXQ+19ce35ZFdC6SaKg2skUk=",
+        "lastModified": 1770817581,
+        "narHash": "sha256-rDuTVA5WvHwYsZTk4GOPQ0zvpynVU0TeuVGeg5ihndE=",
        "owner": "MrOtherGuy",
        "repo": "firefox-csshacks",
-        "rev": "bcb85f04764802557fc1d1dff6f53461065e4893",
+        "rev": "6fc627e1cb85723fd71dd33004a3e48a13566dd2",
        "type": "github"
      },
      "original": {
@@ -684,11 +684,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1770149608,
-        "narHash": "sha256-M71mqmGJOq4tDphaKE8KHHYH3JSrkY3aAw+PnLsw0yk=",
+        "lastModified": 1771421933,
+        "narHash": "sha256-Svu784sqcgeb8cmDaV9UZh3IqaFrReTab3TdRuRoyrI=",
        "owner": "christo-auer",
        "repo": "eilmeldung",
-        "rev": "095980fcebad0d766b927fa7aa395631b8812a5c",
+        "rev": "2e4d5a6c29541de57062ee6194edb58e9f570825",
        "type": "github"
      },
      "original": {
@@ -972,7 +972,7 @@
    "flake-parts_10": {
      "inputs": {
        "nixpkgs-lib": [
-          "stylix",
+          "stylix-stable",
          "nixpkgs"
        ]
      },
@@ -992,28 +992,7 @@
    },
    "flake-parts_11": {
      "inputs": {
-        "nixpkgs-lib": [
-          "stylix-stable",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1767609335,
-        "narHash": "sha256-feveD98mQpptwrAEggBQKJTYbvwwglSbOv53uCfH9PY=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "250481aafeb741edfe23d29195671c19b36b6dca",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-parts_12": {
-      "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib_6"
+        "nixpkgs-lib": "nixpkgs-lib_5"
      },
      "locked": {
        "lastModified": 1768135262,
@@ -1055,11 +1034,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1765835352,
-        "narHash": "sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw=",
+        "lastModified": 1769996383,
+        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "a34fae9c08a15ad73f295041fec82323541400a9",
+        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
        "type": "github"
      },
      "original": {
@@ -1109,21 +1088,25 @@
        "nixpkgs-lib": "nixpkgs-lib_4"
      },
      "locked": {
-        "lastModified": 1767609335,
-        "narHash": "sha256-feveD98mQpptwrAEggBQKJTYbvwwglSbOv53uCfH9PY=",
+        "lastModified": 1769996383,
+        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "250481aafeb741edfe23d29195671c19b36b6dca",
+        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
        "type": "github"
      },
      "original": {
-        "id": "flake-parts",
-        "type": "indirect"
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
      }
    },
    "flake-parts_7": {
      "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib_5"
+        "nixpkgs-lib": [
+          "nixvim",
+          "nixpkgs"
+        ]
      },
      "locked": {
        "lastModified": 1769996383,
@@ -1142,16 +1125,16 @@
    "flake-parts_8": {
      "inputs": {
        "nixpkgs-lib": [
-          "nixvim",
+          "nur",
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1768135262,
-        "narHash": "sha256-PVvu7OqHBGWN16zSi6tEmPwwHQ4rLPU9Plvs8/1TUBY=",
+        "lastModified": 1733312601,
+        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "80daad04eddbbf5a4d883996a73f3f542fa437ac",
+        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
        "type": "github"
      },
      "original": {
@@ -1163,16 +1146,16 @@
    "flake-parts_9": {
      "inputs": {
        "nixpkgs-lib": [
-          "nur",
+          "stylix",
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1733312601,
-        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
+        "lastModified": 1767609335,
+        "narHash": "sha256-feveD98mQpptwrAEggBQKJTYbvwwglSbOv53uCfH9PY=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
+        "rev": "250481aafeb741edfe23d29195671c19b36b6dca",
        "type": "github"
      },
      "original": {
@@ -1544,11 +1527,11 @@
        "zon2nix": "zon2nix"
      },
      "locked": {
-        "lastModified": 1770091344,
-        "narHash": "sha256-tKS5jzMfcWJjzq1Rm2QVUohzHEG/1VOM57aH6RQ5ALk=",
+        "lastModified": 1771513100,
+        "narHash": "sha256-NbejFbBW+h5RbqKY3DUPaEk1Z+jsgVVwZNcc709RuZA=",
        "owner": "ghostty-org",
        "repo": "ghostty",
-        "rev": "51897c0cd51fee61fff824d616fb2901ac41e817",
+        "rev": "c11db662e6f514350cbd8fcef06f81dc95260d00",
        "type": "github"
      },
      "original": {
@@ -1701,11 +1684,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769442434,
-        "narHash": "sha256-Yb3rveS1BoYiRq7RuIe2DUUDj65+EZZhNBpxZTLycjE=",
+        "lastModified": 1771272718,
+        "narHash": "sha256-3m/58a0IuON0JRupQnyxhEgp2fHVFVNluRuG1iZVTbg=",
        "owner": "tale",
        "repo": "headplane",
-        "rev": "2b0f337cb5b3ff204832796d6a77b2de01062ce3",
+        "rev": "9183ec294244a5a2c2b0c05f4629d7aac68eb120",
        "type": "github"
      },
      "original": {
@@ -1722,11 +1705,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1768068402,
-        "narHash": "sha256-bAXnnJZKJiF7Xr6eNW6+PhBf1lg2P1aFUO9+xgWkXfA=",
+        "lastModified": 1770586272,
+        "narHash": "sha256-Ucci8mu8QfxwzyfER2DQDbvW9t1BnTUJhBmY7ybralo=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "8bc5473b6bc2b6e1529a9c4040411e1199c43b4c",
+        "rev": "b1f916ba052341edc1f80d4b2399f1092a4873ca",
        "type": "github"
      },
      "original": {
@@ -1742,11 +1725,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769580047,
-        "narHash": "sha256-tNqCP/+2+peAXXQ2V8RwsBkenlfWMERb+Uy6xmevyhM=",
+        "lastModified": 1770260404,
+        "narHash": "sha256-3iVX1+7YUIt23hBx1WZsUllhbmP2EnXrV8tCRbLxHc8=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "366d78c2856de6ab3411c15c1cb4fb4c2bf5c826",
+        "rev": "0d782ee42c86b196acff08acfbf41bb7d13eed5b",
        "type": "github"
      },
      "original": {
@@ -1763,32 +1746,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1770164260,
-        "narHash": "sha256-mQgOAYWlVJyuyXjZN6yxqXWyODvQI5P/UZUCU7IOuYo=",
+        "lastModified": 1771505064,
+        "narHash": "sha256-lh9rF+C/nKFyWAqbHIa6tK9L/6N0UaQg7zw15aP4jBM=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "4fda26500b4539e0a1e3afba9f0e1616bdad4f85",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "type": "github"
-      }
-    },
-    "home-manager_3": {
-      "inputs": {
-        "nixpkgs": [
-          "zen-browser",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1769872935,
-        "narHash": "sha256-07HMIGQ/WJeAQJooA7Kkg1SDKxhAiV6eodvOwTX6WKI=",
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "rev": "f4ad5068ee8e89e4a7c2e963e10dd35cd77b37b7",
+        "rev": "a0a01d8811fd5e99e003078ed64a0e7b531545dd",
        "type": "github"
      },
      "original": {
@@ -1842,11 +1804,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769284023,
-        "narHash": "sha256-xG34vwYJ79rA2wVC8KFuM8r36urJTG6/csXx7LiiSYU=",
+        "lastModified": 1770511807,
+        "narHash": "sha256-suKmSbSk34uPOJDTg/GbPrKEJutzK08vj0VoTvAFBCA=",
        "owner": "hyprwm",
        "repo": "hyprgraphics",
-        "rev": "13c536659d46893596412d180449353a900a1d31",
+        "rev": "7c75487edd43a71b61adb01cae8326d277aab683",
        "type": "github"
      },
      "original": {
@@ -1903,11 +1865,11 @@
        "xdph": "xdph"
      },
      "locked": {
-        "lastModified": 1770208963,
-        "narHash": "sha256-5oMhKcLzNLMy9GFpHtrZ6XJdgJpthhprv2ZC88DPN5Q=",
+        "lastModified": 1771463568,
+        "narHash": "sha256-QblR2JnpK8x5oqabLtLTJ7HdmEI7uc57pC3/ZMfd4eA=",
        "owner": "hyprwm",
        "repo": "Hyprland",
-        "rev": "02ff413002eddd7419ba70eb0f9f92acd2d97ddc",
+        "rev": "a1e62dcb12f5547ccb786b34a46ae60ca78ec5e7",
        "type": "github"
      },
      "original": {
@@ -2156,11 +2118,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1766253372,
-        "narHash": "sha256-1+p4Kw8HdtMoFSmJtfdwjxM4bPxDK9yg27SlvUMpzWA=",
+        "lastModified": 1770139857,
+        "narHash": "sha256-bCqxcXjavgz5KBJ/1CBLqnagMMf9JvU1m9HmYVASKoc=",
        "owner": "hyprwm",
        "repo": "hyprutils",
-        "rev": "51a4f93ce8572e7b12b7284eb9e6e8ebf16b4be9",
+        "rev": "9038eec033843c289b06b83557a381a2648d8fa5",
        "type": "github"
      },
      "original": {
@@ -2206,11 +2168,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1763640274,
-        "narHash": "sha256-Uan1Nl9i4TF/kyFoHnTq1bd/rsWh4GAK/9/jDqLbY5A=",
+        "lastModified": 1770501770,
+        "narHash": "sha256-NWRM6+YxTRv+bT9yvlhhJ2iLae1B1pNH3mAL5wi2rlQ=",
        "owner": "hyprwm",
        "repo": "hyprwayland-scanner",
-        "rev": "f6cf414ca0e16a4d30198fd670ec86df3c89f671",
+        "rev": "0bd8b6cde9ec27d48aad9e5b4deefb3746909d40",
        "type": "github"
      },
      "original": {
@@ -2260,11 +2222,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769202094,
-        "narHash": "sha256-gdJr/vWWLRW85ucatSjoBULPB2dqBJd/53CZmQ9t91Q=",
+        "lastModified": 1770203293,
+        "narHash": "sha256-PR/KER+yiHabFC/h1Wjb+9fR2Uy0lWM3Qld7jPVaWkk=",
        "owner": "hyprwm",
        "repo": "hyprwire",
-        "rev": "a45ca05050d22629b3c7969a926d37870d7dd75c",
+        "rev": "37bc90eed02b0c8b5a77a0b00867baf3005cfb98",
        "type": "github"
      },
      "original": {
@@ -2278,11 +2240,11 @@
        "nixpkgs": "nixpkgs_4"
      },
      "locked": {
-        "lastModified": 1770160034,
-        "narHash": "sha256-uYNkQ/Rx1z6lGgu3zPVQACJar7bnx0sVd8LF+Asxfzc=",
+        "lastModified": 1771348869,
+        "narHash": "sha256-v6joie0zC6omgEpb6QQxCrNi3psVg3K0SJSJyRGeOpQ=",
        "owner": "JPyke3",
        "repo": "hytale-launcher-nix",
-        "rev": "ccc5a4db5fdb2b3556b55ae6d82450986db2a74a",
+        "rev": "0e4dfdccdbb0451ea478a19bb6d4d8e2192db9f2",
        "type": "github"
      },
      "original": {
@@ -2299,11 +2261,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1770214080,
-        "narHash": "sha256-DnPXRFurU/VrpA1frMLRoodiUHWWpdROQvQu9zWUZhI=",
+        "lastModified": 1771485349,
+        "narHash": "sha256-7bLg+n/O8oOf8M9+C1EAlt6sbWAl+Nk4INAIDRt1yo8=",
        "owner": "ikawrakow",
        "repo": "ik_llama.cpp",
-        "rev": "a335cff6643c7927cdc982cf780cc66e3c04482e",
+        "rev": "b855bf92de0e5500c0a93160e41d320ba75e8e6c",
        "type": "github"
      },
      "original": {
@@ -2322,11 +2284,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1770160276,
-        "narHash": "sha256-17QhiwpLWD60fUUHmqOvHeCu/pDZwlBs6p7oHX+QQ+E=",
+        "lastModified": 1771406976,
+        "narHash": "sha256-LEOtGcM8Z7MBGjgJZAQ95+TbFtE1fiM4H8JuiIYWMKo=",
        "owner": "JakeStanger",
        "repo": "ironbar",
-        "rev": "2e9c248085371e8f46582c741936ccee4086feea",
+        "rev": "d17ee2ac27a30933fc661f8b44822862566e5a6f",
        "type": "github"
      },
      "original": {
@@ -2345,11 +2307,11 @@
        "rust-overlay": "rust-overlay_5"
      },
      "locked": {
-        "lastModified": 1770064250,
-        "narHash": "sha256-3HB6gfnKZnwDoH77lnJktJtQWEZ+D35Oi53pNF6YwO4=",
+        "lastModified": 1771492583,
+        "narHash": "sha256-nQzvnU4BGu8dA6BsPPCqmVcab/3ebVmHtX3ZWbW3Hxc=",
        "owner": "nix-community",
        "repo": "lanzaboote",
-        "rev": "9985b98c74dcc7b1c7ccfe8693daf37caa4ed2ea",
+        "rev": "5e9380994665ef66c87ab8e22c913ff837174ce4",
        "type": "github"
      },
      "original": {
@@ -2380,27 +2342,6 @@
        "type": "github"
      }
    },
-    "mixid": {
-      "inputs": {
-        "flake-parts": "flake-parts_6",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1768471435,
-        "narHash": "sha256-gf0oCl8LrBDaEVxtDLa9eR8wNC7ropbsYsI2ILXPjWk=",
-        "owner": "leguteape",
-        "repo": "MixiD",
