Add associations for telegram

Use latest kernel on framework
Update templ and vscode langservers
2024-12-30 14:05:13 +01:00 · 2024-12-30 14:05:05 +01:00 · 2024-12-30 14:03:29 +01:00 · 2024-12-30 14:03:29 +01:00 · 2024-12-30 14:03:27 +01:00 · 2024-12-30 14:02:42 +01:00
32 changed files with 2275 additions and 213 deletions
--- a/flake.lock
+++ b/flake.lock
@ -133,29 +133,17 @@
    },
    "crane_4": {
      "inputs": {
-        "flake-compat": [
-          "lanzaboote",
-          "flake-compat"
-        ],
-        "flake-utils": [
-          "lanzaboote",
-          "flake-utils"
-        ],
        "nixpkgs": [
          "lanzaboote",
          "nixpkgs"
-        ],
-        "rust-overlay": [
-          "lanzaboote",
-          "rust-overlay"
        ]
      },
      "locked": {
-        "lastModified": 1681177078,
-        "narHash": "sha256-ZNIjBDou2GOabcpctiQykEQVkI8BDwk7TyvlWlI4myE=",
+        "lastModified": 1717535930,
+        "narHash": "sha256-1hZ/txnbd/RmiBPNUs7i8UQw2N89uAK3UzrGAWdnFfU=",
        "owner": "ipetkov",
        "repo": "crane",
-        "rev": "0c9f468ff00576577d83f5019a66c557ede5acf6",
+        "rev": "55e7754ec31dac78980c8be45f8a28e80e370946",
        "type": "github"
      },
      "original": {
@ -319,11 +307,11 @@
    "flake-compat_4": {
      "flake": false,
      "locked": {
-        "lastModified": 1673956053,
-        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
        "owner": "edolstra",
        "repo": "flake-compat",
-        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
        "type": "github"
      },
      "original": {
@ -416,11 +404,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1680392223,
-        "narHash": "sha256-n3g7QFr85lDODKt250rkZj2IFS3i4/8HBU2yKHO3tqw=",
+        "lastModified": 1717285511,
+        "narHash": "sha256-iKzJcpdXih14qYVcZ9QC9XuZYnPc6T8YImb6dX166kw=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "dcc36e45d054d7bb554c9cdab69093debd91a0b5",
+        "rev": "2a55567fcf15b1b1c7ed712a2c6fadaec7412ea8",
        "type": "github"
      },
      "original": {
@ -521,11 +509,11 @@
        "systems": "systems_5"
      },
      "locked": {
-        "lastModified": 1681202837,
-        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
        "type": "github"
      },
      "original": {
@ -627,11 +615,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1660459072,
-        "narHash": "sha256-8DFJjXG8zqoONA1vXtgeKXy68KdJL5UaXR8NtVMUbx8=",
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
        "owner": "hercules-ci",
        "repo": "gitignore.nix",
-        "rev": "a20de23b925fd8264fd7fad6454652e142fd7f73",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
        "type": "github"
      },
      "original": {
@ -721,16 +709,16 @@
        ]
      },
      "locked": {
-        "lastModified": 1716736833,
-        "narHash": "sha256-rNObca6dm7Qs524O4st8VJH6pZ/Xe1gxl+Rx6mcWYo0=",
+        "lastModified": 1733050161,
+        "narHash": "sha256-lYnT+EYE47f5yY3KS/Kd4pJ6CO9fhCqumkYYkQ3TK20=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "a631666f5ec18271e86a5cde998cba68c33d9ac6",
+        "rev": "62d536255879be574ebfe9b87c4ac194febf47c5",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
-        "ref": "release-24.05",
+        "ref": "release-24.11",
        "repo": "home-manager",
        "type": "github"
      }
@ -742,11 +730,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1731887066,
-        "narHash": "sha256-uw7K/RsYioJicV79Nl39yjtfhdfTDU2aRxnBgvFhkZ8=",
+        "lastModified": 1732884235,
+        "narHash": "sha256-r8j6R3nrvwbT1aUp4EPQ1KC7gm0pu9VcV1aNaB+XG6Q=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "f3a2ff69586f3a54b461526e5702b1a2f81e740a",
+        "rev": "819f682269f4e002884702b87e445c82840c68f2",
        "type": "github"
      },
      "original": {
@ -800,16 +788,16 @@
        "rust-overlay": "rust-overlay"
      },
      "locked": {
-        "lastModified": 1682802423,
-        "narHash": "sha256-Fb5TeRTdvUlo/5Yi2d+FC8a6KoRLk2h1VE0/peMhWPs=",
+        "lastModified": 1718178907,
+        "narHash": "sha256-eSZyrQ9uoPB9iPQ8Y5H7gAmAgAvCw3InStmU3oEjqsE=",
        "owner": "nix-community",
        "repo": "lanzaboote",
-        "rev": "64b903ca87d18cef2752c19c098af275c6e51d63",
+        "rev": "b627ccd97d0159214cee5c7db1412b75e4be6086",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
-        "ref": "v0.3.0",
+        "ref": "v0.4.1",
        "repo": "lanzaboote",
        "type": "github"
      }
@ -1006,27 +994,27 @@
    },
    "nixpkgs-stable_2": {
      "locked": {
-        "lastModified": 1678872516,
-        "narHash": "sha256-/E1YwtMtFAu2KUQKV/1+KFuReYPANM2Rzehk84VxVoc=",
+        "lastModified": 1710695816,
+        "narHash": "sha256-3Eh7fhEID17pv9ZxrPwCLfqXnYP006RKzSs0JptsN84=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "9b8e5abb18324c7fe9f07cb100c3cd4a29cda8b8",
+        "rev": "614b4613980a522ba49f0d194531beddbb7220d3",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixos-22.11",
+        "ref": "nixos-23.11",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1731890469,
-        "narHash": "sha256-D1FNZ70NmQEwNxpSSdTXCSklBH1z2isPR84J6DQrJGs=",
+        "lastModified": 1734126203,
+        "narHash": "sha256-0XovF7BYP50rTD2v4r55tR5MuBLet7q4xIz6Rgh3BBU=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "5083ec887760adfe12af64830a66807423a859a7",
+        "rev": "71a6392e367b08525ee710a93af2e80083b5b3e2",
        "type": "github"
      },
      "original": {
@ -1052,6 +1040,22 @@
        "type": "github"
      }
    },
+    "nixpkgs_11": {
+      "locked": {
+        "lastModified": 1734424634,
+        "narHash": "sha256-cHar1vqHOOyC7f1+tVycPoWTfKIaqkoe1Q6TnKzuti4=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "d3c42f187194c26d9f0309a8ecc469d6c878ce33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
    "nixpkgs_2": {
      "locked": {
        "lastModified": 1676300157,
@ -1166,16 +1170,16 @@
    },
    "nixpkgs_9": {
      "locked": {
-        "lastModified": 1731239293,
-        "narHash": "sha256-q2yjIWFFcTzp5REWQUOU9L6kHdCDmFDpqeix86SOvDc=",
+        "lastModified": 1734083684,
+        "narHash": "sha256-5fNndbndxSx5d+C/D0p/VF32xDiJCJzyOqorOYW4JEo=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "9256f7c71a195ebe7a218043d9f93390d49e6884",
+        "rev": "314e12ba369ccdb9b352a4db26ff419f7c49fa84",
        "type": "github"
      },
      "original": {
        "owner": "nixos",
-        "ref": "nixos-24.05",
+        "ref": "nixos-24.11",
        "repo": "nixpkgs",
        "type": "github"
      }
@ -1186,10 +1190,6 @@
          "lanzaboote",
          "flake-compat"
        ],
-        "flake-utils": [
-          "lanzaboote",
-          "flake-utils"
-        ],
        "gitignore": "gitignore",
        "nixpkgs": [
          "lanzaboote",
@ -1198,11 +1198,11 @@
        "nixpkgs-stable": "nixpkgs-stable_2"
      },
      "locked": {
-        "lastModified": 1681413034,
-        "narHash": "sha256-/t7OjNQcNkeWeSq/CFLYVBfm+IEnkjoSm9iKvArnUUI=",
+        "lastModified": 1717664902,
+        "narHash": "sha256-7XfBuLULizXjXfBYy/VV+SpYMHreNRHk9nKMsm1bgb4=",
        "owner": "cachix",
        "repo": "pre-commit-hooks.nix",
-        "rev": "d3de8f69ca88fb6f8b09e5b598be5ac98d28ede5",
+        "rev": "cc4d466cb1254af050ff7bdf47f6d404a7c646d1",
        "type": "github"
      },
      "original": {
@ -1235,7 +1235,8 @@
        "rust-overlay": "rust-overlay_3",
        "secrets": "secrets",
        "sops-nix": "sops-nix",
-        "youmubot": "youmubot"
+        "youmubot": "youmubot",
+        "zen-browser": "zen-browser"
      }
    },
    "rust-analyzer-src": {
@ -1267,11 +1268,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1682129965,
-        "narHash": "sha256-1KRPIorEL6pLpJR04FwAqqnt4Tzcm4MqD84yhlD+XSk=",
+        "lastModified": 1717813066,
+        "narHash": "sha256-wqbRwq3i7g5EHIui0bIi84mdqZ/It1AXBSLJ5tafD28=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "2c417c0460b788328220120c698630947547ee83",
+        "rev": "6dc3e45fe4aee36efeed24d64fc68b1f989d5465",
        "type": "github"
      },
      "original": {
@ -1561,6 +1562,66 @@
        "repo": "youmubot",
        "type": "github"
      }
+    },
+    "zen-browser": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_11",
+        "zen-browser-aarch64": "zen-browser-aarch64",
+        "zen-browser-generic": "zen-browser-generic",
+        "zen-browser-specific": "zen-browser-specific"
+      },
+      "locked": {
+        "lastModified": 1734667644,
+        "narHash": "sha256-vluyzRt6RikEn78Yk0t7Qd96iZZfyRBt4+ESI0mtlhk=",
+        "owner": "youwen5",
+        "repo": "zen-browser-flake",
+        "rev": "8c8af380bf45b42ae14b2f6d5252be3627332f23",
+        "type": "github"
+      },
+      "original": {
+        "owner": "youwen5",
+        "repo": "zen-browser-flake",
+        "type": "github"
+      }
+    },
+    "zen-browser-aarch64": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1734641206,
+        "narHash": "sha256-F5FwGqAgL4kfEy5rNWvofRQl8SH0udQvEIMhysRMDgs=",
+        "type": "tarball",
+        "url": "https://github.com/zen-browser/desktop/releases/download/1.0.2-b.3/zen.linux-aarch64.tar.bz2"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://github.com/zen-browser/desktop/releases/download/1.0.2-b.3/zen.linux-aarch64.tar.bz2"
+      }
+    },
+    "zen-browser-generic": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1734646830,
+        "narHash": "sha256-slIWuEWSV9PK1JTr6UKKC+VP4oLNaczwkxkYiqcjZM8=",
+        "type": "tarball",
+        "url": "https://github.com/zen-browser/desktop/releases/download/1.0.2-b.3/zen.linux-generic.tar.bz2"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://github.com/zen-browser/desktop/releases/download/1.0.2-b.3/zen.linux-generic.tar.bz2"
+      }
+    },
+    "zen-browser-specific": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1734645803,
+        "narHash": "sha256-zAo93sHeB8cTW2JBAqxx0wo3CANcxCgjEcTQgbDeWT4=",
+        "type": "tarball",
+        "url": "https://github.com/zen-browser/desktop/releases/download/1.0.2-b.3/zen.linux-specific.tar.bz2"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://github.com/zen-browser/desktop/releases/download/1.0.2-b.3/zen.linux-specific.tar.bz2"
+      }
    }
  },
  "root": "root",
--- a/flake.nix
+++ b/flake.nix
@ -2,12 +2,12 @@
  description = "nki's systems";

  inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixpkgs-unstable";
    nixos-hardware.url = "github:nixos/nixos-hardware";
    darwin.url = "github:lnl7/nix-darwin/master";
    darwin.inputs.nixpkgs.follows = "nixpkgs-unstable";
-    home-manager.url = "github:nix-community/home-manager/release-24.05";
+    home-manager.url = "github:nix-community/home-manager/release-24.11";
    home-manager.inputs.nixpkgs.follows = "nixpkgs";
    home-manager-unstable.url = "github:nix-community/home-manager";
    home-manager-unstable.inputs.nixpkgs.follows = "nixpkgs-unstable";
@ -18,7 +18,7 @@

    # --- Secure boot
    lanzaboote = {
-      url = github:nix-community/lanzaboote/v0.3.0;
+      url = github:nix-community/lanzaboote/v0.4.1;
      inputs.nixpkgs.follows = "nixpkgs";
    };

@ -49,6 +49,7 @@
    dtth-phanpy.url = "git+ssh://gitea@git.dtth.ch/nki-dtth/phanpy?ref=dtth-fork";
    conduit.url = "gitlab:famedly/conduit/v0.9.0";
    nix-gaming.url = github:fufexan/nix-gaming;
+    zen-browser.url = "github:youwen5/zen-browser-flake";

    # --- Sources
    kakoune.url = github:mawww/kakoune;
--- a/home/common.nix
+++ b/home/common.nix
@ -26,6 +26,7 @@
    ripgrep
    openssh
    tea # gitea CLI (gh-like)
+    glab # gitlab CLI
    fx # JSON viewer
    glow # Markdown viewer
    nix-output-monitor # Nice nix output formatting
--- a/home/kakoune.nix
+++ b/home/kakoune.nix
@ -17,7 +17,6 @@ in
  # Enable the kakoune package.
  programs.my-kakoune.enable = true;
  programs.my-kakoune.enable-fish-session = true;
-
  programs.my-kakoune.tree-sitter.extraAliases = {
    # Scala stuff
    method = "function";
--- a/home/modules/linux/graphical/default.nix
+++ b/home/modules/linux/graphical/default.nix
@ -131,6 +131,8 @@ in
      "x-scheme-handler/feed" = [ "thunderbird.desktop" ];
      "application/rss+xml" = [ "thunderbird.desktop" ];
      "application/x-extension-rss" = [ "thunderbird.desktop" ];
+      "x-scheme-handler/tg2" = [ "org.telegram.desktop.desktop" ];
+      "x-scheme-handler/tonsite2" = [ "org.telegram.desktop.desktop" ];
    };
    xdg.mimeApps.defaultApplications = {
      # Email
@ -167,6 +169,10 @@ in

      # Files
      "inode/directory" = [ "dolphin.desktop" ];
+
+      # Telegram
+      "x-scheme-handler/tg2" = "org.telegram.desktop.desktop";
+      "x-scheme-handler/tonsite2" = "org.telegram.desktop.desktop";
    };

    # Add one for kakoune
--- a/home/osu.nix
+++ b/home/osu.nix
@ -5,10 +5,10 @@ let
  osu-pkg = with pkgs; with lib;
    appimageTools.wrapType2 rec {
      pname = "osu-lazer-bin";
-      version = "2024.1115.3";
+      version = "2024.1219.2";
      src = fetchurl {
        url = "https://github.com/ppy/osu/releases/download/${version}/osu.AppImage";
-        sha256 = "sha256-kwZHy0FfOUFIWvyOj0ghlQz05U+Lnzl5TgC4T6bhm7o=";
+        hash = "sha256-gRUr7jf0+Xbfz8FurPk/o7F67TYisdNySNzVWEMb1es=";
      };
      extraPkgs = pkgs: with pkgs; [ icu ];

@ -19,7 +19,7 @@ let
          mv -v $out/bin/${pname} $out/bin/osu\!
          install -m 444 -D ${contents}/osu\!.desktop -t $out/share/applications
          for i in 16 32 48 64 96 128 256 512 1024; do
-            install -D ${contents}/osu\!.png $out/share/icons/hicolor/''${i}x$i/apps/osu\!.png
+            install -D ${contents}/osu.png $out/share/icons/hicolor/''${i}x$i/apps/osu.png
          done
        '';
    };
--- a/modules/cloud/authentik/default.nix
+++ b/modules/cloud/authentik/default.nix
@ -22,8 +22,8 @@ let
    };
    authentik = mkImage {
      imageName = "ghcr.io/goauthentik/server";
-      finalImageTag = "2024.8.2";
-      imageDigest = "sha256:71984fdbb7a9414f5172bb446104d3fe4ab1ab412c8b3343bb97b04449dd53eb";
+      finalImageTag = "2024.1.0.4";
+      imageDigest = "sha256:5843c56a56be58dcee8927c705f8c9def0af7189511c0e8e687d430f543b0f6d";
    };
  };
  authentikEnv = pkgs.writeText "authentik.env" ''
@ -105,6 +105,7 @@ in
        ports = [
          "127.0.0.1:${toString cfg.port}:9000"
        ];
+
      };
      services.worker.service = {
        image = images.authentik;
@ -123,6 +124,7 @@ in
          AUTHENTIK_POSTGRESQL__NAME = "authentik";
        };
        env_file = [ cfg.envFile "${authentikEnv}" ];
+        user = "root";
      };
      docker-compose.volumes = {
        database.driver = "local";
--- a/modules/common/linux/default.nix
+++ b/modules/common/linux/default.nix
@ -26,15 +26,13 @@ let
      };
    };

