Update webui

flake.lock

@@ -608,11 +608,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1742670145,
+        "lastModified": 1744138333,
-        "narHash": "sha256-xQ2F9f+ICAGBp/nNv3ddD2U4ZvzuLOci0u/5lyMXPvk=",
+        "narHash": "sha256-l0Vjq1EZoYTfWImVmwsvMEuIdasrBRRCoNTV0rNtYi0=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "63e77d09a133ac641a0c204e7cfb0c97e133706d",
+        "rev": "760eed59594f2f258db0d66b7ca4a5138681fd97",
         "type": "github"
       },
       "original": {
@@ -942,11 +942,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1742578646,
+        "lastModified": 1744032190,
-        "narHash": "sha256-GiQ40ndXRnmmbDZvuv762vS+gew1uDpFwOfgJ8tLiEs=",
+        "narHash": "sha256-KSlfrncSkcu1YE+uuJ/PTURsSlThoGkRqiGDVdbiE/k=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "94c4dbe77c0740ebba36c173672ca15a7926c993",
+        "rev": "b0b4b5f8f621bfe213b8b21694bab52ecfcbf30b",
         "type": "github"
       },
       "original": {
@@ -990,11 +990,11 @@
     },
     "nixpkgs_12": {
       "locked": {
-        "lastModified": 1742889210,
+        "lastModified": 1743827369,
-        "narHash": "sha256-hw63HnwnqU3ZQfsMclLhMvOezpM7RSB0dMAtD5/sOiw=",
+        "narHash": "sha256-rpqepOZ8Eo1zg+KJeWoq1HAOgoMCDloqv5r2EAa9TSA=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "698214a32beb4f4c8e3942372c694f40848b360d",
+        "rev": "42a1c966be226125b48c384171c44c651c236c22",
         "type": "github"
       },
       "original": {
@@ -1546,11 +1546,11 @@
         "nixpkgs": "nixpkgs_12"
       },
       "locked": {
-        "lastModified": 1743134754,
+        "lastModified": 1743912348,
-        "narHash": "sha256-NC90oFdXwjABXs7wg0tMi5yxNW/xT1bgezg+0a9+3AI=",
+        "narHash": "sha256-Ui+kUYOhkQ0wkoJbCPLN/LpYQGp+R5sNVsawZWZsEcQ=",
         "owner": "youwen5",
         "repo": "zen-browser-flake",
-        "rev": "ceb2e7122307700e9c310973c793c2c241dc0901",
+        "rev": "75acddf6a50f3a4dd920a3a7220828605ba91090",
         "type": "github"
       },
       "original": {

modules/common/linux/default.nix

@@ -357,6 +357,17 @@ in
     # Firewall: only open to SSH now
     networking.firewall.allowedTCPPorts = [ 22 ];
     networking.firewall.allowedUDPPorts = [ 22 ];
+    # Network namespaces management
+    systemd.services."netns@" = {
+      description = "Network namespace %I";
+      before = [ "network.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        ExecStart = "${pkgs.iproute2}/bin/ip netns add %I";
+        ExecStop = "${pkgs.iproute2}/bin/ip netns del %I";
+      };
+    };
 
     ## Time and Region
     time.timeZone = lib.mkDefault "Europe/Zurich";

nki-home/configuration.nix

@@ -33,207 +33,242 @@ in
     # Other services
     ../modules/personal/u2f.nix
     ./peertube-runner.nix
+    ./deluge.nix
     openrazer
   ];
 