-        "rev": "32d049213cdf4d4d25f310609749daa72f26cf65",
-        "type": "github"
-      },
-      "original": {
-        "owner": "leguteape",
-        "repo": "MixiD",
-        "type": "github"
-      }
-    },
    "music-player": {
      "inputs": {
        "advisory-db": "advisory-db_3",
@@ -2534,18 +2475,18 @@
    },
    "nix-auth": {
      "inputs": {
-        "flake-parts": "flake-parts_7",
+        "flake-parts": "flake-parts_6",
        "nixpkgs": [
          "nixpkgs"
        ],
        "treefmt-nix": "treefmt-nix"
      },
      "locked": {
-        "lastModified": 1770174507,
-        "narHash": "sha256-mCWrj/DGWSJ24H3FFwjiMr+8x/7O/Cq+mucdZpTUi7E=",
+        "lastModified": 1770607034,
+        "narHash": "sha256-kXsl3BQdgXrJwwlhxS/s58rEx4EFbNoyQThmJ6AJO9I=",
        "owner": "numtide",
        "repo": "nix-auth",
-        "rev": "9c6a0d577a443868964b8d0a7d6a2f48dcac2462",
+        "rev": "d867419fc5f8f1831798d7df8ffd62b13a1fd63b",
        "type": "github"
      },
      "original": {
@@ -2561,11 +2502,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1770184146,
-        "narHash": "sha256-DsqnN6LvXmohTRaal7tVZO/AKBuZ02kPBiZKSU4qa/k=",
+        "lastModified": 1771371916,
+        "narHash": "sha256-G14VTfmzzRYxAhtEBNanQgCNA++Cv0/9iV4h/lkqX9U=",
        "owner": "LnL7",
        "repo": "nix-darwin",
-        "rev": "0d7874ef7e3ba02d58bebb871e6e29da36fa1b37",
+        "rev": "aff4c008cec17d6a6760949df641ca0ea9179cac",
        "type": "github"
      },
      "original": {
@@ -2663,11 +2604,11 @@
        "nixpkgs": "nixpkgs_6"
      },
      "locked": {
-        "lastModified": 1770202486,
-        "narHash": "sha256-VhmDekVd7JUEw6CRrN27cou1FfQuoRHhUEq3uCzfl98=",
+        "lastModified": 1771130777,
+        "narHash": "sha256-UIKOwG0D9XVIJfNWg6+gENAvQP+7LO46eO0Jpe+ItJ0=",
        "owner": "Mic92",
        "repo": "nix-index-database",
-        "rev": "f7d77408f21b6e8d03a5271ad9e633bfbac9cc7a",
+        "rev": "efec7aaad8d43f8e5194df46a007456093c40f88",
        "type": "github"
      },
      "original": {
@@ -2683,11 +2624,11 @@
        "systems": "systems_16"
      },
      "locked": {
-        "lastModified": 1770172907,
-        "narHash": "sha256-rqYl9B+4shcM5b6OYjT+qdsdQNJ7SY64/xcPIb96NzU=",
+        "lastModified": 1771469368,
+        "narHash": "sha256-yGRHre2BINQJBDAyUwxyzvgAce22J4pNdpLS8roo6fY=",
        "owner": "Infinidoge",
        "repo": "nix-minecraft",
-        "rev": "8958a5a4259e1aebf4916823bf463faaf2538566",
+        "rev": "a708458be9b9421e377c54d86807d3490db53816",
        "type": "github"
      },
      "original": {
@@ -2815,21 +2756,6 @@
      }
    },
    "nixpkgs-lib_4": {
-      "locked": {
-        "lastModified": 1765674936,
-        "narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=",
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "rev": "2075416fcb47225d9b68ac469a5c4801a9c4dd85",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "type": "github"
-      }
-    },
-    "nixpkgs-lib_5": {
      "locked": {
        "lastModified": 1769909678,
        "narHash": "sha256-cBEymOf4/o3FD5AZnzC3J9hLbiZ+QDT/KDuyHXVJOpM=",
@@ -2844,7 +2770,7 @@
        "type": "github"
      }
    },
-    "nixpkgs-lib_6": {
+    "nixpkgs-lib_5": {
      "locked": {
        "lastModified": 1765674936,
        "narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=",
@@ -2861,11 +2787,11 @@
    },
    "nixpkgs-master": {
      "locked": {
-        "lastModified": 1770224664,
-        "narHash": "sha256-FlGblTdQdCilQB2cwiD7dc+q5H6huDKuNt92oUM09hk=",
+        "lastModified": 1771514878,
+        "narHash": "sha256-LD3tS5k3v0/IaRb4zfXfDLzdvC3MfTAYhobzG65dTmA=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "7b781d7c0829b36dd4fff8f873fd75f56c5bcfa5",
+        "rev": "4df684f1454215cdd30d33d82eff5762ec302339",
        "type": "github"
      },
      "original": {
@@ -2877,11 +2803,11 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1770136044,
-        "narHash": "sha256-tlFqNG/uzz2++aAmn4v8J0vAkV3z7XngeIIB3rM3650=",
+        "lastModified": 1771419570,
+        "narHash": "sha256-bxAlQgre3pcQcaRUm/8A0v/X8d2nhfraWSFqVmMcBcU=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "e576e3c9cf9bad747afcddd9e34f51d18c855b4e",
+        "rev": "6d41bc27aaf7b6a3ba6b169db3bd5d6159cfaa47",
        "type": "github"
      },
      "original": {
@@ -2903,11 +2829,11 @@
        "treefmt-nix": "treefmt-nix_2"
      },
      "locked": {
-        "lastModified": 1770084921,
-        "narHash": "sha256-BfbUL69IOa+LnnAaxt2/ylbC/KhMGr3soe8n11avJME=",
+        "lastModified": 1771467423,
+        "narHash": "sha256-W0QZgcU34PioiwoSy84usD7En5HIg3TnOta5wli3w38=",
        "owner": "nix-community",
        "repo": "nixpkgs-xr",
-        "rev": "88eabef1f8415752a0a3ea537e4c62a62b353205",
+        "rev": "d4e2705e55344cc2c648765eaf63f82731d984d8",
        "type": "github"
      },
      "original": {
@@ -2918,11 +2844,11 @@
    },
    "nixpkgs_10": {
      "locked": {
-        "lastModified": 1768875095,
-        "narHash": "sha256-dYP3DjiL7oIiiq3H65tGIXXIT1Waiadmv93JS0sS+8A=",
+        "lastModified": 1770380644,
+        "narHash": "sha256-P7dWMHRUWG5m4G+06jDyThXO7kwSk46C1kgjEWcybkE=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "ed142ab1b3a092c4d149245d0c4126a5d7ea00b0",
+        "rev": "ae67888ff7ef9dff69b3cf0cc0fbfbcd3a722abe",
        "type": "github"
      },
      "original": {
@@ -2966,11 +2892,11 @@
    },
    "nixpkgs_13": {
      "locked": {
-        "lastModified": 1770115704,
-        "narHash": "sha256-KHFT9UWOF2yRPlAnSXQJh6uVcgNcWlFqqiAZ7OVlHNc=",
+        "lastModified": 1771369470,
+        "narHash": "sha256-0NBlEBKkN3lufyvFegY4TYv5mCNHbi5OmBDrzihbBMQ=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "e6eae2ee2110f3d31110d5c222cd395303343b08",
+        "rev": "0182a361324364ae3f436a63005877674cf45efb",
        "type": "github"
      },
      "original": {
@@ -2998,11 +2924,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1768032153,
-        "narHash": "sha256-zvxtwlM8ZlulmZKyYCQAPpkm5dngSEnnHjmjV7Teloc=",
-        "rev": "3146c6aa9995e7351a398e17470e15305e6e18ff",
+        "lastModified": 1770537093,
+        "narHash": "sha256-XV30uo8tXuxdzuV8l3sojmlPRLd/8tpMsOp4lNzLGUo=",
+        "rev": "fef9403a3e4d31b0a23f0bacebbec52c248fbb51",
        "type": "tarball",
-        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre925418.3146c6aa9995/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre942631.fef9403a3e4d/nixexprs.tar.xz"
      },
      "original": {
        "type": "tarball",
@@ -3027,11 +2953,11 @@
    },
    "nixpkgs_4": {
      "locked": {
-        "lastModified": 1770115704,
-        "narHash": "sha256-KHFT9UWOF2yRPlAnSXQJh6uVcgNcWlFqqiAZ7OVlHNc=",
+        "lastModified": 1771008912,
+        "narHash": "sha256-gf2AmWVTs8lEq7z/3ZAsgnZDhWIckkb+ZnAo5RzSxJg=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "e6eae2ee2110f3d31110d5c222cd395303343b08",
+        "rev": "a82ccc39b39b621151d6732718e3e250109076fa",
        "type": "github"
      },
      "original": {
@@ -3043,11 +2969,11 @@
    },
    "nixpkgs_5": {
      "locked": {
-        "lastModified": 1767364772,
-        "narHash": "sha256-fFUnEYMla8b7UKjijLnMe+oVFOz6HjijGGNS1l7dYaQ=",
+        "lastModified": 1770107345,
+        "narHash": "sha256-tbS0Ebx2PiA1FRW8mt8oejR0qMXmziJmPaU1d4kYY9g=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "16c7794d0a28b5a37904d55bcca36003b9109aaa",
+        "rev": "4533d9293756b63904b7238acb84ac8fe4c8c2c4",
        "type": "github"
      },
      "original": {
@@ -3059,11 +2985,11 @@
    },
    "nixpkgs_6": {
      "locked": {
-        "lastModified": 1764950072,
-        "narHash": "sha256-BmPWzogsG2GsXZtlT+MTcAWeDK5hkbGRZTeZNW42fwA=",
+        "lastModified": 1771008912,
+        "narHash": "sha256-gf2AmWVTs8lEq7z/3ZAsgnZDhWIckkb+ZnAo5RzSxJg=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "f61125a668a320878494449750330ca58b78c557",
+        "rev": "a82ccc39b39b621151d6732718e3e250109076fa",
        "type": "github"
      },
      "original": {
@@ -3107,11 +3033,11 @@
    },
    "nixpkgs_9": {
      "locked": {
-        "lastModified": 1770115704,
-        "narHash": "sha256-KHFT9UWOF2yRPlAnSXQJh6uVcgNcWlFqqiAZ7OVlHNc=",
+        "lastModified": 1771369470,
+        "narHash": "sha256-0NBlEBKkN3lufyvFegY4TYv5mCNHbi5OmBDrzihbBMQ=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "e6eae2ee2110f3d31110d5c222cd395303343b08",
+        "rev": "0182a361324364ae3f436a63005877674cf45efb",
        "type": "github"
      },
      "original": {
@@ -3123,16 +3049,16 @@
    },
    "nixvim": {
      "inputs": {
-        "flake-parts": "flake-parts_8",
+        "flake-parts": "flake-parts_7",
        "nixpkgs": "nixpkgs_10",
        "systems": "systems_18"
      },
      "locked": {
-        "lastModified": 1770025103,
-        "narHash": "sha256-Qlb19PP0n6s+v1MywVjROV5XwsCvA58XXiXHk0Govb4=",
+        "lastModified": 1771135771,
+        "narHash": "sha256-wyvBIhDuyCRyjB3yPg77qoyxrlgQtBR1rVW3c9knV3E=",
        "owner": "nix-community",
        "repo": "nixvim",
-        "rev": "31c3b3687dc85e3fbbf5c44728a5ee231608f8a9",
+        "rev": "ed0424f0b08d303a7348f52f7850ad1b2704f9ba",
        "type": "github"
      },
      "original": {
@@ -3153,11 +3079,11 @@
        "norg-meta": "norg-meta"
      },
      "locked": {
-        "lastModified": 1770170305,
-        "narHash": "sha256-JiwNk8NxcN296k8eyCjpGNXJwj1mIQe0si6RUnL1c/8=",
+        "lastModified": 1771478418,
+        "narHash": "sha256-95q1h+3dTOwLIZpLgvdq+OWQVCMgjkLeU1g1UB/3+lY=",
        "owner": "nvim-neorg",
        "repo": "nixpkgs-neorg-overlay",
-        "rev": "bf18c1ba00e7e69165291fe426db4fd02f9c8242",
+        "rev": "7570f673c169701a42cab9fe952ed36188329c58",
        "type": "github"
      },
      "original": {
@@ -3209,15 +3135,15 @@
    },
    "nur": {
      "inputs": {
-        "flake-parts": "flake-parts_9",
+        "flake-parts": "flake-parts_8",
        "nixpkgs": "nixpkgs_13"
      },
      "locked": {
-        "lastModified": 1770224784,
-        "narHash": "sha256-BOxTTjkaAYejQbRfGjlW92o/k9NyacHD+HfcTOkvHgo=",
+        "lastModified": 1771512979,
+        "narHash": "sha256-JFfNy+Lu2xpDF0nXmGcTFoKafamxxFu4hs4yf6aijK0=",
        "owner": "nix-community",
        "repo": "nur",
-        "rev": "bb065b8f979bd660d3757b464f1491bae844cb68",
+        "rev": "b24dba9151bb8d0681c41a7c48041753eb793d9a",
        "type": "github"
      },
      "original": {
@@ -3369,11 +3295,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769939035,
-        "narHash": "sha256-Fok2AmefgVA0+eprw2NDwqKkPGEI5wvR+twiZagBvrg=",
+        "lastModified": 1770726378,
+        "narHash": "sha256-kck+vIbGOaM/dHea7aTBxdFYpeUl/jHOy5W3eyRvVx8=",
        "owner": "cachix",
        "repo": "pre-commit-hooks.nix",
-        "rev": "a8ca480175326551d6c4121498316261cbb5b260",
+        "rev": "5eaaedde414f6eb1aea8b8525c466dc37bba95ae",
        "type": "github"
      },
      "original": {
@@ -3392,11 +3318,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769069492,
-        "narHash": "sha256-Efs3VUPelRduf3PpfPP2ovEB4CXT7vHf8W+xc49RL/U=",
+        "lastModified": 1770726378,
+        "narHash": "sha256-kck+vIbGOaM/dHea7aTBxdFYpeUl/jHOy5W3eyRvVx8=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "a1ef738813b15cf8ec759bdff5761b027e3e1d23",
+        "rev": "5eaaedde414f6eb1aea8b8525c466dc37bba95ae",
        "type": "github"
      },
      "original": {
@@ -3451,7 +3377,6 @@
        "ironbar": "ironbar",
        "lanzaboote": "lanzaboote",
        "llama-cpp": "llama-cpp",
-        "mixid": "mixid",
        "music-player": "music-player",
        "musnix": "musnix",
        "navigator": "navigator",
@@ -3617,11 +3542,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1770001842,
-        "narHash": "sha256-ZAyTeILfdWwDp1nuF0RK3McBduMi49qnJvrS+3Ezpac=",
+        "lastModified": 1771125043,
