Update youmubot

Update nixpkgs
2024-11-10 23:13:35 +01:00 · 2024-11-04 18:23:59 +01:00 · 2024-11-01 16:27:41 +01:00 · 2024-11-01 16:27:37 +01:00 · 2024-10-31 14:10:47 +01:00 · 2024-10-31 13:04:58 +00:00
56 changed files with 1210 additions and 841 deletions
--- a/.sops.yaml
+++ b/.sops.yaml
@ -4,6 +4,8 @@ keys:
  - &nki_pc age1tt0peqg8zdfh74m5sdgwsczcqh036nhgmwvkqnvywll88uvmm9xs433rhm
  - &nkagami_main age1n8tnmmgredzltzwkspag7aufhrn6034ny8ysjeulhkwdnf7vqqaqec4mg5
  - &nkagami_do age1z2h24mjt80fryqupajkh3kg5r4sjgw65uqy489xeqxhqj8u2a9fsm3ff36
+  - &nki_yoga age1vhjhmxura35apu5zdwg5ur5r40xay45ld9szh07dy0ph9chgsu7shfm4h9
+  - &nki_framework age188tgu3psvywk6shq85mk2q0jdjwd0tcswzwlwu5pa5n3pndx75dq090z59
 creation_rules:
  - path_regex: kagami-air-m1/secrets\.yaml$
    key_groups:
@ -16,9 +18,20 @@ creation_rules:
        - *nki_pc
        - *nkagami_main
        - *nkagami_do
-  - path_regex: nki-home/secrets/secrets\.yaml$
+        - *nki_framework
+  - path_regex: nki-home/secrets\.yaml$
    key_groups:
    - age:
        - *nki_pc
        - *nkagami_main
        - *nkagami_do
+  - path_regex: nki-yoga-g8/secrets\.yaml$
+    key_groups:
+    - age:
+        - *nki_yoga
+        - age1axvjllyv2gutngwmp3pvp4xtq2gqneldaq2c4nrzmaye0uwmk9lqsealdv # The machine itself
+  - path_regex: nki-framework/secrets\.yaml$
+    key_groups:
+    - age:
+        - *nki_framework
+        - age1vgh6kvee8lvxylm7z86fpl3xzjyjs4u3zdfkyf064rjvxk9fpumsew7n27 # The machine itself
--- a/common.nix
+++ b/common.nix
@ -13,6 +13,8 @@ in
 with lib; {
  imports = [
    # defaultShell
+    ./modules/services/nix-cache
+    ./modules/services/nix-build-farm
  ];

  ## Packages
--- a/flake.lock
+++ b/flake.lock
@ -55,16 +55,16 @@
        "nixpkgs": "nixpkgs_4"
      },
      "locked": {
-        "lastModified": 1718214198,
-        "narHash": "sha256-/qKPeE2Ptweaf+rHOvdW0TUDLwN9D93MMgDoU4fTzEA=",
+        "lastModified": 1728224242,
+        "narHash": "sha256-mQLfRAun2G/LDnw3jyFGJbOqpxh2PL8IGzFELRfAgAI=",
        "owner": "famedly",
        "repo": "conduit",
-        "rev": "7a5b8930134cf7ea5ff9880e6fa468b2b3e05c98",
+        "rev": "f8d7ef04e664580e882bac852877b68e7bd3ab1e",
        "type": "gitlab"
      },
      "original": {
        "owner": "famedly",
-        "ref": "v0.8.0",
+        "ref": "v0.9.0",
        "repo": "conduit",
        "type": "gitlab"
      }
@ -115,17 +115,14 @@
    },
    "crane_3": {
      "inputs": {
-        "flake-compat": "flake-compat_3",
-        "flake-utils": "flake-utils_3",
-        "nixpkgs": "nixpkgs_5",
-        "rust-overlay": "rust-overlay"
+        "nixpkgs": "nixpkgs_5"
      },
      "locked": {
-        "lastModified": 1697334144,
-        "narHash": "sha256-gcOxnHEgBcn8mGXgNkTvZ1BLAANZZj+IZzb9QnQt7bc=",
+        "lastModified": 1724006180,
+        "narHash": "sha256-PVxPj0Ga2fMYMtcT9ARCthF+4U71YkOT7ZjgD/vf1Aw=",
        "owner": "ipetkov",
        "repo": "crane",
-        "rev": "4dcf584de14beff8dd0c030ac54e185fd3b72023",
+        "rev": "7ce92819802bc583b7e82ebc08013a530f22209f",
        "type": "github"
      },
      "original": {
@ -175,11 +172,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1718730147,
-        "narHash": "sha256-QmD6B6FYpuoCqu6ZuPJH896ItNquDkn0ulQlOn4ykN8=",
+        "lastModified": 1724377159,
+        "narHash": "sha256-ixjje1JO8ucKT41hs6n2NCde1Vc0+Zc2p2gUbJpCsMw=",
        "owner": "ipetkov",
        "repo": "crane",
-        "rev": "32c21c29b034d0a93fdb2379d6fabc40fc3d0e6c",
+        "rev": "3e47b7a86c19142bd3675da49d6acef488b4dac1",
        "type": "github"
      },
      "original": {
@ -211,7 +208,7 @@
    },
    "deploy-rs": {
      "inputs": {
-        "flake-compat": "flake-compat_4",
+        "flake-compat": "flake-compat_3",
        "nixpkgs": "nixpkgs_6",
        "utils": "utils"
      },
@ -231,21 +228,22 @@
    },
    "dtth-phanpy": {
      "inputs": {
-        "flake-utils": "flake-utils_4",
+        "flake-utils": "flake-utils_3",
        "nixpkgs": "nixpkgs_7"
      },
      "locked": {
-        "lastModified": 1719154855,
-        "narHash": "sha256-uLV3PAVG+eZVnfVkRmHABGi7vRW/q8qvDafw3VzmFgk=",
-        "ref": "refs/heads/dtth-fork",
-        "rev": "97978f4a6556e69b826e15f7d2c3c4079a1c1c47",
-        "revCount": 2662,
+        "lastModified": 1728598146,
+        "narHash": "sha256-8zAvVSR3chBSJ7YKW+MYC1mrDxtZDFBPVobfO4KPXzg=",
+        "ref": "dtth-fork",
+        "rev": "fc6bd96aef92d7796d9c7663ac23e3fa837f8ddb",
+        "revCount": 3218,
        "type": "git",
-        "url": "ssh://gitea@git.dtth.ch/nki/phanpy?branch=dtth-fork"
+        "url": "ssh://gitea@git.dtth.ch/nki/phanpy"
      },
      "original": {
+        "ref": "dtth-fork",
        "type": "git",
-        "url": "ssh://gitea@git.dtth.ch/nki/phanpy?branch=dtth-fork"
+        "url": "ssh://gitea@git.dtth.ch/nki/phanpy"
      }
    },
    "fenix": {
@ -303,22 +301,6 @@
      }
    },
    "flake-compat_3": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1696267196,
-        "narHash": "sha256-AAQ/2sD+0D18bb8hKuEEVpHUYD1GmO2Uh/taFamn6XQ=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "4f910c9827911b1ec2bf26b5a062cd09f8d89f85",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-compat_4": {
      "flake": false,
      "locked": {
        "lastModified": 1696426674,
@ -334,7 +316,7 @@
        "type": "github"
      }
    },
-    "flake-compat_5": {
+    "flake-compat_4": {
      "flake": false,
      "locked": {
        "lastModified": 1673956053,
@ -350,7 +332,7 @@
        "type": "github"
      }
    },
-    "flake-compat_6": {
+    "flake-compat_5": {
      "locked": {
        "lastModified": 1688025799,
        "narHash": "sha256-ktpB4dRtnksm9F5WawoIkEneh1nrEvuxb5lJFt1iOyw=",
@ -452,11 +434,11 @@
        "nixpkgs-lib": "nixpkgs-lib_2"
      },
      "locked": {
-        "lastModified": 1706830856,
-        "narHash": "sha256-a0NYyp+h9hlb7ddVz4LUn1vT/PLwqfrWYcHMvFB1xYg=",
+        "lastModified": 1722555600,
+        "narHash": "sha256-XOQkdLafnb/p9ij77byFQjDf5m5QYl9b2REiVClC+x4=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "b253292d9c0a5ead9bc98c4e9a26c6312e27d69f",
+        "rev": "8471fe90ad337a8074e957b69ca4d0089218391d",
        "type": "github"
      },
      "original": {
@ -480,24 +462,6 @@
        "type": "github"
      }
    },
-    "flake-utils_10": {
-      "inputs": {
-        "systems": "systems_9"
-      },
-      "locked": {
-        "lastModified": 1710146030,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
    "flake-utils_2": {
      "inputs": {
        "systems": "systems"
@ -518,14 +482,14 @@
    },
    "flake-utils_3": {
      "inputs": {
-        "systems": "systems_2"
+        "systems": "systems_3"
      },
      "locked": {
-        "lastModified": 1694529238,
-        "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=",
+        "lastModified": 1726560853,
+        "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "ff7b65b44d01cf9ba6a71320833626af21126384",
+        "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
        "type": "github"
      },
      "original": {
@ -538,24 +502,6 @@
      "inputs": {
        "systems": "systems_4"
      },
-      "locked": {
-        "lastModified": 1710146030,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_5": {
-      "inputs": {
-        "systems": "systems_5"
-      },
      "locked": {
        "lastModified": 1694529238,
        "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=",
@ -570,9 +516,9 @@
        "type": "github"
      }
    },
-    "flake-utils_6": {
+    "flake-utils_5": {
      "inputs": {
-        "systems": "systems_6"
+        "systems": "systems_5"
      },
      "locked": {
        "lastModified": 1681202837,
@ -588,6 +534,24 @@
        "type": "github"
      }
    },
+    "flake-utils_6": {
+      "inputs": {
+        "systems": "systems_6"
+      },
+      "locked": {
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
    "flake-utils_7": {
      "inputs": {
        "systems": "systems_7"
@ -607,15 +571,12 @@
      }
    },
    "flake-utils_8": {
-      "inputs": {
-        "systems": "systems_8"
-      },
      "locked": {
-        "lastModified": 1710146030,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "lastModified": 1659877975,
+        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
        "type": "github"
      },
      "original": {
@ -625,12 +586,15 @@
      }
    },
    "flake-utils_9": {
+      "inputs": {
+        "systems": "systems_8"
+      },
      "locked": {
-        "lastModified": 1659877975,
-        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
        "type": "github"
      },
      "original": {
@ -778,11 +742,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1719037157,
-        "narHash": "sha256-aOKd8+mhBsLQChCu1mn/W5ww79ta5cXVE59aJFrifM8=",
+        "lastModified": 1728337164,
+        "narHash": "sha256-VdRTjJFyq4Q9U7Z/UoC2Q5jK8vSo6E86lHc2OanXtvc=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "cd886711998fe5d9ff7979fdd4b4cbd17b1f1511",
+        "rev": "038630363e7de57c36c417fd2f5d7c14773403e4",
        "type": "github"
      },
      "original": {
@ -794,11 +758,11 @@
    "kak-lsp": {
      "flake": false,
      "locked": {
-        "lastModified": 1719761259,
-        "narHash": "sha256-2cnjweEU/NgQffF2gav9b6EIXmV9TcSd7214FzW7ekY=",
+        "lastModified": 1723206901,
+        "narHash": "sha256-wPCu/VxAMIB+zI0+eDq7lJ/rHJZfe0whYzdoiwrixCc=",
        "owner": "kakoune-lsp",
        "repo": "kakoune-lsp",
-        "rev": "484b19c2e373988ee5ab9afc54ecd6383b8da9bc",
+        "rev": "ebd370f43cb6e7af634e5f8cadb99cc8c16e1efe",
        "type": "github"
      },
      "original": {
@ -826,14 +790,14 @@
    "lanzaboote": {
      "inputs": {
        "crane": "crane_4",
-        "flake-compat": "flake-compat_5",
+        "flake-compat": "flake-compat_4",
        "flake-parts": "flake-parts_4",
-        "flake-utils": "flake-utils_6",
+        "flake-utils": "flake-utils_5",
        "nixpkgs": [
          "nixpkgs"
        ],
        "pre-commit-hooks-nix": "pre-commit-hooks-nix",
-        "rust-overlay": "rust-overlay_2"
+        "rust-overlay": "rust-overlay"
      },
      "locked": {
        "lastModified": 1682802423,
@ -853,20 +817,20 @@
    "lix": {
      "flake": false,
      "locked": {
-        "lastModified": 1720626042,
-        "narHash": "sha256-f8k+BezKdJfmE+k7zgBJiohtS3VkkriycdXYsKOm3sc=",
-        "rev": "2a4376be20d70feaa2b0e640c5041fb66ddc67ed",
+        "lastModified": 1729298361,
+        "narHash": "sha256-hiGtfzxFkDc9TSYsb96Whg0vnqBVV7CUxyscZNhed0U=",
+        "rev": "ad9d06f7838a25beec425ff406fe68721fef73be",
        "type": "tarball",
-        "url": "https://git.lix.systems/api/v1/repos/lix-project/lix/archive/2a4376be20d70feaa2b0e640c5041fb66ddc67ed.tar.gz"
+        "url": "https://git.lix.systems/api/v1/repos/lix-project/lix/archive/ad9d06f7838a25beec425ff406fe68721fef73be.tar.gz?rev=ad9d06f7838a25beec425ff406fe68721fef73be"
      },
      "original": {
        "type": "tarball",
-        "url": "https://git.lix.systems/lix-project/lix/archive/2.90.0.tar.gz"
+        "url": "https://git.lix.systems/lix-project/lix/archive/2.91.1.tar.gz"
      }
    },
    "lix-module": {
      "inputs": {
-        "flake-utils": "flake-utils_7",
+        "flake-utils": "flake-utils_6",
        "flakey-profile": "flakey-profile",
        "lix": "lix",
        "nixpkgs": [
@ -874,20 +838,20 @@
        ]
      },
      "locked": {
-        "lastModified": 1720641669,
-        "narHash": "sha256-yEO2cGNgzm9x/XxiDQI+WckSWnZX63R8aJLBRSXtYNE=",
-        "rev": "5c48c833c15bb80d127a398a8c2484d42fdd8257",
+        "lastModified": 1729360442,
+        "narHash": "sha256-6U0CyPycIBc04hbYy2hBINnVso58n/ZyywY2BD3hu+s=",
+        "rev": "9098ac95768f7006d7e070b88bae76939f6034e6",
        "type": "tarball",
-        "url": "https://git.lix.systems/api/v1/repos/lix-project/nixos-module/archive/5c48c833c15bb80d127a398a8c2484d42fdd8257.tar.gz"
+        "url": "https://git.lix.systems/api/v1/repos/lix-project/nixos-module/archive/9098ac95768f7006d7e070b88bae76939f6034e6.tar.gz?rev=9098ac95768f7006d7e070b88bae76939f6034e6"
      },
      "original": {
        "type": "tarball",
-        "url": "https://git.lix.systems/lix-project/nixos-module/archive/2.90.0.tar.gz"
+        "url": "https://git.lix.systems/lix-project/nixos-module/archive/2.91.1-1.tar.gz"
      }
    },
    "mpd-mpris": {
      "inputs": {
-        "flake-utils": "flake-utils_8",
+        "flake-utils": "flake-utils_7",
        "nixpkgs": [
          "nixpkgs"
        ]
@ -924,14 +888,15 @@
    "nix-gaming": {
      "inputs": {
        "flake-parts": "flake-parts_5",
-        "nixpkgs": "nixpkgs_8"
+        "nixpkgs": "nixpkgs_8",
+        "umu": "umu"
      },
      "locked": {
-        "lastModified": 1716686274,
-        "narHash": "sha256-4JiRUWtoEMrfq38jG4O+NP6rcQIhKxEclnSkHvywnf0=",
+        "lastModified": 1723945279,
+        "narHash": "sha256-3W+/u3v/e0dTOxht6wW6pL+kr44e8Amb8A1Z3Bx8BUE=",
        "owner": "fufexan",
        "repo": "nix-gaming",
-        "rev": "83a47c12d3493f7eb876250d0298d1566a965ce4",
+        "rev": "bcf8116981cc332c2734d4c82a034f115780853d",
        "type": "github"
      },
      "original": {
@ -957,11 +922,11 @@
    },
    "nixos-m1": {
      "inputs": {
-        "flake-compat": "flake-compat_6",
+        "flake-compat": "flake-compat_5",
        "nixpkgs": [
          "nixpkgs"
        ],
-        "rust-overlay": "rust-overlay_3"
+        "rust-overlay": "rust-overlay_2"
      },
      "locked": {
        "lastModified": 1700436815,
@ -1013,20 +978,14 @@
    },
    "nixpkgs-lib_2": {
      "locked": {
-        "dir": "lib",
-        "lastModified": 1706550542,
-        "narHash": "sha256-UcsnCG6wx++23yeER4Hg18CXWbgNpqNXcHIo5/1Y+hc=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "97b17f32362e475016f942bbdfda4a4a72a8a652",
-        "type": "github"
+        "lastModified": 1722555339,
+        "narHash": "sha256-uFf2QeW7eAHlYXuDktm9c25OxOyCoUOQmh5SZ9amE5Q=",
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/a5d394176e64ab29c852d03346c1fc9b0b7d33eb.tar.gz"
      },
      "original": {
-        "dir": "lib",
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/a5d394176e64ab29c852d03346c1fc9b0b7d33eb.tar.gz"
      }
    },
    "nixpkgs-stable": {
@ -1063,11 +1022,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1720750130,
-        "narHash": "sha256-y2wc7CdK0vVSIbx7MdVoZzuMcUoLvZXm+pQf2RIr1OU=",
+        "lastModified": 1730272153,
+        "narHash": "sha256-B5WRZYsRlJgwVHIV6DvidFN7VX7Fg9uuwkRW9Ha8z+w=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "6794d064edc69918bb0fc0e0eda33ece324be17a",
+        "rev": "2d2a9ddbe3f2c00747398f3dc9b05f7f2ebb0f53",
        "type": "github"
      },
      "original": {
@ -1079,27 +1038,11 @@
    },
    "nixpkgs_10": {
      "locked": {
-        "lastModified": 1713128889,
-        "narHash": "sha256-aB90ZqzosyRDpBh+rILIcyP5lao8SKz8Sr2PSWvZrzk=",
+        "lastModified": 1724224976,
+        "narHash": "sha256-Z/ELQhrSd7bMzTO8r7NZgi9g5emh+aRKoCdaAv5fiO0=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "2748d22b45a99fb2deafa5f11c7531c212b2cefa",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_11": {
-      "locked": {
-        "lastModified": 1718530797,
-        "narHash": "sha256-pup6cYwtgvzDpvpSCFh1TEUjw2zkNpk8iolbKnyFmmU=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "b60ebf54c15553b393d144357375ea956f89e9a9",
+        "rev": "c374d94f1536013ca8e92341b540eba4c22f9c62",
        "type": "github"
      },
      "original": {
@ -1159,11 +1102,11 @@
    },
    "nixpkgs_5": {
      "locked": {
-        "lastModified": 1696261572,
-        "narHash": "sha256-s8TtSYJ1LBpuITXjbPLUPyxzAKw35LhETcajJjCS5f0=",
+        "lastModified": 1722640603,
+        "narHash": "sha256-TcXjLVNd3VeH1qKPH335Tc4RbFDbZQX+d7rqnDUoRaY=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "0c7ffbc66e6d78c50c38e717ec91a2a14e0622fb",
+        "rev": "81610abc161d4021b29199aa464d6a1a521e0cc9",
        "type": "github"
      },
      "original": {
@ -1191,11 +1134,11 @@
    },
    "nixpkgs_7": {
      "locked": {
-        "lastModified": 1719075281,
-        "narHash": "sha256-CyyxvOwFf12I91PBWz43iGT1kjsf5oi6ax7CrvaMyAo=",
+        "lastModified": 1728492678,
+        "narHash": "sha256-9UTxR8eukdg+XZeHgxW5hQA9fIKHsKCdOIUycTryeVw=",
        "owner": "nixOS",
        "repo": "nixpkgs",
-        "rev": "a71e967ef3694799d0c418c98332f7ff4cc5f6af",
+        "rev": "5633bcff0c6162b9e4b5f1264264611e950c8ec7",
        "type": "github"
      },
      "original": {
@ -1207,11 +1150,11 @@
    },
    "nixpkgs_8": {
      "locked": {
-        "lastModified": 1708751719,
-        "narHash": "sha256-0uWOKSpXJXmXswOvDM5Vk3blB74apFB6rNGWV5IjoN0=",
+        "lastModified": 1723856861,
+        "narHash": "sha256-OTDg91+Zzs2SpU3csK4xVdSQFoG8cK1lNUwKmTqERyE=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "f63ce824cd2f036216eb5f637dfef31e1a03ee89",
+        "rev": "cd7b95ee3725af7113bacbce91dd6549cee58ca5",
        "type": "github"
      },
      "original": {
@ -1223,11 +1166,11 @@
    },
    "nixpkgs_9": {
      "locked": {
-        "lastModified": 1720954236,
-        "narHash": "sha256-1mEKHp4m9brvfQ0rjCca8P1WHpymK3TOr3v34ydv9bs=",
+        "lastModified": 1730137625,
+        "narHash": "sha256-9z8oOgFZiaguj+bbi3k4QhAD6JabWrnv7fscC/mt0KE=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "53e81e790209e41f0c1efa9ff26ff2fd7ab35e27",
+        "rev": "64b80bfb316b57cdb8919a9110ef63393d74382a",
        "type": "github"
      },
      "original": {
@ -1237,21 +1180,6 @@
        "type": "github"
      }
    },
-    "nur": {
-      "locked": {
-        "lastModified": 1697363080,
-        "narHash": "sha256-/49Rh5mohp0ZD6HaNbDn9oIsLt+d7Tzbc/BGkb/7o+g=",
-        "owner": "nix-community",
-        "repo": "NUR",
-        "rev": "5771ba6f22db037b037a8bdd82acc5467c965c7e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "NUR",
-        "type": "github"
-      }
-    },
    "pre-commit-hooks-nix": {
      "inputs": {
        "flake-compat": [
@ -1291,7 +1219,7 @@
        "darwin": "darwin",
        "deploy-rs": "deploy-rs",
        "dtth-phanpy": "dtth-phanpy",
-        "flake-utils": "flake-utils_5",
+        "flake-utils": "flake-utils_4",
        "home-manager": "home-manager",
        "home-manager-unstable": "home-manager-unstable",
        "kak-lsp": "kak-lsp",
@ -1304,10 +1232,9 @@
        "nixos-m1": "nixos-m1",
        "nixpkgs": "nixpkgs_9",
        "nixpkgs-unstable": "nixpkgs-unstable",
-        "nur": "nur",
+        "rust-overlay": "rust-overlay_3",
        "secrets": "secrets",
        "sops-nix": "sops-nix",
-        "swayfx": "swayfx",
        "youmubot": "youmubot"
      }
    },
@ -1329,31 +1256,6 @@
      }
    },
    "rust-overlay": {
-      "inputs": {
-        "flake-utils": [
-          "crane",
-          "flake-utils"
-        ],
-        "nixpkgs": [
-          "crane",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1696299134,
-        "narHash": "sha256-RS77cAa0N+Sfj5EmKbm5IdncNXaBCE1BSSQvUE8exvo=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "611ccdceed92b4d94ae75328148d84ee4a5b462d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
-    "rust-overlay_2": {
      "inputs": {
        "flake-utils": [
          "lanzaboote",
@ -1378,7 +1280,7 @@
        "type": "github"
      }
    },
-    "rust-overlay_3": {
+    "rust-overlay_2": {
      "flake": false,
      "locked": {
        "lastModified": 1686795910,
@ -1394,27 +1296,50 @@
        "type": "github"
      }
    },
-    "scenefx": {
+    "rust-overlay_3": {
      "inputs": {
-        "nixpkgs": "nixpkgs_10"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
      },
      "locked": {
-        "lastModified": 1715160751,
-        "narHash": "sha256-S8m7phTU7QYgAq4B0hjH5WdtTjHDcNVhYfPFdhbty+A=",
-        "owner": "wlrfx",
-        "repo": "scenefx",
-        "rev": "2ec3505248e819191c37cb831197629f373326fb",
+        "lastModified": 1724466314,
+        "narHash": "sha256-ltKuK6shQ64uej1mYNtBsDYxttUNFiv9AcHqk0+0NQM=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "2b5b3edd96ef336b00622dcabc13788fdef9e3ca",
        "type": "github"
      },
      "original": {
-        "owner": "wlrfx",
-        "repo": "scenefx",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "rust-overlay_4": {
+      "inputs": {
+        "nixpkgs": [
+          "youmubot",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1724466314,
+        "narHash": "sha256-ltKuK6shQ64uej1mYNtBsDYxttUNFiv9AcHqk0+0NQM=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "2b5b3edd96ef336b00622dcabc13788fdef9e3ca",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
        "type": "github"
      }
    },
    "secrets": {
      "inputs": {
-        "flake-utils": "flake-utils_9"
+        "flake-utils": "flake-utils_8"
      },
      "locked": {
        "lastModified": 1693981285,
@ -1453,27 +1378,6 @@
        "type": "github"
      }
    },
-    "swayfx": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "scenefx": "scenefx"
-      },
-      "locked": {
-        "lastModified": 1715273144,
-        "narHash": "sha256-x8z/sjtJPojvaXiOUDvADiSU/QmSo8cqKQ1X4g+5dw4=",
-        "owner": "WillPower3309",
-        "repo": "swayfx",
-        "rev": "3c621dec7d653231f960d377fcb3ceeed55953e2",
-        "type": "github"
-      },
-      "original": {
-        "owner": "WillPower3309",
-        "repo": "swayfx",
-        "type": "github"
-      }
-    },
    "systems": {
      "locked": {
        "lastModified": 1681028828,
@ -1594,24 +1498,34 @@
        "type": "github"
      }
    },
-    "systems_9": {
+    "umu": {
+      "inputs": {
+        "nixpkgs": [
+          "nix-gaming",
+          "nixpkgs"
+        ]
+      },
      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
+        "dir": "packaging/nix",
+        "lastModified": 1723697867,
+        "narHash": "sha256-LTfbJXR8x35oZ8Mo3R0WTVEp9toWpVfzD21xCSr64IM=",
+        "ref": "refs/heads/main",
+        "rev": "c71a45ad53036f4c668bcbe1be7a49f9d3460151",
+        "revCount": 699,
+        "submodules": true,
+        "type": "git",
+        "url": "https://github.com/Open-Wine-Components/umu-launcher/"
      },
      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
+        "dir": "packaging/nix",
+        "submodules": true,
+        "type": "git",
+        "url": "https://github.com/Open-Wine-Components/umu-launcher/"
      }
    },
    "utils": {
      "inputs": {
-        "systems": "systems_3"
+        "systems": "systems_2"
      },
      "locked": {
        "lastModified": 1701680307,
@ -1630,15 +1544,16 @@
    "youmubot": {
      "inputs": {
        "crane": "crane_5",
-        "flake-utils": "flake-utils_10",
-        "nixpkgs": "nixpkgs_11"
+        "flake-utils": "flake-utils_9",
+        "nixpkgs": "nixpkgs_10",
+        "rust-overlay": "rust-overlay_4"
      },
      "locked": {
-        "lastModified": 1720930588,
-        "narHash": "sha256-Ue3ZRLUU/VoN0SUOCcAwR5LZJac9UgaSA9To//rP7fU=",
+        "lastModified": 1730740980,
+        "narHash": "sha256-Z/RLbhlBxdNPZt/DeROPBV7bLQgpmamjcB0rdQrQoNw=",
        "owner": "natsukagami",
        "repo": "youmubot",
-        "rev": "dc02b4b7e280a8d5f129b5f43636407a2e4b96ea",
+        "rev": "803d718c7ad34d3780ae6c2911ca0682b2417cc4",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@ -15,7 +15,6 @@
    sops-nix.inputs.nixpkgs.follows = "nixpkgs-unstable";
    sops-nix.inputs.nixpkgs-stable.follows = "nixpkgs";
    deploy-rs.url = "github:Serokell/deploy-rs";
-    nur.url = "github:nix-community/NUR";