-  # Kernel
+  config = mkMerge [
-  boot.kernelPackages = pkgs.linuxKernel.packages.linux_xanmod_stable;
-
-  # Plasma!
-  services.desktopManager.plasma6.enable = true;
-
-  ## Encryption
-  # Kernel modules needed for mounting USB VFAT devices in initrd stage
-  common.linux.luksDevices.root = "/dev/disk/by-uuid/7c6e40a8-900b-4f85-9712-2b872caf1892";
-  common.linux.sops.enable = true;
-  common.linux.sops.file = ./secrets.yaml;
-
-  # Nix cache server
-  sops.secrets."nix-cache/private-key" = {
-    owner = "harmonia";
-    group = "harmonia";
-    mode = "0600";
-  };
-  nki.services.nix-cache = {
-    enableServer = true;
-    privateKeyFile = config.sops.secrets."nix-cache/private-key".path;
-  };
-
-  sops.secrets."nix-build-farm/private-key" = {
-    mode = "0400";
-  };
-  services.nix-build-farm.hostname = "home";
-  services.nix-build-farm.privateKeyFile = config.sops.secrets."nix-build-farm/private-key".path;
-
-  # Networking
-  common.linux.networking = {
-    hostname = "kagamiPC"; # Define your hostname.
-    networks = {
-      "10-wired" = {
-        match = "enp*";
-        isRequired = true;
-      };
-      "20-wireless".match = "wlan*";
-    };
-    dnsServers = [ "127.0.0.1" ];
-  };
-  nki.services.edns.enable = true;
-  nki.services.edns.ipv6 = true;
-  ## DTTH Wireguard
-  #
-  sops.secrets."dtth-wg/private-key" = {
-    owner = "root";
-    group = "systemd-network";
-    mode = "0640";
-  };
-  sops.secrets."dtth-wg/preshared-key" = {
-    owner = "root";
-    group = "systemd-network";
-    mode = "0640";
-  };
-  systemd.network.netdevs."10-dtth-wg" = {
-    netdevConfig = {
-      Kind = "wireguard";
-      Name = "dtth-wg";
-      MTUBytes = "1280";
-    };
-    wireguardConfig = {
-      PrivateKeyFile = config.sops.secrets."dtth-wg/private-key".path;
-    };
-    wireguardPeers = [
-      {
-        PublicKey = "+7iI4jwmM1Qr+/DKB1Hv8JgFkGu7lSV0PAoo+O5d3yQ=";
-        PresharedKeyFile = config.sops.secrets."dtth-wg/preshared-key".path;
-        AllowedIPs = [
-          "100.64.0.0/10"
-          "fd00::/106"
-        ];
-        Endpoint = "vpn.dtth.ch:51820";
-        PersistentKeepalive = 25;
-      }
-    ];
-  };
-  systemd.network.networks."dtth-wg" = {
-    matchConfig.Name = "dtth-wg";
-    address = [
-      "100.73.146.80/32"
-      "fd00::33:105b/128"
-    ];
-    DHCP = "no";
-    routes = [
-      {
-        Destination = "100.64.0.0/10";
-        Scope = "link";
-      }
-      { Destination = "fd00::/106"; }
-    ];
-  };
-
-  # Define a user account.
-  common.linux.username = "nki";
-  services.getty.autologinUser = "nki";
-
-  ## Hardware
-  # Peripherals
-  hardware.opentabletdriver.enable = true;
-  # Enable razer daemon
-  hardware.openrazer.enable = true;
-  hardware.openrazer.keyStatistics = true;
-  hardware.openrazer.verboseLogging = true;
-
-  # Mounting disks!
-  fileSystems =
-    let
-      ntfsMount = path: {
-        device = path;
-        fsType = "ntfs";
-        options = [
-          "rw"
-          "uid=${toString config.users.users.nki.uid}"
-          "nofail"
-        ];
-      };
-    in
     {
-      "/mnt/Data" = ntfsMount "/dev/disk/by-uuid/A90680F8BBE62FE3";
-      "/mnt/Stuff" = ntfsMount "/dev/disk/by-uuid/717BF2EE20BB8A62";
-      "/mnt/Shared" = ntfsMount "/dev/disk/by-uuid/76AC086BAC0827E7";
-      "/mnt/osu" = ntfsMount "/dev/disk/by-uuid/530D3E1648CD1C26";
-    };
 
-  # PAM
+      # Kernel
-  personal.u2f.enable = true;
+      boot.kernelPackages = pkgs.linuxKernel.packages.linux_xanmod_stable;
 
-  # This value determines the NixOS release from which the default
+      # Plasma!
-  # settings for stateful data, like file locations and database versions
+      services.desktopManager.plasma6.enable = true;
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "22.11"; # Did you read the comment?
 
