hyprland: more improvements

hyprland improve systemd integration
hyprland: minimal config
2024-01-21 01:24:23 -03:00 · 2024-01-21 00:27:21 -03:00 · 2024-01-21 00:27:21 -03:00 · 2024-01-20 21:43:16 -03:00
218 changed files with 14646 additions and 6243 deletions
--- a/.gitattributes
+++ b/.gitattributes
@ -1,2 +0,0 @@
-flake.lock binary
-*.gpg binary
--- a/.sops.yaml
+++ b/.sops.yaml
@ -1,37 +0,0 @@
-keys:
-  - &lelgenio-gpg 0FECE8316E74BA6F44EFC21A2F8F21CE8721456B
-  - &lelgenio-ssh age1zrgu7w8059xydagm60phnffghvfe9h2ca58cx8qwagqpyfuvs9fqw79c8h
-  - &monolith-ssh age1ecyynwv93lfu7crjjp8l47defv07quzfzaktwurpep7jc9eha5pscg7lrw
-  - &double-rainbow-ssh age1026d4c8nqyapcsy4jz57szt6zw3ejcgv3ecyvz0s89t7w7z964fqdqv52h
-  - &phantom-ssh age1m4mqcd2kmuhfr8a22rvh02c68jkakhdfmuqgtusuv0czk4jvna7sz79p3y
-
-creation_rules:
-  - path_regex: secrets/[^/]+\.(yaml|json|env|ini|gpg)$
-    key_groups:
-    - pgp:
-      - *lelgenio-gpg
-      age:
-      - *lelgenio-ssh
-      - *monolith-ssh
-  - path_regex: secrets/monolith/[^/]+\.(yaml|json|env|ini|gpg)$
-    key_groups:
-    - pgp:
-      - *lelgenio-gpg
-      age:
-      - *lelgenio-ssh
-      - *monolith-ssh
-  - path_regex: secrets/double-rainbow/[^/]+\.(yaml|json|env|ini|gpg)$
-    key_groups:
-    - pgp:
-      - *lelgenio-gpg
-      age:
-      - *lelgenio-ssh
-      - *monolith-ssh
-      - *double-rainbow-ssh
-  - path_regex: secrets/phantom/[^/]+\.(yaml|json|env|ini|gpg)$
-    key_groups:
-    - pgp:
-      - *lelgenio-gpg
-      age:
-      - *lelgenio-ssh
-      - *phantom-ssh
--- a/flake.lock
+++ b/flake.lock
--- a/flake.nix
+++ b/flake.nix
@ -1,152 +1,161 @@
 {
  description = "My system config";
  inputs = {
-    nixpkgs.url = "nixpkgs/nixos-26.05";
-    nixpkgs-unstable.url = "nixpkgs/nixos-unstable";
-
-    home-manager.url = "github:nix-community/home-manager/release-26.05";
+    nixpkgs.url = "nixpkgs/nixos-23.11";
+    home-manager.url = "github:nix-community/home-manager/release-23.11";
    home-manager.inputs.nixpkgs.follows = "nixpkgs";

-    vpsadminos.url = "github:vpsfreecz/vpsadminos";
-
    nix-index-database = {
      url = "github:Mic92/nix-index-database";
      inputs.nixpkgs.follows = "nixpkgs";
    };

+    hyprland = {
+      url = "github:hyprwm/Hyprland";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
    ranger-icons.url = "github:alexanderjeurissen/ranger_devicons";
    ranger-icons.flake = false;

+    material-wifi-icons.url = "github:dcousens/material-wifi-icons";
+    material-wifi-icons.flake = false;
+
    plymouth-themes.url = "github:adi1090x/plymouth-themes";
    plymouth-themes.flake = false;

-    sops-nix = {
-      url = "github:Mic92/sops-nix";
+    lipsum.url = "github:hannenz/lipsum";
+    lipsum.flake = false;
+
+    agenix = {
+      url = "github:ryantm/agenix";
      inputs.nixpkgs.follows = "nixpkgs";
    };

-    nixos-mailserver = {
-      url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-26.05";
-      inputs.nixpkgs.follows = "nixpkgs";
+    dzgui-nix = {
+      url = "github:lelgenio/dzgui-nix";
    };

-    dzgui-nix.url = "github:lelgenio/dzgui-nix";
-
    tlauncher = {
-      url = "git+https://git.lelgenio.com/lelgenio/tlauncher-nix";
+      url = "github:lelgenio/tlauncher-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };

-    lsfg-vk-flake = {
-      url = "github:pabloaul/lsfg-vk-flake";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    disko = {
-      url = "github:nix-community/disko";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    treefmt-nix.url = "github:numtide/treefmt-nix";
-
    # my stuff
-    dhist.url = "github:lelgenio/dhist";
-    demoji.url = "github:lelgenio/demoji";
-    wl-crosshair.url = "github:lelgenio/wl-crosshair";
-    warthunder-leak-counter.url = "git+https://git.lelgenio.com/lelgenio/warthunder-leak-counter";
-    made-you-look.url = "git+https://git.lelgenio.com/lelgenio/made-you-look";
-    contador-da-viagem = {
-      url = "git+https://git.lelgenio.com/lelgenio/contador-da-viagem";
-      flake = false;
+    dhist = {
+      url = "github:lelgenio/dhist";
+      inputs.nixpkgs.follows = "nixpkgs";
    };
-    catboy-spinner = {
-      url = "git+https://git.lelgenio.com/lelgenio/catboy-spinner";
-      flake = false;
+    demoji = {
+      url = "github:lelgenio/demoji";
+      inputs.nixpkgs.follows = "nixpkgs";
    };
-    tomater = {
-      url = "git+https://git.lelgenio.com/lelgenio/tomater";
-      flake = false;
+    maildir-notify-daemon = {
+      url = "github:lelgenio/maildir-notify-daemon";
+      inputs.nixpkgs.follows = "nixpkgs";
    };
-    youre-wrong = {
-      url = "git+https://git.lelgenio.com/lelgenio/youre-wrong";
-      flake = false;
-    };
-    hello-fonts = {
-      url = "git+https://git.lelgenio.com/lelgenio/hello-fonts";
-      flake = false;
+    wl-crosshair = {
+      url = "github:lelgenio/wl-crosshair";
+      inputs.nixpkgs.follows = "nixpkgs";
    };
+    nixpkgs-fixed-steam.url = "github:lelgenio/nixpkgs/test-steam-fix";
+
+    # gnome stuff
+    nixos-conf-editor.url = "github:vlinkz/nixos-conf-editor";
+    nix-software-center.url = "github:vlinkz/nix-software-center";
  };
-  outputs =
-    inputs:
+  outputs = inputs:
    let
      nixpkgsConfig = {
        inherit system;
-        config = {
-          allowUnfree = true;
-          # TODO: remover minio após migrar os dados
-          permittedInsecurePackages = [ "minio-2025-10-15T17-29-55Z" ];
-        };
+        config = { allowUnfree = true; };
        overlays = old_overlays.all;
      };

+      bootstrapPkgs = import inputs.nixpkgs nixpkgsConfig;
+      nixpkgs = bootstrapPkgs.applyPatches {
+        name = "patched-nixpkgs";
+        src = inputs.nixpkgs;
+        patches = lib.mapAttrsToList (k: v: ./patches/nixpkgs/${k})
+          (builtins.readDir ./patches/nixpkgs);
+      };
+
      inherit (import ./user/variables.nix) desktop;
      system = "x86_64-linux";
-      pkgs = import inputs.nixpkgs nixpkgsConfig;
+      pkgs = import nixpkgs nixpkgsConfig;
      lib = inputs.nixpkgs.lib;

      packages = import ./pkgs { inherit pkgs inputs; };

      old_overlays = (import ./overlays { inherit packages inputs; });

-      specialArgs = {
-        inherit inputs;
-        self = inputs.self;
-      };
+      specialArgs = { inherit inputs; };
      common_modules = [
        { nixpkgs.pkgs = pkgs; }
        ./system/configuration.nix
-        {
-          login-manager.greetd.enable = desktop == "sway";
-          my.gnome.enable = desktop == "gnome";
-          my.kde.enable = desktop == "kde";
-        }
+        ./system/secrets.nix
+        ./system/specialisation.nix
+        ./system/greetd.nix
+        { login-manager.greetd.enable = desktop == "sway" || desktop == "hyprland"; }

-        { home-manager.extraSpecialArgs = specialArgs; }
-      ];
+        inputs.agenix.nixosModules.default
+        # inputs.hyprland.nixosModules.default
+        inputs.dzgui-nix.nixosModules.default
+        { programs.hyprland.enable = (desktop == "hyprland"); }
+        inputs.home-manager.nixosModules.home-manager
+        {
+          home-manager.useGlobalPkgs = true;
+          home-manager.useUserPackages = true;
+          home-manager.users.lelgenio = import ./user/home.nix;
+          home-manager.backupFileExtension = "bkp";
+          # Optionally, use home-manager.extraSpecialArgs to pass
+          # arguments to home.nix
+          home-manager.extraSpecialArgs = { inherit inputs; };
+        }
+      ]
+      ++ lib.optional (desktop == "gnome") ./system/gnome.nix
+      ++ lib.optional (desktop == "kde") ./system/kde.nix;
    in
    {
-      checks."${system}" = {
-        disko-format-i15 = pkgs.callPackage ./hosts/i15/partitions-test.nix { };
-      };
      nixosConfigurations = {
        i15 = lib.nixosSystem {
-          inherit specialArgs;
-          modules = common_modules ++ [ ./hosts/i15 ];
+          inherit system specialArgs;
+          modules = [ ./hosts/i15.nix ] ++ common_modules;
        };
        monolith = lib.nixosSystem {
-          inherit specialArgs;
-          modules = common_modules ++ [
-            ./hosts/monolith
-          ];
+          inherit system specialArgs;
+          modules = [
+            ./hosts/monolith.nix
+            ./system/monolith-gitlab-runner.nix
+            ./system/nix-serve.nix
+            ./system/steam.nix
+          ] ++ common_modules;
+        };
+        rainbow = lib.nixosSystem {
+          inherit system specialArgs;
+          modules = [
+            ./hosts/rainbow.nix
+            ./system/rainbow-gitlab-runner.nix
+          ] ++ common_modules;
        };
        double-rainbow = lib.nixosSystem {
-          inherit specialArgs;
-          modules = common_modules ++ [
-            ./hosts/double-rainbow
-          ];
+          inherit system specialArgs;
+          modules = [
+            ./hosts/double-rainbow.nix
+            ./system/rainbow-gitlab-runner.nix
+          ] ++ common_modules;
        };
        pixie = lib.nixosSystem {
-          inherit specialArgs;
-          modules = common_modules ++ [
-            ./hosts/pixie.nix
-          ];
+          inherit system specialArgs;
+          modules = [ ./hosts/pixie.nix ] ++ common_modules ++ [{
+            packages.media-packages.enable = lib.mkOverride 0 false;
+            programs.steam.enable = lib.mkOverride 0 false;
+            services.flatpak.enable = lib.mkOverride 0 false;
+          }];
        };
-        phantom = lib.nixosSystem {
-          inherit specialArgs;
-          modules = [
-            { nixpkgs.pkgs = pkgs; }
-            ./hosts/phantom
-          ];
+        ghost = lib.nixosSystem {
+          inherit system specialArgs;
+          modules = [ ./hosts/ghost ];
        };
      };

@ -163,7 +172,6 @@

      packages.${system} = pkgs // packages;

-      # formatter.${system} = pkgs.nixfmt-rfc-style;
-      formatter.${system} = (inputs.treefmt-nix.lib.evalModule pkgs ./treefmt.nix).config.build.wrapper;
+      formatter.${system} = pkgs.nixpkgs-fmt;
    };
 }
--- a/hosts/double-rainbow/default.nix
+++ b/hosts/double-rainbow/default.nix
@ -1,38 +1,13 @@
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
+{ config, lib, pkgs, modulesPath, ... }:
 let
-  btrfs_options = [
-    "compress=zstd:3"
-    "noatime"
-    "x-systemd.device-timeout=0"
-  ];
-  btrfs_ssd = [
-    "ssd"
-    "discard=async"
-  ];
+  btrfs_options = [ "compress=zstd:3" "noatime" "x-systemd.device-timeout=0" ];
+  btrfs_ssd = [ "ssd" "discard=async" ];
 in
 {
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-    ./gitlab-runner.nix
-    ./nebula-vpn.nix
-  ];
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];

-  my.nix-ld.enable = true;
-
-  boot.initrd.availableKernelModules = [
-    "xhci_pci"
-    "ahci"
-    "nvme"
-    "usb_storage"
-    "usbhid"
-    "sd_mod"
-  ];
+  boot.initrd.availableKernelModules =
+    [ "xhci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod" ];
  boot.initrd.kernelModules = [ "i915" ];
  boot.kernelModules = [ "kvm-intel" ];
  boot.extraModulePackages = [ ];
@ -51,13 +26,7 @@ in
    fsType = "vfat";
  };

-  swapDevices = [ { device = "/swapfile"; } ];
-
-  services.udev.extraRules = ''
-    # Force all disks to use mq-deadline scheduler
-    # For some reason "noop" is used by default which is kinda bad when io is saturated
-    ACTION=="add|change", KERNEL=="sd[a-z]*[0-9]*|mmcblk[0-9]*p[0-9]*|nvme[0-9]*n[0-9]*p[0-9]*", ATTR{../queue/scheduler}="mq-deadline"
-  '';
+  swapDevices = [ ];

  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
  # (the default) this is the recommended approach. When using systemd-networkd it's
@ -68,7 +37,8 @@ in

  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  hardware.cpu.intel.updateMicrocode =
+    lib.mkDefault config.hardware.enableRedistributableFirmware;