    # --- Secure boot
    lanzaboote = {
@ -26,25 +25,29 @@
    # --- Build tools
    flake-utils.url = github:numtide/flake-utils;
    crane.url = github:ipetkov/crane;
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
    arion.url = github:hercules-ci/arion;
    lix-module = {
-      url = "https://git.lix.systems/lix-project/nixos-module/archive/2.90.0.tar.gz";
+      url = "https://git.lix.systems/lix-project/nixos-module/archive/2.91.1-1.tar.gz";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    # ---
    # Imported apps
    youmubot.url = "github:natsukagami/youmubot";
-    swayfx = {
-      url = github:WillPower3309/swayfx;
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
+    # swayfx = {
+    #   url = github:WillPower3309/swayfx;
+    #   inputs.nixpkgs.follows = "nixpkgs";
+    # };
    mpd-mpris = {
      url = github:natsukagami/mpd-mpris;
      inputs.nixpkgs.follows = "nixpkgs";
    };
-    dtth-phanpy.url = "git+ssh://gitea@git.dtth.ch/nki/phanpy?branch=dtth-fork";
-    conduit.url = "gitlab:famedly/conduit/v0.8.0";
+    dtth-phanpy.url = "git+ssh://gitea@git.dtth.ch/nki/phanpy?ref=dtth-fork";
+    conduit.url = "gitlab:famedly/conduit/v0.9.0";
    nix-gaming.url = github:fufexan/nix-gaming;

    # --- Sources
@ -60,7 +63,7 @@
    secrets.url = "git+ssh://git@github.com/natsukagami/nix-deploy-secrets";
  };

-  outputs = { self, darwin, nixpkgs, nixpkgs-unstable, home-manager, deploy-rs, sops-nix, nur, ... }@inputs:
+  outputs = { self, darwin, nixpkgs, nixpkgs-unstable, home-manager, deploy-rs, sops-nix, ... }@inputs:
    let
      overlays = import ./overlay.nix inputs;
      lib = nixpkgs.lib;
@ -85,6 +88,20 @@
          trusted-public-keys = [ "nix-gaming.cachix.org-1:nbjlureqMbRAxR1gJ/f3hxemL9svXaZF/Ees8vCUUs4=" ];
        };
        environment.systemPackages = [ inputs.nix-gaming.packages.${pkgs.hostPlatform.system}.osu-stable ];
+        programs.gamemode = {
+          enable = true;
+          enableRenice = true;
+          settings = {
+            general = {
+              renice = 10;
+            };
+
+            custom = {
+              start = "${pkgs.libnotify}/bin/notify-send 'GameMode started'";
+              end = "${pkgs.libnotify}/bin/notify-send 'GameMode ended'";
+            };
+          };
+        };
      };

      # Common Nix modules
--- a/home/common.nix
+++ b/home/common.nix
@ -9,13 +9,6 @@
    ./modules/programs/my-kitty
    ./modules/programs/openconnect-epfl.nix
    ./common-linux.nix
-
-    # PATH Overrides
-    ({ config, lib, ... }: {
-      home.sessionPath = lib.mkBefore [
-        "${config.home.homeDirectory}/.bin/overrides"
-      ];
-    })
  ];

  # Let Home Manager install and manage itself.
@ -35,6 +28,7 @@
    fx # JSON viewer
    glow # Markdown viewer
    nix-output-monitor # Nice nix output formatting
+    unstable.scala-next
    ## PDF Processors
    poppler_utils
    ## htop replacement
--- a/home/config.nix
+++ b/home/config.nix
@ -1,8 +1,3 @@
 {
  allowUnfree = true;
-  packageOverrides = pkgs: {
-    nur = import (builtins.fetchTarball "https://github.com/nix-community/NUR/archive/master.tar.gz") {
-      inherit pkgs;
-    };
-  };
 }
--- a/home/fish/fish.nix
+++ b/home/fish/fish.nix
@ -53,8 +53,7 @@ in
    functions = {
      rebuild = {
        body = ''
-          command sudo -v && \
-          command sudo nixos-rebuild --flake ~/.config/nixpkgs -L --log-format internal-json -v $argv \
+          pls nixos-rebuild --flake ~/.config/nixpkgs -L --log-format internal-json -v $argv \
            &| ${pkgs.nix-output-monitor}/bin/nom --json
        '';
        wraps = "nixos-rebuild";
@ -62,19 +61,18 @@ in
      # Simplify nix usage!
      nx = {
        body = ''
-          set impure
-          if test $argv[1] = "--impure"
-            set impure "--impure"
-            set argv $argv[2..]
-          end
-          if test (count $argv) -gt 0
-            nix run $impure nixpkgs#$argv[1] -- $argv[2..]
-          else
-            echo "nx [--impure] {package} [args...]"
+          argparse -s 'h/help' 'impure' 'u/unstable' 'g/git' -- $argv
+          if set -q _flag_help || test (count $argv) -eq 0
+            echo "nx [--impure] [-u/--unstable/-g/--git] {package} [args...]"
            return 1
+          else
+            set -q _flag_impure && set impure "--impure"
+            set nixpkgs "nixpkgs"
+            set -q _flag_unstable && set nixpkgs "nixpkgs-unstable"
+            set -q _flag_git && set nixpkgs "github:nixOS/nixpkgs/nixpkgs-unstable"
+            nix run $impure $nixpkgs"#"$argv[1] -- $argv[2..]
          end
        '';
-        wraps = "nix run";
        description = "Runs an app from the nixpkgs store.";
      };