-  # tinc network
+      ## Encryption
-  sops.secrets."tinc/ed25519-private-key" = { };
+      # Kernel modules needed for mounting USB VFAT devices in initrd stage
-  sops.secrets."tinc/rsa-private-key" = { };
+      common.linux.luksDevices.root = "/dev/disk/by-uuid/7c6e40a8-900b-4f85-9712-2b872caf1892";
-  services.my-tinc = {
+      common.linux.sops.enable = true;
-    enable = true;
+      common.linux.sops.file = ./secrets.yaml;
-    hostName = "home";
-    rsaPrivateKey = config.sops.secrets."tinc/rsa-private-key".path;
-    ed25519PrivateKey = config.sops.secrets."tinc/ed25519-private-key".path;
-    bindPort = 6565;
-  };
 
-  # Music server
+      # Nix cache server
-  services.navidrome.enable = true;
+      sops.secrets."nix-cache/private-key" = {
-  services.navidrome.settings = {
+        owner = "harmonia";
-    Address = "11.0.0.2";
+        group = "harmonia";
-    MusicFolder = "/mnt/Stuff/Music";
+        mode = "0600";
-  };
+      };
-  systemd.services.navidrome.serviceConfig.BindReadOnlyPaths = lib.mkAfter [ "/etc" ];
+      nki.services.nix-cache = {
-  networking.firewall.allowedTCPPorts = [
+        enableServer = true;
-    4533
+        privateKeyFile = config.sops.secrets."nix-cache/private-key".path;
-    8000
+      };
+
+      sops.secrets."nix-build-farm/private-key" = {
+        mode = "0400";
+      };
+      services.nix-build-farm.hostname = "home";
+      services.nix-build-farm.privateKeyFile = config.sops.secrets."nix-build-farm/private-key".path;
+
+      # Networking
+      common.linux.networking = {
+        hostname = "kagamiPC"; # Define your hostname.
+        networks = {
+          "10-wired" = {
+            match = "enp*";
+            isRequired = true;
+          };
+          "20-wireless".match = "wlan*";
+        };
+        dnsServers = [ "127.0.0.1" ];
+      };
+      nki.services.edns.enable = true;
+      nki.services.edns.ipv6 = true;
+      ## DTTH Wireguard
+      #
+      sops.secrets."wg-dtth/private-key" = {
+        owner = "root";
+        group = "systemd-network";
+        mode = "0640";
+      };
+      sops.secrets."wg-dtth/preshared-key" = {
+        owner = "root";
+        group = "systemd-network";
+        mode = "0640";
+      };
+      systemd.network.netdevs."10-wg-dtth" = {
+        netdevConfig = {
+          Kind = "wireguard";
+          Name = "wg-dtth";
+          MTUBytes = "1280";
+        };
+        wireguardConfig = {
+          PrivateKeyFile = config.sops.secrets."wg-dtth/private-key".path;
+        };
+        wireguardPeers = [
+          {
+            PublicKey = "+7iI4jwmM1Qr+/DKB1Hv8JgFkGu7lSV0PAoo+O5d3yQ=";
+            PresharedKeyFile = config.sops.secrets."wg-dtth/preshared-key".path;
+            AllowedIPs = [
+              "100.64.0.0/10"
+              "fd00::/106"
+            ];
+            Endpoint = "vpn.dtth.ch:51820";
+            PersistentKeepalive = 25;
+          }
+        ];
+      };
+      systemd.network.networks."wg-dtth" = {
+        matchConfig.Name = "wg-dtth";
+        address = [
+          "100.73.146.80/32"
+          "fd00::33:105b/128"
+        ];
+        DHCP = "no";
+        routes = [
+          {
+            Destination = "100.64.0.0/10";
+            Scope = "link";
+          }
+          { Destination = "fd00::/106"; }
+        ];
+      };
+
+      # Define a user account.
+      common.linux.username = "nki";
+      services.getty.autologinUser = "nki";
+
+      ## Hardware
+      # Peripherals
+      hardware.opentabletdriver.enable = true;
+      # Enable razer daemon
+      hardware.openrazer.enable = true;
+      hardware.openrazer.keyStatistics = true;
+      hardware.openrazer.verboseLogging = true;
+
+      # Mounting disks!
+      fileSystems =
+        let
+          ntfsMount = path: {
+            device = path;
+            fsType = "ntfs";
+            options = [
+              "rw"
+              "uid=${toString config.users.users.nki.uid}"
+              "nofail"
+            ];
+          };
+        in
+        {
+          "/mnt/Data" = ntfsMount "/dev/disk/by-uuid/A90680F8BBE62FE3";
+          "/mnt/Stuff" = ntfsMount "/dev/disk/by-uuid/717BF2EE20BB8A62";
+          "/mnt/Shared" = ntfsMount "/dev/disk/by-uuid/76AC086BAC0827E7";
+          "/mnt/osu" = ntfsMount "/dev/disk/by-uuid/530D3E1648CD1C26";
+        };
+
+      # PAM
+      personal.u2f.enable = true;
+
+      # This value determines the NixOS release from which the default