  networking.hostName = "double-rainbow"; # Define your hostname.
 }
--- a/hosts/double-rainbow/gitlab-runner.nix
+++ b/hosts/double-rainbow/gitlab-runner.nix
@ -1,36 +0,0 @@
-{
-  config,
-  pkgs,
-  ...
-}:
-let
-  inherit (pkgs.callPackage ../../system/gitlab-runner.nix { }) mkNixRunnerFull;
-in
-{
-  boot.kernel.sysctl."net.ipv4.ip_forward" = true;
-  virtualisation.docker.enable = true;
-  services.gitlab-runner = {
-    enable = true;
-    settings.concurrent = 4;
-    services = {
-      wopus-gitlab-nix = mkNixRunnerFull {
-        authenticationTokenConfigFile = config.sops.secrets."gitlab-runners/wopus-gitlab-nix".path;
-        # nixCacheSshPrivateKeyPath = config.sops.secrets."gitlab-runners/wopus-ssh-nix-cache-pk".path;
-        # nixCacheSshPublicKeyPath = config.sops.secrets."gitlab-runners/wopus-ssh-nix-cache-pub".path;
-      };
-    };
-  };
-  systemd.services.gitlab-runner.serviceConfig.Nice = 10;
-
-  sops.secrets = {
-    "gitlab-runners/wopus-gitlab-nix" = {
-      sopsFile = ../../secrets/double-rainbow/default.yaml;
-    };
-    "gitlab-runners/wopus-ssh-nix-cache-pk" = {
-      sopsFile = ../../secrets/double-rainbow/default.yaml;
-    };
-    "gitlab-runners/wopus-ssh-nix-cache-pub" = {
-      sopsFile = ../../secrets/double-rainbow/default.yaml;
-    };
-  };
-}
--- a/hosts/double-rainbow/nebula-vpn.nix
+++ b/hosts/double-rainbow/nebula-vpn.nix
@ -1,51 +0,0 @@
-{ pkgs, config, ... }:
-let
-  s = config.sops.secrets;
-
-  secretConfig = {
-    owner = "nebula-wopus";
-    group = "nebula-wopus";
-    restartUnits = [ "nebula@wopus.service" ];
-    sopsFile = ../../secrets/double-rainbow/default.yaml;
-  };
-in
-{
-  environment.systemPackages = with pkgs; [ nebula ];
-
-  services.nebula.networks.wopus = {
-    enable = true;
-    isLighthouse = false;
-    lighthouses = [ "192.168.88.1" ];
-    settings = {
-      cipher = "aes";
-    };
-    cert = s."nebula-wopus-vpn/double-rainbow-crt".path;
-    key = s."nebula-wopus-vpn/double-rainbow-key".path;
-    ca = s."nebula-wopus-vpn/ca-crt".path;
-    staticHostMap = {
-      "192.168.88.1" = [
-        "neubla-vpn.wopus.dev:4242"
-      ];
-    };
-    firewall.outbound = [
-      {
-        host = "any";
-        port = "any";
-        proto = "any";
-      }
-    ];
-    firewall.inbound = [
-      {
-        host = "any";
-        port = "any";
-        proto = "any";
-      }
-    ];
-  };
-
-  sops.secrets = {
-    "nebula-wopus-vpn/ca-crt" = secretConfig;
-    "nebula-wopus-vpn/double-rainbow-crt" = secretConfig;
-    "nebula-wopus-vpn/double-rainbow-key" = secretConfig;
-  };
-}
--- a/hosts/ghost/default.nix
+++ b/hosts/ghost/default.nix
@ -0,0 +1,33 @@
+{ config, pkgs, inputs, ... }: {
+  imports = [
+    "${inputs.nixpkgs}/nixos/modules/virtualisation/digital-ocean-image.nix"
+    inputs.agenix.nixosModules.default
+    ../../system/nix.nix
+    ./hardware-config.nix
+    ./mastodon.nix
+    ./nextcloud.nix
+    ./nginx.nix
+    ./syncthing.nix
+    ./users.nix
+    ./writefreely.nix
+    ./renawiki.nix
+  ];
+
+  # Use more aggressive compression then the default.
+  virtualisation.digitalOceanImage.compressionMethod = "bzip2";
+  # Enable networking
+  networking.networkmanager.enable = true;
+  # Set your time zone.
+  time.timeZone = "America/Sao_Paulo";
+  # Select internationalisation properties.
+  i18n.defaultLocale = "pt_BR.utf8";
+
+  boot.kernel.sysctl."fs.inotify.max_user_watches" = 1048576;
+
+  age = {
+    identityPaths = [ "/root/.ssh/id_rsa" ];
+  };
+
+  system.stateVersion = "23.05"; # Never change this
+}
+
--- a/hosts/ghost/hardware-config.nix
+++ b/hosts/ghost/hardware-config.nix
@ -0,0 +1,13 @@
+{ config, pkgs, inputs, ... }: {
+  swapDevices = [{
+    device = "/swap/swapfile";
+    size = (1024 * 2); # 2 GB
+  }];
+
+  fileSystems."/var" = {
+    device = "/dev/disk/by-uuid/b19e7272-8fd1-4999-93eb-abc6d5c0a1cc";
+    fsType = "btrfs";
+    options = [ "subvol=@var" ];
+  };
+}
+
--- a/hosts/ghost/mastodon.nix
+++ b/hosts/ghost/mastodon.nix
@ -0,0 +1,16 @@
+{ config, pkgs, inputs, ... }: {
+  services.mastodon = {
+    enable = true;
+    localDomain = "social.lelgenio.xyz";
+    configureNginx = true;
+    smtp.fromAddress = "lelgenio@disroot.org";
+    extraConfig.SINGLE_USER_MODE = "true";
+    streamingProcesses = 2;
+  };
+
+  services.nginx.virtualHosts.${config.services.nextcloud.hostName} = {
+    forceSSL = true;
+    enableACME = true;
+  };
+}
+
--- a/hosts/ghost/nextcloud.nix
+++ b/hosts/ghost/nextcloud.nix
@ -0,0 +1,22 @@
+{ config, pkgs, inputs, ... }: {
+  services.nextcloud = {
+    enable = true;
+    package = pkgs.nextcloud27;
+    hostName = "cloud.lelgenio.xyz";
+    https = true;
+    config = {
+      adminpassFile = config.age.secrets.ghost-nextcloud.path;
+    };
+  };
+
+  age = {
+    secrets.ghost-nextcloud = {
+      file = ../../secrets/ghost-nextcloud.age;
+      mode = "400";
+      owner = "nextcloud";
+      group = "nextcloud";
+    };
+  };
+
+}
+
--- a/hosts/ghost/nginx.nix
+++ b/hosts/ghost/nginx.nix
@ -0,0 +1,15 @@
+{ config, pkgs, inputs, ... }: {
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "lelgenio@disroot.org";
+  };
+  
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+}
+
--- a/hosts/ghost/renawiki.nix
+++ b/hosts/ghost/renawiki.nix
@ -0,0 +1,23 @@
+{ config, pkgs, inputs, ... }: {
+  services.mediawiki = {
+    enable = true;
+    name = "Rena Wiki";
+
+    webserver = "nginx";
+    nginx.hostName = "renawiki.lelgenio.xyz";
+    passwordFile = config.age.secrets.ghost-renawiki.path;
+
+    extensions.VisualEditor = null;
+  };
+  services.nginx.virtualHosts."renawiki.lelgenio.xyz" = {
+    enableACME = true;
+    forceSSL = true;
+  };
+
+  age.secrets.ghost-renawiki = {
+    file = ../../secrets/ghost-renawiki.age;
+    mode = "400";
+    owner = "mediawiki";
+  };
+}
+
--- a/hosts/ghost/syncthing.nix
+++ b/hosts/ghost/syncthing.nix
@ -0,0 +1,24 @@
+{ config, pkgs, inputs, ... }: {
+
+  services.syncthing = {
+    enable = true;
+    dataDir = "/var/lib/syncthing-data";
+    guiAddress = "0.0.0.0:8384";
+    openDefaultPorts = true;
+  };
+
+  services.nginx.virtualHosts."syncthing.lelgenio.xyz" = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:8384";
+      extraConfig =
+        # required when the target is also TLS server with multiple hosts
+        "proxy_ssl_server_name on;" +
+        # required when the server wants to use HTTP Authentication
+        "proxy_pass_header Authorization;"
+      ;
+    };
+  };
+}
+
--- a/hosts/phantom/users.nix
+++ b/hosts/phantom/users.nix
@ -1,12 +1,8 @@
-{ pkgs, ... }:
-{
+{ pkgs, ... }: {
  security.rtkit.enable = true;
  services.openssh = {
    enable = true;
-    ports = [
-      9022
-      22
-    ];
+    ports = [ 9022 ];
    settings = {
      PasswordAuthentication = false;
      KbdInteractiveAuthentication = false;
@ -19,15 +15,7 @@
    isNormalUser = true;
    description = "Leonardo Eugênio";
    hashedPassword = "$y$j9T$0e/rczjOVCy7PuwC3pG0V/$gTHZhfO4wQSlFvbDyfghbCnGI2uDI0a52zSrQ/yOA5A";
-    extraGroups = [
-      "networkmanager"
-      "wheel"
-      "docker"
-      "adbusers"
-      "bluetooth"
-      "corectrl"
-      "vboxusers"
-    ];
+    extraGroups = [ "networkmanager" "wheel" "docker" "adbusers" "bluetooth" "corectrl" "vboxusers" ];
    shell = pkgs.fish;
    openssh.authorizedKeys.keys = [
      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCxR/w+38b2lX90yNBqhq3mUmkn1WGu6GAPhN1tVp2ZjYRJNV/+5gWCnTtOWYtDx35HmK/spQ2Qy8X9ttkzORa24fysNx1Iqn/TiXhD7eIJjbGPnrOpIKTkW5/uB3SD/P5NBSa06//BaqJU4sBlG79hoXRpod052hQtdpTVDiMCIV+iboWPKqopmJJfWdBtVnHXs9rep0htPRExxGslImFk7Z6xjcaHyCpIQZPlOGf+sGsmUU7jRqzvZFV8ucIdbnAlMHrU4pepNFhuraESyZVTa/bi9sw0iozXp5Q5+5thMebEslmT1Z771kI4sieDy+O4r8c0Sx2/VY1UAzcpq1faggc3YB01MTh+tiEC6xdMvZLrQGL1NBWjHleMyL53GU5ERluC0vXJF3Hv3BGGBDfXWbrEm5n06DHr2apRVJGC0LwiQ7Woud1X4V4X1pKSusxCVMjT2lmcOwV6YhKhB2sowJc1OdMx4+tL0UWE+YKSZgBHfolwk6ml0F4EO9nnUHc= lelgenio@i15"
@ -40,10 +28,11 @@
    ];
    initialHashedPassword = "$y$j9T$E3aBBSSq0Gma8hZD9L7ov0$iCGDW4fqrXWfHO0qodBYYgMFA9CpIraoklHcPbJJrM3";
  };
-
  security.sudo.wheelNeedsPassword = false;

  programs.fish.enable = true;

-  environment.systemPackages = with pkgs; [ git ];
+  environment.systemPackages = with pkgs; [
+    git
+  ];
 }
--- a/hosts/ghost/writefreely.nix
+++ b/hosts/ghost/writefreely.nix
@ -0,0 +1,25 @@
+{ config, pkgs, inputs, ... }: {
+  services.writefreely = {
+    enable = true;
+    acme.enable = true;
+    nginx.enable = true;
+    nginx.forceSSL = true;
+    host = "blog.lelgenio.xyz";
+    admin.name = "lelgenio";
+    admin.initialPasswordFile = config.age.secrets.ghost-writefreely.path;
+    settings.app = {
+      site_name = "Leo's blog";
+      single_user = true;
+    };
+  };
+
+  age = {
+    secrets.ghost-writefreely = {
+      file = ../../secrets/ghost-writefreely.age;
+      mode = "400";
+      owner = "writefreely";
+      group = "writefreely";
+    };
+  };
+}
+
--- a/hosts/i15.nix
+++ b/hosts/i15.nix
@ -1,30 +1,15 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
+{ config, lib, pkgs, modulesPath, ... }:
 let
-  btrfs_options = [
-    "compress=zstd:3"
-    "noatime"
-    "x-systemd.device-timeout=0"
-  ];
+  btrfs_options = [ "compress=zstd:3" "noatime" "x-systemd.device-timeout=0" ];
 in
 {
  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];

-  boot.initrd.availableKernelModules = [
-    "xhci_pci"
-    "ahci"
-    "usb_storage"
-    "sd_mod"
-    "rtsx_usb_sdmmc"
-  ];
+  boot.initrd.availableKernelModules =
+    [ "xhci_pci" "ahci" "usb_storage" "sd_mod" "rtsx_usb_sdmmc" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ "kvm-intel" ];
  boot.extraModulePackages = [ ];
@ -60,12 +45,10 @@ in
    options = [ "subvol=@swap" ] ++ btrfs_options;
  };

-  swapDevices = [
-    {
-      device = "/swap/swapfile";
-      size = (1024 * 8) + (1024 * 2); # RAM size + 2 GB
-    }
-  ];
+  swapDevices = [{
+    device = "/swap/swapfile";
+    size = (1024 * 8) + (1024 * 2); # RAM size + 2 GB
+  }];

  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
  # (the default) this is the recommended approach. When using systemd-networkd it's
@ -76,6 +59,7 @@ in
  # networking.interfaces.wlp1s0.useDHCP = lib.mkDefault true;

  powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  hardware.cpu.intel.updateMicrocode =
+    lib.mkDefault config.hardware.enableRedistributableFirmware;
  networking.hostName = "i15"; # Define your hostname.
 }
--- a/hosts/i15/default.nix
+++ b/hosts/i15/default.nix
@ -1,38 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
-{
-  networking.hostName = "i15"; # Define your hostname.
-
-  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-
-  boot.initrd.availableKernelModules = [
-    "xhci_pci"
-    "ahci"
-    "usb_storage"
-    "sd_mod"
-    "rtsx_usb_sdmmc"
-  ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  disko.devices = (import ./partitions.nix { disks = [ "/dev/sda" ]; });
-  boot.loader.efi.efiSysMountPoint = "/boot/efi";
-
-  swapDevices = [
-    {
-      device = "/swap/swapfile";
-      size = (1024 * 8) + (1024 * 2); # RAM size + 2 GB
-    }
-  ];
-
-  networking.useDHCP = lib.mkDefault true;
-
-  powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}
--- a/hosts/i15/partitions-test.nix
+++ b/hosts/i15/partitions-test.nix
@ -1,19 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-pkgs.makeDiskoTest {
-  name = "test-disko-i15";
-  disko-config = ./partitions.nix;
-  enableOCR = true;
-  bootCommands = ''
-    machine.wait_for_text("[Pp]assphrase for")
-    machine.send_chars("secretsecret\n")
-  '';
-  extraTestScript = ''
-    machine.succeed("cryptsetup isLuks /dev/vda2");
-    machine.succeed("mountpoint /home");
-  '';
-}
--- a/hosts/i15/partitions.nix
+++ b/hosts/i15/partitions.nix
@ -1,73 +0,0 @@
-{
-  disks ? [ "/dev/sda" ],
-  ...
-}:
-let
-  btrfs_options = [
-    "compress=zstd:3"
-    "noatime"
-  ];
-in
-{
-  disk.sda = {
-    type = "disk";
-    device = builtins.elemAt disks 0;
-    content = {
-      type = "table";
-      format = "gpt";
-      partitions = [
-        {
-          type = "partition";
-          name = "NIX_BOOT";
-          start = "1MiB";
-          end = "300MiB";
-          bootable = true;
-          content = {
-            type = "filesystem";
-            extraArgs = [
-              "-n"
-              "BOOT_I15"
-            ];
-            format = "vfat";
-            mountpoint = "/boot";
-            # options = [ "defaults" ];
-          };
-        }
-        {
-          type = "partition";
-          name = "CRYPT_I15";
-          start = "300MiB";
-          end = "100%";
-          content = {
-            type = "luks";
-            name = "main";
-            keyFile = "/tmp/secret.key";
-            content = {
-              type = "btrfs";
-              extraArgs = [
-                "--label"
-                "ROOT_I15"
-              ];
-              subvolumes =
-                let
-                  mountOptions = btrfs_options;
-                in
-                {
-                  "/home" = {
-                    inherit mountOptions;
-                  };
-                  "/nixos" = {
-                    inherit mountOptions;
-                    mountpoint = "/";
-                  };
-                  "/swap" = {
-                    inherit mountOptions;
-                  };
-                };
-            };
-          };
-        }
-      ];
-    };
-  };
-}
--- a/hosts/monolith.nix
+++ b/hosts/monolith.nix
@ -0,0 +1,131 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+let
+  btrfs_options = [ "compress=zstd:3" "noatime" "x-systemd.device-timeout=0" ];
+  btrfs_ssd = [ "ssd" "discard=async" ];
+in
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+  boot.initrd.availableKernelModules =
+    [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
+
+  boot.extraModulePackages = with config.boot.kernelPackages; [
+    zenpower
+  ];
+  boot.initrd.kernelModules = [ "amdgpu" ];
+  boot.kernelModules = [
+    "kvm-amd"
+    "amdgpu"
+    "zenpower"
+  ];
+  boot.kernelParams = [
+    "video=DP-1:1920x1080@144"
+    # hibernation
+    "resume=LABEL=BTRFS_ROOT" # findmnt -o LABEL --noheadings /swap/
+    "resume_offset=36709632" # btrfs inspect-internal map-swapfile -r /swap/swapfile
+  ];
+  systemd.sleep.extraConfig = ''
+    HibernateDelaySec=30s
+    SuspendState=mem
+  '';
+
+  hardware.opengl.driSupport = true;
+  # # For 32 bit applications
+  hardware.opengl.driSupport32Bit = true;
+
+  hardware.opengl.extraPackages = with pkgs; [
+    libva
+    libvdpau
+    vaapiVdpau
+  ];
+
+  programs.corectrl.enable = true;
+  virtualisation.virtualbox.host.enable = true;
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/BTRFS_ROOT";
+    fsType = "btrfs";
+    options = [ "subvol=nixos" ] ++ btrfs_options ++ btrfs_ssd;
+  };
+  # boot.initrd.luks.reusePassphrases = true;
+  boot.initrd.luks.devices = {
+    "main" = {
+      bypassWorkqueues = true;
+      device = "/dev/disk/by-label/CRYPT_ROOT";
+    };
+    "data" = {
+      bypassWorkqueues = true;
+      device = "/dev/disk/by-label/CRYPT_DATA";
+    };
+    "bigboy" = {
+      bypassWorkqueues = true;
+      device = "/dev/disk/by-label/CRYPT_BIGBOY";
+    };
+  };
+  boot.loader.efi.efiSysMountPoint = "/boot/efi";
+  fileSystems."/boot/efi" = {
+    device = "/dev/disk/by-label/NIXBOOT";
+    fsType = "vfat";
+  };
+  fileSystems."/home" = {
+    device = "/dev/disk/by-label/BTRFS_ROOT";
+    fsType = "btrfs";
+    options = [ "subvol=home" ] ++ btrfs_options ++ btrfs_ssd;
+  };
+  fileSystems."/home/lelgenio/Games" = {
+    device = "/dev/disk/by-label/BTRFS_DATA";
+    fsType = "btrfs";
+    options = [ "subvol=@games" "nofail" ] ++ btrfs_options;
+  };
+  fileSystems."/home/lelgenio/Downloads/Torrents" = {
+    device = "/dev/disk/by-label/BTRFS_DATA";
+    fsType = "btrfs";
+    options = [ "subvol=@torrents" "nofail" ] ++ btrfs_options;
+  };
+  fileSystems."/home/lelgenio/Música" = {
+    device = "/dev/disk/by-label/BTRFS_DATA";
+    fsType = "btrfs";
+    options = [ "subvol=@music" "nofail" ] ++ btrfs_options;
+  };
+  fileSystems."/home/lelgenio/.local/mount/data" = {
+    device = "/dev/disk/by-label/BTRFS_DATA";
+    fsType = "btrfs";
+    options = [ "subvol=@data" "nofail" ] ++ btrfs_options;
+  };
+  fileSystems."/home/lelgenio/.local/mount/bigboy" = {
+    device = "/dev/disk/by-label/BTRFS_BIGBOY";
+    fsType = "btrfs";
+    options = [ "nofail" ] ++ btrfs_options ++ btrfs_ssd;
+  };
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp4s0.useDHCP = lib.mkDefault true;
+  powerManagement.cpuFreqGovernor = "ondemand";
+  hardware.cpu.amd.updateMicrocode =
+    lib.mkDefault config.hardware.enableRedistributableFirmware;
+  networking.hostName = "monolith"; # Define your hostname.
+
+  # Fix broken suspend with Logitech USB dongle
+  # `lsusb | grep Logitech` will return "vendor:product"
+  services.udev.extraRules = ''
+    ACTION=="add" SUBSYSTEM=="usb" ATTR{idVendor}=="046d" ATTR{idProduct}=="c547" ATTR{power/wakeup}="disabled"
+  '';
+
+  # swap
+  fileSystems."/swap" = {
+    device = "/dev/disk/by-label/BTRFS_ROOT";
+    fsType = "btrfs";
+    # Note these options effect the entire BTRFS filesystem and not just this volume,
+    # with the exception of `"subvol=swap"`, the other options are repeated in my other `fileSystem` mounts
+    options = [ "subvol=swap" ] ++ btrfs_options ++ btrfs_ssd;
+  };
+  swapDevices = [{
+    device = "/swap/swapfile";
+    size = (1024 * 16) + (1024 * 2); # RAM size + 2 GB
+  }];
+}
--- a/hosts/monolith/amdgpu.nix
+++ b/hosts/monolith/amdgpu.nix
@ -1,27 +0,0 @@
-{ pkgs, ... }:
-let
-  # mesaPkgs = pkgs.unstable.mesa;
-  mesaPkgs = pkgs;
-in
-{
-  boot.initrd.kernelModules = [ "amdgpu" ];
-  boot.kernelParams = [
-    "video=DP-1:1920x1080@144"
-  ];
-
-  # hardware.amdgpu = {
-  #   overdrive = {
-  #     enable = true;
-  #     ppfeaturemask = "0xffffffff";
-  #   };
-  # };
-
-  hardware.graphics.package = mesaPkgs.mesa; # Mesa 26 at the time
-
-  hardware.graphics.enable32Bit = true;
-
-  hardware.graphics.extraPackages = with mesaPkgs; [
-    # libva needs to match `hardware.graphics.package`
-    libva
-  ];
-}
--- a/hosts/monolith/default.nix
+++ b/hosts/monolith/default.nix
@ -1,154 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
-let
-  btrfs_options = [
-    "compress=zstd:3"
-    "noatime"
-    "x-systemd.device-timeout=0"
-  ];
-in
-{
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-    ./partition.nix
-    ./amdgpu.nix
-    ./factorio-server.nix
-    ./nebula-vpn.nix
-    ./minio.nix
-    ./monolith-forgejo-runner.nix
-    ./monolith-gitlab-runner.nix
-  ];
-  boot.initrd.availableKernelModules = [
-    "nvme"
-    "xhci_pci"
-    "ahci"
-    "usb_storage"
-    "usbhid"
-    "sd_mod"
-  ];
-
-  hardware.opentabletdriver = {
-    enable = true;
-    # TODO: remove this once otd gets updated
-    package = pkgs.unstable.opentabletdriver;
-  };
-
-  sops.defaultSopsFile = lib.mkForce ../../secrets/monolith/default.yaml;
-
-  my.gaming.enable = true;
-  my.nix-ld.enable = true;
-
-  systemd.slices."system" = {
-    enable = true;
-    sliceConfig = {
-      # 50% maximum usage accross 8 cores
-      CPUQuota = "${toString (8 * 50)}%";
-    };
-  };
-
-  boot.extraModulePackages = with config.boot.kernelPackages; [ zenpower ];
-
-  boot.initrd.kernelModules = [ "amdgpu" ];
-  boot.kernelModules = [
-    "kvm-amd"
-    "amdgpu"
-    "zenpower"
-  ];
-
-  systemd.sleep.settings.Sleep = {
-    HibernateDelaySec = "30s";
-    SuspendState = "mem";
-  };
-
-  # boot.initrd.luks.reusePassphrases = true;
-  boot.initrd.luks.devices = {
-    "data" = {
-      bypassWorkqueues = true;
-      device = "/dev/disk/by-label/CRYPT_DATA";
-    };
-    # "bigboy" = {
-    #   bypassWorkqueues = true;
-    #   device = "/dev/disk/by-label/CRYPT_BIGBOY";
-    # };
-  };
-  fileSystems."/home/lelgenio/Downloads/Torrents" = {
-    device = "/dev/disk/by-label/BTRFS_DATA";
-    fsType = "btrfs";
-    options = [
-      "subvol=@torrents"
-      "nofail"
-    ]
-    ++ btrfs_options;
-  };
-  fileSystems."/home/lelgenio/Música" = {
-    device = "/dev/disk/by-label/BTRFS_DATA";
-    fsType = "btrfs";
-    options = [
-      "subvol=@music"
-      "nofail"
-    ]
-    ++ btrfs_options;
-  };
-  fileSystems."/home/lelgenio/.local/mount/data" = {
-    device = "/dev/disk/by-label/BTRFS_DATA";
-    fsType = "btrfs";
-    options = [
-      "subvol=@data"
-      "nofail"
-    ]
-    ++ btrfs_options;
-  };
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp4s0.useDHCP = lib.mkDefault true;
-  powerManagement.cpuFreqGovernor = "ondemand";
-  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-  networking.hostName = "monolith"; # Define your hostname.
-
-  virtualisation.virtualbox.host.enable = true;
-
-  services.udev.extraRules = ''
-    # Fix broken suspend with Logitech USB dongle
-    # `lsusb | grep Logitech` will return "vendor:product"
-    ACTION=="add" SUBSYSTEM=="usb" ATTR{idVendor}=="046d" ATTR{idProduct}=="c547" ATTR{power/wakeup}="disabled"
-    # Force all disks to use kyber scheduler
-    # For some reason "noop" is used by default which is kinda bad when io is saturated
-    ACTION=="add|change", KERNEL=="sd[a-z]*[0-9]*|mmcblk[0-9]*p[0-9]*|nvme[0-9]*n[0-9]*p[0-9]*", ATTR{../queue/scheduler}="kyber"
-  '';
-
-  boot.tmp = {
-    cleanOnBoot = true;
-    useTmpfs = true;
-  };
-
-  fileSystems."/nix/var/nix/builds" = {
-    device = "tmpfs";
-    fsType = "tmpfs";
-    options = [
-      "size=20G" # adjust for your situation and needs
-      "mode=700"
-    ];
-  };
-
-  zramSwap.enable = true;
-  zramSwap.memoryPercent = 100;
-
-  boot.kernel.sysctl = {
-    "vm.swappiness" = 180;
-    "vm.watermark_boost_factor" = 0;
-    "vm.watermark_scale_factor" = 125;
-    "vm.page-cluster" = 0;
-  };
-}
--- a/hosts/monolith/factorio-server.nix
+++ b/hosts/monolith/factorio-server.nix
@ -1,65 +0,0 @@
-{
-  config,
-  pkgs,
-  ...
-}:
-let
-  mkBackup = time: {
-    systemd.services."factorio-backup-save-${time}" = {
-      description = "Backup factorio saves";
-      script = ''
-        set -exuo pipefail
-
-        FILENAME="space-age-$(date --iso=seconds | tr ':' '_').zip"
-        DEST_DIR=~lelgenio/Documentos/GameSaves/factorio_saves/space-age-1/${time}
-
-        mkdir -p "$DEST_DIR"
-        cp /var/lib/factorio/saves/default.zip "$DEST_DIR"/$FILENAME
-        chown lelgenio "$DEST_DIR" "$DEST_DIR"/$FILENAME
-
-        # list all files, from oldest to newest
-        # remove the last 10 from the list
-        # delete the rest
-        cd "$DEST_DIR"
-        ls | head -n-10 | xargs -r rm -v
-      '';
-      serviceConfig.Type = "oneshot";
-    };
-
-    systemd.timers."factorio-backup-save-${time}" = {
-      timerConfig = {
-        # Systemd accepts descriptive names such as "daily"
-        # The times are at midnight, Persistent makes sure that the backups get executed
-        OnCalendar = time;
-        Persistent = true;
-        Unit = "factorio-backup-save-${time}.service";
-      };
-      wantedBy = [ "timers.target" ];
-    };
-  };
-in
-{
-  imports = [
-    (mkBackup "daily")
-    (mkBackup "monthly")
-  ];
-
-  services.factorio = {
-    enable = true;
-    package = pkgs.my-factorio-headless;
-    public = true;
-    lan = true;
-    openFirewall = true;
-    admins = [ "lelgenio" ];
-    extraSettingsFile = config.sops.secrets."factorio/server-config.json".path;
-  };
-
-  systemd.services.factorio = {
-    after = [ "network-online.target" ];
-    wants = [ "network-online.target" ];
-  };
-
-  sops.secrets."factorio/server-config.json" = {
-    mode = "777";
-  };
-}
--- a/hosts/monolith/minio.nix
+++ b/hosts/monolith/minio.nix
@ -1,43 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}:
-let
-  s = config.sops.secrets;
-
-  dataDir = "/var/lib/minio";
-
-  s3Port = 14749;
-  consolePort = 10601;
-
-  secretConfig = {
-    owner = "minio";
-    group = "minio";
-    restartUnits = [ "minio.service" ];
-    sopsFile = ../../secrets/monolith/default.yaml;
-  };
-in
-{
-  services.minio = {
-    enable = true;
-
-    dataDir = [ dataDir ];
-
-    listenAddress = "0.0.0.0:${toString s3Port}";
-    consoleAddress = "127.0.0.1:${toString consolePort}";
-
-    rootCredentialsFile = config.sops.secrets."minio/root-credentials".path;
-  };
-
-  systemd.tmpfiles.rules = [
-    "d ${dataDir} 0755 minio minio -"
-  ];
-
-  networking.firewall.allowedTCPPorts = [ s3Port ];
-
-  sops.secrets = {
-    "minio/root-credentials" = secretConfig;
-  };
-}
--- a/hosts/monolith/monolith-forgejo-runner.nix
+++ b/hosts/monolith/monolith-forgejo-runner.nix
@ -1,22 +0,0 @@
-{ pkgs, config, ... }:
-{
-  services.gitea-actions-runner = {
-    package = pkgs.forgejo-runner;
-    instances.default = {
-      enable = true;
-      name = "monolith";
-      url = "https://git.lelgenio.com";
-      tokenFile = config.sops.secrets."forgejo-runners/git.lelgenio.com-default".path;
-      labels = [
-        # provide a debian base with nodejs for actions
-        "debian-latest:docker://node:18-bullseye"
-        # fake the ubuntu name, because node provides no ubuntu builds
-        "ubuntu-latest:docker://node:18-bullseye"
-        # provide native execution on the host
-        #"native:host"
-      ];
-    };
-  };
-
-  sops.secrets."forgejo-runners/git.lelgenio.com-default" = { };
-}
--- a/hosts/monolith/monolith-gitlab-runner.nix
+++ b/hosts/monolith/monolith-gitlab-runner.nix
@ -1,60 +0,0 @@
-{
-  config,
-  pkgs,
-  inputs,
-  ...
-}:
-let
-  inherit (pkgs.callPackage ../../system/gitlab-runner.nix { inherit inputs; })
-    mkNixRunner
-    mkNixRunnerFull
-    ;
-in
-{
-  boot.kernel.sysctl."net.ipv4.ip_forward" = true;
-  virtualisation.docker.enable = true;
-  services.gitlab-runner = {
-    enable = true;
-    settings = {
-      concurrent = 2;
-    };
-    services = {
-      # # runner for building in docker via host's nix-daemon
-      # # nix store will be readable in runner, might be insecure
-      # thoreb-telemetria-nix = mkNixRunner config.sops.secrets."gitlab-runners/thoreb-telemetria-nix".path;
-      # thoreb-itinerario-nix = mkNixRunner config.sops.secrets."gitlab-runners/thoreb-itinerario-nix".path;
-
-      wopus-gitlab-nix =
-        (mkNixRunnerFull {
-          authenticationTokenConfigFile = config.sops.secrets."gitlab-runners/wopus-gitlab-nix".path;
-          # nixCacheSshPrivateKeyPath = config.sops.secrets."gitlab-runners/wopus-ssh-nix-cache-pk".path;
-          # nixCacheSshPublicKeyPath = config.sops.secrets."gitlab-runners/wopus-ssh-nix-cache-pub".path;
-        })
-        // {
-          requestConcurrency = 2;
-        };
-
-      # default = ({
-      #   # File should contain at least these two variables:
-      #   # `CI_SERVER_URL`
-      #   # `CI_SERVER_TOKEN`
-      #   authenticationTokenConfigFile = config.sops.secrets."gitlab-runners/docker-images-token".path;
-      #   dockerImage = "debian:stable";
-      #   dockerPullPolicy = "if-not-present";
-      # })
-      # // {