@ -82,25 +80,35 @@ in
        description = "Spawns a shell from the given nixpkgs packages";
        wraps = "nix shell";
        body = ''
-          set impure
-          if test $argv[1] = "--impure"
-            set impure "--impure"
-            set argv $argv[2..]
+          function help
+            echo "nsh [--impure] [--impure] [-u/--unstable/-g/--git] {package}* [-c command args...]"
          end
-          if test (count $argv) -gt 0
-            set minusc (contains -i -- "-c" $argv)
-            if test -z $minusc
-              nix shell $impure nixpkgs#$argv -c fish
-            else if test $minusc -eq (count $argv)
-              echo "nsh [--impure] {packages} [-c command args...]"
+          argparse -s 'h/help' 'impure' 'u/unstable' 'g/git' -- $argv
+          if set -q _flag_help || test (count $argv) -eq 0
+            help
+            return 0
+          end
+          set packages $argv
+          set minusc (contains -i -- "-c" $argv)
+          if test -n "$minusc"
+            if test $minusc -eq 1
+              help
              return 1
-            else
-              nix shell $impure nixpkgs#$argv[..(math $minusc - 1)] $argv[$minusc..]
            end
+            set packages $argv[..(math $minusc - 1)]
+            set argv $argv[(math $minusc + 1)..]
          else
-            echo "nsh [--impure] {packages} [-c command args...]"
+            set argv "fish" "-i"
+          end
+          if test (count $packages) -eq 0
+            help
            return 1
          end
+          set -q _flag_impure && set impure "--impure"
+          set nixpkgs "nixpkgs"
+          set -q _flag_unstable && set nixpkgs "nixpkgs-unstable"
+          set -q _flag_git && set nixpkgs "github:nixOS/nixpkgs/nixpkgs-unstable"
+          nix shell $impure $nixpkgs"#"$packages --command $argv
        '';
      };
      # Grep stuff
@ -118,6 +126,30 @@ in
      };
      echo-today = "date +%F";
      newfile = "mkdir -p (dirname $argv[-1]) && touch $argv";
+
+      # pls
+      pls = {
+        wraps = "sudo";
+        body = ''
+          set -l cmd "`"(string join " " -- $argv)"`"
+          echo "I-It's not like I'm gonna run "$cmd" for you or a-anything! Baka >:C" >&2
+          # Send a notification on password prompt
+          if command sudo -vn 2>/dev/null
+              # nothing to do, user already authenticated
+          else
+              # throw a notification
+              set notif_id (kitten notify -P \
+                -p ${./haruka.png} \
+                -a "pls" \
+                -u critical \
+                "A-a command requires your p-password" \
+                (printf "I-I need your p-password to r-run the following c-command:\n\n%s" $cmd))
+              command sudo -v -p "P-password please: "
+              kitten notify -i $notif_id ""
+          end
+          command sudo $argv
+        '';
+      };
    };


@ -146,6 +178,9 @@ in
      if test -e /opt/homebrew/bin/brew
        /opt/homebrew/bin/brew shellenv | source
      end
+
+      # Override PATH
+      set --export --prepend PATH ~/.bin/overrides ~/.local/bin
    '';

    interactiveShellInit = ''
@ -250,8 +285,8 @@ in
      target = ".config/fish/conf.d/change_cmd.fish";
    };
    "fish/pls.fish" = {
-      source = ./. + "/pls.fish";
-      target = ".config/fish/conf.d/pls.fish";
+      source = ./pls_extra.fish;
+      target = ".config/fish/conf.d/pls_extra.fish";
    };
  };
 }
--- a/home/fish/haruka.png
+++ b/home/fish/haruka.png
--- a/home/fish/pls.fish
+++ b/home/fish/pls.fish
@ -1,155 +0,0 @@
-alias sue="pls -e"
-
-function pls
-    set -l cmd "`"(string join " " -- $argv)"`"
-    echo "I-It's not like I'm gonna run "$cmd" for you or a-anything! Baka >:C" >&2
-    # Send a notification on password prompt
-    if command sudo -vn 2>/dev/null
-        # nothing to do, user already authenticated
-    else
-        # throw a notification
-        # notify-send -t 3000 -u critical -i ~/Downloads/harukablush.jpg -h "STRING:command:"$cmd "A-a command requires your p-password" (printf "I-I need your p-password to r-run the following c-command: %s" $cmd)
-    end        
-    command sudo $argv
-end
-
-function sudo
-    echo "Not polite enough."
-end
-
-function __fish_prepend_pls -d "Prepend 'pls ' to the beginning of the current commandline"
-    # If there is no commandline, insert the last item from history
-    # and *then* toggle
-    if not commandline | string length -q
-        commandline -r "$history[1]"
-    end
-
-    set -l cmd (commandline -po)
-    set -l cursor (commandline -C)
-
-    if test "$cmd[1]" = e
-        commandline -C 0
-        commandline -i "su"
-        commandline -C (math $cursor + 2)
-    else if test "$cmd[1]" = sue
-        commandline -r (string sub --start=3 (commandline -p))
-        commandline -C -- (math $cursor - 2)
-    else if test "$cmd[1]" != pls
-        commandline -C 0
-        commandline -i "pls "
-        commandline -C (math $cursor + 4)
-    else
-        commandline -r (string sub --start=5 (commandline -p))
-        commandline -C -- (math $cursor - 4)
-    end
-end
-
-bind --preset -e -M insert \es
-bind -M insert \es __fish_prepend_pls
-
-function __fish_man_page
-    # Get all commandline tokens not starting with "-"
-    set -l args (commandline -po | string match -rv '^-')
-
-    # If commandline is empty, exit.
-    if not set -q args[1]
-        printf \a
-        return
-    end
-
-    #Skip `pls` and display then manpage of following command
-    while set -q args[2]
-        and string match -qr -- '^(pls|.*=.*)$' $args[1]
-        set -e args[1]
-    end
-
-    # If there are at least two tokens not starting with "-", the second one might be a subcommand.
-    # Try "man first-second" and fall back to "man first" if that doesn't work out.
-    set -l maincmd (basename $args[1])
-    if set -q args[2]
-        # HACK: If stderr is not attached to a terminal `less` (the default pager)
-        # wouldn't use the alternate screen.
-        # But since we don't know what pager it is, and because `man` is totally underspecified,
-        # the best we can do is to *try* the man page, and assume that `man` will return false if it fails.
-        # See #7863.
-        if man "$maincmd-$args[2]" &>/dev/null
-            man "$maincmd-$args[2]"
-        else if man "$maincmd" &>/dev/null
-            man "$maincmd"
-        else
-            printf \a
-        end
-    else
-        if man "$maincmd" &>/dev/null
-            man "$maincmd"
-        else
-            printf \a
-        end
-    end
-
-    commandline -f repaint
-end
-
-#
-# Completion for pls
-#
-
-function __fish_pls_print_remaining_args
-    set -l tokens (commandline -opc) (commandline -ct)
-    set -e tokens[1]
-    # These are all the options mentioned in the man page for Todd Miller's "pls.ws" pls (in that order).
-    # If any other implementation has different options, this should be harmless, since they shouldn't be used anyway.
-    set -l opts A/askpass b/background C/close-from= E/preserve-env='?'
-    # Note that "-h" is both "--host" (which takes an option) and "--help" (which doesn't).
-    # But `-h` as `--help` only counts when it's the only argument (`pls -h`),
-    # so any argument completion after that should take it as "--host".
-    set -a opts e/edit g/group= H/set-home h/host= 1-help
-    set -a opts i/login K/remove-timestamp k/reset-timestamp l/list n/non-interactive
-    set -a opts P/preserve-groups p/prompt= S/stdin s/shell U/other-user=
-    set -a opts u/user= T/command-timeout= V/version v/validate
-    argparse -s $opts -- $tokens 2>/dev/null
-    # The remaining argv is the subcommand with all its options, which is what
-    # we want.
-    if test -n "$argv"
-        and not string match -qr '^-' $argv[1]
-        string join0 -- $argv
-        return 0
-    else
-        return 1
-    end
-end
-
-function __fish_pls_no_subcommand
-    not __fish_pls_print_remaining_args >/dev/null
-end
-
-function __fish_complete_pls_subcommand
-    set -l args (__fish_pls_print_remaining_args | string split0)
-    set -lx -a PATH /usr/local/sbin /sbin /usr/sbin
-    __fish_complete_subcommand --commandline $args
-end
-
-# All these options should be valid for GNU and OSX pls
-complete -c pls -n __fish_no_arguments -s h -d "Display help and exit"
-complete -c pls -n __fish_no_arguments -s V -d "Display version information and exit"
-complete -c pls -n __fish_pls_no_subcommand -s A -d "Ask for password via the askpass or \$SSH_ASKPASS program"
-complete -c pls -n __fish_pls_no_subcommand -s C -d "Close all file descriptors greater or equal to the given number" -xa "0 1 2 255"
-complete -c pls -n __fish_pls_no_subcommand -s E -d "Preserve environment"
-complete -c pls -n __fish_pls_no_subcommand -s H -d "Set home"
-complete -c pls -n __fish_pls_no_subcommand -s K -d "Remove the credential timestamp entirely"
-complete -c pls -n __fish_pls_no_subcommand -s P -d "Preserve group vector"
-complete -c pls -n __fish_pls_no_subcommand -s S -d "Read password from stdin"
-complete -c pls -n __fish_pls_no_subcommand -s b -d "Run command in the background"
-complete -c pls -n __fish_pls_no_subcommand -s e -rF -d Edit
-complete -c pls -n __fish_pls_no_subcommand -s g -a "(__fish_complete_groups)" -x -d "Run command as group"
-complete -c pls -n __fish_pls_no_subcommand -s i -d "Run a login shell"
-complete -c pls -n __fish_pls_no_subcommand -s k -d "Reset or ignore the credential timestamp"
-complete -c pls -n __fish_pls_no_subcommand -s l -d "List the allowed and forbidden commands for the given user"
-complete -c pls -n __fish_pls_no_subcommand -s n -d "Do not prompt for a password - if one is needed, fail"
-complete -c pls -n __fish_pls_no_subcommand -s p -d "Specify a custom password prompt"
-complete -c pls -n __fish_pls_no_subcommand -s s -d "Run the given command in a shell"
-complete -c pls -n __fish_pls_no_subcommand -s u -a "(__fish_complete_users)" -x -d "Run command as user"
-complete -c pls -n __fish_pls_no_subcommand -s v -n __fish_no_arguments -d "Validate the credentials, extending timeout"
-
-# Complete the command we are executed under pls
-complete -c pls -x -n 'not __fish_seen_argument -s e' -a "(__fish_complete_pls_subcommand)"
--- a/home/fish/pls_extra.fish
+++ b/home/fish/pls_extra.fish
@ -0,0 +1,47 @@
+alias sue="pls -e"
+
+function sudo
+    echo "Not polite enough."
+end
+
+bind --preset -M visual \es 'fish_commandline_prepend pls'
+bind -M insert \es 'fish_commandline_prepend pls'
+
+function __fish_man_page
+    # Get all commandline tokens not starting with "-", up to and including the cursor's
+    set -l args (string match -rv '^-|^$' -- (commandline -cpx && commandline -t))
+
+    # If commandline is empty, exit.
+    if not set -q args[1]
+        printf \a
+        return
+    end
+
+    # Skip leading commands and display the manpage of following command
+    while set -q args[2]
+        and string match -qr -- '^(and|begin|builtin|caffeinate|command|doas|entr|env|exec|if|mosh|nice|not|or|pipenv|prime-run|setsid|sudo|pls|systemd-nspawn|time|watch|while|xargs|.*=.*)$' $args[1]
+        set -e args[1]
+    end
+
+    # If there are at least two tokens not starting with "-", the second one might be a subcommand.
+    # Try "man first-second" and fall back to "man first" if that doesn't work out.
+    set -l maincmd (path basename $args[1])
+    # HACK: If stderr is not attached to a terminal `less` (the default pager)
+    # wouldn't use the alternate screen.
+    # But since we don't know what pager it is, and because `man` is totally underspecified,
+    # the best we can do is to *try* the man page, and assume that `man` will return false if it fails.
+    # See #7863.
+    if set -q args[2]
+        and not string match -q -- '*/*' $args[2]
+        and man "$maincmd-$args[2]" &>/dev/null
+        man "$maincmd-$args[2]"
+    else
+        if man "$maincmd" &>/dev/null
+            man "$maincmd"
+        else
+            printf \a
+        end
+    end
+
+    commandline -f repaint
+end
--- a/home/kakoune/kak.nix
+++ b/home/kakoune/kak.nix
@ -272,7 +272,7 @@ in
            # override inherited files
            cat ${tree-sitter-go}/queries/highlights.scm ${src}/queries/templ/highlights.scm > $out/queries/highlights.scm
          '';
-          queries.path = "queries/templ";
+          queries.path = "queries";
        };

      go = {
@ -282,6 +282,23 @@ in
        queries.src = tree-sitter-go;
        queries.path = "queries";
      };
+
+      hylo =
+        let
+          src = pkgs.fetchFromGitHub {
+            owner = "natsukagami";
+            repo = "tree-sitter-hylo";
+            rev = "494cbdff0d13cbc67348316af2efa0286dbddf6f";
+            hash = "sha256-R5UeoglCTl0do3VDJ/liCTeqbxU9slvmVKNRA/el2VY=";
+          };
+        in
+        {
+          grammar.src = src;
+          grammar.compile.args = [ "-c" "-fpic" "../parser.c" "-I" ".." ];
+          grammar.link.args = [ "-shared" "-fpic" "parser.o" ];
+          queries.src = src;
+          queries.path = "queries";
+        };
    };

  programs.my-kakoune.package = pkgs.kakoune;
--- a/home/kakoune/kakrc
+++ b/home/kakoune/kakrc
@ -64,6 +64,12 @@ hook global InsertChar \t %{ exec -draft -itersel h@ }
 set global tabstop 2
 set global indentwidth 2

+# Language-specific tabstop with override
+hook global WinSetOption filetype=(rust) %{
+  set window tabstop 4
+  set window indentwidth 4
+}
+
 # Ctrl + a in insert mode = esc
 map global insert <c-a> '<esc>'

@ -152,9 +158,6 @@ hook global WinSetOption filetype=(rust) %{
 hook global WinSetOption filetype=(scala) %{
    # Format the document if possible
    hook -group scala-fmt window BufWritePre .* %{ lsp-formatting-sync }
-
-    set window tabstop 2
-    set window indentwidth 2
 }

 hook global WinSetOption filetype=(typst) %{
@ -214,7 +217,12 @@ hook global BufCreate .*[.]typ %{

 hook global BufCreate .*[.]templ %{
  set-option buffer filetype templ
-  set-option window comment_line "//"
+  set-option buffer comment_line "//"
+}
+
+hook global BufCreate .*[.]hylo %{
+  set-option buffer filetype hylo
+  set-option buffer comment_line "//"
 }

 hook global BufOpenFile .* %{
--- a/home/modules/linux/graphical/default.nix
+++ b/home/modules/linux/graphical/default.nix
@ -3,6 +3,7 @@ with lib;
 let
  cfg = config.linux.graphical;

+  thunderbird = pkgs.thunderbird-128;
  vscode = with pkgs; if stdenv.isAarch64 then unstable.vscode else unstable.vscode-fhs;

  wifi-indicator = pkgs.writeScriptBin "wifi-indicator" ''
@ -57,23 +58,25 @@ in
      feh # For images?
      deluge # Torrent client
      pavucontrol # PulseAudio control panel
-      cinnamon.nemo # File manager
      thunderbird # Email
      sublime-music # For navidrome
-      cinny-desktop
+      # cinny-desktop
      gajim
      vivaldi
      # Audio
      qpwgraph # Pipewire graph

-      zotero_7
+      unstable.zotero
      libreoffice

      mpv # for anki
      anki-bin

+      # Chat stuff
      tdesktop
      whatsapp-for-linux
+      slack
+      zoom-us

      librewolf

@ -82,11 +85,7 @@ in
      # sct # Display color temperature
      xdg-utils # Open stuff
      wifi-indicator
-    ] ++ (if pkgs.stdenv.isAarch64 then [ ] else [
-      gnome.cheese # Webcam check, expensive
-      # Chat stuff
-      slack
-    ]));
+    ]);

    nki.programs.discord.enable = pkgs.stdenv.isx86_64;
    nki.programs.discord.package = pkgs.vesktop;
--- a/home/modules/linux/graphical/wayland.nix
+++ b/home/modules/linux/graphical/wayland.nix
@ -14,7 +14,7 @@ let
      systemd.user.services.swaync.Unit.PartOf = lib.mkForce [ "sway-session.target" ];

      programs.my-sway.waybar = {
-        extraSettings = {
+        extraSettings = [{
          modules-right = mkAfter [ "custom/swaync" ];
          modules."custom/swaync" = {
            tooltip = false;
@ -36,7 +36,7 @@ let
            on-click-right = "${swaync}/bin/swaync-client -d -sw";
            escape = true;
          };
-        };
+        }];
        extraStyle = mkAfter ''
          #custom-swaync {
              background: #F0FFFF;
--- a/home/modules/programs/my-kitty/default.nix
+++ b/home/modules/programs/my-kitty/default.nix
@ -2,11 +2,20 @@

 let
  cfg = config.nki.programs.kitty;
-  cmd = if pkgs.stdenv.isDarwin then "cmd" else "ctrl";
+
+  theme = { lib, options, config, ... }: {
+    programs.kitty = lib.mkIf config.nki.programs.kitty.enable (
+      if builtins.hasAttr "themeFile" options.programs.kitty then {
+        themeFile = "ayu_light";
+      } else {
+        theme = "Ayu Light";
+      }
+    );
+  };
 in
 with lib;
 {
-  imports = [ ./darwin.nix ./linux.nix ./tabs.nix ];
+  imports = [ theme ./darwin.nix ./linux.nix ./tabs.nix ];

  options.nki.programs.kitty = {
    enable = mkEnableOption "Enable kitty";
@ -51,8 +60,6 @@ with lib;
    font.name = "Fantasque Sans Mono";
    font.size = cfg.fontSize;