-    graphics = { config, ... }: {
-      hardware =
-        if config.system.nixos.release == "24.05" then {
-          opengl.enable = true;
-          opengl.driSupport32Bit = true;
-        } else {
-          graphics.enable = true;
-          graphics.enable32Bit = true;
-        };
+    graphics = { config, pkgs, ... }: {
+      hardware.graphics.enable = true;
+      hardware.graphics.enable32Bit = true;
+      # Monitor backlight
+      hardware.i2c.enable = true;
+      services.ddccontrol.enable = true;
+      environment.systemPackages = [ pkgs.luminance pkgs.ddcutil ];
    };

    accounts = { pkgs, ... }: mkIf (config.common.linux.enable && !pkgs.stdenv.isAarch64) {
@ -89,7 +87,7 @@ let
      enable = true;
      # defaults (no need to be set unless modified)
      quantum = 32;
-      rate = 48000;
+      rate = 44100;
    };
    security.rtkit.enable = true;

@ -241,6 +239,8 @@ in
        "wheel" # Enable ‘sudo’ for the user.
        "plugdev" # Enable openrazer-daemon privileges
        "audio"
+        "video"
+        "input"
      ];
      shell = pkgs.fish;
    };
--- a/modules/personal/fonts/default.nix
+++ b/modules/personal/fonts/default.nix
@ -1,6 +1,13 @@
-{ pkgs, lib, ... }:
+{ pkgs, lib, config, ... }:

 with lib;
+let
+  nerd-fonts =
+    if builtins.hasAttr "nerd-fonts" pkgs then
+      pkgs.nerd-fonts.symbols-only
+    else
+      pkgs.nerdfonts.override { fonts = [ "NerdFontsSymbolsOnly" ]; };
+in
 {
  imports = [ ./mounting.nix ];
  # Fonts
@ -8,7 +15,7 @@ with lib;
    packages = with pkgs; mkForce [
      noto-fonts-emoji-blob-bin
      ibm-plex
-      (nerdfonts.override { fonts = [ "NerdFontsSymbolsOnly" ]; })
+      nerd-fonts
      noto-fonts
      (pkgs.noto-fonts-cjk-sans or pkgs.noto-fonts-cjk)
      merriweather
--- a/modules/services/nix-cache/default.nix
+++ b/modules/services/nix-cache/default.nix
@ -39,7 +39,7 @@ in

    services.harmonia = mkIf cfg.enableServer {
      enable = true;
-      signKeyPath = cfg.privateKeyFile;
+      signKeyPaths = [ cfg.privateKeyFile ];
      settings = {
        bind = bindAddr;
        priority = 45;
--- a/nki-framework/hardware-configuration.nix
+++ b/nki-framework/hardware-configuration.nix
@ -12,7 +12,6 @@
  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "sd_mod" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ "kvm-amd" ];
-  boot.kernelPackages = pkgs.linuxPackages; # until mesa fixed
  boot.kernelParams = [
    # Hibernation
    "resume=UUID=fa8aaf51-b99f-4fb4-9230-8c0957d8af3f"
--- a/nki-home/audio/default.nix
+++ b/nki-home/audio/default.nix
@ -1,5 +1,5 @@
 { config, pkgs, lib, ... }: {
  environment.etc = {
-    "wireplumber/main.lua.d/51-sdac.lua".source = ./sdac.lua;
+    "wireplumber/wireplumber.conf.d/51-sdac.conf".source = ./sdac.conf.json;
  };
 }
--- a/nki-home/audio/sdac.conf.json
+++ b/nki-home/audio/sdac.conf.json
@ -0,0 +1,19 @@
+monitor.alsa.rules = [
+  {
+    matches = [
+      {
+        device.name = "alsa_output.usb-Grace_Design_SDAC-00.*"
+      }
+    ]
+    actions = {
+      update-props = {
+        # audio.format = "S24_3LE"
+        audio.rate = 88200
+        api.alsa.period-size = 2
+        api.alsa.headroom = 0
+        api.alsa.disable-batch = true
+      }
+    }
+  }
+]
+
--- a/nki-home/audio/sdac.lua
+++ b/nki-home/audio/sdac.lua
@ -6,7 +6,7 @@ rule = {
  },
  apply_properties = {
    ["audio.format"] = "S24_3LE",
-    ["audio.rate"] = 96000,
+    ["audio.rate"] = 44100,
    ["api.alsa.period-size"] = 2,
    ["api.alsa.headroom"] = 0,
    ["api.alsa.disable-batch"] = true
--- a/nki-home/configuration.nix
+++ b/nki-home/configuration.nix
@ -5,6 +5,16 @@
 { lib, config, pkgs, ... }:

 with lib;
+let
+  openrazer = { pkgs, ... }: {
+    # Razer stuff
+    hardware.openrazer = {
+      enable = true;
+      users = [ "nki" ];
+    };
+    environment.systemPackages = with pkgs; [ polychromatic ];
+  };
+in
 {
  imports =
    [
@ -17,6 +27,7 @@ with lib;
      # Other services
      ../modules/personal/u2f.nix
      ./peertube-runner.nix
+      openrazer
    ];

  # Kernel
@ -181,5 +192,13 @@ with lib;
      passwordFile = config.sops.secrets."scrobble/listenbrainz".path;
    };
  };
+
+  programs.virt-manager.enable = true;
+
+  users.groups.libvirtd.members = [ "nki" ];
+
+  virtualisation.libvirtd.enable = true;
+
+  virtualisation.spiceUSBRedirection.enable = true;
 }

--- a/nki-personal-do/configuration.nix
+++ b/nki-personal-do/configuration.nix
@ -25,6 +25,8 @@
    ./owncast.nix
    ./peertube.nix
    ./outline.nix
+    ./vikunja.nix
+    ./n8n.nix
  ];

  system.stateVersion = "21.11";
@ -60,6 +62,7 @@
  ];

  virtualisation.docker.enable = true;
+  virtualisation.docker.extraOptions = "--data-root /mnt/data/docker";

  services.do-agent.enable = true;

@ -151,7 +154,7 @@
  };

  # Mail
-  sops.secrets.mail-users = { owner = "maddy"; };
+  sops.secrets.mail-users = { owner = "maddy"; reloadUnits = [ "maddy.service" ]; };
  cloud.mail = {
    enable = true;
    debug = true;
--- a/nki-personal-do/gitea.nix
+++ b/nki-personal-do/gitea.nix
@ -180,7 +180,6 @@ in
        MINIO_USE_SSL = "true";
        MINIO_ENDPOINT = "60c0807121eb35ef52cdcd4a33735fa6.r2.cloudflarestorage.com";
        MINIO_ACCESS_KEY_ID = "704c29ade7a8b438b77ab520da2799ca";
-        MINIO_SECRET_ACCESS_KEY = "#miniosecretkey#";
        MINIO_BUCKET = "dtth-gitea";
        MINIO_LOCATION = "auto";
        MINIO_CHECKSUM_ALGORITHM = "md5"; # R2 moment
@ -192,7 +191,8 @@ in

    stateDir = "/mnt/data/gitea";

-    mailerPasswordFile = secrets."gitea/mailer-password".path;
+    secrets.mailer.PASSWD = secrets."gitea/mailer-password".path;
+    secrets.storage.MINIO_SECRET_ACCESS_KEY = config.sops.secrets."gitea/minio-secret-key".path;

    database = {
      inherit user;
@ -216,14 +216,7 @@ in
    # https://github.com/NixOS/nixpkgs/commit/93c1d370db28ad4573fb9890c90164ba55391ce7
    serviceConfig.SystemCallFilter = mkForce "~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap";
    preStart =
-      let
-        configFile = "${config.services.forgejo.customDir}/conf/app.ini";
-      in
      ''
-        # Update minio secret key
-        chmod u+w ${configFile} && \
-        ${lib.getExe pkgs.replace-secret} '#miniosecretkey#' '${config.sops.secrets."gitea/minio-secret-key".path}' '${configFile}' && \
-        chmod u-w ${configFile}
        # Import the signing subkey
        if cat ${config.services.forgejo.stateDir}/.gnupg/gpg.conf | grep -q ${signingKey}; then
          echo "Keys already imported"
--- a/nki-personal-do/headscale.nix
+++ b/nki-personal-do/headscale.nix
@ -27,7 +27,8 @@ rec {
    noCloudflare = true;
  };