-      #   requestConcurrency = 4;
-      # };
-    };
-  };
-  systemd.services.gitlab-runner.serviceConfig.Nice = 10;
-
-  sops.secrets = {
-    "gitlab-runners/thoreb-telemetria-nix" = { };
-    "gitlab-runners/thoreb-itinerario-nix" = { };
-    "gitlab-runners/docker-images-token" = { };
-    "gitlab-runners/wopus-gitlab-nix" = { };
-    "gitlab-runners/wopus-ssh-nix-cache-pk" = { };
-    "gitlab-runners/wopus-ssh-nix-cache-pub" = { };
-  };
-}
--- a/hosts/monolith/nebula-vpn.nix
+++ b/hosts/monolith/nebula-vpn.nix
@ -1,53 +0,0 @@
-{ pkgs, config, ... }:
-let
-  s = config.sops.secrets;
-
-  secretConfig = {
-    owner = "nebula-wopus";
-    group = "nebula-wopus";
-    restartUnits = [ "nebula@wopus.service" ];
-    sopsFile = ../../secrets/monolith/default.yaml;
-  };
-in
-{
-  environment.systemPackages = with pkgs; [ nebula ];
-
-  services.nebula.networks.wopus = {
-    enable = true;
-    isLighthouse = false;
-    lighthouses = [
-      "192.168.88.3"
-    ];
-    settings = {
-      cipher = "aes";
-    };
-    cert = s."nebula-wopus-vpn/monolith-crt".path;
-    key = s."nebula-wopus-vpn/monolith-key".path;
-    ca = s."nebula-wopus-vpn/ca-crt".path;
-    staticHostMap = {
-      "192.168.88.3" = [
-        "72.60.60.221:4242"
-      ];
-    };
-    firewall.outbound = [
-      {
-        host = "any";
-        port = "any";
-        proto = "any";
-      }
-    ];
-    firewall.inbound = [
-      {
-        host = "any";
-        port = "any";
-        proto = "any";
-      }
-    ];
-  };
-
-  sops.secrets = {
-    "nebula-wopus-vpn/ca-crt" = secretConfig;
-    "nebula-wopus-vpn/monolith-crt" = secretConfig;
-    "nebula-wopus-vpn/monolith-key" = secretConfig;
-  };
-}
--- a/hosts/monolith/partition.nix
+++ b/hosts/monolith/partition.nix
@ -1,68 +0,0 @@
-let
-  btrfs_options = [
-    "compress=zstd:3"
-    "noatime"
-    "x-systemd.device-timeout=0"
-  ];
-  btrfs_ssd = btrfs_options ++ [
-    "ssd"
-    "discard=async"
-  ];
-in
-{
-  disko.devices = {
-    disk = {
-      bigboy_disk = {
-        type = "disk";
-        device = "/dev/nvme0n1";
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "2G";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "defaults" ];
-              };
-            };
-            luks = {
-              size = "100%";
-              content = {
-                type = "luks";
-                name = "bigboy";
-                # disable settings.keyFile if you want to use interactive password entry
-                passwordFile = "/tmp/secret.key"; # Interactive
-                # settings = {
-                #   allowDiscards = true;
-                #   keyFile = "/tmp/secret.key";
-                # };
-                # additionalKeyFiles = [ "/tmp/additionalSecret.key" ];
-                content = {
-                  type = "btrfs";
-                  extraArgs = [ "-f" ];
-                  subvolumes = {
-                    "/@nixos" = {
-                      mountpoint = "/";
-                      mountOptions = btrfs_ssd;
-                    };
-                    "/@home" = {
-                      mountpoint = "/home";
-                      mountOptions = btrfs_ssd;
-                    };
-                    "/@swap" = {
-                      mountpoint = "/.swapvol";
-                      swap.swapfile.size = "32G";
-                    };
-                  };
-                };
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}
--- a/hosts/phantom/davi.nix
+++ b/hosts/phantom/davi.nix
@ -1,26 +0,0 @@
-{ pkgs, ... }:
-{
-  users.users.davikiwi = {
-    isNormalUser = true;
-    description = "Davi";
-    hashedPassword = "$y$j9T$0e/rczjOVCy7PuwC3pG0V/$gTHZhfO4wQSlFvbDyfghbCnGI2uDI0a52zSrQ/yOA5A";
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGgZDBnj+gVMHqoNvjpx2T/HqnxUDbLPshu+t7301gXd Davi@DESKTOP-EVHFGJ9"
-    ];
-    extraGroups = [ "docker" ];
-    packages = with pkgs; [
-      (pkgs.python3.withPackages (python-pkgs: [
-        python-pkgs.pip
-        python-pkgs.wheel
-      ]))
-    ];
-  };
-
-  services.nginx.virtualHosts."davikiwi.lelgenio.com" = {
-    enableACME = true;
-    forceSSL = true;
-    locations."/" = {
-      proxyPass = "http://127.0.0.1:24618";
-    };
-  };
-}
--- a/hosts/phantom/default.nix
+++ b/hosts/phantom/default.nix
@ -1,88 +0,0 @@
-{
-  config,
-  pkgs,
-  inputs,
-  lib,
-  ...
-}:
-{
-  imports = [
-    inputs.vpsadminos.nixosConfigurations.container
-    inputs.sops-nix.nixosModules.default
-
-    ../../system/sops.nix
-    ../../system/nix.nix
-    ./hardware-config.nix
-    ./mastodon.nix
-    ./lemmy.nix
-    ./nextcloud.nix
-    ./nginx.nix
-    ./syncthing.nix
-    ./users.nix
-    ./writefreely.nix
-    ./email.nix
-    ./forgejo.nix
-    ./invidious.nix
-    ./davi.nix
-    ./goofs.nix
-  ];
-
-  networking.hostName = "phantom";
-
-  services.nginx.virtualHosts."lelgenio.com" = {
-    enableACME = true;
-    forceSSL = true;
-    root = pkgs.runCommand "www-dir" { } ''
-      mkdir -p $out
-      cat > $out/index.html <<EOF
-        <!DOCTYPE html>
-        <html lang="en">
-        <body>
-          <h1>
-              Nothing to see here!
-          <h1>
-        </body>
-        </html>
-      EOF
-    '';
-  };
-
-  # # Enable networking
-  # networking.networkmanager.enable = true;
-  # Set your time zone.
-  time.timeZone = "America/Sao_Paulo";
-  # Select internationalisation properties.
-  i18n.defaultLocale = "pt_BR.UTF-8";
-
-  boot.kernel.sysctl."fs.inotify.max_user_watches" = 1048576;
-
-  sops = {
-    secrets.hello = { };
-    defaultSopsFile = lib.mkForce ../../secrets/phantom/default.yaml;
-  };
-
-  environment.etc."teste-sops" = {
-    text = config.sops.secrets.hello.path;
-  };
-
-  virtualisation.docker = {
-    enable = true;
-    daemon.settings = {
-      # needed by bitbucket runner ???
-      log-driver = "json-file";
-      log-opts = {
-        max-size = "10m";
-        max-file = "3";
-      };
-    };
-  };
-
-  nix.settings = {
-    cores = 1;
-    max-jobs = 1;
-  };
-
-  networking.firewall.allowedTCPPorts = [ 8745 ];
-
-  system.stateVersion = "23.05"; # Never change this
-}
--- a/hosts/phantom/email.nix
+++ b/hosts/phantom/email.nix
@ -1,62 +0,0 @@
-{
-  pkgs,
-  inputs,
-  config,
-  ...
-}:
-{
-  imports = [ inputs.nixos-mailserver.nixosModules.mailserver ];
-
-  mailserver = {
-    enable = true;
-    fqdn = "lelgenio.com";
-    domains = [
-      "lelgenio.xyz"
-      "git.lelgenio.xyz"
-      "lelgenio.com"
-      "git.lelgenio.com"
-      "social.lelgenio.com"
-    ];
-    certificateScheme = "acme-nginx";
-    # Create passwords with
-    # nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
-    loginAccounts = {
-      "lelgenio@lelgenio.com" = {
-        hashedPassword = "$2y$05$z5s7QCXcs5uTFsfyYpwNJeWzb3RmzgWxNgcPCr0zjSytkLFF/qZmS";
-        aliases = [
-          "postmaster@lelgenio.com"
-          "lelgenio@lelgenio.xyz"
-          "lelgenio@lelgenio.xyz"
-        ];
-      };
-      "noreply@git.lelgenio.com" = {
-        hashedPassword = "$2b$05$TmR1R7ZwXfec7yrOfeBL7u3ZtyXf0up5dEO6uMWSvb/O7LPEm.j0.";
-      };
-      "noreply@social.lelgenio.com" = {
-        hashedPassword = "$2b$05$DcA9xMdvHqqQMZw2.zybI.vfKsQAJtaQ/JB.t9AHu6psstWq97m2C";
-      };
-    };
-
-    enableManageSieve = true;
-
-    stateVersion = 3;
-  };
-
-  # Prefer ipv4 and use main ipv6 to avoid reverse DNS issues
-  services.postfix.settings.main = {
-    smtp_address_preference = "ipv4";
-  };
-
-  # Webmail
-  services.roundcube = {
-    enable = true;
-    package = pkgs.roundcube.withPlugins (p: [ p.carddav ]);
-    hostName = "mail.lelgenio.com";
-    extraConfig = ''
-      $config['smtp_host'] = "tls://${config.mailserver.fqdn}:587";
-      $config['smtp_user'] = "%u";
-      $config['smtp_pass'] = "%p";
-      $config['plugins'] = [ "carddav", "archive", "managesieve" ];
-    '';
-  };
-}
--- a/hosts/phantom/forgejo.nix
+++ b/hosts/phantom/forgejo.nix
@ -1,52 +0,0 @@
-{
-  lib,
-  pkgs,
-  config,
-  ...
-}:
-let
-  cfg = config.services.forgejo;
-  srv = cfg.settings.server;
-in
-{
-  services.nginx = {
-    virtualHosts.${cfg.settings.server.DOMAIN} = {
-      forceSSL = true;
-      enableACME = true;
-      locations."/".proxyPass = "http://localhost:${toString srv.HTTP_PORT}";
-    };
-  };
-
-  services.forgejo = {
-    enable = true;
-    database.type = "postgres";
-    lfs.enable = true;
-    settings = {
-      service.DISABLE_REGISTRATION = true;
-      actions = {
-        ENABLED = true;
-        DEFAULT_ACTIONS_URL = "github";
-      };
-      repository = {
-        ENABLE_PUSH_CREATE_USER = true;
-      };
-      server = {
-        DOMAIN = "git.lelgenio.com";
-        HTTP_PORT = 3000;
-        ROOT_URL = "https://${srv.DOMAIN}/";
-      };
-      mailer = {
-        ENABLED = true;
-        SMTP_ADDR = "lelgenio.com";
-        FROM = "noreply@git.lelgenio.com";
-        USER = "noreply@git.lelgenio.com";
-      };
-    };
-    secrets.mailer.PASSWD = config.sops.secrets."forgejo/smtp_password".path;
-  };
-
-  sops.secrets."forgejo/smtp_password" = {
-    mode = "400";
-    owner = "forgejo";
-  };
-}
--- a/hosts/phantom/goofs.nix
+++ b/hosts/phantom/goofs.nix
@ -1,51 +0,0 @@
-{ inputs, config, ... }:
-{
-  imports = [
-    inputs.warthunder-leak-counter.nixosModules.default
-    inputs.made-you-look.nixosModules.default
-  ];
-
-  services.warthunder-leak-counter.enable = true;
-  services.nginx.virtualHosts."warthunder-leak-counter.lelgenio.com" = {
-    enableACME = true;
-    forceSSL = true;
-    locations."/" = {
-      proxyPass = "http://127.0.0.1:${toString config.services.warthunder-leak-counter.port}";
-    };
-  };
-
-  services.made-you-look.enable = true;
-  services.nginx.virtualHosts."coolest-thing-ever.lelgenio.com" = {
-    enableACME = true;
-    forceSSL = true;
-    locations."/" = {
-      proxyPass = "http://127.0.0.1:${toString config.services.made-you-look.port}";
-    };
-  };
-
-  services.nginx.virtualHosts."catboy-spinner.lelgenio.com" = {
-    enableACME = true;
-    forceSSL = true;
-    root = inputs.catboy-spinner;
-  };
-  services.nginx.virtualHosts."tomater.lelgenio.com" = {
-    enableACME = true;
-    forceSSL = true;
-    root = inputs.tomater;
-  };
-  services.nginx.virtualHosts."youre-wrong.lelgenio.com" = {
-    enableACME = true;
-    forceSSL = true;
-    root = inputs.youre-wrong;
-  };
-  services.nginx.virtualHosts."hello-fonts.lelgenio.com" = {
-    enableACME = true;
-    forceSSL = true;
-    root = inputs.hello-fonts;
-  };
-  services.nginx.virtualHosts."contador-da-viagem.lelgenio.com" = {
-    enableACME = true;
-    forceSSL = true;
-    root = inputs.contador-da-viagem;
-  };
-}
--- a/hosts/phantom/hardware-config.nix
+++ b/hosts/phantom/hardware-config.nix
@ -1,19 +0,0 @@
-{
-  fileSystems."/var/lib/syncthing-data" = {
-    device = "172.16.130.7:/nas/5749/syncthinng_data";
-    fsType = "nfs";
-    options = [ "nofail" ];
-  };
-  fileSystems."/var/lib/mastodon" = {
-    device = "172.16.131.19:/nas/5749/mastodon";
-    fsType = "nfs";
-    options = [ "nofail" ];
-  };
-
-  swapDevices = [
-    {
-      device = "/swap/swapfile";
-      size = (1024 * 2); # 2 GB
-    }
-  ];
-}
--- a/hosts/phantom/invidious.nix
+++ b/hosts/phantom/invidious.nix
@ -1,39 +0,0 @@
-{
-  inputs,
-  pkgs,
-  config,
-  ...
-}:
-{
-  # Replace with unstable, since 24.05 does not have sig-helper
-  disabledModules = [ "services/web-apps/invidious.nix" ];
-  imports = [ (inputs.nixpkgs-unstable + "/nixos/modules/services/web-apps/invidious.nix") ];
-
-  services.invidious = {
-    enable = true;
-    domain = "invidious.lelgenio.com";
-    nginx.enable = true;
-    port = 10601;
-    http3-ytproxy.enable = true;
-    sig-helper = {
-      enable = true;
-      package = pkgs.unstable.inv-sig-helper;
-    };
-    # {
-    #     "visitor_data": "...",
-    #     "po_token": "..."
-    # }
-    extraSettingsFile = config.sops.secrets."invidious/settings.json".path;
-    settings = {
-      force_resolve = "ipv6";
-      db = {
-        user = "invidious";
-        dbname = "invidious";
-      };
-    };
-  };
-
-  sops.secrets."invidious/settings.json" = {
-    mode = "666";
-  };
-}
--- a/hosts/phantom/lemmy.nix
+++ b/hosts/phantom/lemmy.nix
@ -1,18 +0,0 @@
-{ pkgs, ... }:
-{
-  services.lemmy = {
-    enable = true;
-    settings = {
-      hostname = "lemmy.lelgenio.com";
-    };
-    database.createLocally = true;
-    nginx.enable = true;
-  };
-
-  services.pict-rs.package = pkgs.pict-rs;
-
-  services.nginx.virtualHosts."lemmy.lelgenio.com" = {
-    enableACME = true;
-    forceSSL = true;
-  };
-}
--- a/hosts/phantom/mastodon.nix
+++ b/hosts/phantom/mastodon.nix
@ -1,28 +0,0 @@
-{
-  config,
-  pkgs,
-  inputs,
-  ...
-}:
-{
-  services.mastodon = {
-    enable = true;
-    configureNginx = true;
-    localDomain = "social.lelgenio.com";
-    smtp = {
-      authenticate = true;
-      host = "lelgenio.com";
-      fromAddress = "noreply@social.lelgenio.com";
-      user = "noreply@social.lelgenio.com";
-      passwordFile = config.sops.secrets."mastodon/smtp-password".path;
-    };
-    streamingProcesses = 1;
-    extraConfig.SINGLE_USER_MODE = "true";
-    mediaAutoRemove.olderThanDays = 2;
-  };
-
-  sops.secrets."mastodon/smtp-password" = {
-    mode = "400";
-    owner = "mastodon";
-  };
-}
--- a/hosts/phantom/nextcloud.nix
+++ b/hosts/phantom/nextcloud.nix
@ -1,28 +0,0 @@
-{
-  config,
-  pkgs,
-  ...
-}:
-{
-  services.nextcloud = {
-    enable = true;
-    package = pkgs.nextcloud32;
-    hostName = "cloud.lelgenio.com";
-    https = true;
-    config = {
-      dbtype = "sqlite"; # TODO: move to single postgres db
-      adminpassFile = config.sops.secrets."nextcloud/default-password".path;
-    };
-  };
-
-  services.nginx.virtualHosts.${config.services.nextcloud.hostName} = {
-    forceSSL = true;
-    enableACME = true;
-  };
-
-  sops.secrets."nextcloud/default-password" = {
-    mode = "400";
-    owner = "nextcloud";
-    group = "nextcloud";
-  };
-}
--- a/hosts/phantom/nginx.nix
+++ b/hosts/phantom/nginx.nix
@ -1,47 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-{
-  services.nginx = {
-    enable = true;
-    recommendedProxySettings = true;
-    recommendedTlsSettings = true;
-    recommendedOptimisation = true;
-    recommendedGzipSettings = true;
-    clientMaxBodySize = "512M";
-  };
-
-  # Redirect *lelgenio.xyz -> *lelgenio.com
-  services.nginx.virtualHosts =
-    lib.mapAttrs' (key: value: lib.nameValuePair "${key}lelgenio.xyz" value)
-      (
-        lib.genAttrs
-          [
-            ""
-            "social."
-            "blog."
-            "cloud."
-            "mail."
-            "git."
-            "syncthing."
-          ]
-          (name: {
-            enableACME = true;
-            forceSSL = true;
-            locations."/".return = "301 $scheme://${name}lelgenio.com$request_uri";
-          })
-      );
-
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "lelgenio@disroot.org";
-  };
-
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
-}
--- a/hosts/phantom/syncthing.nix
+++ b/hosts/phantom/syncthing.nix
@ -1,39 +0,0 @@
-{
-  config,
-  pkgs,
-  inputs,
-  ...
-}:
-{
-
-  services.syncthing = {
-    enable = true;
-    dataDir = "/var/lib/syncthing-data";
-    guiAddress = "0.0.0.0:8384";
-    openDefaultPorts = true;
-    guiPasswordFile = config.sops.secrets."syncthing/password".path;
-    settings.gui = {
-      user = "lelgenio";
-    };
-  };
-
-  services.nginx.virtualHosts."syncthing.lelgenio.com" = {
-    enableACME = true;
-    forceSSL = true;
-    locations."/" = {
-      proxyPass = "http://127.0.0.1:8384";
-      extraConfig =
-        # required when the target is also TLS server with multiple hosts
-        "proxy_ssl_server_name on;"
-        +
-          # required when the server wants to use HTTP Authentication
-          "proxy_pass_header Authorization;";
-    };
-  };
-
-  sops.secrets."syncthing/password" = {
-    mode = "400";
-    owner = "syncthing";
-    group = "syncthing";
-  };
-}
--- a/hosts/phantom/writefreely.nix
+++ b/hosts/phantom/writefreely.nix
@ -1,27 +0,0 @@
-{
-  config,
-  pkgs,
-  inputs,
-  ...
-}:
-{
-  services.writefreely = {
-    enable = true;
-    acme.enable = true;
-    nginx.enable = true;
-    nginx.forceSSL = true;
-    host = "blog.lelgenio.com";
-    admin.name = "lelgenio";
-    admin.initialPasswordFile = config.sops.secrets."writefreely/password".path;
-    settings.app = {
-      site_name = "Leo's blog";
-      single_user = true;
-    };
-  };
-
-  sops.secrets."writefreely/password" = {
-    mode = "400";
-    owner = "writefreely";
-    group = "writefreely";
-  };
-}
--- a/hosts/pixie/default.nix
+++ b/hosts/pixie/default.nix
@ -1,28 +1,13 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
+{ config, lib, pkgs, modulesPath, ... }:

 {
  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];

-  packages.media-packages.enable = lib.mkOverride 0 false;
-  services.flatpak.enable = lib.mkOverride 0 false;
-
-  boot.initrd.availableKernelModules = [
-    "nvme"
-    "xhci_pci"
-    "ahci"
-    "usb_storage"
-    "usbhid"
-    "sd_mod"
-  ];
+  boot.initrd.availableKernelModules =
+    [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ "kvm-amd" ];
  boot.extraModulePackages = [ ];
@ -33,7 +18,8 @@
    options = [ "subvol=nixos" ];
  };

-  boot.initrd.luks.devices."pixie".device = "/dev/disk/by-uuid/f4ae5858-d2d6-4cd1-a054-bf5147a9a928";
+  boot.initrd.luks.devices."pixie".device =
+    "/dev/disk/by-uuid/f4ae5858-d2d6-4cd1-a054-bf5147a9a928";

  fileSystems."/home" = {
    device = "/dev/mapper/pixie";
@ -60,7 +46,8 @@
  # networking.interfaces.enp4s0.useDHCP = lib.mkDefault true;
  # networking.interfaces.veth74f3ffc.useDHCP = lib.mkDefault true;

-  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  hardware.cpu.amd.updateMicrocode =
+    lib.mkDefault config.hardware.enableRedistributableFirmware;

  networking.hostName = "pixie"; # Define your hostname.
 }
--- a/hosts/rainbow.nix
+++ b/hosts/rainbow.nix
@ -0,0 +1,66 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+let
+  btrfs_options = [ "compress=zstd:3" "noatime" "x-systemd.device-timeout=0" ];
+  btrfs_ssd = [ "ssd" "discard=async" ];
+in
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  boot.initrd.availableKernelModules =
+    [ "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
+  boot.initrd.kernelModules = [ "i915" ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/BTRFS_ROOT";
+    fsType = "btrfs";
+    options = [ "subvol=@nixos" ] ++ btrfs_options ++ btrfs_ssd;
+  };
+
+  boot.initrd.luks.devices = {
+    "main" = {
+      bypassWorkqueues = true;
+      device = "/dev/disk/by-label/CRYPT_ROOT";
+    };
+  };
+
+  fileSystems."/home" = {
+    device = "/dev/disk/by-label/BTRFS_ROOT";
+    fsType = "btrfs";
+    options = [ "subvol=@home" ] ++ btrfs_options ++ btrfs_ssd;
+  };
+
+  boot.loader.efi.efiSysMountPoint = "/boot/efi";
+  fileSystems."/boot/efi" = {
+    device = "/dev/disk/by-uuid/DC3B-5753";
+    fsType = "vfat";
+  };
+
+  fileSystems."/swap" = {
+    device = "/dev/disk/by-label/BTRFS_ROOT";
+    fsType = "btrfs";
+    options = [ "subvol=@swap" ] ++ btrfs_ssd;
+  };
+
+  swapDevices = [{
+    device = "/swap/swapfile";
+    size = (1024 * 8);
+  }];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+
+  powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand";
+  hardware.cpu.intel.updateMicrocode =
+    lib.mkDefault config.hardware.enableRedistributableFirmware;
+
+  networking.hostName = "rainbow"; # Define your hostname.
+}
--- a/install/i15.sh
+++ b/install/i15.sh
@ -0,0 +1,63 @@
+#!/bin/sh
+
+set -xe
+
+settle() {
+    udevadm trigger --subsystem-match=block
+    udevadm settle
+}
+
+lsblk
+echo 'Enter the name of the device to WIPE and install (something like "sda"):'
+read DRIVE_ID
+
+echo 'Enter a passphrase to encrypt the disk:'
+read -s DRIVE_PASSPHRASE
+
+echo "Creating partition table..."
+parted -s "/dev/${DRIVE_ID}" -- mklabel gpt
+
+echo "Creating EFI system partition..."
+parted -s "/dev/${DRIVE_ID}" -- mkpart ESP 1MiB 1GiB
+parted -s "/dev/${DRIVE_ID}" -- set 1 boot on
+mkfs.fat -F32 "/dev/${DRIVE_ID}1" -n NIX_BOOT
+
+echo "Creating encrypted root partition..."
+parted -s "/dev/${DRIVE_ID}" -- mkpart luks 1GiB 100%
+echo "$DRIVE_PASSPHRASE" | cryptsetup --batch-mode luksFormat --label CRYPT_ROOT "/dev/${DRIVE_ID}2"
+settle
+echo "$DRIVE_PASSPHRASE" | cryptsetup luksOpen /dev/disk/by-label/CRYPT_ROOT "crypt_root"
+
+echo "Creating btrfs partition..."
+mkfs.btrfs --quiet --label NIX_ROOT /dev/mapper/"crypt_root"
+MNTPOINT=$(mktemp -d)
+mount /dev/mapper/"crypt_root" "$MNTPOINT"
+
+echo "Creating subvolumes..."
+btrfs subvolume create "$MNTPOINT"/@nixos
+btrfs subvolume create "$MNTPOINT"/@home
+btrfs subvolume create "$MNTPOINT"/@swap
+
+echo "Closing btrfs partition..."
+umount -Rl "$MNTPOINT"
+rm -rf "$MNTPOINT"
+
+echo "Mounting root btrfs submodule to '$MNTPOINT' ..."
+MNTPOINT=$(mktemp -d)
+mount /dev/disk/by-label/NIX_ROOT "$MNTPOINT" -o subvol=@nixos,noatime,compress=zstd
+
+echo "Creating and mounting EFI system partition mountpoint..."
+mkdir -p "$MNTPOINT/boot"
+mount /dev/disk/by-label/NIX_BOOT "$MNTPOINT/boot"
+
+echo "Creating home partition mountpoint..."
+mkdir -p "$MNTPOINT/home"
+mount /dev/disk/by-label/NIX_ROOT "$MNTPOINT/home" -o subvol=@home,noatime,compress=zstd
+
+echo "Swapfile"
+mkdir -p "$MNTPOINT/swap"
+mount /dev/disk/by-label/NIX_ROOT "$MNTPOINT/swap" -o subvol=@swap,noatime
+
+# echo "Installing system..."
+nixos-generate-config --root "$MNTPOINT"
+# nixos-install --root "$MNTPOINT"
--- a/overlays/default.nix
+++ b/overlays/default.nix
@ -1,106 +1,74 @@
-{ inputs, packages, ... }:
-rec {
+{ inputs, packages, ... }: rec {
  all = [
    scripts
-    unstable
+    sway
    themes
    new-packages
    patches
+    variables
    lib_extended
-    disko
  ];

  scripts = (import ../scripts);

-  unstable =
-    final: prev:
-    let
-      args = {
-        inherit (final) config;
-        system = prev.stdenv.hostPlatform.system;
-      };
-    in
-    {
-      unstable = import inputs.nixpkgs-unstable args;
+  sway = (import ./sway.nix);
+
+  themes = (final: prev: {
+    material-wifi-icons = final.stdenv.mkDerivation rec {
+      name = "material-wifi-icons";
+      src = inputs.material-wifi-icons;
+      installPhase = ''
+        install -D material-wifi.ttf $out/share/fonts/${name}
+      '';
    };
+    papirus_red = (final.papirus-icon-theme.override { color = "red"; });
+    orchis_theme_compact = (final.orchis-theme.override {
+      border-radius = 0;
+      tweaks = [ "compact" "solid" ];
+    });
+    nerdfonts_fira_hack = (final.nerdfonts.override { fonts = [ "FiraCode" "Hack" ]; });
+  });

-  themes = (
-    final: prev: {
-      papirus_red = (final.papirus-icon-theme.override { color = "red"; }).overrideAttrs {
-        dontPatchShebangs = true;
-        noAuditTmpdir = true;
-        dontAutoPatchelf = true;
-        dontPatchELF = true;
-        dontCheckForBrokenSymlinks = true;
-      };
-      orchis_theme_compact = (
-        final.orchis-theme.override {
-          border-radius = 0;
-          tweaks = [
-            "compact"
-            "solid"
-          ];
-        }
-      );
-    }
-  );
+  new-packages = (final: prev: packages // {
+    dhist = inputs.dhist.packages.${prev.system}.dhist;
+    demoji = inputs.demoji.packages.${prev.system}.default;
+    tlauncher = inputs.tlauncher.packages.${prev.system}.tlauncher;
+    maildir-notify-daemon = inputs.maildir-notify-daemon.packages.${prev.system}.default;
+    wl-crosshair = inputs.wl-crosshair.packages.${prev.system}.default;

-  new-packages = (
-    final: prev:
-    let
-      system = prev.stdenv.hostPlatform.system;
-    in
-    packages
-    // {
-      lsfg-vk = inputs.lsfg-vk-flake.packages.${system}.lsfg-vk;
-      lsfg-vk-ui = inputs.lsfg-vk-flake.packages.${system}.lsfg-vk-ui;
-      dhist = inputs.dhist.packages.${system}.dhist;
-      demoji = inputs.demoji.packages.${system}.default;
-      tlauncher = inputs.tlauncher.packages.${system}.tlauncher;
-      wl-crosshair = inputs.wl-crosshair.packages.${system}.default;
-      dzgui = inputs.dzgui-nix.packages.${system}.default;
-    }
-  );
+    webcord = (prev.webcord.overrideAttrs (old: {
+      patches = (old.patches or [ ]) ++ [ ../patches/webcord/fix-reading-config.patch ];
+    }));
+  });

-  patches = (
-    final: prev: {
-      mySway = prev.sway.override {
-        withBaseWrapper = true;
-        withGtkWrapper = true;
-        sway-unwrapped = prev.sway-unwrapped.overrideAttrs (old: {
-          patches = old.patches ++ [ ../patches/sway/fix-hide_cursor-clearing-focus.patch ];
-        });
-      };
-      deluge = prev.deluge.overrideAttrs (old: {
-        propagatedBuildInputs = old.propagatedBuildInputs ++ [
-          prev.libappindicator-gtk3
-        ];
-      });
-    }
-  );
+  patches = (final: prev: {
+    bemenu = prev.bemenu.overrideAttrs (o: {
+      postPatch = ''
+        substituteInPlace lib/renderers/wayland/window.c \
+          --replace ZWLR_LAYER_SHELL_V1_LAYER_TOP ZWLR_LAYER_SHELL_V1_LAYER_OVERLAY
+      '';
+    });
+    sway-unwrapped = prev.sway-unwrapped.overrideAttrs (old: {
+      patches = old.patches
+        ++ [ ../patches/sway/fix-hide_cursor-clearing-focus.patch ];
+    });
+  });

-  lib_extended = (
-    final: prev: {
-      lib = prev.lib // rec {
-        # Utility function
-        # Input: [{v1=1;} {v2=2;}]
-        # Output: {v1=1;v2=2;}
-        mergeAttrsSet = prev.lib.foldAttrs (n: _: n) { };
+  variables = (final: prev: {
+    uservars = import ../user/variables.nix;
+  });

-        # Easily translate imperative templating code
-        # Input: [ 1 2 ] (num: { "v${num}" = num; })
-        # Output: {v1=1;v2=2;}
-        forEachMerge = list: func: mergeAttrsSet (prev.lib.forEach list func);
-      };
-    }
-  );
+  lib_extended = (final: prev: {
+    lib = prev.lib // rec {
+      # Utility function
+      # Input: [{v1=1;} {v2=2;}]
+      # Output: {v1=1;v2=2;}
+      mergeAttrsSet = prev.lib.foldAttrs (n: _: n) { };

-  disko = final: prev: {
-    makeDiskoTest =
-      let
-        makeTest = import (prev.path + "/nixos/tests/make-test-python.nix");
-        eval-config = import (prev.path + "/nixos/lib/eval-config.nix");
-      in
-      (prev.callPackage "${inputs.disko}/tests/lib.nix" { inherit makeTest eval-config; }).makeDiskoTest;
-  };
+      # Easily translate imperative templating code
+      # Input: [ 1 2 ] (num: { "v${num}" = num; })
+      # Output: {v1=1;v2=2;}
+      forEachMerge = list: func: mergeAttrsSet (prev.lib.forEach list func);
+    };
+  });
 }
--- a/overlays/sway.nix
+++ b/overlays/sway.nix
@ -0,0 +1,19 @@
+(pkgs: _: {
+  # bash script to let dbus know about important env variables and
+  # propogate them to relevent services run at the end of sway config
+  # see
+  # https://github.com/emersion/xdg-desktop-portal-wlr/wiki/"It-doesn't-work"-Troubleshooting-Checklist
+  # note: this is pretty much the same as  /etc/sway/config.d/nixos.conf but also restarts
+  # some user services to make sure they have the correct environment variables
+  dbus-sway-environment = pkgs.writeTextFile {
+    name = "dbus-sway-environment";
+    destination = "/bin/dbus-sway-environment";
+    executable = true;
+    text = ''
+      systemctl --user import-environment
+      dbus-update-activation-environment --systemd WAYLAND_DISPLAY XDG_CURRENT_DESKTOP=sway
+      # systemctl --user stop pipewire wireplumber xdg-desktop-portal xdg-desktop-portal-wlr
+      # systemctl --user start pipewire wireplumber xdg-desktop-portal xdg-desktop-portal-wlr
+    '';
+  };
+})
--- a/patches/nixpkgs/fix-steam-generation-after-generation-switch.patch
+++ b/patches/nixpkgs/fix-steam-generation-after-generation-switch.patch
@ -0,0 +1,27 @@
+From ac4d51306af54a088e29e2e5efcfac5dfe87d95c Mon Sep 17 00:00:00 2001
+From: lelgenio <lelgenio@disroot.org>
+Date: Fri, 4 Aug 2023 01:25:04 -0300
+Subject: [PATCH] HACK: fix steam after generation switch
+
+---
+ pkgs/build-support/build-fhsenv-bubblewrap/default.nix | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/pkgs/build-support/build-fhsenv-bubblewrap/default.nix b/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
+index 3500e5e9216f..4d7ac0aa7618 100644
+--- a/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
+++ b/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
+@@ -152,6 +152,10 @@ let
+       fi
+       if [[ -L $i ]]; then
+         symlinks+=(--symlink "$(${coreutils}/bin/readlink "$i")" "$i")
+      elif [[ -f $i && -r $i ]]; then
+        SNAPSHOT=$(mktemp --dry-run)
+        cp "$i" "$SNAPSHOT"
+        ro_mounts+=(--ro-bind-try "$SNAPSHOT" "$i")
+       else
+         ro_mounts+=(--ro-bind-try "$i" "$i")
+       fi
+-- 
+2.42.0
+
--- a/patches/qutebrowser/tree-style-tabs.patch
+++ b/patches/qutebrowser/tree-style-tabs.patch
--- a/patches/webcord/fix-reading-config.patch
+++ b/patches/webcord/fix-reading-config.patch
@ -0,0 +1,14 @@
+diff --git a/sources/code/main/modules/config.ts b/sources/code/main/modules/config.ts
+index caf51df..41faabe 100644
+--- a/sources/code/main/modules/config.ts
+++ b/sources/code/main/modules/config.ts
+@@ -158,6 +158,9 @@ class Config<T> {
+   #read(): unknown {
+     const encodedData = readFileSync(this.#path+this.#pathExtension);
+     let decodedData = encodedData.toString();
+    if (decodedData === "")
+        return {};
+
+     if(this.#pathExtension === FileExt.Encrypted)
+       decodedData = safeStorage.decryptString(encodedData);
+     return JSON.parse(decodedData);
--- a/pkgs/caffeinated/default.nix
+++ b/pkgs/caffeinated/default.nix
@ -1,53 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchFromGitHub,
-
-  pkgconf,
-  pkg-config,
-  wayland-scanner,
-
-  systemd,
-  libbsd,
-  wayland,
-  wayland-protocols,
-  libcap,
-}:
-
-stdenv.mkDerivation {
-  pname = "caffeinated";
-  version = "2022-12-08";
-
-  src = fetchFromGitHub {
-    owner = "electrickite";
-    repo = "caffeinated";
-    rev = "5a8eff054bdce225a19cf3ab785dc1bbc9bd3265";
-    hash = "sha256-X1w/YWljcwb5ZH8Nt92CDhPU/yqBLH3lBS7yVJUeyzY=";
-  };
-
-  nativeBuildInputs = [
-    pkgconf
-    pkg-config
-    wayland-scanner
-  ];
-
-  buildInputs = [
-    systemd
-    libbsd
-    wayland
-    wayland-protocols
-    libcap
-  ];
-
-  makeFlags = [ "WAYLAND=1" ];
-
-  installFlags = [ "PREFIX=$(out)" ];
-
-  meta = {
-    description = "Utility to prevent the system from entering an idle state";
-    homepage = "https://github.com/electrickite/caffeinated";
-    license = lib.licenses.mit;
-    platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ lelgenio ];
-  };
-}
--- a/pkgs/cargo-checkmate.nix
+++ b/pkgs/cargo-checkmate.nix
@ -1,12 +1,11 @@
-{
-  lib,
-  rustPlatform,
-  fetchFromGitHub,
-  pkg-config,
-  openssl,
-  zlib,
-  stdenv,
-  Security ? null,
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, openssl
+, zlib
+, stdenv
+, Security ? null
 }:

 rustPlatform.buildRustPackage rec {
@ -23,7 +22,9 @@ rustPlatform.buildRustPackage rec {
  cargoSha256 = "sha256-hOB84u55ishahIFSqBnqccqH3OlC9J8mCYzsd23jTyA=";

  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security ];
+  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [
+    Security
+  ];

  meta = with lib; {
    description = "Check all the things.";
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@ -1,19 +1,8 @@
 # Custom packages, that can be defined similarly to ones from nixpkgs
 # You can build them using 'nix build .#example' or (legacy) 'nix-build -A example'