-    theme = "Ayu Light";
-
    settings =
      let
        # Background color and transparency
--- a/home/modules/programs/my-sway/default.nix
+++ b/home/modules/programs/my-sway/default.nix
@ -1,4 +1,4 @@
-{ pkgs, lib, options, config, ... }:
+{ pkgs, lib, options, config, osConfig, ... }:
 with lib;
 let
  cfg = config.programs.my-sway;
@ -110,12 +110,12 @@ in
        default = barWith: [ (barWith { }) ];
      };
      extraSettings = mkOption {
-        type = types.raw;
+        type = types.listOf types.raw;
        description = "Extra settings to be included with every default bar";
-        default = { };
+        default = [ ];
      };
      extraStyle = mkOption {
-        type = types.str;
+        type = types.lines;
        description = "Additional style for the default waybar";
        default = "";
      };
@ -129,8 +129,11 @@ in
      "PATH" # for portals
      "XDG_DATA_DIRS" # For extra icons
      "XDG_DATA_HOME" # For extra icons
+    ] ++ lib.optionals osConfig.services.desktopManager.plasma6.enable [
+      "XDG_MENU_PREFIX"
    ];
-    systemd.extraCommands = options.wayland.windowManager.sway.systemd.extraCommands.default ++ [
+    systemd.extraCommands = options.wayland.windowManager.sway.systemd.extraCommands.default
+      ++ [
      "systemctl --user restart xdg-desktop-portal.service"
    ];

@ -358,7 +361,9 @@ in
        eval `gnome-keyring-daemon`
        export SSH_AUTH_SOCK
      fi
-    '' else "");
+    '' else "") + lib.optionalString osConfig.services.desktopManager.plasma6.enable ''
+      export XDG_MENU_PREFIX=plasma-
+    '';
    # Extra
    wrapperFeatures.base = true;
    wrapperFeatures.gtk = true;
@ -409,7 +414,7 @@ in

  config.programs.waybar =
    let
-      barWith = { showMedia ? true, showConnectivity ? true, extraSettings ? { }, ... }: (mkMerge [{
+      barWith = { showMedia ? true, showConnectivity ? true, extraSettings ? { }, ... }: mkMerge ([{
        position = "top";
        modules-left = [
          "sway/workspaces"
@ -420,7 +425,7 @@ in
        ];
        modules-right =
          lib.optional showMedia (if cfg.enableMpd then "mpd" else "custom/media")
-          ++ [
+            ++ [
            "tray"
            "pulseaudio"
          ] ++ lib.optionals showConnectivity [
@ -431,7 +436,7 @@ in
            "memory"
            "temperature"
          ] ++ lib.optionals cfg.enableLaptopBars [ "battery" "battery#bat2" ]
-          ++ [
+            ++ [
            "clock"
          ];

@ -598,9 +603,9 @@ in
            "on-click" = "${playerctl} play-pause";
          };
        };
-      }
-        cfg.waybar.extraSettings
-        extraSettings]);
+      }] ++
+      cfg.waybar.extraSettings
+      ++ [ extraSettings ]);
    in
    mkIf cfg.enable {
      enable = true;
--- a/home/modules/programs/openconnect-epfl.nix
+++ b/home/modules/programs/openconnect-epfl.nix
@ -4,13 +4,15 @@ let
    name = "openconnect-epfl";
    runtimeInputs = with pkgs; [ openconnect rbw ];
    text = ''
-      GASPAR_PASSWORD=$(rbw get gaspar)
-      GASPAR_TOKEN=$(rbw code gaspar)
+      METHOD="Microsoft Entra ID"
+      RBW_ENTRY="EPFL Microsoft Auth"
+      GASPAR_PASSWORD=$(rbw get "$RBW_ENTRY")
+      GASPAR_TOKEN=$(rbw code "$RBW_ENTRY")

-      printf "%s\n%s\n" "$GASPAR_PASSWORD" "$GASPAR_TOKEN" | sudo openconnect \
+      printf "\n%s\n%s\n%s\n" "$METHOD" "$GASPAR_PASSWORD" "$GASPAR_TOKEN" | command sudo openconnect \
          --passwd-on-stdin \
-          -u pham \
-           --useragent='AnyConnect' \
+          -u "pham" \
+          --useragent='AnyConnect' \
          "https://vpn.epfl.ch"
    '';
  };
--- a/home/nki-framework.nix
+++ b/home/nki-framework.nix
@ -48,6 +48,21 @@
      tap = "enabled";
    };
  };
+  programs.my-sway.waybar.extraSettings =
+    let
+      change-mode = pkgs.writeScript "change-mode" ''
+        #!/usr/bin/env ${lib.getExe pkgs.fish}
+        set -ax PATH ${lib.getBin pkgs.power-profiles-daemon} ${lib.getBin pkgs.rofi} ${lib.getBin pkgs.ripgrep}
+
+        set profiles (powerprofilesctl list | rg "^[ *] (\S+):" -r '$1')
+        set selected_index (math (contains -i (powerprofilesctl get) $profiles) - 1)
+        set new_profile (printf "%s\n" $profiles | rofi -dmenu -p "Switch to power profile" -a $selected_index)
+        powerprofilesctl set $new_profile
+      '';
+    in
+    [{
+      modules."battery"."on-click" = change-mode;
+    }];

  # input-remapping
  xdg.configFile."autostart/input-remapper-autoload.desktop".source =
@ -61,16 +76,32 @@
  # Multiple screen setup
  services.kanshi = with config.common.monitors; {
    enable = true;
-    profiles.undocked.outputs = [{
-      criteria = "eDP-1";
-    }];
-    profiles.work-both.outputs = [
-      { criteria = "eDP-1"; position = "0,${toString (builtins.floor ((2160 / work.scale - 1200) + 1200 / 3))}"; status = "enable"; }
-      { criteria = work.name; position = "1920,0"; }
-    ];
-    profiles.work-one.outputs = [
-      { criteria = "eDP-1"; status = "disable"; }
-      { criteria = config.common.monitors.work.name; }
+    settings = [
+      {
+        profile.name = "undocked";
+        profile.outputs = [{ criteria = "eDP-1"; }];
+      }
+      {
+        profile.name = "work-both";
+        profile.outputs = [
+          {
+            criteria = "eDP-1";
+            position = "0,${toString (builtins.floor ((2160 / work.scale - 1200) + 1200 / 3))}";
+            status = "enable";
+          }
+          { criteria = work.name; position = "1920,0"; }
+        ];
+      }
+      {
+        profile.name = "work-one";
+        profile.outputs = [
+          {
+            criteria = "eDP-1";
+            status = "disable";
+          }
+        ];
+      }
+      { output.criteria = config.common.monitors.work.name; }
    ];
  };

--- a/home/osu.nix
+++ b/home/osu.nix
@ -1,29 +1,28 @@
 { pkgs, lib, ... }:

 let
-  osu-pkg = pkgs.unstable.osu-lazer-bin;
-  # osu-pkg = with pkgs; with lib;
-  #   appimageTools.wrapType2 rec {
-  #     pname = "osu-lazer-bin";
-  #     version = "2024.312.1";
-  #     src = pkgs.fetchurl {
-  #       url = "https://github.com/ppy/osu/releases/download/${version}/osu.AppImage";
-  #       hash = "sha256-1dzgs1p3/pf4eCdKvQ9JxowN+oBPBNaZv5e6qHeFPEM=";
-  #     };
+  # osu-pkg = pkgs.unstable.osu-lazer-bin;
+  osu-pkg = with pkgs; with lib;
+    appimageTools.wrapType2 rec {
+      pname = "osu-lazer-bin";
+      version = "2024.1009.1";
+      src = fetchurl {
+        url = "https://github.com/ppy/osu/releases/download/${version}/osu.AppImage";
+        sha256 = "sha256-2H2SPcUm/H/0D9BqBiTFvaCwd0c14/r+oWhyeZdNpoU=";
+      };
+      extraPkgs = pkgs: with pkgs; [ icu ];

-  #     extraPkgs = pkgs: with pkgs; [ icu ];
-
-  #     extraInstallCommands =
-  #       let contents = appimageTools.extract { inherit pname version src; };
-  #       in
-  #       ''
-  #         mv -v $out/bin/${pname}-${version} $out/bin/osu\!
-  #         install -m 444 -D ${contents}/osu\!.desktop -t $out/share/applications
-  #         for i in 16 32 48 64 96 128 256 512 1024; do
-  #           install -D ${contents}/osu\!.png $out/share/icons/hicolor/''${i}x$i/apps/osu\!.png
-  #         done
-  #       '';
-  #   };
+      extraInstallCommands =
+        let contents = appimageTools.extract { inherit pname version src; };
+        in
+        ''
+          mv -v $out/bin/${pname} $out/bin/osu\!
+          install -m 444 -D ${contents}/osu\!.desktop -t $out/share/applications
+          for i in 16 32 48 64 96 128 256 512 1024; do
+            install -D ${contents}/osu\!.png $out/share/icons/hicolor/''${i}x$i/apps/osu\!.png
+          done
+        '';
+    };
 in
 {
  home.packages = [ osu-pkg ];
--- a/kagami-air-m1/configuration.nix
+++ b/kagami-air-m1/configuration.nix
@ -70,7 +70,7 @@
  services.printing.drivers = with pkgs; [ epfl-cups-drivers ];

  # Enable touchpad support (enabled default in most desktopManager).
-  services.xserver.libinput.enable = true;
+  services.libinput.enable = true;
  # Keyboard
  services.input-remapper.enable = true;
  services.input-remapper.serviceWantedBy = [ "multi-user.target" ];
--- a/modules/cloud/authentik/default.nix
+++ b/modules/cloud/authentik/default.nix
@ -22,8 +22,8 @@ let
    };
    authentik = mkImage {
      imageName = "ghcr.io/goauthentik/server";
-      finalImageTag = "2024.4.2";
-      imageDigest = "sha256:a2e592a08eb3c9e3435aa4e6585d60cc1eb54850da9d1498d56a131bbfbe03ff";
+      finalImageTag = "2024.8.2";
+      imageDigest = "sha256:71984fdbb7a9414f5172bb446104d3fe4ab1ab412c8b3343bb97b04449dd53eb";
    };
  };
  authentikEnv = pkgs.writeText "authentik.env" ''
@ -48,7 +48,14 @@ in
  };

  config = mkIf cfg.enable {
-    systemd.services.arion-authentik.serviceConfig.EnvironmentFile = cfg.envFile;
+    systemd.services.arion-authentik = {
+      serviceConfig.EnvironmentFile = cfg.envFile;
+      serviceConfig.Type = "notify";
+      serviceConfig.NotifyAccess = "all";
+      script = lib.mkBefore ''
+        ${lib.getExe pkgs.wait4x} http http://127.0.0.1:${toString cfg.port} --expect-status-code 200 -t 0 -q -- systemd-notify --ready &
+      '';
+    };
    virtualisation.arion.projects.authentik.settings = {
      services.postgresql.service = {
        image = images.postgresql;
--- a/modules/cloud/conduit/default.nix
+++ b/modules/cloud/conduit/default.nix
@ -74,6 +74,8 @@ with lib;
              global.port = instance.port;
              global.allow_registration = instance.allow_registration;
              global.database_path = "/mnt/data/${srvName}/";
+              global.well_known_client = "https://${instance.host}";
+              global.well_known_server = "${instance.host}:443";
            });
          in
          {
@ -114,61 +116,12 @@ with lib;
        ))
      cfg.instances);

-  # Serving .well-known files
-  # This is a single .well-known/matrix/server file that points to the server,
-  # which is NOT on port 8448 since Cloudflare doesn't allow us to route HTTPS
-  # through that port.
-  config.services.nginx = mkIf cfg.enable
-    {
-      enable = true;
-      virtualHosts = lib.attrsets.mapAttrs'
-        (name: instance: lib.attrsets.nameValuePair "conduit-${name}-well-known" {
-          listen = [{ addr = "127.0.0.1"; port = instance.well-known_port; }];
-          # Check https://github.com/spantaleev/matrix-docker-ansible-deploy/blob/master/docs/configuring-well-known.md
-          # for the file structure.
-          root = pkgs.symlinkJoin
-            {
-              name = "well-known-files-for-conduit-${name}";
-              paths = [
-                (pkgs.writeTextDir ".well-known/matrix/client" (builtins.toJSON {
-                  "m.homeserver".base_url = "https://${instance.host}";
-                  "org.matrix.msc3575.proxy".url = "https://${instance.host}";
-                }))
-                (pkgs.writeTextDir ".well-known/matrix/server" (builtins.toJSON {
-                  "m.server" = "${instance.host}:443";
-                }))
-              ];
-            };
-          extraConfig =
-            # Enable CORS from anywhere since we want all clients to find us out
-            ''
-              add_header 'Access-Control-Allow-Origin' "*";
-            '' +
-            # Force returning values to be JSON data
-            ''
-              default_type application/json;
-            '';
-        })
-        cfg.instances;
-    };
-
  config.cloud.traefik.hosts = mkIf cfg.enable (
    (lib.attrsets.mapAttrs'
      (name: instance: lib.attrsets.nameValuePair "conduit-${name}" ({
        inherit (instance) host port noCloudflare;
      }))
      cfg.instances)
-    // (lib.attrsets.mapAttrs'
-      (name: instance: lib.attrsets.nameValuePair "conduit-${name}-well-known" (
-        let
-          server_name = if instance.server_name == "" then instance.host else instance.server_name;
-        in
-        {
-          port = instance.well-known_port;
-          filter = "Host(`${server_name}`) && PathPrefix(`/.well-known`)";
-        }
-      ))
-      cfg.instances)
  );
 }

--- a/modules/cloud/conduit/heisenbridge.nix
+++ b/modules/cloud/conduit/heisenbridge.nix
@ -33,7 +33,7 @@ with lib; {
    {
      systemd.services.heisenbridge = {
        description = "Matrix<->IRC bridge";
-        requires = [ "matrix-synapse.service" ]; # So the registration file can be used by Synapse
+        requires = [ "matrix-conduit-nkagami.service" "matrix-synapse.service" ]; # So the registration file can be used by Synapse
        wantedBy = [ "multi-user.target" ];

        serviceConfig = rec {
--- a/modules/cloud/gotosocial/default.nix
+++ b/modules/cloud/gotosocial/default.nix
@ -4,6 +4,7 @@ let
  cfg = config.cloud.gotosocial;