-  systemd.services.headscale.requires = [ "postgresql.service" ];
+  systemd.services.headscale.requires = [ "postgresql.service" "arion-authentik.service" ];
+  systemd.services.headscale.after = [ "postgresql.service" "arion-authentik.service" ];
  services.headscale = {
    enable = true;
    inherit port;
@ -35,23 +36,25 @@ rec {
    settings = {
      server_url = "https://hs.dtth.ch";

-      db_type = "postgres";
-      db_host = "/var/run/postgresql"; # find out yourself
-      db_user = "headscale";
-      db_name = "headscale";
+      database.type = "postgres";
+      database.postgres = {
+        host = "/var/run/postgresql"; # find out yourself
+        user = "headscale";
+        name = "headscale";
+      };

-      dns_config = {
-        base_domain = host;
+      dns = {
+        base_domain = "dtth.ts";
      };

      noise = {
        private_key_path = "/var/lib/headscale/noise_private.key";
      };

-      ip_prefixes = [
-        "fd7a:115c:a1e0::/48"
-        "100.64.0.0/10"
-      ];
+      prefixes = {
+        v6 = "fd7a:115c:a1e0::/48";
+        v4 = "100.64.0.0/10";
+      };

      derp.paths = [
        secrets."headscale/derp-servers/vnm".path
--- a/nki-personal-do/miniflux.nix
+++ b/nki-personal-do/miniflux.nix
@ -42,7 +42,7 @@ in
  systemd.services.miniflux = {
    description = "Miniflux service";
    wantedBy = [ "multi-user.target" ];
-    after = [ "network.target" ];
+    after = [ "network.target" "postgresql.service" ];
    requires = [ "postgresql.service" ];

    serviceConfig = {
--- a/nki-personal-do/n8n.nix
+++ b/nki-personal-do/n8n.nix
@ -0,0 +1,78 @@
+{ config, lib, pkgs, ... }:
+let
+  secrets = config.sops.secrets;
+
+  host = "n8n.dtth.ch";
+  db = "n8n";
+  user = db;
+  port = 23412;
+
+  dataFolder = "/mnt/data/n8n";
+
+  plugins = pkgs.callPackage ./n8n/plugins/package.nix { };
+in
+{
+  sops.secrets."n8n/env" = { reloadUnits = [ "n8n.service" ]; };
+  cloud.postgresql.databases = [ db ];
+  cloud.traefik.hosts.n8n = {
+    inherit port host;
+  };
+
+  # users
+  users.users."${user}" = {
+    group = "${user}";
+    isSystemUser = true;
+  };
+  users.groups."${user}" = { };
+
+  services.n8n = {
+    enable = true;
+    webhookUrl = "https://${host}";
+  };
+
+  systemd.services.n8n = {
+    environment = {
+      # Database
+      DB_TYPE = "postgresdb";
+      DB_POSTGRESDB_DATABASE = db;
+      DB_POSTGRESDB_HOST = "/var/run/postgresql";
+      DB_POSTGRESDB_USER = db;
+      # Deployment
+      N8N_EDITOR_BASE_URL = "https://${host}";
+      N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS = "true";
+      N8N_USER_FOLDER = lib.mkForce dataFolder;
+      HOME = lib.mkForce dataFolder;
+      N8N_HOST = host;
+      N8N_PORT = toString port;
+      N8N_LISTEN_ADDRESS = "127.0.0.1";
+      N8N_HIRING_BANNER_ENABLED = "false";
+      N8N_PROXY_HOPS = "1";
+      # Logs
+      N8N_LOG_LEVEL = "debug";
+      # License
+      N8N_HIDE_USAGE_PAGE = "true";
+      # Security
+      N8N_BLOCK_ENV_ACCESS_IN_NODE = "true";
+      # Timezone
+      GENERIC_TIMEZONE = "Europe/Berlin";
+    };
+    serviceConfig = {
+      EnvironmentFile = [ secrets."n8n/env".path ];
+      User = user;
+      DynamicUser = lib.mkForce false;
+      ReadWritePaths = [ dataFolder ];
+      # ReadOnlyPaths = [ "/var/run/postgresql" ];
+    };
+    unitConfig.RequiresMountsFor = [ dataFolder ];
+  };
+  systemd.tmpfiles.settings."10-n8n" = {
+    ${dataFolder}.d = {
+      user = user;
+      group = user;
+      mode = "0700";
+    };
+    "${dataFolder}/.n8n/nodes"."L+" = {
+      argument = "${plugins}";
+    };
+  };
+}
--- a/nki-personal-do/n8n/plugins/.gitignore
+++ b/nki-personal-do/n8n/plugins/.gitignore
@ -0,0 +1 @@
+node_modules
--- a/nki-personal-do/n8n/plugins/package-lock.json
+++ b/nki-personal-do/n8n/plugins/package-lock.json
--- a/nki-personal-do/n8n/plugins/package.json
+++ b/nki-personal-do/n8n/plugins/package.json
@ -0,0 +1,8 @@
+{
+  "name": "n8n-plugins",
+  "version": "1.0.0",
+  "dependencies": {
+    "n8n-nodes-turndown-html-to-markdown": "^1.0.5",
+    "n8n-nodes-vikunja": "^0.2.0"
+  }
+}
--- a/nki-personal-do/n8n/plugins/package.nix
+++ b/nki-personal-do/n8n/plugins/package.nix
@ -0,0 +1,4 @@
+{ nodejs, importNpmLock }: importNpmLock.buildNodeModules {
+  inherit nodejs;
+  npmRoot = ./.;
+}
--- a/nki-personal-do/peertube.nix
+++ b/nki-personal-do/peertube.nix
@ -3,7 +3,9 @@ let
  secrets = config.sops.secrets;
  cfg = config.services.peertube;

+  user = "peertube";
  host = "peertube.dtth.ch";
+  dataFolder = "/mnt/data/peertube";
  port = 19878;
 in
 {
@ -57,12 +59,6 @@ in
    settings.client.videos = {
      resumable_upload.max_chunk_size = "90MB";
    };
-    settings.storage = {
-      storyboards = "/var/lib/peertube/storage/storyboards/";
-      tmp = "/mnt/data/peertube/tmp/";
-      tmp_persistent = "/mnt/data/peertube/tmp_persistent/";
-      web_videos = "/mnt/data/peertube/web-videos/";
-    };

    # Trust proxy
    settings.trust_proxy = [ "loopback" ] ++ config.services.traefik.staticConfigOptions.entrypoints.https.forwardedHeaders.trustedIPs;
@ -76,5 +72,22 @@ in

    dataDirs = [ "/var/lib/peertube" "/mnt/data/peertube" ];
  };
+
+  systemd.services.peertube = {
+    requires = [ "arion-authentik.service" ];
+    after = [ "arion-authentik.service" ];
+    unitConfig.RequiresMountsFor = [ dataFolder ];
+  };
+  systemd.tmpfiles.settings."10-peertube" = {
+    # The service hard-codes a lot of paths here, so it's nicer if we just symlink
+    "/var/lib/peertube"."L+" = {
+      argument = dataFolder;
+    };
+    ${dataFolder}."d" = {
+      user = user;
+      group = user;
+      mode = "0700";
+    };
+  };
 }