+      # settings for stateful data, like file locations and database versions
+      # on your system were taken. It‘s perfectly fine and recommended to leave
+      # this value at the release version of the first install of this system.
+      # Before changing this value read the documentation for this option
+      # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+      system.stateVersion = "22.11"; # Did you read the comment?
+
+      # tinc network
+      sops.secrets."tinc/ed25519-private-key" = { };
+      sops.secrets."tinc/rsa-private-key" = { };
+      services.my-tinc = {
+        enable = true;
+        hostName = "home";
+        rsaPrivateKey = config.sops.secrets."tinc/rsa-private-key".path;
+        ed25519PrivateKey = config.sops.secrets."tinc/ed25519-private-key".path;
+        bindPort = 6565;
+      };
+
+      # Music server
+      services.navidrome.enable = true;
+      services.navidrome.settings = {
+        Address = "11.0.0.2";
+        MusicFolder = "/mnt/Stuff/Music";
+      };
+      systemd.services.navidrome.serviceConfig.BindReadOnlyPaths = lib.mkAfter [ "/etc" ];
+      networking.firewall.allowedTCPPorts = [
+        4533
+        8000
+      ];
+
+      # Printers
+      services.printing.enable = true;
+
+      # mpd
+      services.mpd = {
+        enable = true;
+        user = "nki";
+        startWhenNeeded = true;
+        extraConfig = ''
+          audio_output {
+            type "pipewire"
+            name "pipewire local"
+            dsd "yes"
+          }
+        '';
+      };
+      systemd.services.mpd.environment = {
+        # https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/609
+        XDG_RUNTIME_DIR = "/run/user/1000"; # User-id 1000 must match above user. MPD will look inside this directory for the PipeWire socket.
+      };
+      sops.secrets."scrobble/lastfm" = { };
+      sops.secrets."scrobble/listenbrainz" = { };
+      services.mpdscribble = {
+        enable = true;
+        endpoints."last.fm" = {
+          username = "natsukagami";
+          passwordFile = config.sops.secrets."scrobble/lastfm".path;
+        };
+        endpoints."listenbrainz" = {
+          username = "natsukagami";
+          passwordFile = config.sops.secrets."scrobble/listenbrainz".path;
+        };
+      };
+
+      programs.virt-manager.enable = true;
+
+      users.groups.libvirtd.members = [ "nki" ];
+
+      virtualisation.libvirtd.enable = true;
+
+      virtualisation.spiceUSBRedirection.enable = true;
+    }
+    {
+      # LLM poop
+      services.ollama = {
+        enable = true;
+        loadModels = [
+          "deepseek-r1:14b"
+          "gemma3:12b"
+        ];
+        acceleration = "rocm";
+        rocmOverrideGfx = "10.3.1";
+      };
+      systemd.services.ollama = {
+        serviceConfig.LimitMEMLOCK = "${toString (16 * 1024 * 1024 * 1024)}";
+      };
+      services.open-webui = {
+        enable = true;
+        port = 5689;
+        openFirewall = true;
+        host = "0.0.0.0";
+        environment = {
+          ANONYMIZED_TELEMETRY = "False";
+          DO_NOT_TRACK = "True";
+          SCARF_NO_ANALYTICS = "True";
+          ENV = "prod";
+          ENABLE_SIGNUP = "false";
+        };
+      };
+      common.linux.tailscale.firewall.allowPorts = [ config.services.open-webui.port ];
+    }
   ];
-
-  # Printers
-  services.printing.enable = true;
-
-  # mpd
-  services.mpd = {
-    enable = true;
-    user = "nki";
-    startWhenNeeded = true;
-    extraConfig = ''
-      audio_output {
-        type "pipewire"
-        name "pipewire local"
-        dsd "yes"
-      }
-    '';
-  };
-  systemd.services.mpd.environment = {
-    # https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/609
-    XDG_RUNTIME_DIR = "/run/user/1000"; # User-id 1000 must match above user. MPD will look inside this directory for the PipeWire socket.
-  };
-  sops.secrets."scrobble/lastfm" = { };
-  sops.secrets."scrobble/listenbrainz" = { };
-  services.mpdscribble = {
-    enable = true;
-    endpoints."last.fm" = {
-      username = "natsukagami";
-      passwordFile = config.sops.secrets."scrobble/lastfm".path;
-    };
-    endpoints."listenbrainz" = {
-      username = "natsukagami";
-      passwordFile = config.sops.secrets."scrobble/listenbrainz".path;
-    };
-  };
-
-  programs.virt-manager.enable = true;
-
-  users.groups.libvirtd.members = [ "nki" ];
-
-  virtualisation.libvirtd.enable = true;
-
-  virtualisation.spiceUSBRedirection.enable = true;
 }