  dbUser = "gotosocial";
+  storageLocation = "/mnt/data/gotosocial";
 in
 {
  options.cloud.gotosocial = {
@ -74,6 +75,9 @@ in
        # Media
        media-emoji-remote-max-size = 256 * 1024 /* bytes */;
        media-emoji-local-max-size = 256 * 1024 /* bytes */;
+        media-remote-cache-days = 7;
+        media-cleanup-from = "00:00";
+        media-cleanup-every = "24h";
        # OIDC
        oidc-enabled = true;
        oidc-idp-name = "DTTH";
@ -82,10 +86,22 @@ in
        http-client.block-ips = [ "11.0.0.0/24" ];
        # Advanced
        advanced-rate-limit-requests = 0;
+        # Storage
+        storage-backend = "local";
+        storage-local-base-path = "${storageLocation}/storage";
        # instance-inject-mastodon-version = true;
      };
    };
-    systemd.services.gotosocial.requires = mkAfter [ "minio.service" "postgresql.service" ];
-    systemd.services.gotosocial.after = mkAfter [ "minio.service" "postgresql.service" ];
+    systemd.services.gotosocial.requires = mkAfter [ "postgresql.service" "arion-authentik.service" ];
+    systemd.services.gotosocial.after = mkAfter [ "postgresql.service" "arion-authentik.service" ];
+    systemd.services.gotosocial.unitConfig = {
+      RequiresMountsFor = [ storageLocation ];
+      ReadWritePaths = [ storageLocation ];
+    };
+    systemd.tmpfiles.settings."10-gotosocial".${storageLocation}.d = {
+      user = dbUser;
+      group = dbUser;
+      mode = "0700";
+    };
  };
 }
--- a/modules/cloud/outline/r2.patch
+++ b/modules/cloud/outline/r2.patch
@ -0,0 +1,183 @@
+commit 8c7f8c28fabc174a71499a4737579b24b5c4b244
+Author: Natsu Kagami <nki@nkagami.me>
+Date:   Mon Oct 21 02:17:36 2024 +0200
+
+    Support R2
+
+diff --git a/.env.sample b/.env.sample
+index eb57ad85c..94ffcee07 100644
+--- a/.env.sample
+++ b/.env.sample
+@@ -66,6 +66,8 @@ AWS_S3_UPLOAD_BUCKET_URL=http://s3:4569
+ AWS_S3_UPLOAD_BUCKET_NAME=bucket_name_here
+ AWS_S3_FORCE_PATH_STYLE=true
+ AWS_S3_ACL=private
+AWS_S3_R2=true
+AWS_S3_R2_PUBLIC_URL=http://s3:4569
+ 
+ # –––––––––––––– AUTHENTICATION ––––––––––––––
+ 
+diff --git a/app/utils/files.ts b/app/utils/files.ts
+index 6607a6b12..5138f68ad 100644
+--- a/app/utils/files.ts
+++ b/app/utils/files.ts
+@@ -63,8 +63,13 @@ export const uploadFile = async (
+     xhr.addEventListener("loadend", () => {
+       resolve(xhr.readyState === 4 && xhr.status >= 200 && xhr.status < 400);
+     });
+-    xhr.open("POST", data.uploadUrl, true);
+-    xhr.send(formData);
+    xhr.open(data.method, data.uploadUrl, true);
+    xhr.setRequestHeader("Content-Type", file.type);
+    if (data.method === "POST") {
+      xhr.send(formData);
+    } else {
+      xhr.send(file);
+    }
+   });
+ 
+   if (!success) {
+diff --git a/server/env.ts b/server/env.ts
+index 5b420f2e1..4ea1e8d3c 100644
+--- a/server/env.ts
+++ b/server/env.ts
+@@ -519,6 +519,14 @@ export class Environment {
+     environment.AWS_S3_UPLOAD_BUCKET_NAME
+   );
+ 
+  @IsOptional()
+  public AWS_S3_R2 = this.toBoolean(environment.AWS_S3_R2 ?? "false");
+
+  @IsOptional()
+  public AWS_S3_R2_PUBLIC_URL = this.toOptionalString(
+    environment.AWS_S3_R2_PUBLIC_URL
+  );
+
+   /**
+    * Whether to force path style URLs for S3 objects, this is required for some
+    * S3-compatible storage providers.
+diff --git a/server/routes/api/attachments/attachments.ts b/server/routes/api/attachments/attachments.ts
+index 5e6c27594..b7620f440 100644
+--- a/server/routes/api/attachments/attachments.ts
+++ b/server/routes/api/attachments/attachments.ts
+@@ -3,6 +3,7 @@ import { v4 as uuidv4 } from "uuid";
+ import { AttachmentPreset } from "@shared/types";
+ import { bytesToHumanReadable } from "@shared/utils/files";
+ import { AttachmentValidation } from "@shared/validations";
+import env from "@server/env";
+ import { AuthorizationError, ValidationError } from "@server/errors";
+ import auth from "@server/middlewares/authentication";
+ import { rateLimiter } from "@server/middlewares/rateLimiter";
+@@ -90,16 +91,30 @@ router.post(
+       { transaction }
+     );
+ 
+-    const presignedPost = await FileStorage.getPresignedPost(
+-      key,
+-      acl,
+-      maxUploadSize,
+-      contentType
+-    );
+    let uploadUrl;
+    let method;
+    let presignedPost = {
+      fields: {},
+    };
+    if (env.AWS_S3_R2) {
+      uploadUrl = await FileStorage.getPresignedPut(key);
+      method = "PUT";
+    } else {
+      uploadUrl = FileStorage.getUploadUrl();
+      method = "POST";
+
+      presignedPost = await FileStorage.getPresignedPost(
+        key,
+        acl,
+        maxUploadSize,
+        contentType
+      );
+    }
+ 
+     ctx.body = {
+       data: {
+-        uploadUrl: FileStorage.getUploadUrl(),
+        uploadUrl,
+        method,
+         form: {
+           "Cache-Control": "max-age=31557600",
+           "Content-Type": contentType,
+diff --git a/server/storage/files/BaseStorage.ts b/server/storage/files/BaseStorage.ts
+index ce0287ebc..a1931c83d 100644
+--- a/server/storage/files/BaseStorage.ts
+++ b/server/storage/files/BaseStorage.ts
+@@ -26,6 +26,8 @@ export default abstract class BaseStorage {
+     contentType: string
+   ): Promise<Partial<PresignedPost>>;
+ 
+  public abstract getPresignedPut(key: string): Promise<string>;
+
+   /**
+    * Returns a promise that resolves with a stream for reading a file from the storage provider.
+    *
+diff --git a/server/storage/files/LocalStorage.ts b/server/storage/files/LocalStorage.ts
+index 83cf98c50..324e60dd9 100644
+--- a/server/storage/files/LocalStorage.ts
+++ b/server/storage/files/LocalStorage.ts
+@@ -30,6 +30,10 @@ export default class LocalStorage extends BaseStorage {
+     });
+   }
+ 
+  public async getPresignedPut(key: string) {
+    return this.getUrlForKey(key);
+  }
+
+   public getUploadUrl() {
+     return "/api/files.create";
+   }
+diff --git a/server/storage/files/S3Storage.ts b/server/storage/files/S3Storage.ts
+index a42442e0c..d55ef5472 100644
+--- a/server/storage/files/S3Storage.ts
+++ b/server/storage/files/S3Storage.ts
+@@ -4,6 +4,7 @@ import {
+   S3Client,
+   DeleteObjectCommand,
+   GetObjectCommand,
+  PutObjectCommand,
+   ObjectCannedACL,
+ } from "@aws-sdk/client-s3";
+ import { Upload } from "@aws-sdk/lib-storage";
+@@ -58,6 +59,16 @@ export default class S3Storage extends BaseStorage {
+     return createPresignedPost(this.client, params);
+   }
+ 
+  public async getPresignedPut(key: string) {
+    const params = {
+      Bucket: env.AWS_S3_UPLOAD_BUCKET_NAME,
+      Key: key,
+    };
+
+    const command = new PutObjectCommand(params);
+    return await getSignedUrl(this.client, command, { expiresIn: 3600 });
+  }
+
+   private getPublicEndpoint(isServerUpload?: boolean) {
+     if (env.AWS_S3_ACCELERATE_URL) {
+       return env.AWS_S3_ACCELERATE_URL;
+@@ -137,10 +148,17 @@ export default class S3Storage extends BaseStorage {
+     );
+   }
+ 
+  public getR2ObjectUrl = async (key: string) =>
+    env.AWS_S3_R2_PUBLIC_URL + "/" + key;
+
+   public getSignedUrl = async (
+     key: string,
+     expiresIn = S3Storage.defaultSignedUrlExpires
+   ) => {
+    if (env.AWS_S3_R2) {
+      return this.getR2ObjectUrl(key);
+    }
+
+     const isDocker = env.AWS_S3_UPLOAD_BUCKET_URL.match(/http:\/\/s3:/);
+     const params = {
+       Bucket: this.getBucket(),
--- a/modules/cloud/postgresql/default.nix
+++ b/modules/cloud/postgresql/default.nix
@ -31,6 +31,13 @@ in
    ensureDatabases = cfg.databases;

    ensureUsers = (map userFromDatabase cfg.databases);
+
+    dataDir = "/mnt/data/postgresql/${config.services.postgresql.package.psqlSchema}";
+  };
+
+  config.systemd.services.postgresql.serviceConfig = {
+    StateDirectory = "postgresql postgresql ${config.services.postgresql.dataDir}";
+    StateDirectoryMode = "0750";
  };

  # Backup settings
--- a/modules/common/linux/default.nix
+++ b/modules/common/linux/default.nix
@ -12,7 +12,6 @@ let
      users.users.${config.common.linux.username}.extraGroups = [ "adbusers" ];
    };
    ios = { config, pkgs, ... }: mkIf config.common.linux.enable {
-      services.avahi.enable = true;
      services.usbmuxd.enable = true;
      services.usbmuxd.package = pkgs.usbmuxd2;
      environment.systemPackages = with pkgs; [
@ -27,8 +26,19 @@ let
      };
    };

+    graphics = { config, ... }: {
+      hardware =
+        if config.system.nixos.release == "24.05" then {
+          opengl.enable = true;
+          opengl.driSupport32Bit = true;
+        } else {
+          graphics.enable = true;
+          graphics.enable32Bit = true;
+        };
+    };
+
    accounts = { pkgs, ... }: mkIf (config.common.linux.enable && !pkgs.stdenv.isAarch64) {
-      environment.systemPackages = with pkgs.gnome; [ pkgs.glib gnome-control-center ];
+      environment.systemPackages = [ pkgs.glib (pkgs.gnome-control-center or pkgs.gnome.gnome-control-center) ];
      services.accounts-daemon.enable = true;
      services.gnome.gnome-online-accounts.enable = true;
      # programs.evolution.enable = true;
@ -104,7 +114,19 @@ let
  };
 in
 {
-  imports = with modules; [ adb ios wlr logitech kwallet virtualisation accounts rt-audio ];
+  imports = with modules; [
+    ./sops.nix
+
+    adb
+    ios
+    graphics
+    wlr
+    logitech
+    kwallet
+    virtualisation
+    accounts
+    rt-audio
+  ];

  options.common.linux = {
    enable = mkOption {
@ -187,7 +209,6 @@ in
    services.fwupd.enable = true;

    # Enable sound.
-    sound.enable = true;
    services.pipewire = {
      enable = true;
      # alsa is optional
@ -251,20 +272,24 @@ in
    services.tailscale.enable = true;

    ## Time and Region
-    time.timeZone = "Europe/Zurich";
+    time.timeZone = lib.mkDefault "Europe/Zurich";
    # Select internationalisation properties.
    console.keyMap = "jp106"; # Console key layout
    i18n.defaultLocale = "ja_JP.UTF-8";
    # Input methods (only fcitx5 works reliably on Wayland)
    i18n.inputMethod = {
-      enabled = "fcitx5";
      fcitx5.waylandFrontend = true;
      fcitx5.addons = with pkgs; [
        fcitx5-mozc
        fcitx5-unikey
        fcitx5-gtk
      ];
-    };
+    } // (if config.system.nixos.release == "24.05" then {
+      enabled = "fcitx5";
+    } else {
+      enable = true;
+      type = "fcitx5";
+    });

    # Default packages
    environment.systemPackages = with pkgs; [
@ -294,8 +319,6 @@ in
    programs.dconf.enable = true;
    # Gaming! (not for ARM64)
    programs.steam.enable = !pkgs.stdenv.isAarch64;
-    hardware.opengl.enable = true;
-    hardware.opengl.driSupport32Bit = !pkgs.stdenv.isAarch64; # For 32 bit applications

    ## Services
    # OpenSSH so you can SSH to me
--- a/modules/common/linux/sops.nix
+++ b/modules/common/linux/sops.nix
@ -0,0 +1,18 @@
+{ config, lib, ... }:
+with { inherit (lib) types mkOption mkEnableOption; };
+let
+  cfg = config.common.linux.sops;
+in
+{
+  options.common.linux.sops = {
+    enable = mkEnableOption "Enable sops configuration";
+    file = mkOption {
+      type = types.path;
+      description = "Path to the default sops file";
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    sops.defaultSopsFile = cfg.file;
+    sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  };
+}
--- a/modules/my-tinc/default.nix
+++ b/modules/my-tinc/default.nix
@ -34,11 +34,6 @@ in
      default = 655;
      description = "The port to listen on";
    };
-
-    meshIp = mkOption {
-      type = types.str;
-      description = "The mesh ip to be assigned by hostname";
-    };
  };

  config = mkIf cfg.enable (builtins.seq
@ -51,7 +46,6 @@ in
        myMeshIp = myHost.subnetAddr;
      in
      {
-        services.my-tinc.meshIp = myMeshIp;
        # Scripts that set up the tinc services
        environment.etc = {
          "tinc/${networkName}/tinc-up".source = pkgs.writeScript "tinc-up-${networkName}" ''
@ -84,6 +78,11 @@ in
        # firewall
        networking.firewall.allowedUDPPorts = [ 655 ];
        networking.firewall.allowedTCPPorts = [ 655 ];
+        networking.firewall.interfaces."tinc.${networkName}" = {
+          allowedUDPPortRanges = [{ from = 0; to = 65535; }];
+          allowedTCPPortRanges = [{ from = 0; to = 65535; }];
+        };
+

        # configure tinc service
        # ----------------------
--- a/modules/my-tinc/hosts.nix
+++ b/modules/my-tinc/hosts.nix
@ -23,10 +23,13 @@ in
      hosts;

    # Add all of them to host
-    networking.extraHosts = lib.strings.concatStringsSep
-      "\n"
-      (lib.attrsets.mapAttrsToList
-        (name: host: "${host.subnetAddr} ${name}.tinc")
-        hosts);
+    nki.services.edns = {
+      enable = true;
+      cloaking-rules =
+        (lib.attrsets.mapAttrs'
+          (name: host: { name = "${name}.tinc"; value = host.subnetAddr; })
+          hosts)
+      ;
+    };
  };
 }
--- a/modules/my-tinc/hosts/default.nix
+++ b/modules/my-tinc/hosts/default.nix
@ -22,4 +22,14 @@
    subnetAddr = "11.0.0.4";
    ed25519PublicKey = "6MN5LVE4juavv8qJW2dTN4t/haKCADWquAQj/ADF7iN";
  };
+
+  yoga = {
+    subnetAddr = "11.0.0.5";
+    ed25519PublicKey = "n+gIZjuuTPxi0OBqw2oOcmXd3loOHG+GQHBMXNlgyqI";
+  };
+
+  framework = {
+    subnetAddr = "11.0.0.6";
+    ed25519PublicKey = "YL7NA6Ydv/3FBfSzOPvyHlGweAViPvsG3b0Zh8L0NzF";
+  };
 }
--- a/modules/personal/fonts/default.nix
+++ b/modules/personal/fonts/default.nix
@ -10,7 +10,7 @@ with lib;
      ibm-plex
      (nerdfonts.override { fonts = [ "NerdFontsSymbolsOnly" ]; })
      noto-fonts
-      noto-fonts-cjk
+      (pkgs.noto-fonts-cjk-sans or pkgs.noto-fonts-cjk)
      merriweather
      corefonts
      font-awesome
--- a/modules/personal/fonts/mounting.nix
+++ b/modules/personal/fonts/mounting.nix
@ -12,7 +12,7 @@ lib.mkIf pkgs.stdenv.isLinux {
        name = "system-icons";
        paths = with pkgs; [
          #libsForQt5.breeze-qt5  # for plasma
-          gnome.gnome-themes-extra
+          (pkgs.gnome-themes-extra or gnome.gnome-themes-extra) # Until 24.11
        ];
        pathsToLink = [ "/share/icons" ];
      };
--- a/modules/personal/u2f.nix
+++ b/modules/personal/u2f.nix
@ -16,7 +16,7 @@ in
    security.pam = mkIf pkgs.stdenv.isLinux {
      u2f = {
        enable = true;
-        cue = true;
+        settings.cue = true;
      };

      # Services
--- a/modules/services/edns/default.nix
+++ b/modules/services/edns/default.nix
@ -8,6 +8,11 @@ in
  options.nki.services.edns = {
    enable = mkEnableOption "Enable encrypted DNS";
    ipv6 = mkEnableOption "Enable ipv6";
+    cloaking-rules = mkOption {
+      type = types.attrsOf types.str;
+      default = { };
+      description = "A set of domain -> ip mapping for cloaking_rules";
+    };
  };

  config = mkIf cfg.enable {
@ -42,6 +47,11 @@ in
          { server_name = "*"; via = [ "anon-plan9-dns" "anon-v.dnscrypt.up-ipv4" ]; }
        ];
        anonymized_dns.skip_incompatible = true;
+
+        # Cloaking rules
+        cloaking_rules = pkgs.writeText "cloaking_rules.txt" (lib.strings.concatStringsSep
+          "\n"
+          (lib.attrsets.mapAttrsToList (name: ip: "${name} ${ip}") cfg.cloaking-rules));
      };
    };
  };
--- a/modules/services/nix-build-farm/default.nix
+++ b/modules/services/nix-build-farm/default.nix
@ -0,0 +1,66 @@
+{ config, lib, ... }:
+with { inherit (lib) mkOption types mkIf; };
+let
+  cfg = config.services.nix-build-farm;
+  hosts = import ./hosts.nix;
+
+  build-user = "nix-builder";
+
+  isBuilder = host: host ? "builder";
+  allBuilders = lib.filterAttrs (_: isBuilder) hosts;
+in
+{
+  options.services.nix-build-farm = {
+    enable = mkOption {
+      type = types.bool;
+      default = true;
+      description = "Whether to enable nix-build-farm as a client";
+    };
+    hostname = mkOption {
+      type = types.enum (builtins.attrNames hosts);
+      description = "The hostname as listed in ./hosts.nix file";
+    };
+    privateKeyFile = mkOption {
+      type = types.path;
+      description = "The path to the private SSH key file";
+    };
+
+    ipAddrs = mkOption {
+      type = types.str;
+      description = "The ip addresses to limit access to";
+      default = "11.0.0.*";
+    };
+  };
+
+  config = mkIf cfg.enable (
+    let
+      host = hosts.${cfg.hostname};
+      otherHosts = lib.filterAttrs (name: _: name != cfg.hostname) hosts;
+      otherBuilders = lib.filterAttrs (name: _: name != cfg.hostname) allBuilders;
+    in
+    {
+      nix.distributedBuilds = true;
+      nix.buildMachines = lib.mapAttrsToList
+        (name: host: {
+          hostName = host.host;
+          sshUser = build-user;
+          sshKey = cfg.privateKeyFile;
+        } // host.builder)
+        otherBuilders;
+
+      users = mkIf (isBuilder host) {
+        users.${build-user} = {
+          description = "Nix build farm user";
+          group = build-user;
+          isNormalUser = true;
+          openssh.authorizedKeys.keys = lib.mapAttrsToList (_: host: ''from="${cfg.ipAddrs}" ${host.pubKey}'') otherHosts;
+        };
+        groups.${build-user} = { };
+      };
+
+      nix.settings.trusted-users = mkIf (isBuilder host) [ build-user ];
+    }
+  );
+}
+
+
--- a/modules/services/nix-build-farm/hosts.nix
+++ b/modules/services/nix-build-farm/hosts.nix
@ -0,0 +1,37 @@
+{
+  cloud = {
+    host = "cloud.tinc";
+    pubKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE87ddj0fTH0NuvJz0dT5ln7v7zbafXqDVdM2A4ddOb0 root@nki-personal-do";
+  };
+
+  home = {
+    host = "home.tinc";
+    pubKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK6N1uTxnbo73tyzD9X7d7OgPeoOpY7JmQaHASjSWFPI nki@kagamiPC";
+
+    builder = {
+      publicHostKey = "c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSUhiVTh2NlNBa0kyOTBCc1QzVG1IRVVJQWdXcVFyNm9jRmpjakRRczRoT2ggcm9vdEBrYWdhbWlQQwo=";
+      systems = [ "x86_64-linux" "aarch64-linux" ];
+      maxJobs = 16;
+      speedFactor = 2;
+      supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
+    };
+  };
+
+  yoga = {
+    host = "yoga.tinc";
+    pubKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE6ZrO/xIdmwBCUx80cscBSpJBBTp55OHGrXYBGRXKAw nki@nki-yoga-g8";
+  };
+
+  framework = {
+    host = "framework.tinc";
+    pubKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH/g472MaT7YySUhBjxClfmMjpn98qYnKXDKlzWHYwuO nki@nki-framework";
+
+    builder = {
+      publicHostKey = "c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSUdOUlBCVFRkNTVVMXY1U1Jac0FjYVdhS3JGZTY0ZjIxOVViODVTQ2NWd28gcm9vdEBua2ktZnJhbWV3b3JrCg==";
+      systems = [ "x86_64-linux" "aarch64-linux" ];
+      maxJobs = 16;
+      speedFactor = 3;
+      supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
+    };
+  };
+}
--- a/modules/services/nix-cache/cache-pub-key.pem
+++ b/modules/services/nix-cache/cache-pub-key.pem
@ -0,0 +1 @@
+nix.home.tinc:zG2uDy0MbLY0wLuoVH/qKzTD6hTfKZufA2cWDSTCZMA=
--- a/modules/services/nix-cache/default.nix
+++ b/modules/services/nix-cache/default.nix
@ -0,0 +1,60 @@
+{ config, pkgs, lib, ... }:
+
+with { inherit (lib) mkEnableOption mkOption types mkIf; };
+let
+  cfg = config.nki.services.nix-cache;
+
+  bindAddr = "127.0.0.1:5000";
+in
+{
+  options.nki.services.nix-cache = {
+    enableClient = mkOption {
+      type = types.bool;
+      default = !cfg.enableServer;
+      description = "Enable nix-cache client";
+    };
+    enableServer = mkEnableOption "Enable nix-cache server";
+
+    host = mkOption {
+      type = types.str;
+      default = "nix.home.tinc";
+    };
+
+    publicKey = mkOption {
+      type = types.str;
+      default = builtins.readFile ./cache-pub-key.pem;
+    };
+
+    privateKeyFile = mkOption {
+      type = types.path;
+      description = "Path to the private key .pem file";
+    };
+  };
+
+  config = {
+    nix.settings = mkIf cfg.enableClient {
+      substituters = lib.mkAfter [ "http://${cfg.host}" ];
+      trusted-public-keys = [ cfg.publicKey ];
+    };
+
+    services.harmonia = mkIf cfg.enableServer {
+      enable = true;
+      signKeyPath = cfg.privateKeyFile;
+      settings = {
+        bind = bindAddr;
+        priority = 45;
+      };
+    };
+
+    services.nginx = mkIf cfg.enableServer {
+      enable = true;
+      recommendedProxySettings = true;
+      virtualHosts = {
+        # ... existing hosts config etc. ...
+        "${cfg.host}" = {
+          locations."/".proxyPass = "http://${bindAddr}";
+        };
+      };
+    };
+  };
+}
--- a/nki-framework/configuration.nix
+++ b/nki-framework/configuration.nix
@ -17,10 +17,18 @@
      ./wireless.nix
    ];