-{ pkgs, inputs }:
-rec {
-  caffeinated = pkgs.callPackage ./caffeinated { };
+{ pkgs, inputs }: {
  cargo-checkmate = pkgs.callPackage ./cargo-checkmate.nix { };
-  lumactl = pkgs.callPackage ./lumactl.nix {
-    wmctl = pkgs.callPackage ./wmctl.nix { };
-  };
-  wmctl = pkgs.callPackage ./wmctl.nix { };
-  lipsum = pkgs.callPackage ./lipsum.nix { };
+  lipsum = pkgs.callPackage ./lipsum.nix { inherit inputs; };
  emmet-cli = pkgs.callPackage ./emmet-cli.nix { };
-  material-wifi-icons = pkgs.callPackage ./material-wifi-icons.nix { };
-  gnome-pass-search-provider = pkgs.callPackage ./gnome-pass-search-provider.nix { };
-  my-factorio-headless = pkgs.callPackage ./factorio-headless {
-    inherit (pkgs.unstable) factorio-headless;
-  };
 }
--- a/pkgs/emmet-cli.nix
+++ b/pkgs/emmet-cli.nix
@ -1,7 +1,6 @@
-{
-  lib,
-  buildNpmPackage,
-  fetchFromGitHub,
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
 }:

 buildNpmPackage rec {
--- a/pkgs/factorio-headless/default.nix
+++ b/pkgs/factorio-headless/default.nix
@ -1,10 +0,0 @@
-{ factorio-headless, pkgs }:
-
-factorio-headless.overrideAttrs (_: rec {
-  version = "2.0.76";
-  src = pkgs.fetchurl {
-    name = "factorio_headless_x64-${version}.tar.xz";
-    url = "https://www.factorio.com/get-download/${version}/headless/linux64";
-    hash = "sha256-7zZj9mFG12NC98CaP3Q3kmNvjNlcOeomz8pb0uDpJDA=";
-  };
-})
--- a/pkgs/factorio-headless/update.sh
+++ b/pkgs/factorio-headless/update.sh
@ -1,14 +0,0 @@
-#!/bin/sh
-
-set -xe
-
-cd "$(dirname $0)"
-
-current_version="$(rg '^.*?version\s*=\s*"(.+)".*?$' --replace '$1' ./default.nix)"
-current_hash="$(rg '^.*?hash\s*=\s*"(.+)".*?$' --replace '$1' ./default.nix)"
-
-new_version="$(curl https://factorio.com/api/latest-releases | jq -r .stable.headless)"
-new_hash="$(nix-hash --to-sri --type sha256 $(nix-prefetch-url --type sha256 https://www.factorio.com/get-download/${new_version}/headless/linux64))"
-
-sd --fixed-strings "$current_version" "$new_version" ./default.nix
-sd --fixed-strings "$current_hash" "$new_hash" ./default.nix
--- a/pkgs/gnome-pass-search-provider.nix
+++ b/pkgs/gnome-pass-search-provider.nix
@ -1,63 +0,0 @@
-{
-  stdenv,
-  fetchFromGitHub,
-  python3Packages,
-  wrapGAppsHook3,
-  gtk3,
-  gobject-introspection,
-}:
-
-let
-  inherit (python3Packages)
-    dbus-python
-    pygobject3
-    fuzzywuzzy
-    levenshtein
-    ;
-in
-
-stdenv.mkDerivation rec {
-  pname = "gnome-pass-search-provider";
-  version = "1.4.0";
-
-  src = fetchFromGitHub {
-    owner = "jle64";
-    repo = "gnome-pass-search-provider";
-    rev = version;
-    hash = "sha256-PDR8fbDoT8IkHiTopQp0zd4DQg7JlacA6NdKYKYmrWw=";
-  };
-
-  nativeBuildInputs = [
-    python3Packages.wrapPython
-    wrapGAppsHook3
-  ];
-
-  propagatedBuildInputs = [
-    dbus-python
-    pygobject3
-    fuzzywuzzy
-    levenshtein
-
-    gtk3
-    gobject-introspection
-  ];
-
-  env = {
-    LIBDIR = builtins.placeholder "out" + "/lib";
-    DATADIR = builtins.placeholder "out" + "/share";
-  };
-
-  postPatch = ''
-    substituteInPlace  conf/org.gnome.Pass.SearchProvider.service.{dbus,systemd} \
-      --replace-fail "/usr/lib" "$LIBDIR"
-  '';
-
-  installPhase = ''
-    bash ./install.sh
-  '';
-
-  postFixup = ''
-    makeWrapperArgs=( "''${gappsWrapperArgs[@]}" )
-    wrapPythonProgramsIn "$out/lib" "$out $propagatedBuildInputs"
-  '';
-}
--- a/pkgs/lipsum.nix
+++ b/pkgs/lipsum.nix
@ -1,28 +1,19 @@
-{
-  stdenv,
-  fetchFromGitHub,
-  pkg-config,
-  vala,
-  wrapGAppsHook3,
-}:
-stdenv.mkDerivation rec {
+{ pkgs, inputs }:
+pkgs.stdenv.mkDerivation rec {
  pname = "lipsum";
  version = "0.0.1";

-  src = fetchFromGitHub {
-    owner = "hannenz";
-    repo = "lipsum";
-    rev = "0fb31e6ede10fbd78d7652f5fb21670cddd8e3ed";
-    hash = "sha256-a6uv0tJulN9cAGWxvQr8B0PUJEY8Rx4e759xzS66Xlo=";
-  };
+  src = inputs.lipsum;

-  nativeBuildInputs = [
+  nativeBuildInputs = with pkgs; [
    pkg-config
    vala
-    wrapGAppsHook3
+    wrapGAppsHook
  ];

-  makeFlags = [ "PRG=${pname}" ];
+  makeFlags = [
+    "PRG=${pname}"
+  ];

  installPhase = ''
    install -Dm 755 "$pname" "$out/bin/$pname"
@ -30,3 +21,4 @@ stdenv.mkDerivation rec {
    glib-compile-schemas "$out/share/glib-2.0/schemas/"
  '';
 }
+
--- a/pkgs/lumactl.nix
+++ b/pkgs/lumactl.nix
@ -1,54 +0,0 @@
-{
-  lib,
-  rustPlatform,
-  fetchFromGitHub,
-  pkg-config,
-  systemd,
-  libxkbcommon,
-  wayland,
-  wayland-scanner,
-  libffi,
-  wmctl,
-  makeWrapper,
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "lumactl";
-  version = "0.1.0";
-
-  src = fetchFromGitHub {
-    owner = "danyspin97";
-    repo = pname;
-    rev = "89e273e25afe545e3bcaf282b84a63e3c34117de";
-    hash = "sha256-PQucBe3xPjjzuiaukdf2f/CvTqbGm0wJMbdpgd2ubnU=";
-  };
-
-  cargoHash = "sha256-RvC8wDCY22dBrUcl6VjrwMHwTTSSoBzLwnghAOAUoYU=";
-
-  nativeBuildInputs = [
-    pkg-config
-    wayland-scanner
-    makeWrapper
-  ];
-  buildInputs = [
-    systemd
-    libxkbcommon
-    wayland
-    libffi
-    wmctl
-  ];
-
-  postFixup = ''
-    wrapProgram $out/bin/lumactl \
-      --prefix PATH : ${lib.makeBinPath [ wmctl ]}
-  '';
-
-  meta = with lib; {
-    description = "CLI utility for controlling display brightness on Linux";
-    homepage = "https://github.com/danyspin97/lumactl";
-    license = licenses.gpl3Plus;
-    mainProgram = "lumactl";
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ lelgenio ];
-  };
-}
--- a/pkgs/material-wifi-icons.nix
+++ b/pkgs/material-wifi-icons.nix
@ -1,16 +0,0 @@
-{ stdenv, fetchFromGitHub }:
-stdenv.mkDerivation rec {
-  pname = "material-wifi-icons";
-  version = "0.0.1";
-
-  src = fetchFromGitHub {
-    owner = "dcousens";
-    repo = "material-wifi-icons";
-    rev = "2daf6b3d96d65beb2a3e37a9a53556aab3826d97";
-    hash = "sha256-KykU5J7SdpBDG+6rkD//XeHd+6pK3qabe+88RduhwKc=";
-  };
-
-  installPhase = ''
-    install -D material-wifi.ttf $out/share/fonts/${pname}
-  '';
-}
--- a/pkgs/wmctl.nix
+++ b/pkgs/wmctl.nix
@ -1,43 +0,0 @@
-{
-  lib,
-  rustPlatform,
-  fetchFromGitHub,
-  pkg-config,
-  libxkbcommon,
-  wayland,
-  wayland-scanner,
-  libffi,
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "wmctl";
-  version = "0.1.0";
-
-  src = fetchFromGitHub {
-    owner = "danyspin97";
-    repo = pname;
-    rev = "398d87945ab6c4b31e04063098c79d1e456afdcc";
-    hash = "sha256-J3ZHq51uDgPMcQbJzEflReDnm1AqPs7Hov3jpCDlNHU=";
-  };
-
-  cargoHash = "sha256-T7FdevuBLbrYE5vTuBincSRMDOLkUsoKx/jg0i1Ybdo=";
-
-  nativeBuildInputs = [
-    pkg-config
-    wayland-scanner
-  ];
-  buildInputs = [
-    libxkbcommon
-    wayland
-    libffi
-  ];
-
-  meta = with lib; {
-    description = "CLI for controlling Wayland compositors";
-    homepage = "https://github.com/danyspin97/wmctl";
-    license = licenses.gpl3Plus;
-    mainProgram = "wmctl";
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ lelgenio ];
-  };
-}
--- a/scripts/_diffr
+++ b/scripts/_diffr
--- a/scripts/_docker-block-external-connections
+++ b/scripts/_docker-block-external-connections
@ -1,33 +0,0 @@
-#!/bin/sh
-
-# Create the DOCKER-USER chain if it doesn't exist
-iptables -N DOCKER-USER || true
-
-# Flush existing rules in the DOCKER-USER chain
-iptables -F DOCKER-USER
-
-# Get all external network interfaces
-interfaces=$(
-    ip -o -f inet addr show |
-    awk '{print $2}' |
-    grep -E '^(enp|eth|wlan|wlp)' |
-    sort -u
-)
-
-for iface in $interfaces; do
-    # Allow traffic from LAN
-    iptables -A DOCKER-USER -i "$iface" -s 127.0.0.1 -j ACCEPT
-    iptables -A DOCKER-USER -i "$iface" -s 10.0.0.0/8 -j ACCEPT
-    iptables -A DOCKER-USER -i "$iface" -s 192.168.0.0/16 -j ACCEPT
-
-    # Allow established and related connections
-    iptables -A DOCKER-USER -i "$iface" -m state --state RELATED,ESTABLISHED -j ACCEPT
-
-    # Drop all other traffic
-    iptables -A DOCKER-USER -i "$iface" -j DROP
-
-    echo "iptables rules have been set up for interface: $iface"
-done
-
-# Return to the previous chain
-iptables -A DOCKER-USER -j RETURN
--- a/scripts/_sway_idle_toggle
+++ b/scripts/_sway_idle_toggle
@ -0,0 +1,11 @@
+#!/bin/sh
+
+swayidlectl() {
+  systemctl --user $1 swayidle.service
+}
+
+if swayidlectl status > /dev/null; then
+    swayidlectl stop
+else
+    swayidlectl start
+fi
--- a/scripts/bcrypt
+++ b/scripts/bcrypt
@ -1,17 +0,0 @@
-#!/bin/sh
-
-set -euo pipefail
-
-if [ "$#" = 0 ]; then
-    echo "Usage: $0 [passwords...] | $0 - < passwords.txt" >&2
-    exit 1
-fi
-
-if [ "$1" = '-' ]; then
-    xargs -x -n1 -d'\n' htpasswd -bnBC 10 "" | tr -d ':' | sed '/^$/d'
-else
-    for pass in "$@"; do
-        htpasswd -bnBC 10 "" "$pass" | tr -d ':' | sed '/^$/d'
-    done
-fi
-
--- a/scripts/bmenu
+++ b/scripts/bmenu
@ -8,10 +8,13 @@
 if test "$argv[1]" = "run"
    test -n "$argv[2]" && set t "$argv[2]" || set t "terminal"

+    test -n "$i3SOCK" && set wrapper 'i3-msg exec --'
+    test -n "$SWAYSOCK" && set wrapper 'swaymsg exec --'
+
    exec j4-dmenu-desktop \
        --dmenu="bmenu start -p Iniciar:" \
        --term "$t" \
-        --i3-ipc \
+        --wrapper="$wrapper" \
        --no-generic
 end

--- a/scripts/br
+++ b/scripts/br
--- a/scripts/controller-battery
+++ b/scripts/controller-battery
@ -1,29 +0,0 @@
-#!/bin/sh
-
-set -e
-
-CONTROLLER=$(find /sys/class/power_supply -maxdepth 1 -name '*controller*' || true)
-
-if test -z "$CONTROLLER"; then
-    echo
-    exit 0
-fi
-
-CAPACITY=$(cat "$CONTROLLER/capacity")
-STATUS=$(cat "$CONTROLLER/status")
-
-echo -n '󰊴 '
-
-if test "$STATUS" = "Charging"; then
-    echo -n "󰂄"
-else
-    print-battery-icon "$CAPACITY"
-fi
-
-# Add terminating newline
-echo
-
-# Tooltip
-echo -n '󰊴'
-print-battery-icon "$CAPACITY"
-echo " $CAPACITY%"
--- a/scripts/default.nix
+++ b/scripts/default.nix
@ -1,175 +1,57 @@
-(
-  final: prev:
-  let
-    lib = prev.lib;
-
-    importScript = (_: path: import (path) { inherit (final) pkgs lib; });
-    wrapScript =
-      name: text: runtimeInputs:
-      final.runCommand name
-        {
-          nativeBuildInputs = [ final.makeWrapper ];
-          meta.mainProgram = name;
-        }
-        ''
-          mkdir -p $out/bin
-          cp ${text} $out/bin/${name}
-          wrapProgram $out/bin/${name} \
-              --suffix PATH : ${lib.makeBinPath runtimeInputs}
+(final: prev:
+with prev;
+let
+  import_script = (_: path: import (path) { inherit pkgs lib; });
+  create_script = (name: text: runtimeInputs:
+    let
+      script_body = pkgs.writeTextFile {
+        inherit name;
+        executable = true;
+        text = ''
+          ${builtins.readFile text}
        '';
-    createScripts = lib.mapAttrs (name: deps: wrapScript name ./${name} deps);
+      };
+    in
+    (pkgs.writeShellApplication {
+      inherit name runtimeInputs;
+      text = ''exec ${script_body} "$@"'';
+      checkPhase = "";
+    }));
+  create_scripts =
+    lib.mapAttrs (name: deps: create_script name ./${name} deps);

-    myPass = final.pass.withExtensions (ex: with ex; [ pass-otp ]);
-  in
-  with final;
-  createScripts {
+  pass = pkgs.pass.withExtensions (ex: with ex; [
+    pass-otp
+  ]);
+in
+create_scripts
+  {
    br = [ ];
-    bmenu = [
-      bemenu
-      dhist
-      fish
-      j4-dmenu-desktop
-      jq
-      sway
-    ];
-    down_meme = [
-      wl-clipboard
-      unstable.yt-dlp
-      libnotify
-    ];
-    wl-copy-file = [
-      wl-clipboard
-      fish
-    ];
+    bmenu = [ final.bemenu final.dhist fish j4-dmenu-desktop jq sway ];
+    down_meme = [ wl-clipboard yt-dlp libnotify ];
+    wl-copy-file = [ wl-clipboard fish ];
    _diffr = [ diffr ];
-    _thunar-terminal = [ terminal ];
-    kak-pager = [
-      fish
-      _diffr
-    ];
-    kak-man-pager = [ kak-pager ];
-    kubectl-rsh = [
-      bash
-      kubectl
-      rsync
-    ];
-    helix-pager = [
-      fish
-      _diffr
-    ];
-    helix-man-pager = [ helix-pager ];
-    bcrypt = [ apacheHttpd ];
-    musmenu = [
-      mpc
-      wdmenu
-      trash-cli
-      xdg-user-dirs
-      libnotify
-      sd
-      wl-clipboard
-    ];
-    showkeys = [ ]; # This will not work unless programs.wshowkeys is enabled systemwide
+    _thunar-terminal = [ final.terminal ];
+    _sway_idle_toggle = [ final.swayidle ];
+    kak-pager = [ fish final._diffr ];
+    kak-man-pager = [ final.kak-pager ];
+    helix-pager = [ fish final._diffr ];
+    helix-man-pager = [ final.helix-pager ];
+    musmenu = [ mpc-cli final.wdmenu trash-cli xdg-user-dirs libnotify sd wl-clipboard ];
+    showkeys =
+      [ ]; # This will not work unless programs.wshowkeys is enabled systemwide
    terminal = [ alacritty ];
    playerctl-status = [ playerctl ];
-    pass-export = [
-      pass2csv
-      gnupg
-      sd
-    ];
-    wpass = [
-      wdmenu
-      ripgrep
-      fd
-      myPass
-      sd
-      wl-clipboard
-      wtype
-    ];
-    screenshotsh = [
-      capitaine-cursors
-      grim
-      slurp
-      jq
-      sway
-      wl-clipboard
-      xdg-user-dirs
-    ];
-    volumesh = [
-      pulseaudio
-      libnotify
-    ];
-    pulse_sink = [
-      pulseaudio
-      pamixer
-      wdmenu
-    ];
-    color_picker = [
-      grim
-      slurp
-      wl-clipboard
-      libnotify
-      imagemagick
-    ];
-    dzadd = [
-      procps
-      libnotify
-      wdmenu
-      jq
-      mpv
-      pqiv
-      python3Packages.deemix
-      mpc
-      mpdDup
-    ];
-    mpdDup = [
-      mpc
-      perl
-    ];
-    readQrCode = [
-      grim
-      zbar
-      wl-clipboard
-    ];
-    git_clean_remote_deleted = [
-      git
-      gnugrep
-      gawk
-      findutils
-    ];
-    pint-fmt = [ ];
-    powerplay-led-idle = [
-      bash
-      libinput
-      libratbag
-    ];
-    sway-sync-xkbmap = [
-      xorg.setxkbmap
-      jq
-    ];
-    kde-sync-xkbmap = [
-      xorg.setxkbmap
-      dbus
-      gnugrep
-      gnused
-      gawk
-    ];
-    print-battery-icon = [ ];
-    controller-battery = [ print-battery-icon ];
-    mouse-battery = [ print-battery-icon ];
-    nix-prefetch-firefox-extension = [
-      nix
-    ];
-
-    _docker-block-external-connections = [
-      iptables
-      gawk
-      gnugrep
-      iproute2
-    ];
-  }
-  // lib.mapAttrs importScript {
-    wdmenu = ./wdmenu.nix;
-    wlauncher = ./wlauncher.nix;
-    _gpg-unlock = ./_gpg-unlock.nix;
-  }
-)
+    wpass = [ final.wdmenu fd pass sd wl-clipboard wtype ];
+    screenshotsh =
+      [ capitaine-cursors grim slurp jq sway wl-clipboard xdg-user-dirs ];
+    volumesh = [ pulseaudio libnotify ];
+    pulse_sink = [ pulseaudio pamixer final.wdmenu ];
+    color_picker = [ grim slurp wl-clipboard libnotify imagemagick ];
+    dzadd = [ procps libnotify final.wdmenu jq mpv pqiv python3Packages.deemix mpc-cli final.mpdDup ];
+    mpdDup = [ mpc-cli perl ];
+  } // lib.mapAttrs import_script {
+  wdmenu = ./wdmenu.nix;
+  wlauncher = ./wlauncher.nix;
+  _gpg-unlock = ./_gpg-unlock.nix;
+})
--- a/scripts/down_meme
+++ b/scripts/down_meme
@ -1,19 +1,10 @@
 #!/bin/sh