+        "narHash": "sha256-ldf/s49n6rOAxl7pYLJGGS1N/assoHkCOWdEdLyNZkc=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "5018343419ea808f8a413241381976b7e60951f2",
+        "rev": "4912f951a26dc8142b176be2c2ad834319dc06e8",
        "type": "github"
      },
      "original": {
@@ -3664,11 +3589,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1770174315,
-        "narHash": "sha256-GUaMxDmJB1UULsIYpHtfblskVC6zymAaQ/Zqfo+13jc=",
+        "lastModified": 1771470520,
+        "narHash": "sha256-PvytHcaYN5cPUll7FB70mXv1rRsIBRmu47fFfq3haxA=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "095c394bb91342882f27f6c73f64064fb9de9f2a",
+        "rev": "a1d4cc1f264c45d3745af0d2ca5e59d460e58777",
        "type": "github"
      },
      "original": {
@@ -3726,11 +3651,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1770145881,
-        "narHash": "sha256-ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY=",
+        "lastModified": 1771166946,
+        "narHash": "sha256-UFc4lfGBr+wJmwgDGJDn1cVD6DTr0/8TdronNUiyXlU=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c",
+        "rev": "2d0cf89b4404529778bc82de7e42b5754e0fe4fa",
        "type": "github"
      },
      "original": {
@@ -3746,7 +3671,7 @@
        "base16-helix": "base16-helix",
        "base16-vim": "base16-vim",
        "firefox-gnome-theme": "firefox-gnome-theme",
-        "flake-parts": "flake-parts_10",
+        "flake-parts": "flake-parts_9",
        "gnome-shell": "gnome-shell",
        "nixpkgs": [
          "nixpkgs"
@@ -3760,11 +3685,11 @@
        "tinted-zed": "tinted-zed"
      },
      "locked": {
-        "lastModified": 1769978605,
-        "narHash": "sha256-Vjniae6HHJCb9xZLeUOP15aRQXSZuKeeaZFM+gRDCgo=",
+        "lastModified": 1771428844,
+        "narHash": "sha256-rTzo6bZEsdT7yHUZ0B4BYe32XQZzm8SiWKvWLJnxerE=",
        "owner": "nix-community",
        "repo": "stylix",
-        "rev": "ce22070ec5ce6169a6841da31baea33ce930ed38",
+        "rev": "801843d10e9e22d7a00f660d069e2de70aa2980a",
        "type": "github"
      },
      "original": {
@@ -3780,7 +3705,7 @@
        "base16-helix": "base16-helix_2",
        "base16-vim": "base16-vim_2",
        "firefox-gnome-theme": "firefox-gnome-theme_2",
-        "flake-parts": "flake-parts_11",
+        "flake-parts": "flake-parts_10",
        "gnome-shell": "gnome-shell_2",
        "nixpkgs": [
          "nixpkgs-stable"
@@ -3794,11 +3719,11 @@
        "tinted-zed": "tinted-zed_2"
      },
      "locked": {
-        "lastModified": 1769885983,
-        "narHash": "sha256-jLS7410B58f+3WfZ4PQ28aaaTONnmxlfAbDPdNuciLc=",
+        "lastModified": 1771429540,
+        "narHash": "sha256-YKytDx8LOPOvE+dip1ja+1nbIpDVdqTaFbP4MaXwveM=",
        "owner": "nix-community",
        "repo": "stylix",
-        "rev": "fe06391a1e1905fc7e6c13443ea439a89695ca69",
+        "rev": "1a5c9d8be82127aeccc929f60b952e8a3df6b63c",
        "type": "github"
      },
      "original": {
@@ -4404,11 +4329,11 @@
    "tree-sitter-just": {
      "flake": false,
      "locked": {
-        "lastModified": 1770056803,
-        "narHash": "sha256-H8aAmI8/D2/3eeR4Nn/q8JNPbJjKEyV6/QX608Ikbm4=",
+        "lastModified": 1770661194,
+        "narHash": "sha256-cul4U1V42l/nYcCvs2eVA09qSrPi34t0eJ/Pr/Ewfhc=",
        "owner": "IndianBoy42",
        "repo": "tree-sitter-just",
-        "rev": "fe94f5230d97ff9fc7bee8c57e650dff615ed7cc",
+        "rev": "60df3d5b3fda2a22fdb3621226cafab50b763663",
        "type": "github"
      },
      "original": {
@@ -4452,11 +4377,11 @@
    "tree-sitter-slint": {
      "flake": false,
      "locked": {
-        "lastModified": 1770217631,
-        "narHash": "sha256-FS1a0N2yiRyBqhxxzUgR4mTnQ81Q8CfNZTb2AQrkBPw=",
+        "lastModified": 1770882723,
+        "narHash": "sha256-A4m3jG7VjGws7pVzd7ulbhINe783shv4pc3tH8EDji0=",
        "owner": "slint-ui",
        "repo": "tree-sitter-slint",
-        "rev": "5dafe6745dd3bb24342acebe478015b642dc7135",
+        "rev": "a6e4e1c656429e5df52dcfcd92da87b642f6678b",
        "type": "github"
      },
      "original": {
@@ -4470,11 +4395,11 @@
        "nixpkgs": "nixpkgs_5"
      },
      "locked": {
-        "lastModified": 1769691507,
-        "narHash": "sha256-8aAYwyVzSSwIhP2glDhw/G0i5+wOrren3v6WmxkVonM=",
+        "lastModified": 1770228511,
+        "narHash": "sha256-wQ6NJSuFqAEmIg2VMnLdCnUc0b7vslUohqqGGD+Fyxk=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "28b19c5844cc6e2257801d43f2772a4b4c050a1b",
+        "rev": "337a4fe074be1042a35086f15481d763b8ddc0e7",
        "type": "github"
      },
      "original": {
@@ -4491,11 +4416,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769691507,
-        "narHash": "sha256-8aAYwyVzSSwIhP2glDhw/G0i5+wOrren3v6WmxkVonM=",
+        "lastModified": 1770228511,
+        "narHash": "sha256-wQ6NJSuFqAEmIg2VMnLdCnUc0b7vslUohqqGGD+Fyxk=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "28b19c5844cc6e2257801d43f2772a4b4c050a1b",
+        "rev": "337a4fe074be1042a35086f15481d763b8ddc0e7",
        "type": "github"
      },
      "original": {
@@ -4544,11 +4469,11 @@
        "systems": "systems_24"
      },
      "locked": {
-        "lastModified": 1770222494,
-        "narHash": "sha256-5YZsKIJXWY8y0Qo2kMlp3v7ZY4cOZ7NI5u55x4t7TTM=",
+        "lastModified": 1771502217,
+        "narHash": "sha256-Bx9QKfFsC0bVN6O9P8DFpyzC9SJ6nbarMfWzIH/fzIg=",
        "owner": "vicinaehq",
        "repo": "vicinae",
-        "rev": "2e885835d8a9c5f7abbfe946298bf7ca4b330c24",
+        "rev": "54833492742d58428eaad093451fcd3469f0f3e5",
        "type": "github"
      },
      "original": {
@@ -4575,7 +4500,7 @@
    },
    "wivrn": {
      "inputs": {
-        "flake-parts": "flake-parts_12",
+        "flake-parts": "flake-parts_11",
        "nixpkgs": [
          "nixpkgs"
        ]
@@ -4653,17 +4578,19 @@
    },
    "zen-browser": {
      "inputs": {
-        "home-manager": "home-manager_3",
+        "home-manager": [
+          "home-manager"
+        ],
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1770097899,
-        "narHash": "sha256-FKRpvwWR96VDW4bdsxIrZgIAXvdXqsCTaV1HghCJBoQ=",
+        "lastModified": 1771503632,
+        "narHash": "sha256-qvI2afshgl062MRRpal5s76PWFev0Vm1xv4hl2+wT/8=",
        "owner": "0xc000022070",
        "repo": "zen-browser-flake",
-        "rev": "615a27db86f3fddd0f096b5e9ea832795a4608d1",
+        "rev": "48e35b2df995cf65603f447d5d2e30c34e63cd3f",
        "type": "github"
      },
      "original": {
@@ -4736,11 +4663,11 @@
        "rust-overlay": "rust-overlay_10"
      },
      "locked": {
-        "lastModified": 1766016463,
-        "narHash": "sha256-aWp608krMtk5I+c3GXyuHkb6ugah40cBI0R52fNqMiI=",
+        "lastModified": 1771148613,
+        "narHash": "sha256-nLzdw8jskekSRrunxBDCA0NCHr/2aJjcXqZ1Fcqm5eY=",
        "owner": "dj95",
        "repo": "zjstatus",
-        "rev": "9a4b88fdceee8eb2b8c28111c53e94254d61c994",
+        "rev": "7a039f56da80681408454d6e175fde3f54b9e592",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -155,9 +155,9 @@
    };
    zen-browser = {
      url = "github:0xc000022070/zen-browser-flake";
-      # IMPORTANT: we're using "libgbm" and is only available in unstable so ensure
-      # to have it up-to-date or simply don't specify the nixpkgs input
+      # IMPORTANT: To ensure compatibility with the latest Firefox version, use nixpkgs-unstable.
      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.home-manager.follows = "home-manager";
    };

    anyrun = {
@@ -252,10 +252,6 @@
    hytale-launcher = {
      url = "github:JPyke3/hytale-launcher-nix";
    };
-    mixid = {
-      url = "github:leguteape/MixiD";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
  };

  outputs = {
--- a/home/accounts/fastmail.nix
+++ b/home/accounts/fastmail.nix
@@ -5,8 +5,10 @@
 }: {
  sops = {
    secrets."accounts/mail/fastmail" = {};
+    secrets."accounts/calendar/fastmail" = {};
  };
-  accounts.email = {
+  accounts = {
+    email = {
      maildirBasePath = "Mail";
      accounts = {
        fastmail = rec {
@@ -29,9 +31,6 @@
            port = 465;
            tls.enable = true;
          };
-        imapnotify = {
-          enable = true;
-        };
          passwordCommand = ["cat" "${config.sops.secrets."accounts/mail/fastmail".path}"];
          mbsync = {
            enable = true;
@@ -40,8 +39,27 @@
        };
      };
    };
-  programs.mbsync.enable = true;
-  services.mbsync.enable = pkgs.stdenv.isLinux;
+    calendar = {
+      basePath = "Calendar";
+      accounts = {
+        fastmail = {
+          remote = {
+            url = "https://caldav.fastmail.com/dav/calendars/user/email@uttarayan.me";
+            userName = "email@uttarayan.me";
+            passwordCommand = ["cat" "${config.sops.secrets."accounts/calendar/fastmail".path}"];
+            type = "caldav";
+          };
+          khal = {
+            enable = true;
+            addresses = ["email@uttarayan.me"];
+          };
+          vdirsyncer = {
+            enable = true;
+          };
+        };
+      };
+    };
+  };
  # accounts.email.accounts.<name>.mbsync.create
  # services.mbsync.enable = true;
 }
--- a/home/apps/affine.nix
+++ b/home/apps/affine.nix
@@ -0,0 +1,9 @@
+{
+  pkgs,
+  lib,
+  ...
+}: {
+  home.packages = lib.optionals pkgs.stdenv.isLinux [
+    pkgs.affine
+  ];
+}
--- a/home/apps/default.nix
+++ b/home/apps/default.nix
@@ -13,15 +13,21 @@ lib.optionalAttrs device.hasGui {
    # ./ida.nix
    # ./jellyflix.nix
    # ./kicad.nix
+    # ./lmstudio.nix
    # ./neovide.nix
    # ./openscad.nix
+    # ./orcaslicer.nix
    # ./pcsx2.nix
+    # ./prismlauncher.nix
    # ./rpcs3.nix
+    # ./shadps4.nix
    # ./thunderbird.nix
    # ./tsukimi.nix
    # ./vial.nix
+    # ./vlc.nix
    # ./vscode.nix

+    ./affine.nix
    ./blueman.nix
    ./chromium.nix
    ./discord.nix
@@ -29,16 +35,12 @@ lib.optionalAttrs device.hasGui {
    ./ghostty.nix
    ./hyprpicker.nix
    ./kitty.nix
-    ./lmstudio.nix
+    ./matrix.nix
    ./mpv.nix
    ./nextcloud.nix
    ./obs-studio.nix
-    ./orcaslicer.nix
-    ./prismlauncher.nix
-    ./shadps4.nix
    ./slack.nix
    ./vicinae.nix
-    ./vlc.nix
    ./wezterm.nix
    ./zathura.nix
    ./zed.nix
--- a/home/apps/matrix.nix
+++ b/home/apps/matrix.nix
@@ -0,0 +1,12 @@
+{
+  pkgs,
+  lib,
+  device,
+  ...
+}: {
+  home.packages = lib.optionals (device.is "ryu") [
+    pkgs.fluffychat
+    pkgs.fractal
+    # pkgs.quaternion
+  ];
+}
--- a/home/apps/mpv.nix
+++ b/home/apps/mpv.nix
@@ -8,20 +8,20 @@
      loop-playlist = "inf";
    };
    profiles = {
-      hdr = {
-        vo = "gpu-next";
-        gpu-api = "vulkan";
-        hdr-compute-peak = "yes";
-        hdr-peak-detect = "yes";
-        target-peak = 400;
-        target-prim = "bt.2020";
-        target-trc = "pq";
-        inverse-tone-mapping = "yes";
-        tone-mapping = "spline";
-        tone-mapping-mode = "auto";
-        target-colorspace-hint = "auto";
-        gamut-mapping = "desaturate";
-      };
+      # hdr = {
+      #   vo = "gpu-next";
+      #   gpu-api = "vulkan";
+      #   hdr-compute-peak = "yes";
+      #   hdr-peak-detect = "yes";
+      #   target-peak = 400;
+      #   target-prim = "bt.2020";
+      #   target-trc = "pq";
+      #   inverse-tone-mapping = "yes";
+      #   tone-mapping = "spline";
+      #   tone-mapping-mode = "auto";
+      #   target-colorspace-hint = "auto";
+      #   gamut-mapping = "desaturate";
+      # };
    };
  };
 }
--- a/home/apps/vicinae.nix
+++ b/home/apps/vicinae.nix
@@ -12,7 +12,9 @@
      autoStart = true;
    };
  };
-  home.packages = with pkgs; [
-    pulseaudio
+  home.packages = with pkgs;
+    lib.optionals (device.is "ryu") [
+      # pulseaudio
+      playerctl
    ];
 }
--- a/home/apps/zen.nix
+++ b/home/apps/zen.nix
@@ -2,6 +2,7 @@
  pkgs,
  inputs,
  device,
+  config,
  ...