+  # Sops
+  common.linux.sops.enable = true;
+  common.linux.sops.file = ./secrets.yaml;
+
+  sops.secrets."nix-build-farm/private-key" = { mode = "0400"; };
+  services.nix-build-farm.hostname = "framework";
+  services.nix-build-farm.privateKeyFile = config.sops.secrets."nix-build-farm/private-key".path;
+
  # services.xserver.enable = true;
  # services.xserver.displayManager.sddm.enable = true;
  # services.xserver.displayManager.sddm.wayland.enable = true;
-  services.xserver.desktopManager.plasma6.enable = true;
+  services.desktopManager.plasma6.enable = true;

  # Power Management
  services.upower = {
@ -34,13 +42,13 @@
  services.power-profiles-daemon.enable = true;
  # powerManagement.enable = true;
  # powerManagement.powertop.enable = true;
-  services.logind.lidSwitch = "suspend";
+  services.logind.lidSwitch = "suspend-then-hibernate";

  # Printing
  services.printing.drivers = with pkgs; [ epfl-cups-drivers ];

  # Enable touchpad support (enabled default in most desktopManager).
-  services.xserver.libinput.enable = true;
+  services.libinput.enable = true;
  # Keyboard
  services.input-remapper.enable = true;
  services.input-remapper.serviceWantedBy = [ "multi-user.target" ];
@ -77,6 +85,16 @@
  security.pam.services.swaylock.fprintAuth = true;
  security.pam.services.login.fprintAuth = true;

+  # tinc network
+  sops.secrets."tinc-private-key" = { };
+  services.my-tinc = {
+    enable = true;
+    hostName = "framework";
+    ed25519PrivateKey = config.sops.secrets."tinc-private-key".path;
+    bindPort = 6565;
+  };
+
+
  # Secrets
  # sops.defaultSopsFile = ./secrets.yaml;
  # sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
--- a/nki-framework/hardware-configuration.nix
+++ b/nki-framework/hardware-configuration.nix
@ -12,10 +12,8 @@
  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "sd_mod" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ "kvm-amd" ];
-  boot.extraModulePackages = [ ];
+  boot.kernelPackages = pkgs.linuxPackages; # until mesa fixed
  boot.kernelParams = [
-    # See https://community.frame.work/t/tracking-graphical-corruption-in-fedora-39-amd-3-03-bios/39073/143
-    "amdgpu.sg_display=0"
    # Hibernation
    "resume=UUID=fa8aaf51-b99f-4fb4-9230-8c0957d8af3f"
    "resume_offset=5776640" # btrfs inspect-internal map-swapfile -r /var/swapfile
--- a/nki-framework/secrets.yaml
+++ b/nki-framework/secrets.yaml
@ -0,0 +1,32 @@
+tinc-private-key: ENC[AES256_GCM,data:cKtOFrF5FRSHWxe/QxH5O9GAba1WcWeCwW1IOzmbgdtFufRoWbCtYeaLP+WQhQ70z6xobiY9DN8Jrh7mDptKSsfKrrx2SH5JrdpsoINhLMbetXq7E29+q6CkS8NlLgE/KyV8eFjQySNsYiA/+Efq9xj9e1wOmHBDsND/jgiJDkA1qsEIFZg/vuv8LdoRY3TV/oKJ4pao9+70G4H+8Ef1sMZHGNe9qJ94Wa71nNX2fTSjKH5YBbRijMAePWr/IeCpZ9Phs7RqjBs=,iv:l0iB136X7nLVblQjFi7K4f42JKSxdsiLIRy5GPzK1nc=,tag:HAgkvWkl0Rx62ejGZckdKA==,type:str]
+nix-build-farm:
+    private-key: ENC[AES256_GCM,data:w56sobHrhvVcKbuK15Yj20EqgFrR/5pNy/rcQjlZCiFEfgPC6ZrbsxziIdMTOX+Q4DyllKCKo+g/MIKm5S+s+nIff509ODlILhTtXlZvZlnT9+wvm5oN3WQCdkkqOr1gNnErPupfMxA6V35tNvNBCeomYuM8Xb7TuH4I1fXa5GFeT0Tnp5A2WqWoS1MzXz34CxlKXvoL6i4w7nUngt5zaGr9oMZbSa0pHxEzIhXk6h/lE864QlJid7q/mDok9gh2R80WvArGtNNj9PrT6cNKYIFuXo7vITkSkT3vo9BLflg5sgRxy4+7rBaRla0ziihQvZLtworwo6aNDvEqPqYfiX0TMYPpEWvJpp/HGDJy+Po7b0ZZkwSza+tB0J79vFH2h11Px1XSwXdq757Bn9G4OTb5oKWS5ycBU4xTnnHQBjYTSooFxYyTAvfKNEsB8AHKSuQRZgtVhWoOSPpJ6YL94ClUIT+DTaNmQjwouqNatf/nif+N/FCar8JWZDE+FX1TBu0yLmJie/f0LCdCQx+6IVdyXg7oVCoNiGg0,iv:TeSxlVc0WlOMMUtv/uq3f7JvW/kNCM7LjguhZxL51a4=,tag:m1iuk4pAX/yugM0ObzkJHQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age188tgu3psvywk6shq85mk2q0jdjwd0tcswzwlwu5pa5n3pndx75dq090z59
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmL2Z1RzBWaTI1TDl6WDNa
+            NTNVdEhTSFU5enNlTGVNWTI5anBZb1BtaVhjCm1BRnJDSXl1cWdBRUs1VnREVjBU
+            QWZxdkgzdm9JL0k5WmhDL1RCNTltdm8KLS0tIFhvQTlKMDZiVklTRWd4TzVmc2ll
+            bmpjcWdBV1doZml2NjlzQzdQczJ3alEKBMRP3POxtPIqBWnrvxY/++5jtVE70Uxa
+            EVfhsUO76A/hzyxfzpLEy1QGFE+DB/zlU0CK7HkNGPD2TrBHbzkPJA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1vgh6kvee8lvxylm7z86fpl3xzjyjs4u3zdfkyf064rjvxk9fpumsew7n27
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2MUxQU0dZOGRaekF4MWdo
+            T0krcERtRTJndFR1RHZmL0t6MjBxMW5PSENNCkR6SUhxQ0FoaEhuaWpiUzJ0MnJE
+            RXRERzVhL0lRVW1iRUlac0c5OHZsckEKLS0tIC9VM1dNZTNzdkFnMWk2YUwvcDNB
+            TDZnVjBaVzZBem5lZDB1MW4xQ0RmZ28K6d7mF+f3ZyilXlSIQGT2pBrTWuYLccE1
+            rYIJjHjFft/2wPX2gAW9VTiwfMT3lKJhJRqNdoie5phV5BZhkb3D9w==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-08-17T14:58:10Z"
+    mac: ENC[AES256_GCM,data:ZCrzXDttLxYUvdLiqM5I17Ys6O3zoOVKq8xP78VaLb3AAoV4RGGQxixKVQ6K9h84e8bFymh512BR7xKa9fqebxTyL1XCqPkRaSZy0aWjbc6QCaK+JD4yqivgO/x5x2xgMpX/ZhPFzKNLpMga61bnm6plvF8ocG+wOqYvj3vL0Ss=,iv:QZ8YJD7h2QD2jqVKo4bg0rwpZSTyyNw6zZDcBfClKPo=,tag:PH2XnTqxV2irymg2+Z+Egg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.0
--- a/nki-home/configuration.nix
+++ b/nki-home/configuration.nix
@ -10,8 +10,6 @@ with lib;
    [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
-      # secret management
-      ./secrets
      # Fonts
      ../modules/personal/fonts
      # Encrypted DNS
@ -27,10 +25,22 @@ with lib;
  # Plasma!
  services.desktopManager.plasma6.enable = true;

-
  ## Encryption
  # Kernel modules needed for mounting USB VFAT devices in initrd stage
  common.linux.luksDevices.root = "/dev/disk/by-uuid/7c6e40a8-900b-4f85-9712-2b872caf1892";
+  common.linux.sops.enable = true;
+  common.linux.sops.file = ./secrets.yaml;
+
+  # Nix cache server
+  sops.secrets."nix-cache/private-key" = { owner = "harmonia"; group = "harmonia"; mode = "0600"; };
+  nki.services.nix-cache = {
+    enableServer = true;
+    privateKeyFile = config.sops.secrets."nix-cache/private-key".path;
+  };
+
+  sops.secrets."nix-build-farm/private-key" = { mode = "0400"; };
+  services.nix-build-farm.hostname = "home";
+  services.nix-build-farm.privateKeyFile = config.sops.secrets."nix-build-farm/private-key".path;

  # Networking
  common.linux.networking =
@ -61,13 +71,11 @@ with lib;
      PrivateKeyFile = config.sops.secrets."dtth-wg/private-key".path;
    };
    wireguardPeers = [{
-      wireguardPeerConfig = {
-        PublicKey = "+7iI4jwmM1Qr+/DKB1Hv8JgFkGu7lSV0PAoo+O5d3yQ=";
-        PresharedKeyFile = config.sops.secrets."dtth-wg/preshared-key".path;
-        AllowedIPs = [ "100.64.0.0/10" "fd00::/106" ];
-        Endpoint = "vpn.dtth.ch:51820";
-        PersistentKeepalive = 25;
-      };
+      PublicKey = "+7iI4jwmM1Qr+/DKB1Hv8JgFkGu7lSV0PAoo+O5d3yQ=";
+      PresharedKeyFile = config.sops.secrets."dtth-wg/preshared-key".path;
+      AllowedIPs = [ "100.64.0.0/10" "fd00::/106" ];
+      Endpoint = "vpn.dtth.ch:51820";
+      PersistentKeepalive = 25;
    }];
  };
  systemd.network.networks."dtth-wg" = {
@ -75,8 +83,8 @@ with lib;
    address = [ "100.73.146.80/32" "fd00::33:105b/128" ];
    DHCP = "no";
    routes = [
-      { routeConfig = { Destination = "100.64.0.0/10"; Scope = "link"; }; }
-      { routeConfig.Destination = "fd00::/106"; }
+      { Destination = "100.64.0.0/10"; Scope = "link"; }
+      { Destination = "fd00::/106"; }
    ];
  };

--- a/nki-home/hardware-configuration.nix
+++ b/nki-home/hardware-configuration.nix
@ -36,10 +36,6 @@
  swapDevices =
    [{ device = "/dev/disk/by-uuid/561f6441-1915-4059-a5e1-76a449b0c9bf"; }];

-  # GPU options
-  services.xserver.videoDrivers = [ "amdgpu" ];
-  hardware.opengl.enable = true;
-
  # bluetooth usb
  hardware.firmware = [ pkgs.rtl8761b-firmware ];
 }
--- a/nki-home/secrets/secrets.yaml
+++ b/nki-home/secrets/secrets.yaml
@ -13,6 +13,10 @@ dtth-wg:
    preshared-key: ENC[AES256_GCM,data:96q0ZfvPz4pb53XvTGameVkcETamYH8Xbv69672RBdacH6QjRCCVvPnBTfA=,iv:Q2Yonb07/Uu6KidhMgRX4zJuNU1ZySNC7g/5TwpMU80=,tag:1qQQdk20yIQlGZmX+/25RA==,type:str]
 peertube:
    dtth-key: ENC[AES256_GCM,data:Gu7qOisVBZrFXKBr51165FJ7Ej4hV+lIf3AMC02R3UFNXOnTHF2xC8E=,iv:F83FuD1VjZEJFMcx3gkQuKCpJmYdHtO15fRHkYdMxJM=,tag:ScH42Tr5ZsIo9JMnXhylSw==,type:str]
+nix-cache:
+    private-key: ENC[AES256_GCM,data:4sbfIQb10Y50CrZbgjN+1iXEbXTpDqMbIB/yA3WlaAqhLtb8HKib5aZX3DLoxFbVihJcztQsvBBgEAhT9iMijoksaT9qzBQ5yIn4NGCfFem1DK8DQdjhTLMCVTyMFCT7hQHu/2Sd7w==,iv:zTSxuKOtOLekOBKBvl9MScD/Bo1Hviqq/n8Saa+1Cgo=,tag:fx73fCDPY9d07V3KKMw3DA==,type:str]
+nix-build-farm:
+    private-key: ENC[AES256_GCM,data:m5neeWCEdaZ1MRhNwTptfDIgv3ABNlYyNil3oTD81Jbe/6WxWaS5Q++CRlHCjc2hOoHsWsZixw8iGZVTA+QXgH6B9C6A4oOAhgR9m92EGTEfFw0qxQbdzs7U98Yonx/N8SApUycZZB/EU81+MrDNY4GGzCiO6s00/vZLkDTYnqRFgbo+8KTG0BQTl4q+VYP2q3l0wy+Ivz5CWPmbz42Xdin/sBnjeFHKDuof4iZZnN3i8gUJ/mMw3lbdiHd6A8DL0G5Ut46ljzMC2aMsZOATCID3mPOPgI0xIetDofPJLDqVsNqptRHo8WB+KwDidvl222f5F7JqdSqgAMOJYPscrX0odufApiJfg5bbXBygvrDfAlPSruW7GsWGoKAhw0qC4NC/j+qYCwhS0qdorCLnIy3zzMtA6HkHtE675hy7/7oLj7k9Y8MhE4PxztjXTmDazaVCtKhnA/DpaxP2mH84gfCkJFD1YF9jtPm+P3e+46FwkW+WnHaA2L+H7Evava30DLEBhh5y9Gd1A3JN4isn,iv:7KUWg7+GWgmGJkbIvsy9gtccZBb+1Y5uDWhXQFk0obk=,tag:qJdM684XPHxecLVxVb5pgw==,type:str]
 sops:
    kms: []
    gcp_kms: []
@ -46,8 +50,8 @@ sops:
            bUhIT0Z2b1dVWGNyS1hRVFRyZTA4d00KchP7EhSOMwBl5vFuuskzosRoi8jUu1sw
            hVjJNF2a40ewgkQgVAoWEzirHbknbQORzmepDDRth7Bve3UQU64+GA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-04-18T13:34:51Z"
-    mac: ENC[AES256_GCM,data:cinVE1pHSgjCRPIDwANzR0oHw7zdN8DVDQKkhXT5j+dGiaFzNvLoYyMcEsjoxAjEdup3YMo+Vg6I4C94AUCrTn7N9BGjnGFVQz3m9q13zORi1+HWam0VItBzJm1iIo8x0PPs79OBaIHVUFAz8r4DW46P/LQISl9MQSDpCCTjVVk=,iv:2VAehWaoh2lNZM8jlmt+dqo5eeHfcr++eAdQfm/tCcM=,tag:QSnbObe3046AnFpK3Y01Eg==,type:str]
+    lastmodified: "2024-08-16T13:59:20Z"
+    mac: ENC[AES256_GCM,data:ncT8fbtEb9ZcLcftXwgAKJRPPSG4TRHFMArtVgWNmIjDRcCNNT7ICa+9Dl8DAYKRJ+8pgelV9StIg2f7rvypHYlckontEP5nwSFzEApLItG3AZXewTC8VPoDYb4T8/OWKDoa5kBMvGrDr1bFP/CZz7H8No+k5TV7fVExsw0PHpg=,iv:vxbkeJtHkOAq7NcaZEIOMV3qGEqBUg/vpJYumBBfY70=,tag:T0yw2x1O5Tp0UllLpcFryg==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.8.1
+    version: 3.9.0
--- a/nki-home/secrets/default.nix
+++ b/nki-home/secrets/default.nix
@ -1,6 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  sops.defaultSopsFile = ./secrets.yaml;
-  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-}
--- a/nki-personal-do/configuration.nix
+++ b/nki-personal-do/configuration.nix
@ -12,6 +12,9 @@
    ../modules/cloud/conduit
    ../modules/cloud/gotosocial

+    # Encrypted DNS
+    ../modules/services/edns
+
    ./headscale.nix
    ./gitea.nix
    ./miniflux.nix
@ -21,8 +24,11 @@
    ./invidious.nix
    ./owncast.nix
    ./peertube.nix
+    ./outline.nix
  ];

+  system.stateVersion = "21.11";
+
  common.linux.enable = false; # Don't enable the "common linux" module, this is a special machine.