nki-home/deluge.nix

@@ -0,0 +1,96 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+let
+  wg = "wgdeluge";
+  webui-port = "58846";
+in
+{
+  services.deluge = {
+    enable = true;
+    web.enable = true;
+  };
+
+  sops.secrets."wg-deluge.conf" = {
+    owner = "root";
+    mode = "0400";
+    reloadUnits = [ "${wg}.service" ];
+  };
+  # setting up wireguard interface within network namespace
+  systemd.services.${wg} =
+    let
+      ip = lib.getExe' pkgs.iproute2 "ip";
+      wireguard = lib.getExe pkgs.wireguard-tools;
+    in
+    {
+      description = "WireGuard network interface for Deluge";
+      bindsTo = [ "netns@${wg}.service" ];
+      requires = [ "network-online.target" ];
+      after = [ "netns@${wg}.service" ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        ExecStart = pkgs.writers.writeBash "wg-up" ''
+          set -e
+          ${ip} link add ${wg} type wireguard
+          ${ip} link set ${wg} netns ${wg}
+          ${ip} -n ${wg} address add "100.123.50.189/32" dev ${wg}
+          ${ip} netns exec ${wg} \
+            ${wireguard} setconf ${wg} ${config.sops.secrets."wg-deluge.conf".path}
+          ${ip} -n ${wg} link set ${wg} up
+          # need to set lo up as network namespace is started with lo down
+          ${ip} -n ${wg} link set lo up
+          ${ip} -n ${wg} route add default dev ${wg}
+          # ${ip} -n ${wg} -6 route add default dev ${wg}
+        '';
+        ExecStop = pkgs.writers.writeBash "wg-down" ''
+          ${ip} -n ${wg} route del default dev ${wg}
+          # ${ip} -n ${wg} -6 route del default dev ${wg}
+          ${ip} -n ${wg} link del ${wg}
+          ${ip} link del ${wg}
+        '';
+      };
+    };
+
+  # binding deluged to network namespace
+  systemd.services.deluged.bindsTo = [ "netns@${wg}.service" ];
+  systemd.services.deluged.requires = [
+    "network-online.target"
+    "${wg}.service"
+  ];
+  systemd.services.deluged.serviceConfig.NetworkNamespacePath = [ "/var/run/netns/${wg}" ];
+
+  # allowing delugeweb to access deluged in network namespace, a socket is necesarry
+  systemd.sockets."proxy-to-deluged" = {
+    enable = true;
+    description = "Socket for Proxy to Deluge Daemon";
+    listenStreams = [ "${webui-port}" ];
+    wantedBy = [ "sockets.target" ];
+  };
+
+  # creating proxy service on socket, which forwards the same port from the root namespace to the isolated namespace
+  systemd.services."proxy-to-deluged" = {
+    enable = true;
+    description = "Proxy to Deluge Daemon in Network Namespace";
+    requires = [
+      "deluged.service"
+      "proxy-to-deluged.socket"
+    ];
+    after = [
+      "deluged.service"
+      "proxy-to-deluged.socket"
+    ];
+    unitConfig = {
+      JoinsNamespaceOf = "deluged.service";
+    };
+    serviceConfig = {
+      User = "deluge";
+      Group = "deluge";
+      ExecStart = "${pkgs.systemd}/lib/systemd/systemd-socket-proxyd --exit-idle-time=5min 127.0.0.1:${webui-port}";
+      PrivateNetwork = "yes";
+    };
+  };
+}