--- a/nki-personal-do/secrets/secrets.yaml
+++ b/nki-personal-do/secrets/secrets.yaml
@ -5,7 +5,7 @@ authentik-oidc-client-secret: ENC[AES256_GCM,data:lD/xyU87nik68JX+T2H3Gw5ZqsSGzX
 cloudflare-dns-api-token: ENC[AES256_GCM,data:2ny3JehpK30fTUDKrbzHv1QOczriChRyMQn6kNPULpUJ+eVwdptLvg==,iv:8wNAn3oawzLez7sO4ZvhFXcaZIpFVKgKCvTBlszFHn8=,tag:fRaO+u/5MtAWnTiy2Zwh0Q==,type:str]
 #ENC[AES256_GCM,data:KWrVRQg+cLm5MUdfsYrh7hkI4CWkl4Z0sDj0769eebeXDy+veixrQrxh1ZW+ro3WLwoIdU/IH5DPM4TWYn2qoM5aDHjGX764pr1x,iv:uZHBsGvSHv9vd/Wragl1dYNJ+8vCcMit2K3SrMFlz7s=,tag:7z4LyADfQvXsM2vvtWru8w==,type:comment]
 traefik-dashboard-users: ENC[AES256_GCM,data:kviapOq+xzxhjryse+5DaZbXRS/LEYyjqqFbHymXAZVEkWlu0T5pZ2bxSNCbXN+tXnb0u+6YPgGCaRNPLW74AF1hO8W8QqlLDA==,iv:41bwPyFQcuOLILTjLWUu5Kcnct/MaIIJsMbllc+n7Y0=,tag:17HyUjfRUcLGb0FrUm1O2A==,type:str]
-mail-users: ENC[AES256_GCM,data:qKLi42k8LT6ojxbPXQgbi6FlI2I6ge6qJn0aNj/Lp9iRjjnnuArdsLJTfBMB7rPUyKWELa7jPrh8cHzJZZX7PsaXt1x07tQrVitKY6aDMpmb0pdU5TsvRTNhMV8lNWDrQeDXMV3hfigFXDU9YYRowllTJn8Uh5m20oGm8xjQrc55pPd2mDRWUt8WdJYGIYvXJ4Dyc+kXwibFC5xb0+7sLIPOcL8SkurMk0v2E63oBvoR089ZOhgWZ2DtqsUF7cGMcEDj6D6GcH2tlIkhTXo/na0b6caK6/mSIHbz/cfeVD/kdphC+q9edqm5UAAm5SaBDsar5vrXZcgQfD3/iEDHpqfdNJQv7Jt1l4vfwSY6nx3BgjggAZpL7YKXME+5Qqrp/epSegailDled5GUOlXKtomzixTA4OsgTjhMFPPOR/GiBuNIbYoGWnnR6Zs6l9Nw5ITJXKFgwNQTZVkndvQcr1Bw6nQqBDXt1qgmTdKTtNkrWEfgyYBnJtQW6qS+rZL8RB1x9Rjnu5PE+ao4YzrZEnKcenlWRh7+1GUdkRPm5qJWAMnuT1LkBdUx4bUPGf1D8iQ12kMLa5NnMQMq4Yek,iv:fTsBB5yZYi47dk8JIDs1JmgtnK8dOhkNt481vqAU+ME=,tag:pAXBSgzPB8nDdAO9YXM02A==,type:str]
+mail-users: ENC[AES256_GCM,data:4ugvUKK1Hxlnt/bTrAe7pEt5Ehla6yfCzeeZkwaXGN0rlYO3zIFz2paajuFDVoZ1UOntxgdoL/bmS55SkvinQybzQqK+1HUb5N4esODZyJkf8qhacBjjUnDq2sK0GXmoWRoR36ny4haRTbfzTxoVph+Y81P6+T7etnMuARM55i/kWCTcKyin9WKkllLF8vEi6MdbvDj5fwVSxKYQZk2Ti4xY+hCGkEUFL3S2l4Hgbzt2irV0ccjU4+GXSrRepFWSakvDl0fuQf0N3oXMQWCYkRqsoPdtV/n1+C1all9HWtA4XNcnNHlPk7bbi51gO3fSQwmayrgsqO4QAIKY2oJMCrMOabvSjRF8pjR/WFqEMN6fLOCByPYTtej2JEDZ0mg/uQIuIh+Us+QIO/ulMSK+Cq4WTBsmN0V9tYucp1vNv2xzuLUN4GkHc0tRZ6jIVPFUCIGEgw9x7qVPNqFPgr4RFzGGP12746+UwHqDuBIz4od47aQMNrXJOD9xbX7mp54bqwkdASIP/5iBAsnzRDhg/9hHMkJrhPjzrGC4feVNYzI9yo+v0cOPworKYuSfk6KYX5SGu2HgcgCG7zGRL4/NoytNwDGoqBKWA81Xuyp9+vMFF//nm5bKQH6Zt2gVaMViyqKZrTkITrOZMaMKVkOeiJdQQpsM1jqU5ygsrHIq9jc8BJ2MbK8WW2wlfovAo2MNtSN68LknoWiMbEuRXIcC8rhvdVX9C++XT/JQH+kHwg==,iv:059jHrKniQmw2H45FDz/5DJqeTzKdsg9a51pX3FxvHE=,tag:aCMJOFv8PWtz80ouUqUCGA==,type:str]
 youmubot-env: ENC[AES256_GCM,data:EQ9e6lmCrjofHiHyN5Qe4b2oplP9/3JKl0vuFp54Hw9aYIS7j3nqzWLCvV54ZK7j1PcQ+CQorjeCVMV0TUy1f1Pf3qjrLkdOdV7ICq540gdfXOeXuhAx2EILpGkwIYOdKmTMSO3l2QkOlM02RNOn1lq/DogAydkEq7gJ7qSWnUEr45oNCa1+LamH8vcbDmIyzUWWXyA5EQ==,iv:fnNGZ6OaZ4D71SvWPRynsMpO1IsvxjQ3XtrswNSY+Wo=,tag:cN/ZnKrjSfD6AbU9pYNl+Q==,type:str]
 outline:
    smtp-password: ENC[AES256_GCM,data:zpIi6jVB2Y7ksBOR8SGFgjOD1x3aS6dKa6taLKB8v2l9p92iWDti75qgB1puglmmq8mCzz8KXLrM0Bv7W8GWRg==,iv:6tKINzQcApmNuIbNn0kSzFJtwn3rky/uFG2Ff3lazUk=,tag:kjB6qB87tRQVpy32Pt3D5A==,type:str]
@ -42,6 +42,11 @@ peertube: ENC[AES256_GCM,data:YWySVZVTC26qPMcgSV5v4Vp1u69jGt7VV2ElQBSxvG/R589PCJ
 peertube-env: ENC[AES256_GCM,data:ZrWBwSfMuepIYTzHVCCSnpsXb+MTcOfklI0O/UdcGaR3RzO1R+/wXQcFlV46g9dvKLMOaH7bxrHeWxqPh/7hlPEYFYwlbwcX31MGiSeRyeR5YtVi0CmhiGRA3l8X5NMCpvZmNhnjYNuri/My86SMkjhuaFQ5+BjYISoJ5WnbNSqE9qgQKuJVu64hsOgaQQbmaBL/LU7Pv/vushbNg421kdbRnzCPcc3IzkVzsFsgYH2fdEJa3gE8M63eLn99PbA+e5cWEwGNkuoNuro2tnaMaX1PM6iTF+q0A8HbiEioNMRIdD9czatgF7EwKgCFNu44cm2lp/c5qj+Lm/nC,iv:+MjpreGr9M+Oe5DrDe5SIBKtLuIqtb0a50YvGhDZT2Y=,tag:gYGlMcgWwa1ZpbQb4XfMmQ==,type:str]
 nix-build-farm:
    private-key: ENC[AES256_GCM,data:bYQ5TAHgJ8rZmmnp0ZW9pM3p6e2ewAqz9+clp2lDnvPsU/YHr/POSW+UESvulT0UDI8t5th71py2G4BG3z9PdPaWw2iSm6hW3VITYCGYvLbF2yK6anSkww0ilpjwm5NXKJLTiPehkAqsZlZsAxeYw5bF0+7JjeH9+49jLOXtGD0uFSf5M3wVZcObzSYsdGaNKGYkokBYeZii1tdwZvAuUKKZ1eOvDAz5v6hjqZA7brDWr5IZXNCqRZOdyGQ5g3UP4o5XFnl57d1RAmKPK9WaTCjbi0hMfms4zldqGeXTRDAhvqMH2w/BY7KvgIOr+aQelTvQbOciq+DaZbzNgdI5gqrSUA19EEL04Qu/gjoVGwMhZ7Lq9+yS2Lb+xdhmn/99sbcRjaRqqjgzHRvbyirPT9EuEAdrijyuZzY9kASv8LN/Q8cawRZNk2vf0M8Qzg0F7iw2kcDrf+dwdcyrrAbg2XDlGsFBckBcPKA44PkOPtFLHZRU9pSpd15rL1JIes6m2YX7AmJFP2+FA5WjXQoqF+CRhBVUWXaXAmcq,iv:7Uqnu2xEcHotczRzIcDfq9bM7wNXdz0Fg2HNpxlV1/Q=,tag:w5aLsT9LN92+83rdP2YJTg==,type:str]
+vikunja:
+    env: ENC[AES256_GCM,data:wHwLaX7z31Ogee0fSIJ4EpP/FUHOmj8lESqPacmrgokf9+2NpG8OKt99csDiYM9EEq2S3P70N6r+Dhzxob53lmQhNK8JuvZqrZ1HxgvMXirjnkXl0LGqVHBM4QdMvxVkICRNc1GMrG6ZY4OBQkn5did1ZZiCuXFC/ByuNTqBNHXoZmZMrewF9MFY+wfGx7+gIYzZ5JF1sgkTqtBdnAiUT2t9AaYNc8qjoZvNj3sgMb35/tKG0CYpt0vz6QuMQwOBJNrRkh2lV7YgTcr1tOkTc2FvRoLLyDykl8fjUf9KDcJLz672E90D0rRA5oHp/Lk28sSThh9WAM0skJofjXMOpq9ScsljWovUuizXUVCg5O/79EyhI7zPX6M3C/415sWdmGLYcRYRq7Ww1IoRgi2j9nCDLstHSMgF1igRWnsBEIFISCmSURMHOZNMkxWsxJ+0HJoMX9bmoZLLMrkjCqyPi/1r0X90aforkmA2xB+pC8rvYBKSxXYt8Nfu6KOK1JsmKTMmmC1R1dswuXvt/qCCH0yf0tl7GrGACKkDerDXVDZj4+SygkXM2bQF/L/KjQI7UspSdmGUmAvjhX31Zt1qZoYa2E2gabBWSGgXDuNixgbL/twaUA1CcA+ZPVBH0oAlOCc0dLXy0OZSn2U4IV1NH//66s1cmWEQQs4GKxhXzABiBvYaSj45LQtnEo2/HaifKhBWPxkjY9fW85Hy4Bgock4ReHYKsCF0LbsgKZhZ+WQp9mjTGLKxmRJJskwSEgxLmjK+AC2FK8zq2COMQ/eOxHe9OxEwjiQs5xCwnYXt2wOMHcxg3yoBCkTxoqMLs11kWORqcXzyoW1rV5W5DHk8K+7a4N385arHyg9+9S2FtfFUL46/GPcqf7lw5qgCDP/An5lPQZxA7/ItLzxFkviSx+e/cNl3UMTdx2aX4dn4L2cv54GuXDMHVHw++onJJnqn97aczK4O5y0=,iv:4T7vftUcSOS84MpZUOM9ODA36GSrKeW5TClQM3GN2mk=,tag:5mzK4NsmmrYERRn+Vb01Eg==,type:str]