 }: {
  imports = [
@@ -10,6 +11,47 @@
  programs.zen-browser = {
    enable = device.isLinux;
    profiles.default = {
+      containersForce = true;
+      containers = {
+        Personal = {
+          color = "purple";
+          icon = "fingerprint";
+          id = 1;
+        };
+        Work = {
+          color = "blue";
+          icon = "briefcase";
+          id = 2;
+        };
+        Shopping = {
+          color = "yellow";
+          icon = "dollar";
+          id = 3;
+        };
+      };
+      spacesForce = true;
+      spaces = let
+        containers = config.programs.zen-browser.profiles."default".containers;
+      in {
+        "Personal" = {
+          id = "";
+          icon = "👤";
+          container = containers."Personal".id;
+          position = 1000;
+        };
+        "Work" = {
+          id = "00bdd434-e31b-4e2b-b8f5-fa7055631a64";
+          icon = "💼";
+          container = containers."Work".id;
+          position = 2000;
+        };
+        "Shopping" = {
+          id = "77452260-56e6-4c9e-8d5f-417958bc4fa4";
+          icon = "💸";
+          container = containers."Shopping".id;
+          position = 3000;
+        };
+      };
      extensions.packages = with pkgs.nur.repos.rycee.firefox-addons; [
        privacy-badger
        violentmonkey
@@ -42,5 +84,6 @@
        Fingerprinting = true;
      };
    };
+    suppressXdgMigrationWarning = true;
  };
 }
--- a/home/default.nix
+++ b/home/default.nix
@@ -27,6 +27,7 @@
    home-manager = {
      enable = true;
    };
+    man.generateCaches = true;
  };

  fonts.fontconfig.enable = true;
--- a/home/programs/attic.nix
+++ b/home/programs/attic.nix
@@ -0,0 +1,35 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: let
+  attic-unwrapped = pkgs.attic-client.overrideAttrs (oldAttrs: {
+    patches =
+      (oldAttrs.patches or [])
+      ++ [
+        # PR #309: Add environment variable support for login
+        # https://github.com/zhaofengli/attic/pull/309
+        (pkgs.fetchpatch {
+          url = "https://github.com/zhaofengli/attic/pull/309.patch";
+          hash = "sha256-mDoxA+e2bBZDvERp03SyYvkEdtH/bfWtZqKZv0uCS0M=";
+        })
+      ];
+  });
+in {
+  sops.secrets."attic/token" = {};
+  home.packages = [
+    (pkgs.stdenv.mkDerivation {
+      pname = "attic-client";
+      version = "0.1.0";
+      src = attic-unwrapped;
+      buildInputs = [];
+      nativeBuildInputs = [pkgs.makeWrapper];
+      installPhase = ''
+        install -Dm755 $src/bin/attic $out/bin/attic
+        wrapProgram $out/bin/attic \
+          --run "export ATTIC_LOGIN_TOKEN=\`cat -v ${config.sops.secrets."attic/token".path}\`"
+      '';
+    })
+  ];
+}
--- a/home/programs/blobdrop.nix
+++ b/home/programs/blobdrop.nix
@@ -4,5 +4,5 @@
  lib,
  ...
 }: {
-  home.packages = lib.optionals (device.name != "shiro") [pkgs.blobdrop];
+  home.packages = lib.optionals (device.name == "ryu") [pkgs.blobdrop];
 }
--- a/home/programs/calendar.nix
+++ b/home/programs/calendar.nix
@@ -0,0 +1,6 @@
+{pkgs, ...}: {
+  programs.khal.enable = true;
+  programs.qcal.enable = true;
+  programs.vdirsyncer.enable = true;
+  accounts.calendar.accounts.fastmail.qcal.enable = true;
+}
--- a/home/programs/carapace.nix
+++ b/home/programs/carapace.nix
@@ -1,13 +1,8 @@
-{
-  pkgs,
-  lib,
-  device,
-  ...
-}: {
+{...}: {
  programs.
    carapace = {
    enable = false;
-    enableFishIntegration = true;
+    enableFishIntegration = false;
    enableNushellIntegration = true;
  };
 }
--- a/home/programs/cargo.nix
+++ b/home/programs/cargo.nix
@@ -13,6 +13,7 @@ in
        [alias]
        lldb = ["with", "rust-lldb", "--"]
        t = ["nextest", "run"]
+        pkgs = ["metadata", "--no-deps", "--format-version", "1"]

        [net]
        git-fetch-with-cli = true
--- a/home/programs/cfcli.nix
+++ b/home/programs/cfcli.nix
@@ -0,0 +1,27 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: {
+  sops.secrets."cloudflare/darksailor_dev_api_key" = {};
+  home.packages = [
+    # (pkgs.stdenv.mkDerivation {
+    #   pname = "cfcli";
+    #   version = "0.1.0";
+    #   buildInputs = [pkgs.cloudflare-cli];
+    #   nativeBuildInputs = [pkgs.makeWrapper];
+    #   installPhase = ''
+    #     $out/bin/cfcli \
+    #       --run "export CF_API_KEY=\`cat -v ${config.sops.secrets."cloudflare/darksailor_dev_api_key".path}\`"
+    #   '';
+    # })
+    (pkgs.writeShellScriptBin
+      "cfcli"
+      ''
+        #!/bin/sh
+        export CF_API_KEY="$(cat -v ${config.sops.secrets."cloudflare/darksailor_dev_api_key".path})"
+        exec ${pkgs.cloudflare-cli}/bin/cfcli "$@"
+      '')
+  ];
+}
--- a/home/programs/default.nix
+++ b/home/programs/default.nix
@@ -4,12 +4,31 @@
  ...
 }: {
  imports = [
+    # ./bluetui.nix
+    # ./goread.nix
+    # ./helix.nix
+    # ./magika.nix
+    # ./mpd.nix
+    # ./mpris-scrobbler.nix
+    # ./ncmpcpp.nix
+    # ./newsboat.nix
+    # ./nh.nix
+    # ./ryujinx.nix
+    # ./sxiv.nix
+    # ./tea.nix
+    # ./template.nix
+    # ./tuifeed.nix
+    # ./xh.nix
+    # ./zellij.nix
+
    ../../modules
+
    ./1password-cli.nix
    ./aichat.nix
    ./alejandra.nix
    ./aria2.nix
    ./ast-grep.nix
+    ./attic.nix
    ./atuin.nix
    ./bat.nix
    ./binwalk.nix
@@ -17,8 +36,10 @@
    ./bottom.nix
    ./btop.nix
    ./cachix.nix
+    ./calendar.nix
    ./carapace.nix
    ./cargo.nix
+    ./cfcli.nix
    ./ddcbacklight.nix
    ./deploy-rs.nix
    ./direnv.nix
@@ -37,6 +58,7 @@
    ./himalaya.nix
    ./hyprshade.nix
    ./jq.nix
+    ./jujutsu.nix
    ./just.nix
    ./ncpamixer.nix
    ./neomutt.nix
@@ -60,21 +82,6 @@
    ./yazi.nix
    ./yt-dlp.nix
    ./zoxide.nix
-    # ./bluetui.nix
-    # ./goread.nix
-    # ./helix.nix
-    # ./magika.nix
-    # ./mpd.nix
-    # ./mpris-scrobbler.nix
-    # ./ncmpcpp.nix
-    # ./newsboat.nix
-    # ./nh.nix
-    # ./ryujinx.nix
-    # ./sxiv.nix
-    # ./tea.nix
-    # ./template.nix
-    # ./tuifeed.nix
-    # ./xh.nix
-    # ./zellij.nix
+    ./yq.nix
  ];
 }
--- a/home/programs/fish.nix
+++ b/home/programs/fish.nix
@@ -43,6 +43,7 @@
      ''}
    '';
  };
+  home.shell.enableFishIntegration = true;
 }
 // lib.optionalAttrs (!(device.is "tsuba")) {
  stylix.targets.fish.enable = false;
--- a/home/programs/jujutsu.nix
+++ b/home/programs/jujutsu.nix
@@ -0,0 +1 @@
+{pkgs, ...}: {home.packages = [pkgs.jujutsu];}
--- a/home/programs/neomutt.nix
+++ b/home/programs/neomutt.nix
@@ -1,4 +1,9 @@
-{pkgs, ...}: {
+{pkgs, ...}: let
+  theme = builtins.fetchurl {
+    url = "https://raw.githubusercontent.com/catppuccin/neomutt/refs/heads/main/neomuttrc";
+    sha256 = "sha256:1q086p5maqwxa4gh6z8g7h3nfavdmkbql025ibdhglpz46hsq0hs";
+  };
+in {
  programs.neomutt = {
    enable = true;
    vimKeys = true;
@@ -6,6 +11,9 @@
    sidebar = {
      enable = true;
    };
+    extraConfig = ''
+      source ${theme}
+    '';
  };
  programs.notmuch = {
    enable = true;
@@ -17,4 +25,38 @@
    enable = true;
    neomutt.enable = true;
  };
+  services.imapnotify = {
+    enable = true;
+    path = [pkgs.coreutils pkgs.isync pkgs.libnotify];
+  };
+  accounts.email.accounts.fastmail.imapnotify = {
+    enable = true;
+    boxes = ["Inbox"];
+    onNotify = "${pkgs.writeShellScript "mbsync-notify" ''
+      ${pkgs.isync}/bin/mbsync $1
+      ${pkgs.libnotify}/bin/notify-send "New Mail" "New email in $1"
+    ''} %s";
+  };
+  programs.mbsync.enable = true;
+  services.mbsync.enable = pkgs.stdenv.isLinux;
+
+  # launchd.agents.mbsync = {
+  #   enable = true;
+  #   config = {
+  #     # A label for the service
+  #     Label = "dev.darksailor.atuin-daemon";
+  #     # The command to run
+  #     ProgramArguments = [
+  #       "${pkgs.atuin}/bin/atuin"
+  #       "daemon"
+  #     ];
+  #     # Run the service when you log in
+  #     RunAtLoad = true;
+  #     # Keep the process alive, or restart if it dies
+  #     KeepAlive = true;
+  #     # Log files
+  #     StandardOutPath = "${device.home}/Library/Logs/atuin-daemon.log";
+  #     StandardErrorPath = "${device.home}/Library/Logs/atuin-daemon.error.log";
+  #   };
+  # };
 }
--- a/home/programs/nushell.nix
+++ b/home/programs/nushell.nix
@@ -26,4 +26,5 @@
      }
    '';
  };
+  home.shell.enableNushellIntegration = true;
 }
--- a/home/programs/opencode.nix
+++ b/home/programs/opencode.nix
@@ -6,5 +6,20 @@
 lib.optionalAttrs (device.is "ryu" || device.is "kuro") {
  programs.opencode = {
    enable = true;
+    settings.provider = {
+      ollama = {
+        models = {
+          "glm-4.7-flash" = {
+            # "_launch" = true;
+            name = "glm-4.7-flash";
+          };
+        };
+        name = "Ollama (local)";
+        npm = "@ai-sdk/openai-compatible";
+        options = {
+          baseURL = "https://ollama.darksailor.dev/v1";
+        };
+      };
+    };
  };
 }
--- a/home/programs/yazi.nix
+++ b/home/programs/yazi.nix
@@ -17,5 +17,6 @@
        cache_dir = config.home.homeDirectory + "/.cache/yazi/previews";
      };
    };
+    shellWrapperName = "yy";
  };
 }
--- a/home/programs/yq.nix
+++ b/home/programs/yq.nix
@@ -0,0 +1 @@
+{pkgs, ...}: {home.packages = [pkgs.yq];}
--- a/home/services/hyprland.nix
+++ b/home/services/hyprland.nix
@@ -61,9 +61,9 @@
        {
          output = device.monitors.secondary;
          mode = "2560x1440@170";
-          position = "-1440x-1120";
+          position = "-2560x0";
          scale = 1;
-          transform = 1;
+          transform = 0;
        }
        {
          output = device.monitors.tertiary;
--- a/home/services/hyprpaper.nix
+++ b/home/services/hyprpaper.nix
@@ -9,6 +9,7 @@
    nextcloudWallpapers = name: config.home.homeDirectory + "/Nextcloud/Wallpapers/" + name;
    # silksongFleas = nextcloudWallpapers "silksong-fleas.jpg";
    bocchiVertical = nextcloudWallpapers "bocchi-vertical.jpg";
+    silksongShadeLord = nextcloudWallpapers "silksong-shadelord.jpg";
  in {
    enable = device.is "ryu";
    settings = {
@@ -16,7 +17,7 @@
      wallpaper = [
        {
          monitor = device.monitors.primary;
-          path = wallpapers.skull;
+          path = silksongShadeLord;
          fit_mode = "cover";
        }
        {
--- a/2
+++ b/2
@@ -41,3 +41,5 @@ add program:
    alejandra fmt home/programs/{{program}}.nix home/programs/default.nix
    git add home/programs/{{program}}.nix 

+# add-secret secret:
+#     openssl rand -hex 32 | tr -d '\n' | jq -sR | sops set --value-stdin secrets/secrets.yaml {{secret}}
--- a/modules/nixos/affine.nix
+++ b/modules/nixos/affine.nix
@@ -0,0 +1,162 @@
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.services.affine;
+  dbName = "affine";
+  dbUser = "affine";
+in {
+  options.services.affine = {
+    enable = mkEnableOption "AFFiNE self-hosted workspace";
+
+    port = mkOption {
+      type = types.port;
+      default = 3010;
+      description = "Port for the AFFiNE server to listen on";
+    };
+
+    domain = mkOption {
+      type = types.str;
+      description = "Public domain for AFFiNE (e.g. notes.darksailor.dev)";
+    };
+
+    imageTag = mkOption {
+      type = types.str;
+      default = "stable";
+      description = "Docker image tag for AFFiNE (stable, beta, canary)";
+    };
+
+    dataDir = mkOption {
+      type = types.str;
+      default = "/var/lib/affine";
+      description = "Base data directory for AFFiNE storage";
+    };
+
+    environmentFiles = mkOption {
+      type = types.listOf types.path;
+      default = [];
+      description = "Environment files containing secrets (DB password, etc.)";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # Create data directories
+    systemd.tmpfiles.rules = [
+      "d ${cfg.dataDir} 0755 root root -"
+      "d ${cfg.dataDir}/storage 0755 root root -"
+      "d ${cfg.dataDir}/config 0755 root root -"
+      "d ${cfg.dataDir}/postgres 0700 root root -"
+      "d ${cfg.dataDir}/redis 0755 root root -"
+    ];
+
+    virtualisation.oci-containers = {
+      backend = "docker";
+      containers = {
+        affine-postgres = {
+          image = "pgvector/pgvector:pg16";
+          volumes = [
+            "${cfg.dataDir}/postgres:/var/lib/postgresql/data"
+          ];
+          environment = {
+            POSTGRES_USER = dbUser;
+            POSTGRES_DB = dbName;
+            POSTGRES_INITDB_ARGS = "--data-checksums";
+            POSTGRES_HOST_AUTH_METHOD = "trust";
+          };
+          environmentFiles = cfg.environmentFiles;
+          extraOptions = [
+            "--health-cmd=pg_isready -U ${dbUser} -d ${dbName}"
+            "--health-interval=10s"
+            "--health-timeout=5s"
+            "--health-retries=5"
+          ];
+          networks = ["affine-net"];
+        };
+
+        affine-redis = {
+          image = "redis:7";
+          volumes = [
+            "${cfg.dataDir}/redis:/data"
+          ];
+          networks = ["affine-net"];
+          extraOptions = [
+            "--health-cmd=redis-cli --raw incr ping"
+            "--health-interval=10s"
+            "--health-timeout=5s"
+            "--health-retries=5"
+          ];
+        };
+
+        affine = {
+          image = "ghcr.io/toeverything/affine:${cfg.imageTag}";
+          ports = ["127.0.0.1:${toString cfg.port}:3010"];
+          dependsOn = [
+            "affine-postgres"
+            "affine-redis"
+            "affine-migration"
+          ];
+          volumes = [
+            "${cfg.dataDir}/storage:/root/.affine/storage"
+            "${cfg.dataDir}/config:/root/.affine/config"
+          ];
+          environment = {
+            AFFINE_SERVER_PORT = "3010";
+            AFFINE_SERVER_HOST = cfg.domain;
+            AFFINE_SERVER_HTTPS = "true";
+            AFFINE_SERVER_EXTERNAL_URL = "https://${cfg.domain}";
+            REDIS_SERVER_HOST = "affine-redis";
+            DATABASE_URL = "postgresql://${dbUser}:$${AFFINE_DB_PASSWORD:-affine}@affine-postgres:5432/${dbName}";