-set -euo pipefail
-
-cleanup() {
-    if test "$?" != 0; then
-        notify-send "Failed to download"
-    fi
-}
-trap cleanup EXIT INT
-
 DIR=$(mktemp -d)

 cd "$DIR"

-yt-dlp --cookies-from-browser firefox --merge-output-format mp4 "$(wl-paste)"
+yt-dlp --merge-output-format mp4 "$(wl-paste)"

 FILENAME="$(ls | head -n1)"

--- a/scripts/git_clean_remote_deleted
+++ b/scripts/git_clean_remote_deleted
@ -1,6 +0,0 @@
-#!/bin/sh
-
-git branch -vv \
-| grep ': gone]' \
-| awk '{print $1}' \
-| xargs git branch -D
--- a/scripts/helix-pager
+++ b/scripts/helix-pager
--- a/scripts/kak-pager
+++ b/scripts/kak-pager
--- a/scripts/kde-sync-xkbmap
+++ b/scripts/kde-sync-xkbmap
@ -1,51 +0,0 @@
-#!/bin/sh
-
-set -euo pipefail
-
-get_layout_display_name() {
-    idx="$1"
-    dbus-send --session --print-reply --dest=org.kde.keyboard /Layouts org.kde.KeyboardLayouts.getLayoutsList 2>/dev/null \
-        | grep 'string "' \
-        | sed 's/.*string "\([^"]*\)".*/\1/' \
-        | awk -v idx="$idx" 'NR%3==0 { if (c++ == idx) { print; exit } }'
-}
-
-get_layout_index() {
-    dbus-send --session --print-reply --dest=org.kde.keyboard /Layouts org.kde.KeyboardLayouts.getLayout 2>/dev/null \
-        | awk '/uint32/ { print $2; exit }'
-}
-
-LAST_LAYOUT=""
-
-apply_layout() {
-    idx="$1"
-    CURRENT_LAYOUT=$(get_layout_display_name "$idx")
-
-    if test "$LAST_LAYOUT" = "$CURRENT_LAYOUT"; then
-        return 0
-    elif test "$CURRENT_LAYOUT" = "English (Colemak)"; then
-        echo "Setting layout to colemak"
-        setxkbmap us colemak
-    elif test "$CURRENT_LAYOUT" = "Portuguese (Brazil)"; then
-        echo "Setting layout to br"
-        setxkbmap br
-    fi
-
-    LAST_LAYOUT="$CURRENT_LAYOUT"
-}
-
-update_layout() {
-    INDEX=$(get_layout_index)
-    apply_layout "$INDEX"
-}
-
-while ! get_layout_index; do
-    sleep 1s
-done
-update_layout
-
-dbus-monitor --session \
-    "type='signal',interface='org.kde.KeyboardLayouts',member='layoutChanged',path='/Layouts'" \
-    | while read -r line; do
-        update_layout
-    done
--- a/scripts/kubectl-rsh
+++ b/scripts/kubectl-rsh
@ -1,30 +0,0 @@
-#!/usr/bin/env bash
-
-set -exu
-set -o pipefail
-
-namespace=''
-container=''
-pod=$1
-shift
-
-# rsync calls us with "-l pod namespace" if we use pod@namespace
-if [ "X$pod" = "X-l" ]; then
-	pod=$1
-	shift
-	namespace="-n $1"
-	shift
-fi
-
-# pod is "pod.container"
-if [[ "$pod" == *"."* ]]; then
-	container="-c ${pod#*.}"
-	pod="${pod%.*}"
-fi
-
-# pod is "type#name"
-if [[ "$pod" == *"#"* ]]; then
-	pod="${pod//#/\/}"
-fi
-
-exec kubectl $namespace exec -i $container $pod -- "$@"
--- a/scripts/mouse-battery
+++ b/scripts/mouse-battery
@ -1,39 +0,0 @@
-#!/bin/sh
-
-set -e
-
-MODEL_NAME_FILE=$(rg --files-with-matches G502 /sys/class/power_supply/*/model_name | head -n1)
-
-if test -z "$MODEL_NAME_FILE"; then
-    echo
-    exit 0
-fi
-
-MOUSE=$(dirname "$MODEL_NAME_FILE")
-
-if test -z "$MOUSE"; then
-    echo
-    exit 0
-fi
-
-CAPACITY=$(cat "$MOUSE/capacity")
-STATUS=$(cat "$MOUSE/status")
-
-echo -n '🖱️'
-
-if test "$STATUS" = "Charging"; then
-    echo -n "󰂄"
-else
-    print-battery-icon "$CAPACITY"
-fi
-
-if test "$CAPACITY" -lt 50; then
-    echo -n "$CAPACITY%"
-fi
-
-echo
-
-# Tooltip
-echo -n '🖱️'
-print-battery-icon "$CAPACITY"
-echo " $CAPACITY%"
--- a/scripts/nix-prefetch-firefox-extension
+++ b/scripts/nix-prefetch-firefox-extension
@ -1,7 +0,0 @@
-#!/bin/sh
-
-set -euo pipefail
-
-hash="$(nix-prefetch-url --type sha256 "$@")"
-
-nix-hash --to-sri --type sha256 "$hash" 2>/dev/null
--- a/scripts/pass-export
+++ b/scripts/pass-export
@ -1,13 +0,0 @@
-#!/bin/sh
-
-if test -z "$PASSWORD_STORE_DIR"; then
-  PASSWORD_STORE_DIR="$HOME/.password-store"
-fi
-
-pass2csv "$PASSWORD_STORE_DIR" "$HOME/passwords.csv" \
-  -f User '(user|login)(:\s*)?' \
-  -f TOTP 'otpauth(:)?' \
-  -f URL 'url(:\s*)?'
-
-# Fix TOTP format for keepass
-sd '"//totp/.*?secret=(.*?)(&.*?)?"' '"$1"' "$HOME/passwords.csv"
--- a/scripts/pint-fmt
+++ b/scripts/pint-fmt
@ -1,7 +0,0 @@
-#!/bin/sh
-
-file="$(mktemp)"
-cat - >"$file"
-./vendor/bin/pint --quiet "$file"
-cat "$file"
-rm "$file"
--- a/scripts/playerctl-status
+++ b/scripts/playerctl-status
--- a/scripts/powerplay-led-idle
+++ b/scripts/powerplay-led-idle
@ -1,79 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-# Constants
-SECONDS_UNTIL_FADE=$(( 1 * 60))
-SECONDS_UNTIL_OFF=$(( 6 * 60))
-
-COLOR_ON=ff0000
-COLOR_FADE=880000
-COLOR_OFF=000000
-
-# Logging
-
-if [[ "$1" = "debug" ]]; then
-    echo "Running with debugging" >&2
-    DEBUG="true"
-
-    SECONDS_UNTIL_FADE=$(( 3 ))
-    SECONDS_UNTIL_OFF=$(( 5 ))
-fi
-
-log() {
-    if [[ "$DEBUG" = "true" ]]; then
-        echo "$@" >&2
-    fi
-}
-
-# Implementation
-
-main() {
-    CURRENT_STATE="UNKNOWN"
-    LAST_POINTER_MOTION="$(date +%s)"
-
-    if [ "$(ratbagctl list | wc -l)" -ne 1 ]; then
-        echo "Not exactly one device found, exiting..."
-        exit 1
-    fi
-
-    DEVICE="$(ratbagctl list | cut -d: -f1)"
-
-    while true; do
-        while read line; do
-            LAST_POINTER_MOTION="$(date +%s)"
-            break
-        done < <(
-            timeout 5s \
-                libinput debug-events \
-                | grep POINTER_MOTION
-        )
-        TIME_SINCE_LAST=$(( "$(date +%s)" - "$LAST_POINTER_MOTION" ))
-        log "Last pointer motion was $TIME_SINCE_LAST seconds ago"
-        if [ "$TIME_SINCE_LAST" -gt "$SECONDS_UNTIL_OFF" ]; then
-            setState OFF "$COLOR_OFF"
-        elif [ "$TIME_SINCE_LAST" -gt "$SECONDS_UNTIL_FADE" ]; then
-            setState FADE "$COLOR_FADE"
-        else
-            setState ON "$COLOR_ON"
-        fi
-    done
-}
-
-setState() {
-    STATE="$1"
-    COLOR="$2"
-    MODE="$3"
-
-    if [[ "$STATE" = "$CURRENT_STATE" ]]; then
-        log "Already in $STATE state"
-        return
-    fi
-    log "Changing state to $STATE"
-    CURRENT_STATE="$STATE"
-
-    ratbagctl "$DEVICE" led 0 set mode on
-    ratbagctl "$DEVICE" led 0 set color "$COLOR"
-}
-
-main
--- a/scripts/print-battery-icon
+++ b/scripts/print-battery-icon
@ -1,33 +0,0 @@
-#!/bin/sh
-
-set -e
-
-if test $# -ne 1; then
-    echo "Usage $0" >&2
-    exit 1
-fi
-CAPACITY="$1"
-
-if test "$CAPACITY" -ge 90; then
-    echo -n '󰁹'
-elif test "$CAPACITY" -ge 90; then
-    echo -n '󰂂'
-elif test "$CAPACITY" -ge 80; then
-    echo -n '󰂁'
-elif test "$CAPACITY" -ge 70; then
-    echo -n '󰂀'
-elif test "$CAPACITY" -ge 60; then
-    echo -n '󰁿'
-elif test "$CAPACITY" -ge 50; then
-    echo -n '󰁾'
-elif test "$CAPACITY" -ge 40; then
-    echo -n '󰁽'
-elif test "$CAPACITY" -ge 30; then
-    echo -n '󰁼'
-elif test "$CAPACITY" -ge 20; then
-    echo -n '󰁻'
-elif test "$CAPACITY" -ge 10; then
-    echo -n '󰁺'
-else
-    echo -n '󰂎'
-fi
--- a/scripts/pulse_sink
+++ b/scripts/pulse_sink
--- a/scripts/readQrCode
+++ b/scripts/readQrCode
@ -1,18 +0,0 @@
-#!/bin/sh
-
-set -o pipefail
-
-main() {
-
-    if wl-paste | zbarimg -q --raw - | wl-copy
-    then
-        notify-send "Copied" "QrCode was copied to clipboard"
-        rm "$LOGFILE"
-    else
-        notify-send "Failed to read QrCode" "Log file is '$LOGFILE'"
-    fi
-
-}
-
-LOGFILE=$(mktemp /tmp/qrcode-XXXXXXXX.log)
-main > "$LOGFILE" 2>&1
--- a/scripts/screenshotsh
+++ b/scripts/screenshotsh
@ -46,13 +46,4 @@ case $1 in
            $screenshot -o "$cur_output" - | $copy ||
            $screenshot - | $copy
        ;;
-    edit)
-        # Focused monitor to clipboard
-        cur_output=$(swaymsg -t get_outputs |
-            jq -r '.[] | select(.focused) | .name')
-
-        test -n "$cur_output" &&
-            $screenshot -o "$cur_output" - | satty --filename - --output-filename "$DESTFILE" ||
-            $screenshot - | satty --filename - --output-filename "$DESTFILE"
-        ;;
 esac
--- a/scripts/showkeys
+++ b/scripts/showkeys
--- a/scripts/sway-sync-xkbmap
+++ b/scripts/sway-sync-xkbmap
@ -1,22 +0,0 @@
-#!/bin/sh
-
-set -euo pipefail
-
-LAST_LAYOUT=""
-
-while sleep 1s; do
-    CURRENT_LAYOUT=$(swaymsg -t get_inputs | jq -r '.[]|.xkb_active_layout_name|select(.)' | head -n1)
-
-    if test "$LAST_LAYOUT" = "$CURRENT_LAYOUT"; then
-        true
-    elif test "$CURRENT_LAYOUT" = "English (Colemak)"; then
-        echo "Setting layout to colemak"
-        setxkbmap us colemak
-    elif test "$CURRENT_LAYOUT" = "Portuguese (Brazil)"; then
-        echo "Setting layout to br"
-        setxkbmap br
-    fi
-
-    LAST_LAYOUT="$CURRENT_LAYOUT"
-done
-
--- a/scripts/terminal
+++ b/scripts/terminal
--- a/scripts/wdmenu.nix
+++ b/scripts/wdmenu.nix
@ -1,4 +1,12 @@
 { pkgs, ... }:
+let
+  inherit (pkgs.uservars) dmenu;
+  available_menus = {
+    bmenu = "bmenu";
+    rofi = "rofi -dmenu -sort";
+  };
+  menu_cmd = available_menus.${dmenu};
+in
 pkgs.writeShellScriptBin "wdmenu" ''
-  exec bmenu "$@"
+  exec ${menu_cmd} "$@"
 ''
--- a/scripts/wfile-picker.nix
+++ b/scripts/wfile-picker.nix
@ -1,6 +1,6 @@
 { pkgs, ... }:
 let
-  inherit (config.my) dmenu;
+  inherit (pkgs.uservars) dmenu;
  available_menus = {
    bmenu = "bmenu run";
    rofi = "rofi -show drun -sort";
--- a/scripts/wl-copy-file
+++ b/scripts/wl-copy-file
@ -10,13 +10,12 @@ if test (count $argv) != 1
 end

 set -a file (realpath $argv[1])
-set -a url (string escape --style=url "$file")
 set -e argv[1]

 if test -d "$file"
    die 1 "Cannot copy directories" >&2
 else if test -f "$file"
-    wl-copy $argv -t text/uri-list "file:///$url"
+    wl-copy $argv -t text/uri-list "file:///$file"
 else
    die 2 "No file found" >&2
 end
--- a/scripts/wlauncher.nix
+++ b/scripts/wlauncher.nix
@ -1,4 +1,12 @@
 { pkgs, ... }:
+let
+  inherit (pkgs.uservars) dmenu;
+  available_menus = {
+    bmenu = "bmenu run";
+    rofi = "rofi -show drun -sort";
+  };
+  menu_cmd = available_menus.${dmenu};
+in
 pkgs.writeShellScriptBin "wlauncher" ''
-  exec bmenu run "$@"
+  exec ${menu_cmd} "$@"
 ''
--- a/scripts/wpass
+++ b/scripts/wpass
@ -18,13 +18,6 @@ print_actions_for_entry() {
  if test -n "$otp"; then
    echo "OTP"
  fi
-
-  echo "$entry_content" | \
-    rg '^(\w+): .*$' --replace '$1' | \
-    sed \
-      -e '/login/d' \
-      -e '/user/d' \
-      -e '/email/d'
 }

 main() {
@ -36,9 +29,8 @@ main() {

    test -n "$entry" || exit 0

-    entry_content="$(pass show "$entry" 2>/dev/null)" || true
-    username=`echo "$entry_content" | rg -m1 '(login|user|email): (.*)' -r '$2'` || true
-    password=`echo "$entry_content" | head -n 1` || true
+    username=`pass show "$entry" 2>/dev/null | perl -ne 'print $2 if /^(login|user|email): (.*)/'`
+    password=`pass show "$entry" 2>/dev/null | head -n 1`
    otp=`pass otp "$entry" 2>/dev/null` || true

    action="$(print_actions_for_entry | wdmenu -p Action)"
@ -53,19 +45,17 @@ main() {
            printf '%s' "$password" | wl-copy;;
        OTP)
            pass otp "$entry" | wl-copy;;
-        *)
-            key="$action"
-            printf '%s\n' "$entry_content"  | rg -m1 "^$key: (.*)" -r '$1' | wl-copy -n
-            ;;
    esac

 }

 autotype(){
-    if test -n "$username"; then
-        env wtype -s 100 "$username"
-        env wtype -s 100 -k tab
+    if pgrep qutebrowser >/dev/null; then
+        qutebrowser ":mode-enter insert"
    fi
+
+    env wtype -s 100 "$username"
+    env wtype -s 100 -k tab
    env wtype -s 100 "$password"
 }