+    provider-clientsecret: ENC[AES256_GCM,data:/fN1rH2CKoaivhespd+/KamERjBQOdwR7QQ+hoB+pQ3ZSrBVIKbLMWyOJe8f7rVwXAByqDxQIZJEVPjcjhWSU1eicwpu57FBx+/xJLFazspTVZ+5XKyAwR+UxTHDGAgtFV00QHN53l7ygg4joWWko4IPN1JIpNIASaIWWzpsrIo=,iv:NLsZcmE1kKlzV7B/XPVfENMWlpQtOpESH0ByX1KQ8IQ=,tag:P+ZmsKq0KJAeRTTbvbduMg==,type:str]
+n8n:
+    env: ENC[AES256_GCM,data:LA/6tMfGgX0cDNfhIZ+n2Ay+6OW5gPPebcXQnfO3qQJSjMjf9vwauF2+W3KpIvM1Dsg3hyNEwqLNRn/28bgWC/qpBpgU2/gVI2n5oxcQaYGgnS/jB0nZWXvORVTnXjH0R+HBFCWgMJe7v+o0EeBH6kni/Nc9geb8paRkxZOGVKeJQy9K4OB2CN6FVO9KeR7gpeQpsh5V5SVW1MoND2tpCOiIK7d0uM6OHF/7p2RFrEEAarvJssj/dZRHjA/jALuqbQ6UDAaAppqlkEgIdZdFEfgebfCWR4e4aWjznW1DGOQQYtg4k/Kj8J/df8CWXX+lUO+9nTo/lhhcH395w+CRE8GUwze15yxQppUwqyLKdYwgmpK1tFnLP/W/As2f97c1fBB9rXrZYOUEIq4GspHOTPgjzcRfWOxX8cMKG69EmeZ3mWPsIDaC1ZvkVQjjcH/o9aC7QeFCwPfcy+mgI+9RjAaCw7qdig1CwgQabAaCd2hzQ4FTXBFJoZRfYZ1v3Rdwe8zqMivIcw2AHv6kYx6c9A==,iv:KmyJ/CLAGrYfzHjSWygtgA/+am9fUrKnOsGRPgV9QfU=,tag:G3LhfdSujcaC9ZZFUse0DQ==,type:str]
 sops:
    kms: []
    gcp_kms: []
@ -75,8 +80,8 @@ sops:
            by9kZFlTRVdCZFkxYTVVb0RIRk8zUlkKCqMw9oL9RaYBV5Hhy3o8Nm5xmGrPH8Sd
            hv36sxRFFNZT/DCKaHaSRbT3mfpBZSTXJt1dgl4nZe6whH54t/1KmA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-10-26T12:06:05Z"
-    mac: ENC[AES256_GCM,data:nici08Luubj2xDfsi1s16VCyG5oizIC6DRfvypmjWRpn0DSpcoWW1j32ya2poEwzpBJoVksFp7ijyjaJv8obExKx94ZYc790eOp/kp1f8lBaHDF8qrYYPL5penkt+UTKeb8xb7BPCJ7O89IVkIjAt7EoQOliMYrLpbiZGkMdHE0=,iv:qY5+MjU5VaXAesuFGt4SgmEdcJ6+vb/mk+NdOPLjCik=,tag:poRJZW3sAMv6EMi64SEQyA==,type:str]
+    lastmodified: "2024-12-07T23:38:16Z"
+    mac: ENC[AES256_GCM,data:GKCMZJVKj5Fq7Ak4wQgI/pAl8JKDdzAYCBRwnxHlg0Z10AstbchAYm+LLwCaE85ebl6m/JexmfJeutJo0yGXuOIQKcEgfyNq9O/i/y34ISc4looQ6cyH5Hcxsd9JXgrmgQzVPquBXQzDHz4rj93VhNrvqmw+SgDPZVwcUznvCBI=,iv:HtUmf0qjvbYW7ngocISpqycX7ceNv0YsILgZhOMTSMg=,tag:kJ7EFOLL8o/2OFkn5PhvJw==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.9.1
--- a/nki-personal-do/vikunja.nix
+++ b/nki-personal-do/vikunja.nix
@ -0,0 +1,99 @@
+{ pkgs, lib, config, ... }:
+let
+  secrets = config.sops.secrets;
+
+  host = "kanban.dtth.ch";
+  user = "vikunja";
+  port = 12785;
+
+  storageMount = "/mnt/data/vikunja";
+in
+{
+  sops.secrets."vikunja/env" = { restartUnits = [ "vikunja.service" ]; };
+  sops.secrets."vikunja/provider-clientsecret" = { restartUnits = [ "vikunja.service" ]; };
+  cloud.postgresql.databases = [ user ];
+  cloud.traefik.hosts.vikunja = {
+    inherit port host;
+  };
+
+  # users
+  users.users."${user}" = {
+    group = "${user}";
+    isSystemUser = true;
+  };
+  users.groups."${user}" = { };
+
+
+  services.vikunja = {
+    inherit port;
+    enable = true;
+
+    frontendScheme = "https";
+    frontendHostname = host;
+
+    environmentFiles = [ secrets."vikunja/env".path ];
+
+    database = {
+      type = "postgres";
+      host = "/var/run/postgresql";
+      user = user;
+      database = user;
+    };
+
+    settings = {
+      service = {
+        publicurl = "https://${host}";
+        enableregistration = false;
+        enablepublicteams = true;
+      };
+      mailer = {
+        enabled = true;
+        host = "mx1.nkagami.me";
+        port = 465;
+        forcessl = true;
+      };
+      files.basepath = lib.mkForce storageMount;
+      migration = {
+        todoist.enable = true;
+        trello.enable = true;
+      };
+      backgrounds.providers.unsplash.enabled = true;
+      auth = {
+        local.enabled = false;
+        openid = {
+          enabled = true;
+          providers.authentik = {
+            name = "DTTH Discord Account";
+            authurl = "https://auth.dtth.ch/application/o/vikunja/";
+            logouturl = "https://auth.dtth.ch/application/o/vikunja/end-session/";
+            clientid = "GvCIBtdE2ZRbAo5BJzw4FbZjer7umJlaROT1Pvlp";
+            scope = "openid profile email vikunja_scope";
+          };
+        };
+      };
+      defaultsettings = {
+        avatar_provider = "gravatar";
+        week_start = 1;
+        language = "VN";
+        timezone = "Asia/Ho_Chi_Minh";
+      };
+    };
+  };
+
+  systemd.services.vikunja = {
+    serviceConfig.LoadCredential = [ "VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHENTIK_CLIENTSECRET_FILE:${secrets."vikunja/provider-clientsecret".path}" ];
+    serviceConfig.User = user;
+    serviceConfig.DynamicUser = lib.mkForce false;
+    serviceConfig.ReadWritePaths = [ storageMount ];
+    environment.VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHENTIK_CLIENTSECRET_FILE = "%d/VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHENTIK_CLIENTSECRET_FILE";
+    unitConfig = {
+      RequiresMountsFor = [ storageMount ];
+    };
+  };
+  systemd.tmpfiles.settings."10-vikunja".${storageMount}.d = {
+    user = user;
+    group = user;
+    mode = "0700";
+  };
+}
+
--- a/nki-yoga-g8/configuration.nix
+++ b/nki-yoga-g8/configuration.nix
@ -4,6 +4,14 @@