+            AFFINE_INDEXER_ENABLED = "false";
+          };
+          environmentFiles = cfg.environmentFiles;
+          networks = ["affine-net"];
+        };
+
+        affine-migration = {
+          image = "ghcr.io/toeverything/affine:${cfg.imageTag}";
+          dependsOn = [
+            "affine-postgres"
+            "affine-redis"
+          ];
+          volumes = [
+            "${cfg.dataDir}/storage:/root/.affine/storage"
+            "${cfg.dataDir}/config:/root/.affine/config"
+          ];
+          cmd = ["sh" "-c" "node ./scripts/self-host-predeploy.js"];
+          environment = {
+            REDIS_SERVER_HOST = "affine-redis";
+            DATABASE_URL = "postgresql://${dbUser}:$${AFFINE_DB_PASSWORD:-affine}@affine-postgres:5432/${dbName}";
+            AFFINE_INDEXER_ENABLED = "false";
+          };
+          environmentFiles = cfg.environmentFiles;
+          networks = ["affine-net"];
+        };
+      };
+    };
+
+    # Create the Docker network
+    # systemd.services.affine-network = {
+    #   description = "Create AFFiNE Docker network";
+    #   after = ["docker.service"];
+    #   wantedBy = ["multi-user.target"];
+    #   serviceConfig = {
+    #     Type = "oneshot";
+    #     RemainAfterExit = true;
+    #     # ExecStart = "${config.virtualisation.docker.package}/bin/docker network create affine-net";
+    #     # ExecStop = "${config.virtualisation.docker.package}/bin/docker network remove affine-net";
+    #   };
+    # };
+    #
+    # Ensure containers start after the network is created
+    # systemd.services.docker-affine.after = ["affine-network.service"];
+    # systemd.services.docker-affine.requires = ["affine-network.service"];
+    # systemd.services.docker-affine-postgres.after = ["affine-network.service"];
+    # systemd.services.docker-affine-postgres.requires = ["affine-network.service"];
+    # systemd.services.docker-affine-redis.after = ["affine-network.service"];
+    # systemd.services.docker-affine-redis.requires = ["affine-network.service"];
+    # systemd.services.docker-affine-migration.after = ["affine-network.service"];
+    # systemd.services.docker-affine-migration.requires = ["affine-network.service"];
+  };
+}
--- a/modules/nixos/caddy/default.nix
+++ b/modules/nixos/caddy/default.nix
@@ -1,480 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.services.caddy;
-
-  certs = config.security.acme.certs;
-  virtualHosts = attrValues cfg.virtualHosts;
-  acmeEnabledVhosts = filter (hostOpts: hostOpts.useACMEHost != null) virtualHosts;
-  vhostCertNames = unique (map (hostOpts: hostOpts.useACMEHost) acmeEnabledVhosts);
-  dependentCertNames = filter (cert: certs.${cert}.dnsProvider == null) vhostCertNames; # those that might depend on the HTTP server
-  independentCertNames = filter (cert: certs.${cert}.dnsProvider != null) vhostCertNames; # those that don't depend on the HTTP server
-
-  mkVHostConf = hostOpts: let
-    sslCertDir = config.security.acme.certs.${hostOpts.useACMEHost}.directory;
-  in ''
-    ${hostOpts.hostName} ${concatStringsSep " " hostOpts.serverAliases} {
-      ${optionalString (
-      hostOpts.listenAddresses != []
-    ) "bind ${concatStringsSep " " hostOpts.listenAddresses}"}
-      ${optionalString (
-      hostOpts.useACMEHost != null
-    ) "tls ${sslCertDir}/cert.pem ${sslCertDir}/key.pem"}
-      log {
-        ${hostOpts.logFormat}
-      }
-
-      ${hostOpts.extraConfig}
-    }
-  '';
-
-  settingsFormat = pkgs.formats.json {};
-
-  configFile =
-    if cfg.settings != {}
-    then settingsFormat.generate "caddy.json" cfg.settings
-    else let
-      Caddyfile = pkgs.writeTextDir "Caddyfile" ''
-        {
-          ${cfg.globalConfig}
-        }
-        ${cfg.extraConfig}
-        ${concatMapStringsSep "\n" mkVHostConf virtualHosts}
-      '';
-
-      Caddyfile-formatted = pkgs.runCommand "Caddyfile-formatted" {} ''
-        mkdir -p $out
-        cp --no-preserve=mode ${Caddyfile}/Caddyfile $out/Caddyfile
-        ${lib.getExe cfg.package} fmt --overwrite $out/Caddyfile
-      '';
-    in "${
-      if pkgs.stdenv.buildPlatform == pkgs.stdenv.hostPlatform
-      then Caddyfile-formatted
-      else Caddyfile
-    }/Caddyfile";
-
-  etcConfigFile = "caddy/caddy_config";
-
-  configPath = "/etc/${etcConfigFile}";
-
-  mkCertOwnershipAssertion = import ../../../security/acme/mk-cert-ownership-assertion.nix lib;
-in {
-  imports = [
-    (mkRemovedOptionModule [
-      "services"
-      "caddy"
-      "agree"
-    ] "this option is no longer necessary for Caddy 2")
-    (mkRenamedOptionModule ["services" "caddy" "ca"] ["services" "caddy" "acmeCA"])
-    (mkRenamedOptionModule ["services" "caddy" "config"] ["services" "caddy" "extraConfig"])
-  ];
-
-  # interface
-  options.services.caddy = {
-    enable = mkEnableOption "Caddy web server";
-
-    user = mkOption {
-      default = "caddy";
-      type = types.str;
-      description = ''
-        User account under which caddy runs.
-
-        ::: {.note}
-        If left as the default value this user will automatically be created
-        on system activation, otherwise you are responsible for
-        ensuring the user exists before the Caddy service starts.
-        :::
-      '';
-    };
-
-    group = mkOption {
-      default = "caddy";
-      type = types.str;
-      description = ''
-        Group under which caddy runs.
-
-        ::: {.note}
-        If left as the default value this group will automatically be created
-        on system activation, otherwise you are responsible for
-        ensuring the group exists before the Caddy service starts.
-        :::
-      '';
-    };
-
-    package = mkPackageOption pkgs "caddy" {};
-
-    dataDir = mkOption {
-      type = types.path;
-      default = "/var/lib/caddy";
-      description = ''
-        The data directory for caddy.
-
-        ::: {.note}
-        If left as the default value this directory will automatically be created
-        before the Caddy server starts, otherwise you are responsible for ensuring
-        the directory exists with appropriate ownership and permissions.
-
-        Caddy v2 replaced `CADDYPATH` with XDG directories.
-        See <https://caddyserver.com/docs/conventions#file-locations>.
-        :::
-      '';
-    };
-
-    logDir = mkOption {
-      type = types.path;
-      default = "/var/log/caddy";
-      description = ''
-        Directory for storing Caddy access logs.
-
-        ::: {.note}
-        If left as the default value this directory will automatically be created
-        before the Caddy server starts, otherwise the sysadmin is responsible for
-        ensuring the directory exists with appropriate ownership and permissions.
-        :::
-      '';
-    };
-
-    logFormat = mkOption {
-      type = types.lines;
-      default = ''
-        level ERROR
-      '';
-      example = literalExpression ''
-        mkForce "level INFO";
-      '';
-      description = ''
-        Configuration for the default logger. See
-        <https://caddyserver.com/docs/caddyfile/options#log>
-        for details.
-      '';
-    };
-
-    configFile = mkOption {
-      type = types.path;
-      default = configFile;
-      defaultText = "A Caddyfile automatically generated by values from services.caddy.*";
-      example = literalExpression ''
-        pkgs.writeText "Caddyfile" '''
-          example.com
-
-          root * /var/www/wordpress
-          php_fastcgi unix//run/php/php-version-fpm.sock
-          file_server
-        ''';
-      '';
-      description = ''
-        Override the configuration file used by Caddy. By default,
-        NixOS generates one automatically.
-
-        The configuration file is exposed at {file}`${configPath}`.
-      '';
-    };
-
-    adapter = mkOption {
-      default =
-        if ((cfg.configFile != configFile) || (builtins.baseNameOf cfg.configFile) == "Caddyfile")
-        then "caddyfile"
-        else null;
-      defaultText = literalExpression ''
-        if ((cfg.configFile != configFile) || (builtins.baseNameOf cfg.configFile) == "Caddyfile") then "caddyfile" else null
-      '';
-      example = literalExpression "nginx";
-      type = with types; nullOr str;
-      description = ''
-        Name of the config adapter to use.
-        See <https://caddyserver.com/docs/config-adapters>
-        for the full list.
-
-        If `null` is specified, the `--adapter` argument is omitted when
-        starting or restarting Caddy. Notably, this allows specification of a
-        configuration file in Caddy's native JSON format, as long as the
-        filename does not start with `Caddyfile` (in which case the `caddyfile`
-        adapter is implicitly enabled). See
-        <https://caddyserver.com/docs/command-line#caddy-run> for details.
-
-        ::: {.note}
-        Any value other than `null` or `caddyfile` is only valid when providing
-        your own `configFile`.
-        :::
-      '';
-    };
-
-    resume = mkOption {
-      default = false;
-      type = types.bool;
-      description = ''
-        Use saved config, if any (and prefer over any specified configuration passed with `--config`).
-      '';
-    };
-
-    globalConfig = mkOption {
-      type = types.lines;
-      default = "";
-      example = ''
-        debug
-        servers {
-          protocol {
-            experimental_http3
-          }
-        }
-      '';
-      description = ''
-        Additional lines of configuration appended to the global config section
-        of the `Caddyfile`.
-
-        Refer to <https://caddyserver.com/docs/caddyfile/options#global-options>
-        for details on supported values.
-      '';
-    };
-
-    extraConfig = mkOption {
-      type = types.lines;
-      default = "";
-      example = ''
-        example.com {
-          encode gzip
-          log
-          root /srv/http
-        }
-      '';
-      description = ''
-        Additional lines of configuration appended to the automatically
-        generated `Caddyfile`.
-      '';
-    };
-
-    virtualHosts = mkOption {
-      type = with types; attrsOf (submodule (import ./vhost-options.nix {inherit cfg;}));
-      default = {};
-      example = literalExpression ''
-        {
-          "hydra.example.com" = {
-            serverAliases = [ "www.hydra.example.com" ];
-            extraConfig = '''
-              encode gzip
-              root * /srv/http
-            ''';
-          };
-        };
-      '';
-      description = ''
-        Declarative specification of virtual hosts served by Caddy.
-      '';
-    };
-
-    acmeCA = mkOption {
-      default = null;
-      example = "https://acme-v02.api.letsencrypt.org/directory";
-      type = with types; nullOr str;
-      description = ''
-        ::: {.note}
-        Sets the [`acme_ca` option](https://caddyserver.com/docs/caddyfile/options#acme-ca)
-        in the global options block of the resulting Caddyfile.
-        :::
-
-        The URL to the ACME CA's directory. It is strongly recommended to set
-        this to `https://acme-staging-v02.api.letsencrypt.org/directory` for
-        Let's Encrypt's [staging endpoint](https://letsencrypt.org/docs/staging-environment/)
-        while testing or in development.
-
-        Value `null` should be prefered for production setups,
-        as it omits the `acme_ca` option to enable
-        [automatic issuer fallback](https://caddyserver.com/docs/automatic-https#issuer-fallback).
-      '';
-    };
-
-    email = mkOption {
-      default = null;
-      type = with types; nullOr str;
-      description = ''
-        Your email address. Mainly used when creating an ACME account with your
-        CA, and is highly recommended in case there are problems with your
-        certificates.
-      '';
-    };
-
-    enableReload = mkOption {
-      default = true;
-      type = types.bool;
-      description = ''
-        Reload Caddy instead of restarting it when configuration file changes.
-
-        Note that enabling this option requires the [admin API](https://caddyserver.com/docs/caddyfile/options#admin)
-        to not be turned off.
-
-        If you enable this option, consider setting [`grace_period`](https://caddyserver.com/docs/caddyfile/options#grace-period)
-        to a non-infinite value in {option}`services.caddy.globalConfig`
-        to prevent Caddy waiting for active connections to finish,
-        which could delay the reload essentially indefinitely.
-      '';
-    };
-
-    settings = mkOption {
-      type = settingsFormat.type;
-      default = {};
-      description = ''
-        Structured configuration for Caddy to generate a Caddy JSON configuration file.
-        See <https://caddyserver.com/docs/json/> for available options.
-
-        ::: {.warning}
-        Using a [Caddyfile](https://caddyserver.com/docs/caddyfile) instead of a JSON config is highly recommended by upstream.
-        There are only very few exception to this.
-
-        Please use a Caddyfile via {option}`services.caddy.configFile`, {option}`services.caddy.virtualHosts` or
-        {option}`services.caddy.extraConfig` with {option}`services.caddy.globalConfig` instead.
-        :::
-
-        ::: {.note}
-        Takes presence over most `services.caddy.*` options, such as {option}`services.caddy.configFile` and {option}`services.caddy.virtualHosts`, if specified.
-        :::
-      '';
-    };
-
-    environmentFile = mkOption {
-      type = with types; nullOr path;
-      default = null;
-      example = "/run/secrets/caddy.env";
-      description = ''
-        Environment file as defined in {manpage}`systemd.exec(5)`.
-
-        You can use environment variables to pass secrets to the service without adding
-        them to the world-redable nix store.