--- a/secrets/double-rainbow/default.yaml
+++ b/secrets/double-rainbow/default.yaml
@ -1,57 +0,0 @@
-gitlab-runners:
-    wopus-gitlab-nix: ENC[AES256_GCM,data:n/bm5W5Q/h7MxMZX7yz4qeUBpfZDrI7A7/PlnLncMto5V5itVTXRvfd3+D/d2r9PVuJSogfMgMAh0cwuvPspjlm9ToPxrmgGdYbnAkhnFeTHdCfcF1x2DG2JkHe54wUhcQa9QEJkWZ5jJM//2jU=,iv:63lrYCCBMSr5toulba7Rni+iun0Bl2vMFbIsTVvOWQs=,tag:Z1GHj91q09sOWCaLPIKJ4Q==,type:str]
-    wopus-ssh-nix-cache-pk: ENC[AES256_GCM,data:+5I7INvMNfegjjC0xPNOSj+vFakXe6V4N/S5wvL64DOxfPXhSQAjVtdMslp/LlJXH4XWbkQ8ErLbySB3WMDMRDnDRY+6+UKXsP6MFpvEtho0lN+8ZeAGC25ehadYDSFTX43wz6cLRuoAqRQdhPKM96wcYif7nF40cStgaAQhkNemK7AenSA9LQ4J72dWovFuwfTZml8qH6W/O+YEqfOgZsyJ/LobcM1fiuN1S4NnCOJSWB2Ahsu0tiMOSRxKWeUS9+ewh+x1xnZL3y4vax5GgtS2KojtXq0U4qgNi4Gwnmef7HmH1tVgeMO2ykCsuCCZ9iJR0IOqTHU2l+U6hTzf5vehpgK5/tsthkXRsLUmVRnjUaQwaEq9JYltGpEdk6U0UnD+Mf0f5BsDw23lHgannLeduhrSFrPFj+BVodnPxjyYJTPXwXfbWrKIQ8s5kWfIq9x0VePsteIgEH4xLL0yFtyZzrYeCq9WF3j5xTvJsOlG0ehQzX22orrM4RzrFVmeLYOIc/V4bQeyIf1lWemr,iv:UNaUnlVayrzF7qpgIVi9gxPFGCzIP24jNUpO295JPog=,tag:a5OlD+AJH3u6y+Lo3lOQWw==,type:str]
-    wopus-ssh-nix-cache-pub: ENC[AES256_GCM,data:aknblYwAAGaso/Vhr9f1RX64tA3uOh3qxc1dBI7DQmk4TUlQn/AYrKF7wanIhhydrasRulDEam3CBiiyeW/ejcXG07wKIUyZ94TOYfcyRd1yo+PGkmb1yycU6PdjaP5/zwUPAnjMhR2quW+8iwADaUMYKXIJkdQaqUW9a845vBKIxgNgBskWMGMzldb+aUnr2eCb,iv:MQdEUrNugzv+QL6f/MNUqh9M+nFVsWI4VHlMrgQOTEg=,tag:olNTQyCSOhv3sgSjuIXKBA==,type:str]
-nebula-wopus-vpn:
-    ca-crt: ENC[AES256_GCM,data:zNESDEqeRPBsaY53cDKx6DMYdHIdEjxAsX7rLMrGkd0+aw2zOEJDJ5jb/zIeatf7xBj5DkJa+CDWmWsu5v9p0QUu0LEEvdin3utuGa5GQEYR+1LCCrlB52klTvKEK6ck5cYewVR5bmq0NTvw4aVxZJoMKMXICYhNEs20ZMCIrbX8UOddXKt6OxeOzVZ/9uFg1gY9qkHe3Wn5mmNLwvXoHvzwtr+Oc9xT+SRMPYkGUkbyxQ5zRjJUKS79aPQ8R6ZgZVJqUmr9wS58D2To1Sfk4Ykrd4Q2lIlbTXdswp1im3LSTy0YosHu5P6mmBq9u3M=,iv:hnCrHDkQiUsoaFTImtWlvM+tuSplU5p4s6kkm/ysLZ0=,tag:5vH6oEWwUOA/QsiW0XvBag==,type:str]
-    double-rainbow-crt: ENC[AES256_GCM,data:gdR79bE2RdE8cc9HdIxoiTCbyzsaTrSRg8uouVLmq6IRnb8B7tltIitli0SRXzMWqfg1IUIQbXHbIvPgeQ+puCHqr1ghYK1GzrDLz6GIGTn8g+9MnDbRTghdlWKKrKVxJnrSecJvV0qEkDr2/WEAsXalstxcDEPNq2Rb+c7bv/P2oFNjKN1eeWsE5TgpFj61RLEWx/wPzQKyNx2ZFu1l4r63II6npvlZ8rwdrJAeZIT8oaU53zQzMMs0tHGYTJeaZcPgdBKfVSCmzGxrE2kuwR0bxSSB2knqdBmtl1aVxs3bF2Fkm1+wovCadCze+Ta6Vgtk4v8d3Ta+wE5qzek8shb2m7lXTixki356wOG0r3B+180Kzk5B7q4tIycrk9ggKPKAA+2XNHVFM9L8PojflK3BY+U=,iv:wNoELN2y8QrFGPJYQdrAVsaLrhMzD8ep313o/jpT9fM=,tag:8sRBtkfd1TVMK7R64sMXqw==,type:str]
-    double-rainbow-key: ENC[AES256_GCM,data:I0LGhV9biErwZw4PzOX6mbqyh+8n2XbpikwOqLe70g9+pfO72e8qdXvzYko8zLGIL0x8ZUYn6XCP63ZYzP866cLHCgglZ0+PQeBbqzp3lgfYDd7zBHDJE0NQobPtV6n1enbpzRtBe+ROeYQxCV5sZmEoxbzUyR0aSJ3JaGgZNw==,iv:Y5Iy32zHnQgqIH3d9U81FlsW+Mg8u06fk+AMnTcGejk=,tag:1ojEKwVALA9grJRzyNc+9g==,type:str]
-sops:
-    age:
-        - recipient: age1zrgu7w8059xydagm60phnffghvfe9h2ca58cx8qwagqpyfuvs9fqw79c8h
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0eTBFdVM5OFlQTi9JMmFw
-            QWpIU2dSdDMzQTVJOWJCUU03QXR1QVZoeXc4CkljdHNKQ0tUczMrNys5eXNGMnVa
-            K003QjdRaWY4RmNtaEw4cEsxSEJwZlEKLS0tIFZpbGUyaHh0RndkVlpQVlVucHJa
-            TndIUUhsY2xSR3E1WlJXV3ZFN0lIMncKjjf1yt4XhfguzYoCNmHYSmetMDnoz4cr
-            frbZdy4hl9w9EZO5JUeC/n7QMYTZLC2/Zk2PXRUvwyQglrGoUVK2Bg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ecyynwv93lfu7crjjp8l47defv07quzfzaktwurpep7jc9eha5pscg7lrw
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHbHd4L0NEZW55OWd3SWlv
-            U3dEcDNKZUJid2VsZ1lQdy9NRnIyVDRPRm1VCnZDcCs0S1BLNjJLZTFpSHVpNVRj
-            OFpMK0ZjWTJkcWJoUFk2YnBCK3JKcFUKLS0tIEtqRkF4Q0FobXhPVTF6eWN2d0Nx
-            eVAwSi9LaVNEcHIvQnhhZmZLbHRPOUUK6A91L8YCpi/sM9FiXcJ1sLmW3U4KadYL
-            uw07mobP1Rf0RUdAuSK+42ErFgmS+OTDze/mT/PXg6Dfk+vhTjbfGA==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1026d4c8nqyapcsy4jz57szt6zw3ejcgv3ecyvz0s89t7w7z964fqdqv52h
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEaUpLU1ZxQWNCNFNGeEpl
-            dEpVbzBFbk1XaVoxMXIzMWFmTkZWS05GOFFvCmJGamVGK2pCeTJROVloMGdYK3Mx
-            cGF1elFSbjJ3UmUyc1FsUkh6b2JNWTgKLS0tIFRzbHZIL25tK1dnWm90QVFueWZM
-            WUZrTkg0cklJSUg5MndsN0ZPcVk4U0kKPsj787kDFDMxsBt5qk4Bp121AMTE++99
-            m2X4lL6ona9fUe8e8wGhdgxZmqvJL2RCaVWJJy5SAbJ/skP3y7i2mw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-11-12T16:38:27Z"
-    mac: ENC[AES256_GCM,data:XMsrBwV2G1jRA2c/T3y4015p6bJdggfrbI62bHZ1PQtbOImQUpxChVI9JhZqOIzWpyYB32HavRHwCe5nfam+L2tWNlVMRSogKBpDuanxyf3o2EHHStQqZYUuJrYtOL5cdeYMIXKRWS6LmHdHkcI2ixHsL+NXIG5o3XIYMaEBufo=,iv:G20hevYygnonf5l4qGZqs+b9f1FC+cfnYIKZcs+mUP4=,tag:p5rITlVoOwqdrG8Kcmjieg==,type:str]
-    pgp:
-        - created_at: "2025-09-09T20:27:32Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQEMAzy6JxafzLr5AQf/a5v/AIIsdE9WawM710HCLQwEJXskDXfN7UP055gDBJer
-            96qny8cKC833OhTPLqWCUpAVgJ1JQ8EDLvj2YvXLiq/NmMFs+mBwjPdzNIUKzK6E
-            QgtjRJuQfOGSW0i44b+nkmWLSi1PhxVbIFt27Nl4I+mrvkhztIZcTwht+be3mMrp
-            z1hEn/BbXsin6JOB6EuyFbsRZ3wYFUlr23NiKVI/JSo39ifbtGqgWn68GN+tYYYs
-            mZ5tJykyRZxTU6qEKBaW9veClxs0FW2shQpp6Go/u6u/ghhHeB99trauPFL2rypT
-            IaLGWruFwHMsd+rSTcw+YrTbL7bfkqx/4xj5dxJaFNJeAfo5F5ddr1odeAHeSQmh
-            pfStJmy83SHhyDw8wLKMeF9d7dPKIyU4cXbLjSv1w86bDpDw8LBJSYEjJPVjLONV
-            F6AXCJxNckDXmshGUejC09abAcMzzTsEJK7ocqEoMg==
-            =XAWM
-            -----END PGP MESSAGE-----
-          fp: 0FECE8316E74BA6F44EFC21A2F8F21CE8721456B
-    unencrypted_suffix: _unencrypted
-    version: 3.10.2
--- a/secrets/ghost-nextcloud.age
+++ b/secrets/ghost-nextcloud.age
@ -0,0 +1,15 @@
+age-encryption.org/v1
+-> ssh-rsa BwwxHg
+bpGCgyaAPDutva1Gp/YPuek6IZTXJHKb7+oIAV/x+7Ry4Oci9zM2VWvPVE/rPE/d
+0AzBX1NvsWBB005w42RfiErk4FQYRCouwNR1FNjUWNdQOmku++RPfxBXspAFIDkQ
+yM7mqbhwf5by5rZY+2kl20QxkErkVtZolus1am9RV4uyXfdPaRcKjWOuPiEim42d
+YdeCXq4nJGxlL3tRunIqLIZGhV08wHBl7Dubhn9hdD6/ekDk0RloVTBDZUY5tUPL
+dJk+bfFPI0DimytzCwyQbWEHOkdiWYSNzbx2JhTSvuqefHP1UzB2LukaQc2gOJFV
+mVKvQuGpOWknytMUhM6zCTvRw4OQutAZd96OniQYTas/vnmfT2l2n9aMEzQK157A
+U9DmsvhBypILiQSPpA7QrGB1QVuRjAFJA86ASY1FAT6MdBBK4vZ8fK7mpT06JO/n
+gwv+UlvFBziWHzA/1GOLrfD+ExjmbeucRZr5XGszrAaK/7GPZt4LF69hRmKegL94
+
+-> 9I3~SC,<-grease M$2 RibFL]C
+uR6MirHtTc4Tyrcw3T2my+BN2Q
+--- 56zk9BqgwQqNymga1mUDgpvtfIpMy5i/JnaSXbjx6jk
+ÞQÚÞ—Ž)NâÿÚ¦¨Žß‘-†ŸÀ ÷ÑDz-ÖIÅß-°]p$ÉX5æT·PU=u;kæ8}wÁV¦mšç=
--- a/secrets/ghost-renawiki.age
+++ b/secrets/ghost-renawiki.age
@ -0,0 +1,16 @@
+age-encryption.org/v1
+-> ssh-rsa BwwxHg
+BUJ9L1bwZ0RWj3FmMghmZDkY4iuc0gujS3Rfat+hj/pg+MALZ69Tovc5RnqmOZT/
+pTGPTzWj3WO70YU+wCUHKZ74JcKdL3wSD1FWOWYRvyDV3gxZjDTjw4Grs+sH9M4Z
+MrhdoyY95fhmGZHJ7Qkx/aKCAK/OaFSu5Vhh37ykmLd1gQ9NJYQ+G3lLr1Mrqjd/
+1QaBqJtJpAFTA0eCd3+oBtQ/qgHD2ZBJcOmkS9sRC6S4YKNoyoDifTbL29aJC4f/
+08myI0WH/ApbtN1hWuiVWibmy/9/76IAvgUqi8fULNY5w7Otz3nKGV+mDA5+oD11
+jCHZJdcec9JFyZ/V2mh/PoHpNawksNPy85eJ0MpM1avM25Qib8kWJM6fnZb7uJzt
+DsYCl2q4ILnTaieuTSJUfgacKbrwSv7MQfgdh1SkXAShyZ7aSCoDhsgSdOVwYoAX
+Mspm0NtodeV7493qZwYspO6H0xbfh20vXa1DOeMt98T1iP0aYYhfRXkb0wACx1QF
+
+-> \z/RLj3S-grease cmv( uCkG*= .cX3S 9r^&
+OVTVTnB3PjD4COiRCtQ
+--- EhfDqxfjLIHF9Sa7V4ytO1xsRK8p23WDsWcB9/B9fRw
+.ß=–£))/’ö‰Í¹êÒ‹#´ýLÁƒŒÓ‰Ž—|p
+7	ÍñÄKä®7ò²Š@üCJfš:w6Pè•@@/N<>7¿
--- a/secrets/phantom-writefreely.age
+++ b/secrets/phantom-writefreely.age
--- a/secrets/gitlab-runner-thoreb-telemetria-registrationConfigFile.age
+++ b/secrets/gitlab-runner-thoreb-telemetria-registrationConfigFile.age
@ -0,0 +1,16 @@
+age-encryption.org/v1
+-> ssh-rsa BwwxHg
+KuJIQzvERsM1zAF4iikbaIMsi4e/vnyx1yq6h9Mzxf6FnXyFRcUgLPVe05krQhJX
+0wjv18bI0jxRb8742Ww9i2nU5Tlrok9ol458iye5CPl63fAlVih4/Rkl3IkUIiIz
+q/VayGVaIHmpRD2xiEa4L+NXS9N69vVXoubX0oZrB0nPdYJ83gFU9u+CBqqG2EWr
+PBjyIvT5i5MDBnPZGOudadIoyeWGfjXEPsQWhQhL9ssi5QOzLXBnTDlxT53bNvHX
+2yOFprLDZ+ZONedkxy8OXZpPDYNcgPAIHiqx1E87ftqPIucdeU49AqlPh46wrPC3
+79E2hgSoPvn4poTlJtAD0tIADRGkcEV6wLCylN2lTOUJenUfhLNQ7ok4ITx8MOv3
+IkbWiD9yTMExVBlhc+us+XfBHM8mlWs/zu+18YTy21RM03gzY6lHVZCQPxay2Rof
+A505SeZ4Tyhoy0+oLaYv9b+7DJdlhUo/XMaKSibtgJ/2MCtRqmV5ZsnuUIWn1Qsc
+
+-> Vg-grease `tLg-(2z
+4EPuRnZmXpoB32r/0GCtskU3HU3h5ic
+--- QmKr+zAXnMpWBBBqNm2u954fOu2Zt8Y/kPPdq4UHgZc
+¤ì{çu|õæu´Ó€]OmXÝP3µÆ²•4_±½Â_
+q4›<EFBFBD>Ð6mþm©<‚pLH+d.hî‹’C<RDµ‘q<1F>Oø}öô3ÁZ¤KJ¤DÉàj]ÈýÒ¯Ù
ìá‚ØûCROË¥F;>‡
--- a/secrets/lelgenio-cachix.age
+++ b/secrets/lelgenio-cachix.age
--- a/secrets/lsfg.dll.gpg
+++ b/secrets/lsfg.dll.gpg
--- a/Show more
+++ b/Show more
Author	SHA1	Message	Date
Leonardo Eugênio	fb323ec227	hyprland: more improvements	2024-01-21 01:24:23 -03:00
Leonardo Eugênio	f3ef679499	hyprland improve systemd integration	2024-01-21 00:27:21 -03:00
Leonardo Eugênio	6ad0d3685e	hyprland: minimal config	2024-01-21 00:27:21 -03:00
Leonardo Eugênio	7b2f97155f	WIP: use hyprland	2024-01-20 21:43:16 -03:00