nki-home/secrets.yaml

@@ -8,20 +8,17 @@ windscribe:
 scrobble:
     lastfm: ENC[AES256_GCM,data:+3G9zwmAu/B9omG0KUT0b5G+lJ4=,iv:ubrE4A35si9f6+m2sAino4SfOf9F4g2UjtF2Yy9n2e4=,tag:A/e6GECfIZuX2bVGPo9qyA==,type:str]
     listenbrainz: ENC[AES256_GCM,data:FNSJnYEQd+LgInmdyqcaAQG6imiJS/OPBEe2fBKQGKBjpCLy,iv:qhloVpcwcGwRDn6vOujgmvelbPl2korhELfyf5BvdjM=,tag:WnLaMUtHsxBaXNTAKwchkQ==,type:str]
-dtth-wg:
+wg-dtth:
-    private-key: ENC[AES256_GCM,data:ySxPGzOplKwNLxRnPNw7If7xzxMwRkwTasT7FaQE9n5YB04R+gaQVjDqPqg=,iv:f5t94bUoo9sCGGwWytiuhg5jcKjzRjbR3Q0OIM28VDU=,tag:fJos9Hb9XytQbfGaPMa1/A==,type:str]
+    private-key: ENC[AES256_GCM,data:a//pmovhmjh73YBHmae/91oVtWFmbiuh87gz6busqi7XcEZEn3KiYszuiMI=,iv:hLw5nqJDGDdiT9CfwDShXGRP6qoTWvfReq7qPs9x0n4=,tag:+b3cMjuVJTsz73wnlPW02Q==,type:str]
-    preshared-key: ENC[AES256_GCM,data:96q0ZfvPz4pb53XvTGameVkcETamYH8Xbv69672RBdacH6QjRCCVvPnBTfA=,iv:Q2Yonb07/Uu6KidhMgRX4zJuNU1ZySNC7g/5TwpMU80=,tag:1qQQdk20yIQlGZmX+/25RA==,type:str]
+    preshared-key: ENC[AES256_GCM,data:go9dm+FTEq7k0ec936ay1loTJZV8espqTFpGzqAQa9TzMnB1AD/JJHLMENQ=,iv:LjXD3ySLJVkerQH5J7ylSGATykTT6jEObuJc4vUnh28=,tag:qYO5r72tjothlT16Y8Ms0Q==,type:str]
 peertube:
     dtth-key: ENC[AES256_GCM,data:Gu7qOisVBZrFXKBr51165FJ7Ej4hV+lIf3AMC02R3UFNXOnTHF2xC8E=,iv:F83FuD1VjZEJFMcx3gkQuKCpJmYdHtO15fRHkYdMxJM=,tag:ScH42Tr5ZsIo9JMnXhylSw==,type:str]
 nix-cache:
     private-key: ENC[AES256_GCM,data:4sbfIQb10Y50CrZbgjN+1iXEbXTpDqMbIB/yA3WlaAqhLtb8HKib5aZX3DLoxFbVihJcztQsvBBgEAhT9iMijoksaT9qzBQ5yIn4NGCfFem1DK8DQdjhTLMCVTyMFCT7hQHu/2Sd7w==,iv:zTSxuKOtOLekOBKBvl9MScD/Bo1Hviqq/n8Saa+1Cgo=,tag:fx73fCDPY9d07V3KKMw3DA==,type:str]
 nix-build-farm:
     private-key: ENC[AES256_GCM,data:m5neeWCEdaZ1MRhNwTptfDIgv3ABNlYyNil3oTD81Jbe/6WxWaS5Q++CRlHCjc2hOoHsWsZixw8iGZVTA+QXgH6B9C6A4oOAhgR9m92EGTEfFw0qxQbdzs7U98Yonx/N8SApUycZZB/EU81+MrDNY4GGzCiO6s00/vZLkDTYnqRFgbo+8KTG0BQTl4q+VYP2q3l0wy+Ivz5CWPmbz42Xdin/sBnjeFHKDuof4iZZnN3i8gUJ/mMw3lbdiHd6A8DL0G5Ut46ljzMC2aMsZOATCID3mPOPgI0xIetDofPJLDqVsNqptRHo8WB+KwDidvl222f5F7JqdSqgAMOJYPscrX0odufApiJfg5bbXBygvrDfAlPSruW7GsWGoKAhw0qC4NC/j+qYCwhS0qdorCLnIy3zzMtA6HkHtE675hy7/7oLj7k9Y8MhE4PxztjXTmDazaVCtKhnA/DpaxP2mH84gfCkJFD1YF9jtPm+P3e+46FwkW+WnHaA2L+H7Evava30DLEBhh5y9Gd1A3JN4isn,iv:7KUWg7+GWgmGJkbIvsy9gtccZBb+1Y5uDWhXQFk0obk=,tag:qJdM684XPHxecLVxVb5pgw==,type:str]
+wg-deluge.conf: ENC[AES256_GCM,data:CjCqgC1458C6odMtcWigE9tZwci4bJYyk+2fVTpP2OnHYwAp38bt0TbBLwgytMqKfB5EpJZLdbeTSoL33MhT2MD4gWBuDH1++p59l9213LS+9mF6gxG/RksrnnLvz9Pnk5J19qOz1PDxm6t8ZF2qu5qAHY83CF+k32G04/p2Nl04bDllAmMUlGGHJ5TXvXCSRcNU/2tWYv/sC4SwfUfpMjRbSKJUQSTEXnQsPaKsf+fq3mhj1a/xT6zJ6sxwDAGQ3PwIY8xTDf5ucS9ULPO9Zn27NUBoFmS1g0fJd+ZCJJYIWkG2uYDf+ldu/Ag95BduHX7Juf3GolhVd24hZzaIq3LeME99+T3SYA4LBkAaASnBvrVOXmFavHPKhFfbZ1DG0mO7S2M+Ticz+dUktjTXCh/Fe4uwf2R82PieuPhNng==,iv:AKleoSHG6qKEMJ7vIFsQ+X7d/jaXt+d0kg3LnbeWrRc=,tag:zrtqRIxEBbpSh9Ryj8cwqw==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
         - recipient: age1tt0peqg8zdfh74m5sdgwsczcqh036nhgmwvkqnvywll88uvmm9xs433rhm
           enc: |
@@ -50,8 +47,7 @@ sops:
             bUhIT0Z2b1dVWGNyS1hRVFRyZTA4d00KchP7EhSOMwBl5vFuuskzosRoi8jUu1sw
             hVjJNF2a40ewgkQgVAoWEzirHbknbQORzmepDDRth7Bve3UQU64+GA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-08-16T13:59:20Z"
+    lastmodified: "2025-04-08T23:20:49Z"
-    mac: ENC[AES256_GCM,data:ncT8fbtEb9ZcLcftXwgAKJRPPSG4TRHFMArtVgWNmIjDRcCNNT7ICa+9Dl8DAYKRJ+8pgelV9StIg2f7rvypHYlckontEP5nwSFzEApLItG3AZXewTC8VPoDYb4T8/OWKDoa5kBMvGrDr1bFP/CZz7H8No+k5TV7fVExsw0PHpg=,iv:vxbkeJtHkOAq7NcaZEIOMV3qGEqBUg/vpJYumBBfY70=,tag:T0yw2x1O5Tp0UllLpcFryg==,type:str]
+    mac: ENC[AES256_GCM,data:4RANoPaf4TCLkkTkY/UyOCLWKVL6o5N+bSXbNCoQLoI5hI5oW6zgPnvEKtERhJiKNttEoPStb68dt8/DRZ6enpi6h/DP+kNm7wCCT0atMnfKUXz1Hco6ixub9cyT1wpRxjU0O5EPmYSDRYTayOBOqvXzns+OpVFGMcskUAeroL8=,iv:JHMW8tsydX2k39SPqbFfyash4k8juTCi8DtufA8lL/s=,tag:lTQc62Y4nDEErT/TbL+Hbg==,type:str]
-    pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.0
+    version: 3.10.1