-
-        ```
-        # in configuration.nix
-        services.caddy.environmentFile = "/run/secrets/caddy.env";
-        services.caddy.globalConfig = '''
-          {
-            acme_ca https://acme.zerossl.com/v2/DV90
-            acme_eab {
-              key_id {$EAB_KEY_ID}
-              mac_key {$EAB_MAC_KEY}
-            }
-          }
-        ''';
-        ```
-
-        ```
-        # in /run/secrets/caddy.env
-        EAB_KEY_ID=secret
-        EAB_MAC_KEY=secret
-        ```
-
-        Find more examples
-        [here](https://caddyserver.com/docs/caddyfile/concepts#environment-variables)
-      '';
-    };
-  };
-
-  # implementation
-  config = mkIf cfg.enable {
-    assertions =
-      [
-        {
-          assertion = cfg.configFile == configFile -> cfg.adapter == "caddyfile" || cfg.adapter == null;
-          message = "To specify an adapter other than 'caddyfile' please provide your own configuration via `services.caddy.configFile`";
-        }
-      ]
-      ++ map (
-        name:
-          mkCertOwnershipAssertion {
-            cert = config.security.acme.certs.${name};
-            groups = config.users.groups;
-            services = [config.systemd.services.caddy];
-          }
-      )
-      vhostCertNames;
-
-    services.caddy.globalConfig = ''
-      ${optionalString (cfg.email != null) "email ${cfg.email}"}
-      ${optionalString (cfg.acmeCA != null) "acme_ca ${cfg.acmeCA}"}
-      log {
-        ${cfg.logFormat}
-      }
-    '';
-
-    # https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes
-    boot.kernel.sysctl."net.core.rmem_max" = mkDefault 2500000;
-    boot.kernel.sysctl."net.core.wmem_max" = mkDefault 2500000;
-
-    systemd.packages = [cfg.package];
-    systemd.services.caddy = {
-      wants = map (certName: "acme-finished-${certName}.target") vhostCertNames;
-      after =
-        map (certName: "acme-selfsigned-${certName}.service") vhostCertNames
-        ++ map (certName: "acme-${certName}.service") independentCertNames; # avoid loading self-signed key w/ real cert, or vice-versa
-      before = map (certName: "acme-${certName}.service") dependentCertNames;
-
-      wantedBy = ["multi-user.target"];
-      startLimitIntervalSec = 14400;
-      startLimitBurst = 10;
-      reloadTriggers = optional cfg.enableReload cfg.configFile;
-      restartTriggers = optional (!cfg.enableReload) cfg.configFile;
-
-      serviceConfig = let
-        runOptions = ''--config ${configPath} ${
-            optionalString (cfg.adapter != null) "--adapter ${cfg.adapter}"
-          }'';
-      in {
-        # Override the `ExecStart` line from upstream's systemd unit file by our own:
-        # https://www.freedesktop.org/software/systemd/man/systemd.service.html#ExecStart=
-        # If the empty string is assigned to this option, the list of commands to start is reset, prior assignments of this option will have no effect.
-        ExecStart = [
-          ""
-          ''${lib.getExe cfg.package} run ${runOptions} ${optionalString cfg.resume "--resume"}''
-        ];
-        # Validating the configuration before applying it ensures we’ll get a proper error that will be reported when switching to the configuration
-        ExecReload =
-          [
-            ""
-          ]
-          ++ lib.optional cfg.enableReload "${lib.getExe cfg.package} reload ${runOptions} --force";
-        User = cfg.user;
-        Group = cfg.group;
-        ReadWritePaths = [cfg.dataDir];
-        StateDirectory = mkIf (cfg.dataDir == "/var/lib/caddy") ["caddy"];
-        LogsDirectory = mkIf (cfg.logDir == "/var/log/caddy") ["caddy"];
-        Restart = "on-failure";
-        RestartPreventExitStatus = 1;
-        RestartSec = "5s";
-        EnvironmentFile = optional (cfg.environmentFile != null) cfg.environmentFile;
-
-        # TODO: attempt to upstream these options
-        NoNewPrivileges = true;
-        PrivateDevices = true;
-        ProtectHome = true;
-      };
-    };
-
-    users.users = optionalAttrs (cfg.user == "caddy") {
-      caddy = {
-        group = cfg.group;
-        uid = config.ids.uids.caddy;
-        home = cfg.dataDir;
-      };
-    };
-
-    users.groups = optionalAttrs (cfg.group == "caddy") {
-      caddy.gid = config.ids.gids.caddy;
-    };
-
-    security.acme.certs = let
-      certCfg =
-        map (
-          certName:
-            nameValuePair certName {
-              group = mkDefault cfg.group;
-              reloadServices = ["caddy.service"];
-            }
-        )
-        vhostCertNames;
-    in
-      listToAttrs certCfg;
-
-    environment.etc.${etcConfigFile}.source = cfg.configFile;
-  };
-}
--- a/modules/nixos/caddy/vhost-options.nix
+++ b/modules/nixos/caddy/vhost-options.nix
@@ -1,83 +0,0 @@
-{cfg}: {
-  config,
-  lib,
-  name,
-  ...
-}: let
-  inherit (lib) literalExpression mkOption types;
-in {
-  options = {
-    hostName = mkOption {
-      type = types.str;
-      default = name;
-      description = "Canonical hostname for the server.";
-    };
-
-    serverAliases = mkOption {
-      type = with types; listOf str;
-      default = [];
-      example = [
-        "www.example.org"
-        "example.org"
-      ];
-      description = ''
-        Additional names of virtual hosts served by this virtual host configuration.
-      '';
-    };
-
-    listenAddresses = mkOption {
-      type = with types; listOf str;
-      description = ''
-        A list of host interfaces to bind to for this virtual host.
-      '';
-      default = [];
-      example = [
-        "127.0.0.1"
-        "::1"
-      ];
-    };
-
-    useACMEHost = mkOption {
-      type = types.nullOr types.str;
-      default = null;
-      description = ''
-        A host of an existing Let's Encrypt certificate to use.
-        This is mostly useful if you use DNS challenges but Caddy does not
-        currently support your provider.
-
-        *Note that this option does not create any certificates, nor
-        does it add subdomains to existing ones – you will need to create them
-        manually using [](#opt-security.acme.certs).*
-      '';
-    };
-
-    logFormat = mkOption {
-      type = types.lines;
-      default = ''
-        output file ${cfg.logDir}/access-${lib.replaceStrings ["/" " "] ["_" "_"] config.hostName}.log
-      '';
-      defaultText = ''
-        output file ''${config.services.caddy.logDir}/access-''${hostName}.log
-      '';
-      example = literalExpression ''
-        mkForce '''
-          output discard
-        ''';
-      '';
-      description = ''
-        Configuration for HTTP request logging (also known as access logs). See
-        <https://caddyserver.com/docs/caddyfile/directives/log#log>
-        for details.
-      '';
-    };
-
-    extraConfig = mkOption {
-      type = types.lines;
-      default = "";
-      description = ''
-        Additional lines of configuration appended to this virtual host in the
-        automatically generated `Caddyfile`.
-      '';
-    };
-  };
-}
--- a/neovim/default.nix
+++ b/neovim/default.nix
@@ -620,6 +620,21 @@ in {
        };
        sources = {
          cmdline = [];
+          # default =
+          # rawLua
+          # /*
+          # lua
+          # */
+          # ''
+          #   function(ctx)
+          #     local success, node = pcall(vim.treesitter.get_node)
+          #     if success and node and vim.tbl_contains({ 'comment', 'line_comment', 'block_comment' }, node:type()) then
+          #       return { 'buffer' }
+          #     else
+          #       return { 'git', 'lsp', 'path', 'snippets', 'buffer', 'dictionary', 'ripgrep', 'tmux' }
+          #     end
+          #   end
+          # '';
          default = [
            "git"
            "lsp"
@@ -628,6 +643,7 @@ in {
            "path"
            "buffer"
            "ripgrep"
+            # "tmux"
          ];
          providers = {
            buffer = {
@@ -639,23 +655,30 @@ in {
            path = {};
            dictionary = {
              module = "blink-cmp-dictionary";
-              name = "Dict";
+              name = "dict";
              min_keyword_length = 3;
              opts = {
              };
            };
            git = {
              module = "blink-cmp-git";
-              name = "Git";
+              name = "git";
              opts = {
                # -- options for the blink-cmp-git
              };
            };
            ripgrep = {
              module = "blink-ripgrep";
-              name = "Ripgrep";
+              name = "ripgrep";
              opts = {};
            };
+            # tmux = {
+            #   module = "blink-cmp-tmux";
+            #   name = "tmux";
+            #   opts = {
+            #     triggered_only = false;
+            #   };
+            # };
          };
        };
      };
@@ -665,6 +688,7 @@ in {
    blink-cmp-dictionary.enable = true;
    blink-cmp-copilot.enable = true;
    blink-cmp-spell.enable = true;
+    blink-cmp-tmux.enable = true;
    blink-compat = {
      enable = true;
      settings.impersonate_nvim_cmp = true;
--- a/nixos/documentation.nix
+++ b/nixos/documentation.nix
@@ -4,4 +4,5 @@
  documentation.dev.enable = true;
  documentation.doc.enable = true;
  documentation.nixos.enable = true;
+  documentation.man.generateCaches = true;
 }
--- a/nixos/ryu/apps/default.nix
+++ b/nixos/ryu/apps/default.nix
@@ -6,8 +6,12 @@
  imports = [
    # ./alvr.nix
    ./easyeffects.nix
-    ./mixid.nix
    ./vr.nix
    ./helvum.nix
+    # ./wine.nix
+    # ./virt.nix
+    ./gparted.nix
+    ./nvtop.nix
+    # ./qpwgraph.nix
  ];
 }
--- a/nixos/ryu/apps/gparted.nix
+++ b/nixos/ryu/apps/gparted.nix
@@ -0,0 +1,3 @@
+{pkgs, ...}: {
+  environment.systemPackages = with pkgs; [gparted];
+}
--- a/nixos/ryu/apps/mixid.nix
+++ b/nixos/ryu/apps/mixid.nix
@@ -1,4 +0,0 @@
-{pkgs, ...}: {
-  environment.systemPackages = with pkgs; [mixid];
-  services.udev.packages = with pkgs; [mixid];
-}
--- a/nixos/ryu/apps/nvtop.nix
+++ b/nixos/ryu/apps/nvtop.nix
@@ -0,0 +1,3 @@
+{pkgs, ...}: {
+  environment.systemPackages = with pkgs; [nvtopPackages.nvidia];
+}
--- a/nixos/ryu/apps/qpwgraph.nix
+++ b/nixos/ryu/apps/qpwgraph.nix
@@ -0,0 +1,3 @@
+{pkgs, ...}: {
+  environment.systemPackages = with pkgs; [qpwgraph];
+}
--- a/nixos/ryu/apps/virt.nix
+++ b/nixos/ryu/apps/virt.nix
@@ -0,0 +1,6 @@
+{pkgs, ...}: {
+  environment.systemPackages = with pkgs; [
+    virt-manager
+    quickemu
+  ];
+}
--- a/nixos/ryu/apps/wine.nix
+++ b/nixos/ryu/apps/wine.nix
@@ -0,0 +1,7 @@
+{pkgs, ...}: {
+  environment.systemPackages = with pkgs; [
+    wine-wayland
+    winetricks
+    wineWowPackages.waylandFull
+  ];
+}
--- a/nixos/ryu/configuration.nix
+++ b/nixos/ryu/configuration.nix
@@ -2,6 +2,7 @@
  pkgs,
  lib,
  device,
+  config,
  ...