 { config, pkgs, lib, ... }:

+let
+  vmware = { pkgs, ... }: {
+    environment.systemPackages = [ pkgs.vmware-horizon-client ];
+    virtualisation.vmware.host = {
+      enable = true;
+    };
+  };
+in
 {
  imports =
    [
@ -13,6 +21,8 @@
      ../modules/personal/fonts
      # Encrypted DNS
      ../modules/services/edns
+
+      vmware
    ];

  # Secrets
@ -70,7 +80,7 @@
  services.printing.drivers = with pkgs; [ epfl-cups-drivers ];

  # Enable touchpad support (enabled default in most desktopManager).
-  services.xserver.libinput.enable = true;
+  services.libinput.enable = true;
  # Keyboard
  services.input-remapper.enable = true;
  services.input-remapper.serviceWantedBy = [ "multi-user.target" ];
--- a/overlay.nix
+++ b/overlay.nix
@ -9,9 +9,6 @@ let
    # Typst updates really quickly.
    typst = final.unstable.typst;
    typst-lsp = final.unstable.typst-lsp;
-
-    # Until 0.35 is in
-    kitty = final.unstable.kitty;
  };
  overlay-imported = final: prev: {
    sway = prev.sway.override { sway-unwrapped = final.swayfx-unwrapped; };
@ -74,19 +71,18 @@ let
      nativeMessagingHosts = with final; [ kdePackages.plasma-browser-integration ];
    });

-    # Add desktop file to premid
-    premid = final.symlinkJoin {
-      name = prev.premid.name;
-      paths = [
-        prev.premid
-        (final.makeDesktopItem {
-          name = prev.premid.name;
-          desktopName = "PreMID";
-          exec = "${final.lib.getExe prev.premid} --no-sandbox %U";
-          icon = "premid";
-        })
-      ];
-    };
+    vikunja =
+      builtins.seq
+        (final.lib.assertMsg (prev.vikunja.version == "0.24.5") "Vikunja probably doesn't need custom versions anymore")
+        (final.callPackage ./packages/common/vikunja.nix { });
+
+    luminance = prev.luminance.overrideAttrs (attrs: {
+      nativeBuildInputs = attrs.nativeBuildInputs ++ [ final.wrapGAppsHook ];
+      buildInputs = attrs.buildInputs ++ [ final.glib ];
+      postInstall = attrs.postInstall + ''
+        glib-compile-schemas $out/share/glib-2.0/schemas
+      '';
+    });
  };

  overlay-libs = final: prev: {
@ -110,23 +106,15 @@ let
        meta.mainProgram = "kak-lsp";
      };

-    zen-browser-bin = final.callPackage ./packages/x86_64-linux/zen-browser-bin.nix {
-      nativeMessagingHosts = with final; [ kdePackages.plasma-browser-integration ];
+    zen-browser-bin = final.callPackage inputs.zen-browser.packages.${final.stdenv.system}.zen-browser.override {
+      wrap-firefox = opts: final.wrapFirefox (opts // {
+        nativeMessagingHosts = with final; [ kdePackages.plasma-browser-integration ];
+      });
+      zen-browser-unwrapped = final.callPackage inputs.zen-browser.packages.${final.stdenv.system}.zen-browser-unwrapped.override {
+        sources = inputs.zen-browser.inputs;
+      };
    };
  };
-
-  overlay-rust-is-dumb = final: prev: {
-    # Use stable delta compiled with old Rust version
-    delta = final.stable.delta;
-    deepfilternet = final.stable.deepfilternet;
-    harmonia = final.callPackage
-      (import
-        (builtins.fetchurl {
-          url = "https://raw.githubusercontent.com/Mic92/nixpkgs/63f91202f5cd071187ede5e5ffc56003cb442876/pkgs/by-name/ha/harmonia/package.nix";
-          sha256 = "1mz211c0bxn116ix0j5xx4wlglpbkfg7d3npw1z8hg9gc0vbj2xb";
-        }))
-      { };
-  };
 in
 [
  # inputs.swayfx.inputs.scenefx.overlays.override
@ -135,17 +123,17 @@ in
  inputs.rust-overlay.overlays.default
  inputs.youmubot.overlays.default

-  (import ./overlays/openrazer)
  overlay-unstable
  overlay-needs-unstable
  overlay-packages
  overlay-imported
  overlay-versioning
  overlay-libs
-  overlay-rust-is-dumb

  (import ./packages/common)