  # Personal user
@ -57,18 +63,15 @@

  services.do-agent.enable = true;

-  system.autoUpgrade = {
-    enable = true;
-    allowReboot = true;
-    flake = "github:natsukagami/nix-home#nki-personal-do";
-  };
-
  nix = {
    extraOptions = ''
      experimental-features = nix-command flakes
    '';
  };

+  nki.services.edns.enable = true;
+  nki.services.edns.ipv6 = true;
+
  # Secret management
  sops.defaultSopsFile = ./secrets/secrets.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
@ -81,6 +84,10 @@
  services.my-tinc.rsaPrivateKey = config.sops.secrets."tinc/rsa-private-key".path;
  services.my-tinc.ed25519PrivateKey = config.sops.secrets."tinc/ed25519-private-key".path;

+  sops.secrets."nix-build-farm/private-key" = { mode = "0400"; };
+  services.nix-build-farm.hostname = "home";
+  services.nix-build-farm.privateKeyFile = config.sops.secrets."nix-build-farm/private-key".path;
+
  # Set up traefik
  sops.secrets.cloudflare-dns-api-token = { owner = "traefik"; };
  sops.secrets.traefik-dashboard-users = { owner = "traefik"; };
@ -185,74 +192,13 @@
    protocol = "udp";
  };

-
-  # Outline
-  sops.secrets.minio-secret-key = { owner = "root"; mode = "0444"; };
-  sops.secrets.authentik-oidc-client-secret = { owner = "outline"; };
-  sops.secrets."outline/smtp-password" = { owner = "outline"; };
-  services.outline = {
-    enable = true;
-    package = pkgs.outline.overrideAttrs (attrs: {
-      patches = if builtins.hasAttr "patches" attrs then attrs.patches else [ ] ++ [ ../modules/cloud/outline/dtth-wiki.patch ];
-    });
-    databaseUrl = "postgres://outline:outline@localhost/outline?sslmode=disable";
-    redisUrl = "local";
-    publicUrl = "https://wiki.dtth.ch";
-    port = 18729;
-    storage = {
-      accessKey = "minio";
-      secretKeyFile = config.sops.secrets.minio-secret-key.path;
-      region = config.services.minio.region;
-      uploadBucketUrl = "https://s3.dtth.ch";
-      uploadBucketName = "dtth-outline";
-      uploadMaxSize = 50 * 1024 * 1000;
-    };
-    maximumImportSize = 50 * 1024 * 1000;
-
-    oidcAuthentication = {
-      clientId = "3a0c10e00cdcb4a1194315577fa208a747c1a5f7";
-      clientSecretFile = config.sops.secrets.authentik-oidc-client-secret.path;
-      authUrl = "https://auth.dtth.ch/application/o/authorize/";
-      tokenUrl = "https://auth.dtth.ch/application/o/token/";
-      userinfoUrl = "https://auth.dtth.ch/application/o/userinfo/";
-      displayName = "DTTH Account";
-    };
-
-    smtp = {
-      fromEmail = "DTTH Wiki <dtth.wiki@nkagami.me>";
-      replyEmail = "";
-      host = "mx1.nkagami.me";
-      username = "dtth.wiki@nkagami.me";
-      passwordFile = config.sops.secrets."outline/smtp-password".path;
-      port = 465;
-      secure = true;
-    };
-
-    forceHttps = false;
-  };
-  cloud.postgresql.databases = [ "outline" ];
-  systemd.services.outline.requires = [ "postgresql.service" ];
-  cloud.traefik.hosts.outline = { host = "wiki.dtth.ch"; port = 18729; };
-
  # GoToSocial
-  sops.secrets.gts-env = { };
+  sops.secrets.gts-env = { restartUnits = [ "gotosocial.service" ]; };
  cloud.gotosocial = {
    enable = true;
    envFile = config.sops.secrets.gts-env.path;
  };

-  # Minio
-  sops.secrets.minio-credentials = { };
-  services.minio = {
-    enable = true;
-    listenAddress = ":61929";
-    consoleAddress = ":62929";
-    rootCredentialsFile = config.sops.secrets.minio-credentials.path;
-    dataDir = lib.mkForce [ "/mnt/data/minio" ];
-  };
-  cloud.traefik.hosts.minio = { host = "s3.dtth.ch"; port = 61929; };
-  system.stateVersion = "21.11";
-
  # ntfy
  cloud.traefik.hosts.ntfy-sh = { host = "ntfy.nkagami.me"; port = 11161; noCloudflare = true; };
  services.ntfy-sh = {
--- a/nki-personal-do/gitea.nix
+++ b/nki-personal-do/gitea.nix
@ -98,6 +98,7 @@ in
  };
  users.groups.${user} = { };
  sops.secrets."gitea/signing-key".owner = user;
+  sops.secrets."gitea/minio-secret-key".owner = user;
  sops.secrets."gitea/mailer-password".owner = user;
  # database
  cloud.postgresql.databases = [ user ];
@ -114,8 +115,6 @@ in

    inherit user;

-    appName = "DTTHgit";
-
    settings = {
      server = {
        DOMAIN = host;
@ -136,7 +135,7 @@ in
      };
      "repository.signing" = {
        SIGNING_KEY = signingKey;
-        SIGNING_NAME = "DTTHGit";
+        SIGNING_NAME = "DTTHgit";
        SIGNING_EMAIL = "dtth-gitea@nkagami.me";
      };
      ui.THEMES = default-themes + "," + themes;
@ -176,8 +175,19 @@ in
        PATH = "${pkgs.git}/bin/git";
      };

-      federation.ENABLED = true;
+      storage = {
+        STORAGE_TYPE = "minio";
+        MINIO_USE_SSL = "true";
+        MINIO_ENDPOINT = "60c0807121eb35ef52cdcd4a33735fa6.r2.cloudflarestorage.com";
+        MINIO_ACCESS_KEY_ID = "704c29ade7a8b438b77ab520da2799ca";
+        MINIO_SECRET_ACCESS_KEY = "#miniosecretkey#";
+        MINIO_BUCKET = "dtth-gitea";
+        MINIO_LOCATION = "auto";
+        MINIO_CHECKSUM_ALGORITHM = "md5"; # R2 moment
+      };

+      federation.ENABLED = true;
+      DEFAULT.APP_NAME = "DTTHGit";
    };

    stateDir = "/mnt/data/gitea";
@ -205,17 +215,25 @@ in
    environment.GNUPGHOME = "${config.services.gitea.stateDir}/.gnupg";
    # https://github.com/NixOS/nixpkgs/commit/93c1d370db28ad4573fb9890c90164ba55391ce7
    serviceConfig.SystemCallFilter = mkForce "~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap";
-    preStart = ''
-      # Import the signing subkey
-      if cat ${config.services.gitea.stateDir}/.gnupg/gpg.conf | grep -q ${signingKey}; then
-        echo "Keys already imported"
-        # imported
-      else
-        echo "Import your keys!"
-        ${pkgs.gnupg}/bin/gpg --quiet --import ${secrets."gitea/signing-key".path}
-        echo "trusted-key ${signingKey}" >> ${config.services.gitea.stateDir}/.gnupg/gpg.conf
-        exit 1
-      fi
-    '';
+    preStart =
+      let
+        configFile = "${config.services.forgejo.customDir}/conf/app.ini";
+      in
+      ''
+        # Update minio secret key
+        chmod u+w ${configFile} && \
+        ${lib.getExe pkgs.replace-secret} '#miniosecretkey#' '${config.sops.secrets."gitea/minio-secret-key".path}' '${configFile}' && \
+        chmod u-w ${configFile}
+        # Import the signing subkey
+        if cat ${config.services.forgejo.stateDir}/.gnupg/gpg.conf | grep -q ${signingKey}; then
+          echo "Keys already imported"
+          # imported
+        else
+          echo "Import your keys!"
+          ${pkgs.gnupg}/bin/gpg --quiet --import ${secrets."gitea/signing-key".path}
+          echo "trusted-key ${signingKey}" >> ${config.services.forgejo.stateDir}/.gnupg/gpg.conf
+          exit 1
+        fi
+      '';
  };
 }
--- a/nki-personal-do/hardware-configuration.nix
+++ b/nki-personal-do/hardware-configuration.nix
@ -9,9 +9,11 @@
  swapDevices = [{ device = "/var/swapfile"; size = 4 * 1024; priority = 1024; }];
  zramSwap.enable = true;
  # volumes
+  services.btrfs.autoScrub.enable = true;
  fileSystems.data = {
-    device = "/dev/disk/by-id/scsi-0HC_Volume_31812942";
-    fsType = "ext4";
+    device = "/dev/disk/by-id/scsi-0HC_Volume_101470796";
+    fsType = "btrfs";
    mountPoint = "/mnt/data";
+    options = [ "compress=zstd" ];
  };
 }
--- a/nki-personal-do/nextcloud.nix
+++ b/nki-personal-do/nextcloud.nix
@ -1,67 +0,0 @@
-{ lib, pkgs, config, ... }:
-with lib;
-let
-  user = "nextcloud";
-  host = "cloud.dtth.ch";
-  port = 61155;
-
-  secrets = config.sops.secrets;
-in
-{
-  sops.secrets."nextcloud/admin-password" = { owner = user; };
-  sops.secrets."nextcloud/minio-secret-key" = { owner = user; key = "minio-secret-key"; };
-  # database
-  cloud.postgresql.databases = [ user ];
-  # traefik
-  cloud.traefik.hosts.nextcloud = {
-    inherit port host;
-  };
-  systemd.services.nextcloud.requires = [ "postgresql.service" ];
-  services.nextcloud = {
-    enable = true;
-    hostName = host;
-    package = pkgs.nextcloud26;
-    enableBrokenCiphersForSSE = false;
-
-    home = "/mnt/data/nextcloud";
-    https = true;
-    database.createLocally = false;
-
-    extraApps = with pkgs.nextcloud26Packages.apps; {
-      inherit calendar contacts deck forms groupfolders news tasks;
-      sociallogin = pkgs.fetchNextcloudApp rec {
-        url = "https://github.com/zorn-v/nextcloud-social-login/releases/download/v5.4.3/release.tar.gz";
-        sha256 = "sha256-ZKwtF9j9WFIk3MZgng9DmN00A73S2Rb4qbehL9adaZo=";
-      };
-    };
-
-    config = {
-      # Database
-      dbtype = "pgsql";
-      dbname = user;
-      dbuser = user;
-      dbhost = "/run/postgresql";
-      # User
-      adminuser = "nki";
-      adminpassFile = secrets."nextcloud/admin-password".path;
-      # General
-      overwriteProtocol = "https";
-      defaultPhoneRegion = "VN";
-
-      objectstore.s3 = {
-        enable = true;
-        bucket = "nextcloud-dtth";
-        autocreate = true;
-        key = "minio";
-        secretFile = config.sops.secrets."nextcloud/minio-secret-key".path;
-        hostname = "s3.dtth.ch";
-        port = 443;
-        useSsl = true;
-        usePathStyle = true;
-        region = "us-east-1";
-      };
-    };
-  };
-  services.nginx.virtualHosts.${host}.listen = [{ inherit port; addr = "127.0.0.1"; }];
-}
-
--- a/nki-personal-do/outline.nix
+++ b/nki-personal-do/outline.nix
@ -0,0 +1,56 @@
+{ config, pkgs, ... }: {
+  sops.secrets.authentik-oidc-client-secret = { owner = "outline"; };
+  sops.secrets."outline/smtp-password" = { owner = "outline"; };
+  sops.secrets."outline/s3-secret-key" = { owner = "outline"; };
+
+  services.outline = {
+    enable = true;
+    package = pkgs.outline.overrideAttrs (attrs: {
+      patches = attrs.patches or [ ] ++ [
+        ../modules/cloud/outline/dtth-wiki.patch
+        ../modules/cloud/outline/r2.patch
+      ];
+    });
+    databaseUrl = "postgres://outline:outline@localhost/outline?sslmode=disable";
+    redisUrl = "local";
+    publicUrl = "https://wiki.dtth.ch";
+    port = 18729;
+    storage = {
+      accessKey = "6ef730e13f172d2ed6ed77f0b5b9bad9";
+      secretKeyFile = config.sops.secrets."outline/s3-secret-key".path;
+      region = "auto";
+      uploadBucketUrl = "https://60c0807121eb35ef52cdcd4a33735fa6.r2.cloudflarestorage.com";
+      uploadBucketName = "dtth-outline";
+      uploadMaxSize = 50 * 1024 * 1000;
+    };
+    maximumImportSize = 50 * 1024 * 1000;
+
+    oidcAuthentication = {
+      clientId = "3a0c10e00cdcb4a1194315577fa208a747c1a5f7";
+      clientSecretFile = config.sops.secrets.authentik-oidc-client-secret.path;
+      authUrl = "https://auth.dtth.ch/application/o/authorize/";
+      tokenUrl = "https://auth.dtth.ch/application/o/token/";
+      userinfoUrl = "https://auth.dtth.ch/application/o/userinfo/";
+      displayName = "DTTH Account";
+    };
+
+    smtp = {
+      fromEmail = "DTTH Wiki <dtth.wiki@nkagami.me>";
+      replyEmail = "";
+      host = "mx1.nkagami.me";
+      username = "dtth.wiki@nkagami.me";
+      passwordFile = config.sops.secrets."outline/smtp-password".path;
+      port = 465;
+      secure = true;
+    };
+
+    forceHttps = false;
+  };
+  cloud.postgresql.databases = [ "outline" ];
+  systemd.services.outline.requires = [ "postgresql.service" ];
+  systemd.services.outline.environment = {
+    AWS_S3_R2 = "true";
+    AWS_S3_R2_PUBLIC_URL = "https://s3.wiki.dtth.ch";
+  };
+  cloud.traefik.hosts.outline = { host = "wiki.dtth.ch"; port = 18729; };
+}
--- a/nki-personal-do/secrets/secrets.yaml
+++ b/nki-personal-do/secrets/secrets.yaml
--- a/nki-x1c1/hardware-configuration.nix
+++ b/nki-x1c1/hardware-configuration.nix
@ -36,6 +36,4 @@
    [{ device = "/dev/disk/by-uuid/2694d189-2ff6-4719-a449-367c52ed3ad6"; }];

  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-
-  hardware.opengl.enable = true;
 }
--- a/nki-yoga-g8/configuration.nix
+++ b/nki-yoga-g8/configuration.nix
@ -15,7 +15,24 @@
      ../modules/services/edns
    ];

-  services.xserver.desktopManager.plasma6.enable = true;
+  # Secrets
+  common.linux.sops.enable = true;
+  common.linux.sops.file = ./secrets.yaml;
+
+  # Build farm
+  sops.secrets."nix-build-farm/private-key" = { mode = "0400"; };
+  services.nix-build-farm.hostname = "yoga";
+  services.nix-build-farm.privateKeyFile = config.sops.secrets."nix-build-farm/private-key".path;
+
+  ## tinc
+  sops.secrets."tinc-private-key" = { };
+  services.my-tinc = {
+    enable = true;
+    hostName = "yoga";
+    ed25519PrivateKey = config.sops.secrets."tinc-private-key".path;
+  };
+
+  services.desktopManager.plasma6.enable = true;