 }: {
  imports = [
@@ -47,6 +48,7 @@
      auto-optimise-store = true;
      extra-experimental-features = "nix-command flakes auto-allocate-uids";
      trusted-users = [device.user];
+      extra-sandbox-paths = [config.programs.ccache.cacheDir];
    };
    extraOptions = ''
      build-users-group = nixbld
@@ -157,12 +159,31 @@
          Name = "Ryu";
          Enable = "Source,Sink,Media,Socket";
          ControllerMode = "dual";
-          FactConnectable = "true";
-          Experimental = "true";
+          FactConnectable = true;
+          Experimental = true;
        };
      };
    };
  };
+  boot.extraModprobeConfig = ''
+    # Keep Bluetooth coexistence disabled for better BT audio stability
+    options iwlwifi bt_coex_active=0
+
+    # Enable software crypto (helps BT coexistence sometimes)
+    options iwlwifi swcrypto=1
+
+    # Disable power saving on Wi-Fi module to reduce radio state changes that might disrupt BT
+    options iwlwifi power_save=0
+
+    # Disable Unscheduled Automatic Power Save Delivery (U-APSD) to improve BT audio stability
+    options iwlwifi uapsd_disable=1
+
+    # Disable D0i3 power state to avoid problematic power transitions
+    options iwlwifi d0i3_disable=1
+
+    # Set power scheme for performance (iwlmvm)
+    options iwlmvm power_scheme=1
+  '';

  networking = {
    interfaces.eno1.wakeOnLan = {
@@ -272,42 +293,6 @@
  fonts.fontconfig.enable = true;
  fonts.fontDir.enable = true;
  environment = {
-    # List packages installed in system profile. To search, run:
-    # $ nix search wget
-    systemPackages = with pkgs; [
-      v4l-utils
-      polychromatic
-      openrazer-daemon
-      cudatoolkit
-      # Wine
-      wine-wayland
-      winetricks
-      wineWowPackages.waylandFull
-
-      virt-manager
-      gparted
-      nvtopPackages.nvidia
-      quickemu
-      # (nixvim.makeNixvim (import ../../neovim))
-      qpwgraph
-      hyprland
-      xorg.xhost
-      foot
-      git
-      fish
-      nushell
-      # (pkgs.wrapFirefox
-      #   (pkgs.firefox-unwrapped.override {pipewireSupport = true;})
-      #   {})
-      gnumake
-      python3
-      nerd-fonts.fira-code
-      nerd-fonts.hasklug
-      nerd-fonts.symbols-only
-      monaspace
-      ddcutil
-      libnotify
-    ];
    sessionVariables = {
      WLR_NO_HARDWARE_CURSORS = "1";
      NIXOS_OZONE_WL = "1";
--- a/nixos/ryu/games/default.nix
+++ b/nixos/ryu/games/default.nix
@@ -1,5 +1,5 @@
 {...}: {
  imports = [
-    ./hytale.nix
+    # ./hytale.nix
  ];
 }
--- a/nixos/ryu/hardware/default.nix
+++ b/nixos/ryu/hardware/default.nix
--- a/nixos/ryu/programs/ccache.nix
+++ b/nixos/ryu/programs/ccache.nix
@@ -0,0 +1,6 @@
+{...}: {
+  programs.ccache = {
+    enable = true;
+    packageNames = ["ollama" "orca-slicer" "opencv" "onnxruntime" "obs-studio" "llama-cpp"];
+  };
+}
--- a/nixos/ryu/programs/cuda.nix
+++ b/nixos/ryu/programs/cuda.nix
@@ -0,0 +1,3 @@
+{pkgs, ...}: {
+  environment.systemPackages = with pkgs; [cudatoolkit];
+}
--- a/nixos/ryu/programs/ddcutil.nix
+++ b/nixos/ryu/programs/ddcutil.nix
@@ -0,0 +1,3 @@
+{pkgs, ...}: {
+  environment.systemPackages = with pkgs; [ddcutil];
+}
--- a/nixos/ryu/programs/default.nix
+++ b/nixos/ryu/programs/default.nix
@@ -4,7 +4,7 @@
    ./steam.nix
    ./1password.nix
    ./localsend.nix
-    ./appimage.nix
+    # ./appimage.nix
    ./obs-studio.nix
    ./gnome-disks.nix
    ./nix-ld.nix
@@ -12,5 +12,15 @@
    ./droidcam.nix
    ./wireshark.nix
    ./flatpak.nix
+    ./v4l-utils.nix
+    ./razer.nix
+    ./cuda.nix
+    ./fonts.nix
+    ./dev.nix
+    ./shells.nix
+    ./hyprland.nix
+    ./foot.nix
+    ./ddcutil.nix
+    ./libnotify.nix
  ];
 }
--- a/nixos/ryu/programs/dev.nix
+++ b/nixos/ryu/programs/dev.nix
@@ -0,0 +1,7 @@
+{pkgs, ...}: {
+  environment.systemPackages = with pkgs; [
+    git
+    gnumake
+    python3
+  ];
+}
--- a/nixos/ryu/programs/fonts.nix
+++ b/nixos/ryu/programs/fonts.nix
@@ -0,0 +1,8 @@
+{pkgs, ...}: {
+  environment.systemPackages = with pkgs; [
+    nerd-fonts.fira-code
+    nerd-fonts.hasklug
+    nerd-fonts.symbols-only
+    monaspace
+  ];
+}
--- a/nixos/ryu/programs/foot.nix
+++ b/nixos/ryu/programs/foot.nix
@@ -0,0 +1,3 @@
+{pkgs, ...}: {
+  environment.systemPackages = with pkgs; [foot];
+}
--- a/nixos/ryu/programs/hyprland.nix
+++ b/nixos/ryu/programs/hyprland.nix
@@ -0,0 +1,6 @@
+{pkgs, ...}: {
+  environment.systemPackages = with pkgs; [
+    hyprland
+    xorg.xhost
+  ];
+}
--- a/nixos/ryu/programs/libnotify.nix
+++ b/nixos/ryu/programs/libnotify.nix
@@ -0,0 +1,3 @@
+{pkgs, ...}: {
+  environment.systemPackages = with pkgs; [libnotify];
+}
--- a/nixos/ryu/programs/razer.nix
+++ b/nixos/ryu/programs/razer.nix
@@ -0,0 +1,6 @@
+{pkgs, ...}: {
+  environment.systemPackages = with pkgs; [
+    polychromatic
+    openrazer-daemon
+  ];
+}
--- a/nixos/ryu/programs/shells.nix
+++ b/nixos/ryu/programs/shells.nix
@@ -0,0 +1,6 @@
+{pkgs, ...}: {
+  environment.systemPackages = with pkgs; [
+    fish
+    nushell
+  ];
+}
--- a/nixos/ryu/programs/v4l-utils.nix
+++ b/nixos/ryu/programs/v4l-utils.nix
@@ -0,0 +1,3 @@
+{pkgs, ...}: {
+  environment.systemPackages = with pkgs; [v4l-utils];
+}
--- a/nixos/tako/services/affine.nix
+++ b/nixos/tako/services/affine.nix
@@ -0,0 +1,89 @@
+{config, ...}: let
+  domain = "notes.darksailor.dev";
+in {
+  imports = [
+    ../../../modules/nixos/affine.nix
+  ];
+
+  # SOPS secrets
+  sops = {
+    secrets = {
+      "affine/db_password" = {};
+      "authelia/oidc/affine/client_id" = {
+        owner = config.systemd.services.authelia-darksailor.serviceConfig.User;
+        mode = "0440";
+        restartUnits = ["authelia-darksailor.service"];
+      };
+      "authelia/oidc/affine/client_secret" = {
+        owner = config.systemd.services.authelia-darksailor.serviceConfig.User;
+        mode = "0440";
+        restartUnits = ["authelia-darksailor.service"];
+      };
+    };
+    templates."affine.env".content = ''
+      AFFINE_DB_PASSWORD=${config.sops.placeholder."affine/db_password"}
+      POSTGRES_PASSWORD=${config.sops.placeholder."affine/db_password"}
+      AFFINE_SERVER_EXTERNAL_URL=https://${domain}
+    '';
+  };
+
+  # Enable AFFiNE service
+  services.affine = {
+    enable = true;
+    inherit domain;
+    environmentFiles = [
+      config.sops.templates."affine.env".path
+    ];
+  };
+
+  # Caddy reverse proxy with SSO forward auth
+  services.caddy.virtualHosts."${domain}".extraConfig = ''
+    reverse_proxy localhost:${toString config.services.affine.port}
+  '';
+
+  # Authelia access control rules
+  services.authelia.instances.darksailor.settings = {
+    access_control.rules = [
+      {
+        inherit domain;
+        policy = "bypass";
+        resources = [
+          "^/api/(sync|awareness)([/?].*)?$"
+          "^/socket\\.io([/?].*)?$"
+        ];
+      }
+      {
+        inherit domain;
+        policy = "one_factor";
+      }
+    ];
+    # OIDC client for AFFiNE
+    identity_providers.oidc.clients = [
+      {
+        client_name = "AFFiNE: Darksailor";
+        client_id = ''{{ secret "${config.sops.secrets."authelia/oidc/affine/client_id".path}" }}'';
+        client_secret = ''{{ secret "${config.sops.secrets."authelia/oidc/affine/client_secret".path}" }}'';
+        public = false;
+        authorization_policy = "one_factor";
+        require_pkce = false;
+        redirect_uris = [
+          "https://${domain}/oauth/callback"
+        ];
+        scopes = [
+          "openid"
+          "email"
+          "profile"
+        ];
+        response_types = ["code"];
+        grant_types = ["authorization_code"];
+        userinfo_signed_response_alg = "none";
+        token_endpoint_auth_method = "client_secret_post";
+      }
+    ];
+  };
+
+  # Ensure containers start after secrets are available
+  systemd.services.docker-affine.after = ["sops-install-secrets.service"];
+  systemd.services.docker-affine-migration.after = ["sops-install-secrets.service"];
+  systemd.services.docker-affine-postgres.after = ["sops-install-secrets.service"];
+}
--- a/nixos/tako/services/attic.nix
+++ b/nixos/tako/services/attic.nix
@@ -1,16 +1,21 @@
-{...}: {
+{config, ...}: let
+  address = "127.0.0.1:8052";
+in {
+  sops = {
+    secrets."attic/jwt_secret" = {};
+    templates."attic.env".content = ''
+      ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64=${config.sops.placeholder."attic/jwt_secret"}
+    '';
+  };
  services = {
    atticd = {
-      enable = false;
-      listen = "/run/attic.sock";
+      enable = true;
+      settings.listen = address;
+      environmentFile = config.sops.templates."attic.env".path;
    };
    caddy = {
      virtualHosts."cache.darksailor.dev".extraConfig = ''
-        reverse_proxy /run/attic.sock {
-          transport http {
-            protocol = "fd"
-          }
-        }
+        reverse_proxy ${address}
      '';
    };
  };
--- a/nixos/tako/services/default.nix
+++ b/nixos/tako/services/default.nix
@@ -1,29 +1,33 @@
 {...}: {
  imports = [
-    ./games
-    # ./headscale.nix
-    ./llms.nix
-    ./monitoring.nix
-    # ./paperless.nix
-    ./navidrome.nix
-    ./shitpost.nix
    ./atuin.nix
    ./authelia.nix
    ./caddy.nix
-    ./excalidraw.nix
    ./fail2ban.nix
-    ./flaresolverr.nix
-    ./gitea.nix
    ./homepage.nix
-    ./immich.nix
    ./lldap.nix
+    ./navidrome.nix
    ./nextcloud.nix
    ./openssh.nix
-    ./prowlarr.nix
    ./resolved.nix
-    ./searxng.nix
    ./tailscale.nix
+    ./gitea.nix
+
+    ./affine.nix
+    ./attic.nix
+    ./excalidraw.nix
+    ./flaresolverr.nix
+    # ./games
+    # ./headscale.nix
+    ./immich.nix
    ./kellnr.nix
+    # ./llms.nix
+    ./matrix
+    # ./monitoring.nix
+    # ./paperless.nix
+    ./prowlarr.nix
+    # ./searxng.nix
+    # ./shitpost.nix
  ];
  services = {
    nix-serve = {
--- a/nixos/tako/services/excalidraw.nix
+++ b/nixos/tako/services/excalidraw.nix
@@ -1,30 +1,91 @@
-{...}: {
+{config, ...}: let
+  dataDir = "/var/lib/excalidraw";
+  base_domain = "darksailor.dev";
+in {
+  # SOPS secrets and templates
+  sops = {
+    secrets = {
+      "excalidraw/jwt_secret" = {};
+      "authelia/oidc/excalidraw/client_id" = {
+        owner = config.systemd.services.authelia-darksailor.serviceConfig.User;
+        mode = "0440";
+        restartUnits = ["authelia-darksailor.service"];
+      };
+      "authelia/oidc/excalidraw/client_secret" = {
+        owner = config.systemd.services.authelia-darksailor.serviceConfig.User;
+        mode = "0440";
+        restartUnits = ["authelia-darksailor.service"];
+      };
+    };
+    templates."excalidraw.env".content = ''
+      OIDC_ISSUER_URL=https://auth.${base_domain}
+      OIDC_CLIENT_ID=${config.sops.placeholder."authelia/oidc/excalidraw/client_id"}
+      OIDC_CLIENT_SECRET=${config.sops.placeholder."authelia/oidc/excalidraw/client_secret"}
+      OIDC_REDIRECT_URL=https://draw.${base_domain}/auth/callback
+      JWT_SECRET=${config.sops.placeholder."excalidraw/jwt_secret"}
+      STORAGE_TYPE=sqlite
+      DATA_SOURCE_NAME=excalidraw.db
+      LOCAL_STORAGE_PATH=/root/data
+    '';
+  };
+
+  # Create data directory and initialize SQLite DB
+  systemd.tmpfiles.rules = [
+    "d ${dataDir} 0755 root root -"
+    "d ${dataDir}/data 0755 root root -"
+    "f ${dataDir}/excalidraw.db 0644 root root -"
+  ];
+
  virtualisation.oci-containers = {
    backend = "docker";
    containers = {
+      # Excalidraw Full backend
      excalidraw = {
-        image = "excalidraw/excalidraw:latest";
-        ports = ["127.0.0.1:5959:80"];
-        volumes = [];
+        image = "ghcr.io/betterandbetterii/excalidraw-full:latest";
+        ports = ["127.0.0.1:3002:3002"];
+        environmentFiles = [
+          config.sops.templates."excalidraw.env".path
+        ];
+        volumes = [
+          "${dataDir}/data:/root/data"
+          "${dataDir}/excalidraw.db:/root/excalidraw.db"
+        ];
      };
    };
  };
-  services.caddy.virtualHosts."draw.darksailor.dev".extraConfig = ''
-    import auth
-    reverse_proxy localhost:5959
+
+  # Caddy reverse proxy
+  services.caddy.virtualHosts."draw.${base_domain}".extraConfig = ''
+    reverse_proxy localhost:3002
  '';
-  services.authelia = {
-    instances.darksailor = {
-      settings = {
-        access_control = {
-          rules = [
+
+  # Configure Authelia OIDC for Excalidraw
+  services.authelia.instances.darksailor.settings = {
+    identity_providers = {
+      oidc = {
+        clients = [
          {
-              domain = "draw.darksailor.dev";
-              policy = "one_factor";
+            client_name = "Excalidraw: Darksailor";
+            client_id = ''{{ secret "${config.sops.secrets."authelia/oidc/excalidraw/client_id".path}" }}'';
+            client_secret = ''{{ secret "${config.sops.secrets."authelia/oidc/excalidraw/client_secret".path}" }}'';
+            public = false;
+            authorization_policy = "one_factor";
+            require_pkce = false;
+            redirect_uris = [
+              "https://draw.${base_domain}/auth/callback"
+            ];
+            scopes = [
+              "openid"
+              "email"
+              "profile"
+            ];
+            response_types = ["code"];
+            grant_types = ["authorization_code"];
+            userinfo_signed_response_alg = "none";
+            token_endpoint_auth_method = "client_secret_post";
          }
        ];
      };
    };
  };
-  };
 }
--- a/nixos/tako/services/fail2ban.nix
+++ b/nixos/tako/services/fail2ban.nix
@@ -16,6 +16,7 @@
      ignoreIP = [
        "106.219.121.52"
        "106.219.122.125"
+        "106.219.122.221"
      ];
    };
  };
--- a/nixos/tako/services/gitea.nix
+++ b/nixos/tako/services/gitea.nix
@@ -79,22 +79,22 @@
        };
      };
    };
-    # gitea-actions-runner = {
-    #   instances = {
-    #     tako = {
-    #       enable = true;
-    #       name = "tako";
-    #       url = "https://git.darksailor.dev";
-    #       labels = [
-    #         "ubuntu-latest:docker://catthehacker/ubuntu:full-latest"
-    #         "ubuntu-22.04:docker://catthehacker/ubuntu:full-22.04"
-    #         "ubuntu-20.04:docker://catthehacker/ubuntu:full-20.04"
-    #         "native:host"
-    #       ];
-    #       tokenFile = "${config.sops.templates."GITEA_REGISTRATION_TOKEN.env".path}";
-    #     };
-    #   };
-    # };
+    gitea-actions-runner = {
+      instances = {
+        tako = {
+          enable = true;
+          name = "tako";
+          url = "https://git.darksailor.dev";
+          labels = [
+            "ubuntu-latest:docker://catthehacker/ubuntu:full-latest"
+            "ubuntu-22.04:docker://catthehacker/ubuntu:full-22.04"
+            "ubuntu-20.04:docker://catthehacker/ubuntu:full-20.04"
+            "native:host"
+          ];
+          tokenFile = "${config.sops.templates."GITEA_REGISTRATION_TOKEN.env".path}";
+        };
+      };
+    };
    caddy = {
      virtualHosts."git.darksailor.dev".extraConfig = ''
        reverse_proxy localhost:3000
--- a/nixos/tako/services/headscale.nix
+++ b/nixos/tako/services/headscale.nix
@@ -34,12 +34,12 @@
        };
      };
    };
-    # headplane = {
-    #   enable = true;
-    #   settings = {
-    #     server.port = 42562;
-    #   };
-    # };
+    headplane = {
+      enable = true;
+      settings = {
+        server.port = 42562;
+      };
+    };
    caddy = {
      virtualHosts."headscale.darksailor.dev".extraConfig = ''
        reverse_proxy localhost:${toString config.services.headplane.settings.server.port}
--- a/nixos/tako/services/matrix/default.nix
+++ b/nixos/tako/services/matrix/default.nix
@@ -0,0 +1,7 @@
+{...}: {
+  imports = [
+    ./tuwunel.nix
+    # ./signal.nix // libolm deprecated
+    # ./discord.nix
+  ];
+}
--- a/nixos/tako/services/matrix/discord.nix
+++ b/nixos/tako/services/matrix/discord.nix
@@ -0,0 +1,19 @@
+{...}: {
+  services.mautrix-discord = {
+    enable = true;
+    settings = {
+      homeserver = {
+        address = "http://localhost:6167";
+        domain = "darksailor.dev";
+      };
+      appservice.public = {
+        prefix = "/public";
+        external = "https://matrix.darksailor.dev/public";
+      };
+      bridge.permissions = {
+        "darksailor.dev" = "user";
+        "@servius:darksailor.dev" = "admin";
+      };
+    };
+  };
+}
--- a/nixos/tako/services/matrix/signal.nix
+++ b/nixos/tako/services/matrix/signal.nix
@@ -0,0 +1,5 @@
+{...}: {
+  services.mautrix-signal = {
+    enable = true;
+  };
+}
--- a/nixos/tako/services/matrix/tuwunel.nix
+++ b/nixos/tako/services/matrix/tuwunel.nix
@@ -0,0 +1,193 @@
+{
+  config,
+  pkgs,
+  ...