  # Bug fixes
 ] # we assign the overlay created before to the overlays of nixpkgs.

+
+
--- a/overlays/openrazer/default.nix
+++ b/overlays/openrazer/default.nix
@ -1,31 +0,0 @@
-final: prev:
-let
-  version = "3.3.0";
-  src = final.fetchFromGitHub {
-    owner = "openrazer";
-    repo = "openrazer";
-    rev = "v${version}";
-    sha256 = "sha256-lElE1nIiJ5fk2DupHu43tmxRjRsS5xeL1Yz/LuRlgtM=";
-  };
-in
-rec
-{
-  openrazer-daemon = prev.openrazer-daemon.overrideAttrs (old: {
-    inherit src version;
-  });
-
-  python3 = prev.python3.override {
-    packageOverrides = self: super: {
-      openrazer-daemon = super.openrazer-daemon.overrideAttrs (old: {
-        inherit src version;
-      });
-    };
-  };
-  python3Packages = python3.pkgs;
-
-  linuxPackages_latest = prev.linuxPackages_latest.extend (self: super: {
-    openrazer = super.openrazer.overrideAttrs (old: {
-      inherit src version;
-    });
-  });
-}
--- a/packages/common/vikunja.nix
+++ b/packages/common/vikunja.nix
@ -0,0 +1,128 @@
+{ lib, fetchFromGitHub, stdenv, nodejs, pnpm, buildGoModule, mage, writeShellScriptBin, nixosTests, autoPatchelfHook, musl }:
+
+let
+  version = "0.24.5-git";
+  src = fetchFromGitHub {
+    owner = "go-vikunja";
+    repo = "vikunja";
+    rev = "e57f04ec23e9ff8aa9877d2ea7d571c2a44790b0";
+    hash = "sha256-W6o1h6XBPvT1lH1zO5N7HcodksKill5eqSuaFl2kfuY=";
+  };
+
+  frontend = stdenv.mkDerivation (finalAttrs: {
+    pname = "vikunja-frontend";
+    inherit version src;
+
+    sourceRoot = "${finalAttrs.src.name}/frontend";
+
+    pnpmDeps = pnpm.fetchDeps {
+      inherit (finalAttrs) pname version src sourceRoot;
+      hash = "sha256-sOCaJDBgEMID+lN5plQpSqaGBIUs5h2tAwDzhtOH53o=";
+    };
+
+    nativeBuildInputs = [
+      nodejs
+      pnpm.configHook
+      autoPatchelfHook
+    ];
+
+    buildInputs = [
+      musl # For sass-embedded
+    ];
+
+    doCheck = true;
+    dontAutoPatchelf = true;
+
+    # See https://github.com/sass/embedded-host-node/issues/334
+    preBuild = ''
+      autoPatchelf node_modules/.pnpm/sass-embedded*
+    '';
+
+    postBuild = ''
+      pnpm run build
+    '';
+
+    checkPhase = ''
+      pnpm run test:unit --run
+    '';
+
+    installPhase = ''
+      cp -r dist/ $out
+    '';
+  });
+
+  # Injects a `t.Skip()` into a given test since there's apparently no other way to skip tests here.
+  skipTest = lineOffset: testCase: file:
+    let
+      jumpAndAppend = lib.concatStringsSep ";" (lib.replicate (lineOffset - 1) "n" ++ [ "a" ]);
+    in
+    ''
+      sed -i -e '/${testCase}/{
+      ${jumpAndAppend} t.Skip();
+      }' ${file}
+    '';
+in
+buildGoModule {
+  inherit src version;
+  pname = "vikunja";
+
+  nativeBuildInputs =
+    let
+      fakeGit = writeShellScriptBin "git" ''
+        if [[ $@ = "describe --tags --always --abbrev=10" ]]; then
+            echo "${version}"
+        else
+            >&2 echo "Unknown command: $@"
+            exit 1
+        fi
+      '';
+    in
+    [ fakeGit mage ];
+
+  vendorHash = "sha256-UWjlivF9ySXCAr84A1trCJ/n9pB98ZhEyG11qz3PL7g=";
+
+  inherit frontend;
+
+  prePatch = ''
+    cp -r ${frontend} frontend/dist
+  '';
+
+  postConfigure = ''
+    # These tests need internet, so we skip them.
+    ${skipTest 1 "TestConvertTrelloToVikunja" "pkg/modules/migration/trello/trello_test.go"}
+    ${skipTest 1 "TestConvertTodoistToVikunja" "pkg/modules/migration/todoist/todoist_test.go"}
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    # Fixes "mkdir /homeless-shelter: permission denied" - "Error: error compiling magefiles" during build
+    export HOME=$(mktemp -d)
+    mage build:build
+
+    runHook postBuild
+  '';
+
+  checkPhase = ''
+    mage test:unit
+    mage test:integration
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dt $out/bin vikunja
+    runHook postInstall
+  '';
+
+  passthru.tests.vikunja = nixosTests.vikunja;
+
+  meta = {
+    changelog = "https://kolaente.dev/vikunja/api/src/tag/v${version}/CHANGELOG.md";
+    description = "Todo-app to organize your life";
+    homepage = "https://vikunja.io/";
+    license = lib.licenses.agpl3Plus;
+    maintainers = with lib.maintainers; [ leona ];
+    mainProgram = "vikunja";
+    platforms = lib.platforms.linux;
+  };
+}
--- a/packages/x86_64-linux/zen-browser-bin.nix
+++ b/packages/x86_64-linux/zen-browser-bin.nix
@ -1,32 +0,0 @@
-{ appimageTools, fetchurl, nativeMessagingHosts ? [ ], ... }:
-let
-  pname = "zen-browser-bin";
-  version = "1.0.1-a.19";
-  src = fetchurl {
-    url = "https://github.com/zen-browser/desktop/releases/download/${version}/zen-specific.AppImage";
-    hash = "sha256-qAPZ4VyVmeZLRfL0kPHF75zyrSUFHKQUSUcpYKs3jk8=";
-  };
-
-  appimageContents = appimageTools.extract {
-    inherit pname version src;
-  };
-
-in
-appimageTools.wrapType2 {
-  inherit pname version src;
-
-  extraInstallCommands = ''
-    mv $out/bin/${pname} $out/bin/zen
-    install -m 444 -D ${appimageContents}/zen.desktop $out/share/applications/zen.desktop
-    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/128x128/apps/zen.png \
-      $out/share/icons/hicolor/128x128/apps/zen.png
-
-    mkdir -p $out/lib/mozilla/native-messaging-hosts
-    for ext in ${toString nativeMessagingHosts}; do
-        ln -sLt $out/lib/mozilla/native-messaging-hosts $ext/lib/mozilla/native-messaging-hosts/*
-    done
-  '';
-
-  meta.mainProgram = "zen";
-}
-
Author	SHA1	Message	Date
Natsu Kagami	cb800c9fa4	Add associations for telegram	2024-12-30 14:05:13 +01:00
Natsu Kagami	546d8fffb5	Use latest kernel on framework	2024-12-30 14:05:05 +01:00
Natsu Kagami	a6c34181b4	Update templ and vscode langservers	2024-12-30 14:03:29 +01:00
Natsu Kagami	281fcad46f	podman: add slirp4netns to the wrapper	2024-12-30 14:03:29 +01:00
Natsu Kagami	c6724e382b	Further cleanup	2024-12-30 14:03:27 +01:00
Natsu Kagami	0f0c1649a2	Revert tree-sitter	2024-12-30 14:02:42 +01:00
Natsu Kagami	8608362922	Cleanup the home kakoune module, restore tree-sitter	2024-12-30 14:02:40 +01:00
Natsu Kagami	eb3d53b829	Make tree-sitter kinda work	2024-12-30 13:55:50 +01:00
Natsu Kagami	53cafeb021	Add tree-sitter	2024-12-30 13:55:50 +01:00
Natsu Kagami	87af0ae3ba	Add lsp and rc	2024-12-30 13:55:50 +01:00
Natsu Kagami	22f6e123de	kakoune: add back themes	2024-12-30 13:55:50 +01:00
Natsu Kagami	6a924444c9	kakoune: add back kaktex	2024-12-30 13:55:49 +01:00
Natsu Kagami	f636223a8c	kakoune: set up package with plugins	2024-12-30 13:55:49 +01:00
Natsu Kagami	983a1fb071	Update osu	2024-12-20 20:53:35 +01:00
Natsu Kagami	a336f2dcd6	Update nixpkgs-unstable	2024-12-20 20:53:35 +01:00
Natsu Kagami	a86023efc7	Update nixpkgs and default peertube data to external	2024-12-20 20:53:35 +01:00
Natsu Kagami	96b6b8c954	Update zen	2024-12-20 12:32:37 +01:00
Natsu Kagami	bfaa5c00c5	yoga: rename obsolete libinput path	2024-12-20 12:32:32 +01:00
Natsu Kagami	e02b92e427	Enable virt-manager	2024-12-17 03:03:11 +01:00
Natsu Kagami	318abcfc80	Update zen	2024-12-16 03:16:50 +01:00
Natsu Kagami	9c5f0981a3	Update osu	2024-12-15 23:51:33 +01:00
Natsu Kagami	c080abeb6c	Add some n8n plugins	2024-12-12 23:13:56 +01:00
Natsu Kagami	770b47b6d4	Update zen	2024-12-12 14:28:23 +01:00
Natsu Kagami	ea331093bb	Add luminance and external monitor kernel modules	2024-12-12 01:49:47 +01:00
Natsu Kagami	56a8c33f9c	Update peertube requirements	2024-12-12 01:49:47 +01:00
Natsu Kagami	28ce4a5feb	n8n: deploy	2024-12-12 01:49:47 +01:00
Natsu Kagami	7a893711dc	Add authentik requirements to relevant services	2024-12-12 01:49:47 +01:00
Natsu Kagami	840033ac1e	Move docker directory to /mnt/data	2024-12-12 01:49:47 +01:00
Natsu Kagami	f4a1a8e76c	zen: update to 1.0.2-b1	2024-12-11 18:13:05 +01:00
Natsu Kagami	bd9604de5c	lanzaboote: update Will need manual intervention to re-set TPM keys	2024-12-11 17:07:25 +01:00
Natsu Kagami	abb7bd815c	yoga: new nerd-fonts not compatible with 24.11	2024-12-11 17:07:12 +01:00
Natsu Kagami	ab5fcfd802	yoga: enable vmware	2024-12-11 16:14:57 +01:00
Natsu Kagami	48460fe71e	Add glab	2024-12-11 16:14:57 +01:00
Natsu Kagami	dba80e2fd1	Update authentik to 2024.10.4	2024-12-07 19:36:01 +01:00
Natsu Kagami	acf1e42b69	Update nixpkgs-unstable	2024-12-07 19:26:34 +01:00
Natsu Kagami	a3e4298d0a	vikunja: Properly use the right frontend too	2024-12-07 18:24:34 +01:00
Natsu Kagami	bfd19b166e	vikunja: add Todoist and Trello import	2024-12-07 16:53:30 +01:00
Natsu Kagami	924944f8fe	cloud: add vikunja	2024-12-03 14:29:16 +01:00
Natsu Kagami	e4aae3b8ae	cloud: Update nixpkgs to 24.11	2024-12-03 00:00:00 +01:00
Natsu Kagami	67f6aba9c5	Update nixpkgs and home-manager	2024-12-02 21:15:07 +01:00
Natsu Kagami	07368dce7e	home: Add openrazer back	2024-11-30 17:25:34 +01:00