nki-personal-do/headscale.nix

@@ -89,7 +89,7 @@ rec {
   environment.etc."headscale/config.yaml".mode = "0644";
   virtualisation.arion.projects.headscale-webui.settings = {
     services.webui.service = {
-      image = "ghcr.io/ifargle/headscale-webui@sha256:b4f02337281853648b071301af4329b4e4fc9189d77ced2eb2fbb78204321cab";
+      image = "ghcr.io/ifargle/headscale-webui@sha256:f047209ddf2f71587d8a0f749b0cb92f22a3105dda624724a053c2a7aa23a210";
       restart = "unless-stopped";
 
       environment = {

overlay.nix

@@ -131,7 +131,7 @@ let
     kak-lsp = final.unstable.rustPlatform.buildRustPackage {
       name = "kak-lsp";
       src = inputs.kak-lsp;
-      cargoHash = "sha256-8Y+haxC7ssN07ODZcKoDdTv0vEnKqxYseLPoQSNmWI4=";
+      cargoLock.lockFile = "${inputs.kak-lsp}/Cargo.lock";
       buildInputs = [ final.libiconv ];
 
       meta.mainProgram = "kak-lsp";

packages/common/kak-tree-sitter/default.nix

@@ -20,7 +20,8 @@ let
     inherit src;
     pname = "kak-tree-sitter";
     version = "1.1.3";
-    cargoHash = "sha256-1OwPfl1446SYt1556jwR9mvWOWEv+ab+wH7GZQeS4/E=";
+    cargoLock.lockFile = "${src}/Cargo.lock";
+
     cargoBuildOptions = [
       "--package"
       "kak-tree-sitter"