+}: let
+  port = 6167;
+  base_domain = "darksailor.dev";
+  client_id = "tuwunel";
+  rtc_domain = "matrix-rtc.${base_domain}";
+  jwt_port = 8081;
+  elementConfig = builtins.toJSON {
+    default_server_config = {
+      "m.homeserver" = {
+        base_url = "https://matrix.${base_domain}";
+      };
+    };
+    sso_redirect_options = {
+      immediate = false;
+      on_welcome_page = true;
+      on_login_page = true;
+    };
+  };
+  elementConfigFile = pkgs.writeText "element-config.json" elementConfig;
+in {
+  sops = {
+    secrets."tuwunel/client_id" = {
+      owner = config.services.matrix-tuwunel.user;
+      group = config.systemd.services.authelia-darksailor.serviceConfig.Group;
+      mode = "0440";
+    };
+    secrets."tuwunel/client_secret" = {
+      owner = config.services.matrix-tuwunel.user;
+      group = config.systemd.services.authelia-darksailor.serviceConfig.Group;
+      mode = "0440";
+    };
+    secrets."tuwunel/registration_token".owner = config.services.matrix-tuwunel.user;
+    secrets."livekit/key_name" = {};
+    secrets."livekit/key_secret" = {};
+    templates."livekit-keys".content = ''
+      ${config.sops.placeholder."livekit/key_name"}: ${config.sops.placeholder."livekit/key_secret"}
+    '';
+  };
+  services.matrix-tuwunel = {
+    enable = true;
+    settings.global = {
+      server_name = "${base_domain}";
+      address = ["127.0.0.1"];
+      port = [port];
+      allow_registration = true;
+      registration_token_file = config.sops.secrets."tuwunel/registration_token".path;
+      single_sso = true;
+      identity_provider = [
+        {
+          inherit client_id;
+          brand = "Authelia";
+          name = "Authelia";
+          default = true;
+          issuer_url = "https://auth.${base_domain}";
+          client_secret_file = config.sops.secrets."tuwunel/client_secret".path;
+          callback_url = "https://matrix.${base_domain}/_matrix/client/unstable/login/sso/callback/${client_id}";
+        }
+      ];
+      well_known = {
+        client = "https://matrix.${base_domain}";
+        server = "matrix.${base_domain}:443";
+        rtc_transports = [
+          {
+            type = "livekit";
+            livekit_service_url = "https://${rtc_domain}";
+          }
+        ];
+      };
+    };
+    package = pkgs.matrix-tuwunel;
+  };
+  services.caddy.virtualHosts = {
+    "matrix.${base_domain}".extraConfig = ''
+      reverse_proxy /_matrix/* localhost:${toString port}
+      handle_path /config.json  {
+        file_server
+        root ${elementConfigFile}
+      }
+      root * ${pkgs.element-web}
+      file_server
+    '';
+    "${base_domain}".extraConfig = ''
+      reverse_proxy /.well-known/* localhost:${toString port}
+    '';
+    "${rtc_domain}".extraConfig = ''
+      @jwt_service {
+        path /sfu/get* /healthz*
+      }
+      handle @jwt_service {
+        reverse_proxy localhost:${toString jwt_port}
+      }
+      handle {
+        reverse_proxy localhost:${toString config.services.livekit.settings.port} {
+          header_up Connection "upgrade"
+          header_up Upgrade {http.request.header.Upgrade}
+        }
+      }
+    '';
+  };
+  networking.firewall = {
+    allowedTCPPorts = [8448 7881];
+    allowedUDPPorts = [3478];
+    allowedUDPPortRanges = [
+      {
+        from = 50300;
+        to = 65535;
+      }
+    ];
+  };
+
+  users.users.${config.services.caddy.user}.extraGroups = [config.services.matrix-tuwunel.group];
+
+  services.livekit = {
+    enable = true;
+    keyFile = config.sops.templates."livekit-keys".path;
+    openFirewall = true;
+    settings = {
+      rtc = {
+        tcp_port = 7881;
+        port_range_start = 50100;
+        port_range_end = 50200;
+        use_external_ip = true;
+        enable_loopback_candidate = false;
+      };
+      turn = {
+        enabled = true;
+        udp_port = 3478;
+        relay_range_start = 50300;
+        relay_range_end = 65535;
+        domain = rtc_domain;
+      };
+    };
+  };
+
+  services.lk-jwt-service = {
+    enable = true;
+    port = jwt_port;
+    livekitUrl = "wss://${rtc_domain}";
+    keyFile = config.sops.templates."livekit-keys".path;
+  };
+
+  services = {
+    authelia = {
+      instances.darksailor = {
+        settings = {
+          identity_providers = {
+            oidc = {
+              claims_policies = {
+                tuwunel = {
+                  id_token = [
+                    "email"
+                    "name"
+                    "groups"
+                    "preferred_username"
+                  ];
+                };
+              };
+              clients = [
+                {
+                  inherit client_id;
+                  client_name = "Matrix: Darksailor";
+                  client_secret = ''{{ secret "${config.sops.secrets."tuwunel/client_secret".path}" }}'';
+                  public = false;
+                  authorization_policy = "one_factor";
+                  require_pkce = false;
+                  # pkce_challenge_method = "S256";
+                  redirect_uris = [
+                    "https://matrix.${base_domain}/_matrix/client/unstable/login/sso/callback/${client_id}"
+                  ];
+                  scopes = [
+                    "openid"
+                    "groups"
+                    "email"
+                    "profile"
+                  ];
+                  response_types = ["code"];
+                  response_modes = ["form_post"];
+                  grant_types = ["refresh_token" "authorization_code"];
+                  userinfo_signed_response_alg = "none";
+                  token_endpoint_auth_method = "client_secret_post";
+                }
+              ];
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/nixos/tako/services/monitoring.nix
+++ b/nixos/tako/services/monitoring.nix
@@ -382,21 +382,21 @@ in {
  };

  # Docker cAdvisor for container metrics
-  virtualisation.oci-containers.containers.cadvisor = {
-    image = "gcr.io/cadvisor/cadvisor:v0.49.1";
-    ports = ["127.0.0.1:${toString ports.cadvisor}:8080"];
-    volumes = [
-      "/:/rootfs:ro"
-      "/var/run:/var/run:ro"
-      "/sys:/sys:ro"
-      "/var/lib/docker/:/var/lib/docker:ro"
-      "/dev/disk/:/dev/disk:ro"
-    ];
-    extraOptions = [
-      "--privileged"
-      "--device=/dev/kmsg"
-    ];
-  };
+  # virtualisation.oci-containers.containers.cadvisor = {
+  #   image = "gcr.io/cadvisor/cadvisor:v0.49.1";
+  #   ports = ["127.0.0.1:${toString ports.cadvisor}:8080"];
+  #   volumes = [
+  #     "/:/rootfs:ro"
+  #     "/var/run:/var/run:ro"
+  #     "/sys:/sys:ro"
+  #     "/var/lib/docker/:/var/lib/docker:ro"
+  #     "/dev/disk/:/dev/disk:ro"
+  #   ];
+  #   extraOptions = [
+  #     "--privileged"
+  #     "--device=/dev/kmsg"
+  #   ];
+  # };

  # Link dashboard files from Nix store to Grafana's expected location
  systemd.tmpfiles.rules = let
--- a/nixos/tako/services/navidrome.nix
+++ b/nixos/tako/services/navidrome.nix
@@ -18,8 +18,8 @@ in {
      enable = true;
      settings = {
        MusicFolder = "/media/music";
-        ReverseProxyUserHeader = "Remote-User";
-        ReverseProxyWhitelist = "@";
+        "ExtAuth.TrustedSources" = "@";
+        "ExtAuth.UserHeader" = "Remote-User";
        Address = "unix:${socket}";
        BaseUrl = "https://music.darksailor.dev";
      };
--- a/nixos/tako/services/openssh.nix
+++ b/nixos/tako/services/openssh.nix
@@ -2,6 +2,6 @@
  services.openssh = {
    enable = true;
    settings.PasswordAuthentication = false;
-    settings.PermitRootLogin = "prohibit-password";
+    settings.PermitRootLogin = "no";
  };
 }
--- a/overlays.nix
+++ b/overlays.nix
@@ -291,7 +291,6 @@ in
    inputs.headplane.overlays.default
    inputs.vicinae.overlays.default
    inputs.eilmeldung.overlays.default
-    inputs.mixid.overlays.default
    jellyfin
    libfprint
    misc-applications
--- a/secrets/secrets.yaml
+++ b/secrets/secrets.yaml
Author	SHA1	Message	Date
servius	1ac96316ea	feat: re-enable affine service All checks were successful Flake checker / Build Nix targets (pull_request) Successful in 9m32s Details	2026-02-23 17:05:03 +05:30
servius	8d636ce194	refactor(matrix): simplify LiveKit configuration to use services.livekit and services.lk-jwt-service	2026-02-23 16:32:14 +05:30
servius	bbeed99f43	refactor(affine): use Docker network option instead of --network flag	2026-02-23 16:05:09 +05:30
servius	7e6ece1b0d	feat(matrix): add LiveKit support with firewall and systemd services	2026-02-23 15:49:50 +05:30
servius	60952a0e7f	feat(programs): add yq package to home programs	2026-02-23 14:43:49 +05:30
servius	738013df66	refactor: update mbsync settings for Fastmail and Neomutt	2026-02-22 15:32:38 +05:30
servius	34160d0de4	feat: Updated notifications All checks were successful Flake checker / Build Nix targets (push) Successful in 9m27s Details	2026-02-22 15:16:10 +05:30
servius	02b8a16f41	feat(cargo): add pkgs metadata alias All checks were successful Flake checker / Build Nix targets (push) Successful in 9m33s Details	2026-02-20 03:42:46 +05:30
servius	684f6fdea5	fix(apps): make playerctl conditional to ryu device only	2026-02-20 03:42:44 +05:30
servius	7ef1785a0f	feat: Added caldav	2026-02-20 03:08:24 +05:30
servius	49c0c607d8	feat: Added stuff	2026-02-20 02:01:24 +05:30
servius	ab52b423ee	feat: Move stuff into programs / apps in ryu	2026-02-19 23:03:52 +05:30
servius	f852a73d47	feat: Updated to latest nixpkgs-unstable	2026-02-19 21:16:08 +05:30
servius	998ebc1164	feat(programs): add jujutsu(jj) package All checks were successful Flake checker / Build Nix targets (push) Successful in 9m41s Details	2026-02-19 13:51:12 +05:30
servius	9acb378e5f	feat: disable some services and disable root login from ssh altogether	2026-02-19 13:41:40 +05:30
servius	dca434c0ba	Enable Audacity and add local Ollama provider configuration - Remove comment from audacity.nix to enable Audacity application - Add Ollama provider configuration for local LLM access - Configure glm-4.7-flash model with custom base URL	2026-02-19 00:19:08 +05:30
servius	c22ff38874	feat: Added affine	2026-02-18 18:03:06 +05:30
servius	0591868be3	feat: Added affine server	2026-02-18 17:23:05 +05:30
servius	e249f13313	feat: Vertical to horizontal secondary monitor 3 All checks were successful Flake checker / Build Nix targets (push) Successful in 9m37s Details	2026-02-16 03:17:34 +05:30
servius	4ecf045deb	feat: Added ip target for ignore ip	2026-02-16 02:48:03 +05:30
servius	05d1890b01	feat: Added steamdeck deploy target All checks were successful Flake checker / Build Nix targets (push) Successful in 9m35s Details	2026-02-16 02:21:06 +05:30
servius	2babff5576	feat: Added cloudflare cli to add / remove dns entries from cli	2026-02-12 19:04:13 +05:30
servius	aa7c26516c	feat: Added gitea runner All checks were successful Flake checker / Build Nix targets (push) Successful in 9m33s Details	2026-02-12 16:21:36 +05:30
servius	a1369cbb41	feat(attic): Use env variable for attic login All checks were successful Flake checker / Build Nix targets (push) Successful in 29m34s Details	2026-02-11 19:53:05 +05:30
servius	54c5cf932d	feat: Added attic-client	2026-02-11 17:53:27 +05:30
servius	bb68711814	fix: use tcp instead of unix sockets for attic Some checks failed Flake checker / Build Nix targets (push) Has been cancelled Details	2026-02-11 17:07:40 +05:30
servius	6b31922615	feat: Added attic ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64 Some checks failed Flake checker / Build Nix targets (push) Has been cancelled Details	2026-02-11 16:56:23 +05:30
servius	21e779c304	fix: Macos fixes Some checks failed Flake checker / Build Nix targets (push) Has been cancelled Details	2026-02-11 16:30:38 +05:30
servius	e718da413b	feat: Replace deprecated options from navidrome Some checks failed Flake checker / Build Nix targets (push) Has been cancelled Details	2026-02-11 04:48:39 +05:30
servius	98989afdec	feat: upgrade to excalidraw-full	2026-02-11 04:27:14 +05:30
servius	3a97de6af2	fix: Matrix server fix Some checks failed Flake checker / Build Nix targets (push) Has been cancelled Details	2026-02-11 03:55:29 +05:30
servius	66b7a31943	feat: Update to latest nix	2026-02-10 23:14:12 +05:30
servius	ddb53d879e	feat: Added matrix	2026-02-10 22:25:37 +05:30
servius	e403e47c28	feat: Added tuwunel	2026-02-10 14:24:39 +05:30
servius	d8b3d6fb09	chore: Update flake.nix Some checks failed Flake checker / Build Nix targets (push) Has been cancelled Details	2026-02-07 02:42:39 +05:30
				`@@ -0,0 +1 @@`
				`{pkgs, ...}: {home.packages = [pkgs.jujutsu];}`