  # Power Management
  services.upower = {
--- a/nki-yoga-g8/secrets.yaml
+++ b/nki-yoga-g8/secrets.yaml
@ -0,0 +1,32 @@
+tinc-private-key: ENC[AES256_GCM,data:lzmisexQPfRlIMGqbmb+uqGtOPceQ3CJGlVOeOC6nbP/IDwkufSWtxugYmUwi9IJKwO0mldijiKWuG3p9005H++8567hhPy/bU7fA4vyVC+3UVGW6l0mE+yKQXTyI7kzxkXMCK5a4Q4rUJj544vU6pt75/mytfg+Cox2woGZAHZvJ/pRuHDe2t3R6w3EYYTu6x1w5azGnFvCOVdR6XPsGJA2p3oRnEpz64L7KD2QOdtm0YsfMnorH9FbvkZgNr927VbRnBRJ1QM=,iv:4K4w6ruQxtRGjmFnWszlXZKp36TuTTnrB0sDEE/tmrM=,tag:NBP897Sw84bvZTvo/+fVfA==,type:str]
+nix-build-farm:
+    private-key: ENC[AES256_GCM,data:etqFl2T2atN2djxqktFRtrTGqsC61A+ZUd2yS0PLm5KPO2s2/k6XqQGac9rUWP86C1YGpTJhUMzYuOPGW4yNc0YmoeHVslxBR7nX8pubXabZNdB2YMm/yAgsdeeflo4slbxJ6+00eH0iCrtWcHtWbZafHnxojborZABOvCsODdx/ahJ4J9aHqf22cAqe9iJY3L0TgE+iazKS8OO+C/PTaQiV02NZjP8GajRMXzPVoYT7wz3u0t0q0m/t8FkhMIDl9QKL+kFUDeLEGoCBzR57JXLZiW1gJsRxbkP8hVIB3s4TQnhasxqQQlCJuqBSNFl/cGdBm/ADm/yi78VHQG7rUxUrFVDL4Aoidjp6GyoojLIEpdQjtlvC7RCLNpTibV6B71EB3obpjMmmIwfoDLT4jEWhXNx3b8DnMoa0Qh4ba+HBJf+XKA93B0qOJWwJzj4qH9uqBK3xPOGTkqQMmd9M1HYrStTcI/JUX0WvEMwk8xI8MZN/TsLij4w5i6NCwSqa8Dn2lyLK0BGp5C8RT8R4k6U2ieyY6lmxsGIe,iv:703rM/FQz65upd1JWTHNsjAXh2BeoknkALShKuHUsis=,tag:yAB6KJqpm1mOFT5GzKRPBw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vhjhmxura35apu5zdwg5ur5r40xay45ld9szh07dy0ph9chgsu7shfm4h9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBseVN3ODV1YkZnNms0Y09l
+            dUFBK1EyOTEydWg5KzAwcjZVSG8yYlRDWlhRCklLS2ZJNlBvSlEyOGF2ZFg2UGVW
+            UC9LN0hxdmtGN3JlOWJaTU5hbGwvc2MKLS0tIGM1NGZxd1NoTXNacEJqMVlsbTdi
+            MytuNUNydmJYWFYyQk9DaHVuVk85cjAKScucMPO8pyMlSxFw09NqzqVmDYVEh5xT
+            4fSTAsMwIiuOyV7jvHYORxKWNMLr5t6fnj8+OFq5qUc//jNWf9pVuA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1axvjllyv2gutngwmp3pvp4xtq2gqneldaq2c4nrzmaye0uwmk9lqsealdv
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYNXp6MWZGb2dGdW1ML2xq
+            ZWMvSVdWalQ5Z2NzTWd3Z1AweXlXZnRwUWtRCkY1VFhPS0NtbFZKU0VCMlAvSmhG
+            N2NmdWxTUEpMb05Ld3p6MzhhRkdBc3cKLS0tIGQ0TmFxdk1GV205azRzZ0hUWitj
+            eitNc1E2SzY5bkUxNWtNczRsWWJaU2MKUIu9GT7zu0MvvnXxiQfLW9pQcxFKOwPm
+            VRU2k3XQkYjSDZX29DxrOzaPS/L3OYNyBYMyOW8GyMa2V12lMH6lPQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-08-16T14:17:07Z"
+    mac: ENC[AES256_GCM,data:qrMyVDLhtK4URqrHFBx+08PMrFyfib4iH0y7iAeVB/oFGazjm3O5MeS9fNYJeONghuelux69nh2FRfSJHG/moEBcWlL68R4xbCb4he528P+n7mQnR54BNFJdT2oOra4bqO9n/4m2UA8jmA0veoqSrZUVjnmjftqOedjnRESY1L8=,iv:jql79ItwPcJg/nnbsUywOzWz/UJy0ZpY04pvEF290c4=,tag:XKrToym2dXdippnivoK1/Q==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1
--- a/overlay.nix
+++ b/overlay.nix
@ -1,6 +1,7 @@
-{ nixpkgs, nixpkgs-unstable, nur, ... }@inputs:
+{ nixpkgs, nixpkgs-unstable, ... }@inputs:
 let
  overlay-unstable = final: prev: {
+    stable = import nixpkgs { config.allowUnfree = true; system = prev.system; };
    unstable = import nixpkgs-unstable { config.allowUnfree = true; system = prev.system; };
    x86 = import nixpkgs-unstable { system = prev.system; config.allowUnsupportedSystem = true; };
  };
@ -24,7 +25,7 @@ let

  overlay-versioning = final: prev: {
    gotosocial = prev.gotosocial.overrideAttrs (attrs: rec {
-      version = "0.16.0";
+      version = "0.17.1";
      ldflags = [
        "-s"
        "-w"
@ -34,13 +35,13 @@ let

      web-assets = final.fetchurl {
        url = "https://github.com/superseriousbusiness/gotosocial/releases/download/v${version}/gotosocial_${version}_web-assets.tar.gz";
-        hash = "sha256-aZQpd5KvoZvXEMVzGbWrtGsc+P1JStjZ6U5mX6q7Vb0=";
+        hash = "sha256-rGntLlIbgfCtdqpD7tnvAY8qwF+BpYbQWfAGMhdOTgY=";
      };
      src = final.fetchFromGitHub {
        owner = "superseriousbusiness";
        repo = "gotosocial";
        rev = "v${version}";
-        hash = "sha256-QoG09+jmq5e5vxDVtkhY35098W/9B1HsYTuUnz43LV4=";
+        hash = "sha256-oWWsCs9jgd244yzWhgLkuHp7kY0BQ8+Ay6KpuBVG+U8=";
      };
      postInstall = ''
        tar xf ${web-assets}
@ -86,6 +87,13 @@ let
        })
      ];
    };
+
+    # https://github.com/NixOS/nixpkgs/issues/334822
+    vulkan-validation-layers = prev.vulkan-validation-layers.overrideAttrs (attrs: {
+      buildInputs = attrs.buildInputs ++ [
+        final.spirv-tools
+      ];
+    });
  };

  overlay-libs = final: prev: {
@ -108,39 +116,24 @@ let
      };
  };

-  overlay-aarch64-linux = final: prev:
-    let
-      optionalOverride = pkg: alt:
-        if prev.stdenv.isLinux && prev.stdenv.isAarch64 then alt else pkg;
-    in
-    {
-      # See https://github.com/sharkdp/fd/issues/1085
-      fd = optionalOverride prev.fd (prev.fd.overrideAttrs (attrs: {
-        preBuild = ''
-          export JEMALLOC_SYS_WITH_LG_PAGE=16
-        '';
-      }));
-      # See https://www.reddit.com/r/AsahiLinux/comments/zqejue/kitty_not_working_with_mesaasahiedge/
-      kitty = optionalOverride prev.kitty (final.writeShellApplication {
-        name = "kitty";
-        runtimeInputs = [ ];
-        text = ''
-          MESA_GL_VERSION_OVERRIDE=3.3 MESA_GLSL_VERSION_OVERRIDE=330 ${prev.kitty}/bin/kitty "$@"
-        '';
-      });
-      # Zotero does not have their own aarch64-linux build
-      zotero = optionalOverride prev.zotero (final.callPackage ./packages/aarch64-linux/zotero.nix { });
-      # Typora for aarch64-linux only
-      typora = optionalOverride
-        (builtins.abort "no support for non-aarch64-linux")
-        (final.callPackage ./packages/aarch64-linux/typora.nix { });
-    };
-
-  overlay-asahi = inputs.nixos-m1.overlays.default;
+  overlay-rust-is-dumb = final: prev: {
+    # Use stable delta compiled with old Rust version
+    delta = final.stable.delta;
+    deepfilternet = final.stable.deepfilternet;
+    harmonia = final.callPackage
+      (import
+        (builtins.fetchurl {
+          url = "https://raw.githubusercontent.com/Mic92/nixpkgs/63f91202f5cd071187ede5e5ffc56003cb442876/pkgs/by-name/ha/harmonia/package.nix";
+          sha256 = "1mz211c0bxn116ix0j5xx4wlglpbkfg7d3npw1z8hg9gc0vbj2xb";
+        }))
+      { };
+  };
 in
 [
-  inputs.swayfx.overlays.default
+  # inputs.swayfx.inputs.scenefx.overlays.override
+  # inputs.swayfx.overlays.override
  inputs.mpd-mpris.overlays.default
+  inputs.rust-overlay.overlays.default
  inputs.youmubot.overlays.default

  (import ./overlays/openrazer)
@ -150,9 +143,7 @@ in
  overlay-imported
  overlay-versioning
  overlay-libs
-  overlay-asahi
-  overlay-aarch64-linux
-  nur.overlay
+  overlay-rust-is-dumb

  (import ./packages/common)
Author	SHA1	Message	Date
Natsu Kagami	baa3d1cd0d	Update youmubot	2024-11-10 23:13:35 +01:00
Natsu Kagami	cd4a9807cb	Update nixpkgs	2024-11-04 18:23:59 +01:00
Natsu Kagami	f98b48a5e3	Update nixpkgs	2024-11-01 16:27:41 +01:00
Natsu Kagami	fc57e77340	Update zotero and add zoom	2024-11-01 16:27:37 +01:00
Natsu Kagami	dc49540f8d	Update youmubot	2024-10-31 14:10:47 +01:00
Natsu Kagami	c36f5f66b1	Move stuff to various S3 stores instead of local minio (#5 ) Move most things to Cloudflare R2, whilst gotosocial goes to local. Reviewed-on: #5 Co-authored-by: Natsu Kagami <nki@nkagami.me> Co-committed-by: Natsu Kagami <nki@nkagami.me>	2024-10-31 13:04:58 +00:00
Natsu Kagami	8702656b24	Update gotosocial to 0.17.0	2024-10-19 20:06:00 +02:00
Natsu Kagami	02ea7e95b7	Update osu	2024-10-17 11:36:39 +02:00
Natsu Kagami	22d1dbebe6	Update youmubot	2024-10-13 22:41:50 +02:00
Natsu Kagami	c14aab4a8f	Update phanpy and gts	2024-10-12 17:08:29 +02:00
Natsu Kagami	d99d57f53e	Update nixpkgs-unstable, add scala to common	2024-10-10 17:01:14 +02:00
Natsu Kagami	267f135972	Enhance nx and nsh to support unstable and git nixpkgs	2024-10-10 16:59:52 +02:00
Natsu Kagami	600ba660c9	Add compatibility workarounds for 24.05	2024-10-09 11:47:29 +02:00
Natsu Kagami	55397974b4	Update conduit to v0.9	2024-10-07 22:53:57 +02:00
Natsu Kagami	2f7179e7d5	Update youmubot	2024-10-07 22:36:03 +02:00
Natsu Kagami	2c54a0a9a1	sway: only import menu prefix if we have plasma	2024-09-28 15:23:25 +02:00
Natsu Kagami	21947fd510	kitty: use themeFile instead of just theme	2024-09-28 15:05:23 +02:00
Natsu Kagami	097a0efd90	Update nixpkgs-unstable and home-manager	2024-09-28 15:03:51 +02:00
Natsu Kagami	5cc543c9db	Suspend then hibernate on lid switch	2024-09-28 14:25:10 +02:00
Natsu Kagami	6a1deaae36	Export XDG_MENU_PREFIX as plasma- in sway	2024-09-27 11:51:27 +02:00
Natsu Kagami	5af862a4ad	Move pls to fish.functions definition	2024-09-27 11:51:03 +02:00
Natsu Kagami	a1bd5600a9	Disable avahi	2024-09-27 10:43:48 +02:00
Natsu Kagami	a59fa31628	Update authentik	2024-09-25 09:33:40 +02:00
Natsu Kagami	81b549a670	Update nixpkgs	2024-09-24 14:28:04 +02:00
Natsu Kagami	17e66e339c	Create notifications for pls	2024-09-22 15:46:35 +02:00
Natsu Kagami	63c2616c0f	Update nixpkgs-unstable	2024-09-22 15:07:48 +02:00
Natsu Kagami	bc5de8bc77	Update youmubot	2024-09-14 18:16:54 +02:00
Natsu Kagami	177f0f686e	Set timezone to just default	2024-09-14 15:58:13 +03:00
Natsu Kagami	4fe33b7e80	Use new vpn format	2024-09-14 15:58:13 +03:00
Natsu Kagami	5ecad94dcb	Update nixpkgs	2024-09-11 11:57:52 +02:00
Natsu Kagami	84fa06937c	Update youmubot	2024-08-24 23:50:19 +02:00
Natsu Kagami	08d0c7aea3	Enable gamemode	2024-08-24 23:22:08 +02:00
Natsu Kagami	5b85a94be7	Update crane	2024-08-19 17:53:03 +02:00
Natsu Kagami	40d325218f	Update nix-gaming	2024-08-19 17:36:28 +02:00
Natsu Kagami	db7e115863	Update home manager	2024-08-19 17:34:33 +02:00
Natsu Kagami	59f9ae8d5b	Remove NUR	2024-08-19 17:28:08 +02:00
Natsu Kagami	fbe19bac34	Update nixpkgs	2024-08-19 17:25:24 +02:00
Natsu Kagami	bc4cfe7c69	Set up build farm (#3 ) Reviewed-on: #3 Co-authored-by: Natsu Kagami <nki@nkagami.me> Co-committed-by: Natsu Kagami <nki@nkagami.me>	2024-08-19 14:04:52 +00:00
Natsu Kagami	70ab3aa5b3	Update osu	2024-08-17 17:03:07 +02:00
Natsu Kagami	41f717c5be	Properly configure firewall to allow tinc to pass through	2024-08-16 15:02:25 +02:00
Natsu Kagami	9fecd353f8	Add nix cache implementation	2024-08-16 14:36:11 +02:00
Natsu Kagami	f0807443fd	Resolve tinc hosts with subdomains too	2024-08-16 14:13:30 +02:00
Natsu Kagami	b1db7229cd	Remove conflicting secrets config	2024-08-16 14:13:05 +02:00
Natsu Kagami	f4c514baa6	Set up tinc for framework	2024-08-15 18:37:13 +02:00
Natsu Kagami	58a49a71a8	Get things to work	2024-08-15 18:11:33 +02:00
Natsu Kagami	e8424a0d21	Update lix	2024-08-15 17:18:29 +02:00
Natsu Kagami	81d3c1dcd1	Update nixpkgs	2024-08-15 17:16:06 +02:00
Natsu Kagami	08111c8f13	Use stable kernel until mesa is fixed	2024-08-13 18:31:43 +02:00
Natsu Kagami	5d2f127bcc	Remove obsolete parameters	2024-08-13 18:31:43 +02:00
Natsu Kagami	a490d5a5ef	Use nixpkgs swayfx	2024-08-13 18:31:43 +02:00
Natsu Kagami	a5df4c0b58	Update authentik and phanpy	2024-08-12 15:53:47 +02:00
Natsu Kagami	73d9b5fb4e	Update nixpkgs and move postgresql	2024-08-12 15:21:11 +02:00
Natsu Kagami	e772814eed	Clean up deprecated config	2024-08-07 14:52:11 +02:00
Natsu Kagami	7b53f1d945	Update youmubot	2024-08-07 14:30:39 +02:00
Natsu Kagami	167d1dddb8	Update youmubot	2024-08-05 13:44:55 +02:00
Natsu Kagami	472daa8e59	Migrate gitea	2024-08-05 13:31:59 +02:00
Natsu Kagami	d18a5ca503	Update youmubot	2024-08-04 23:14:01 +02:00
Natsu Kagami	f164a27290	Update nixpkgs	2024-08-04 22:50:17 +02:00
Natsu Kagami	0887487c29	Update osu	2024-08-04 22:49:04 +02:00
Natsu Kagami	0b2e4feebb	Update thunderbird to 128	2024-08-04 22:49:04 +02:00
Natsu Kagami	8ec79eac11	Update to address home-manager config changes	2024-08-02 18:35:31 +02:00
Natsu Kagami	07478138d9	Update to address nixpkgs depreations	2024-08-02 18:27:48 +02:00
Natsu Kagami	45e90570b7	Add power_profiles prompt to framework	2024-08-02 18:12:11 +02:00
Natsu Kagami	28080d31c0	Set up special indentation for crab	2024-07-29 17:07:15 +02:00
Natsu Kagami	e82627e317	Update nixpkgs	2024-07-29 13:56:11 +02:00
Natsu Kagami	228db93202	Update nixpkgs and youmubot	2024-07-24 03:02:03 +02:00
Natsu Kagami	fec7f40440	Add yoga to tinc	2024-07-23 18:27:08 +02:00
Natsu Kagami	38c7afa96f	Update nixpkgs	2024-07-22 20:03:03 +02:00
Natsu Kagami	581093ff78	Add hylo to tree-sitter	2024-07-22 17:37:20 +02:00
				`@ -0,0 +1 @@`
				`nix.home.tinc:zG2uDy0MbLY0wLuoVH/qKzTD6hTfKZufA2cWDSTCZMA=`