sops -> pass : add syncoid ssh key

This reverts commit 325f07bdd8.

flake.nix

@@ -2,7 +2,7 @@
   inputs = {
 
     secrets = {
-      url = "git+ssh://gitea@git.ingolf-wagner.de/palo/nixos-secrets.git?ref=main";
+      url = "git+ssh://forgejo@git.ingolf-wagner.de/palo/nixos-secrets.git?ref=main";
       flake = false;
     };
 
@@ -11,126 +11,113 @@
 
     clan-core = {
       url = "git+https://git.clan.lol/clan/clan-core";
+      #url = "git+file:///home/palo/dev/nixos/clan-core";
       inputs.nixpkgs.follows = "nixpkgs"; # Needed if your configuration uses nixpkgs unstable.
       inputs.flake-parts.follows = "flake-parts";
     };
 
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-23.11";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
-    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
-    nixpkgs-legacy_2305.url = "github:nixos/nixpkgs/nixos-23.05";
-    nixpkgs-legacy_2211.url = "github:nixos/nixpkgs/nixos-22.11";
-    nixpkgs-legacy_2205.url = "github:nixos/nixpkgs/nixos-22.05";
     nixpkgs-legacy_2105.url = "github:nixos/nixpkgs/nixos-21.05";
+    nixpkgs-legacy_2205.url = "github:nixos/nixpkgs/nixos-22.05";
+    nixpkgs-legacy_2211.url = "github:nixos/nixpkgs/nixos-22.11";
+    nixpkgs-legacy_2305.url = "github:nixos/nixpkgs/nixos-23.05";
+    nixpkgs-legacy_2311.url = "github:nixos/nixpkgs/nixos-23.11";
     nixos-hardware.url = "github:nixos/nixos-hardware";
-
     nixos-anywhere.url = "github:nix-community/nixos-anywhere";
 
     home-manager = {
-      url = "github:nix-community/home-manager/release-23.11";
+      #url = "github:nix-community/home-manager/release-23.11";
-      inputs.nixpkgs.follows = "nixpkgs";
+      url = "github:nix-community/home-manager";
+      #inputs.nixpkgs.follows = "nixpkgs";
     };
+
     polygon-art = {
       url = "git+https://git.ingolf-wagner.de/palo/polygon-art.git";
     };
-    sops-nix.url = "github:Mic92/sops-nix";
+
-    doom-emacs-nix = {
-      url = "github:nix-community/nix-doom-emacs";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     home-manager-utils = {
       url = "github:mrvandalo/home-manager-utils";
       inputs.home-manager.follows = "home-manager";
     };
-    nixpkgs-fmt = {
+
-      url = "github:nix-community/nixpkgs-fmt";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    grocy-scanner = {
-      url = "github:mrVanDalo/grocy-scanner";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     permown = {
       url = "github:mrVanDalo/module.permown";
       #url = "git+file:///home/palo/dev/nixos/permown";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
     private_assets = {
-      #url = "git+file:///home/palo/dev/nixos/nixos-private-assets";
+      url = "git+file:///home/palo/dev/nixos/nixos-private-assets";
-      url = "git+ssh://gitea@git.ingolf-wagner.de/palo/nixos-private-assets.git?ref=main";
+      #url = "git+ssh://forgejo@git.ingolf-wagner.de/palo/nixos-private-assets.git?ref=main";
       flake = true;
     };
+
     retiolum = {
       url = "github:Mic92/retiolum";
       #url = "git+file:///home/palo/dev/nixos/retiolum";
     };
+
     srvos.url = "github:nix-community/srvos";
-    srvos_nixpkgs.follows = "srvos/nixpkgs";
+
     landingpage = {
       #url = "git+file:///home/palo/dev/landingpage";
       url = "github:mrVanDalo/landingpage";
     };
+
+    # todo: mabye use https://github.com/jtroo/kanata instead
+    # fixme: kmonad crashes every now and than and the keyboard is not usable anymore.
     kmonad = {
       url = "github:kmonad/kmonad?dir=nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    disko = {
+
-      url = "github:nix-community/disko";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    dns = {
-      url = "github:kirelagin/dns.nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    nixinate.url = "github:matthewcroughan/nixinate";
     stylix = {
       #url = "github:danth/stylix?ref=35cab8eb76c1d3672b2b290a64f357847c30d090";
-      url = "github:danth/stylix/release-23.11";
+      #url = "github:danth/stylix/release-23.11";
+      url = "github:danth/stylix";
       inputs.nixpkgs.follows = "nixpkgs";
       inputs.home-manager.follows = "home-manager";
     };
-    smoke = {
+
-      url = github:SamirTalwar/smoke;
+    # smoke test framwork to trigger tests (enable if I  want to use it for real)
-      inputs.nixpkgs.follows = "nixpkgs";
+    #smoke = {
-    };
+    #  url = github:SamirTalwar/smoke;
+    #  inputs.nixpkgs.follows = "nixpkgs";
+    #};
+
+    # had to override it to  remove colors
     taskshell = {
       url = "github:mrvandalo/taskshell";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    overviewer.url = "git+ssh://gitea@git.ingolf-wagner.de/palo/overviewer.git?ref=main";
+
+    # my  own tool
+    overviewer.url = "git+ssh://forgejo@git.ingolf-wagner.de/palo/overviewer.git?ref=main";
   };
 
   outputs =
     inputs@{ self
     , clan-core
-    , disko
-    , dns
-    , doom-emacs-nix
     , flake-parts
-    , grocy-scanner
     , home-manager
     , home-manager-utils
     , kmonad
     , landingpage
-    , nixinate
     , nixos-anywhere
     , nixos-hardware
     , nixpkgs
-    , nixpkgs-fmt
     , nixpkgs-legacy_2105
     , nixpkgs-legacy_2205
     , nixpkgs-legacy_2211
     , nixpkgs-legacy_2305
-    , nixpkgs-unstable
+    , nixpkgs-legacy_2311
     , overviewer
     , permown
     , polygon-art
     , private_assets
     , retiolum
     , secrets
-    , smoke
-    , sops-nix
     , srvos
-    , srvos_nixpkgs
     , stylix
     , taskshell
     }:
@@ -147,28 +134,28 @@
           inherit system;
           config.allowUnfree = true;
           config.permittedInsecurePackages = [
+            "electron-24.8.6" # for bitwarden
             "python-2.7.18.6"
             "python-2.7.18.7"
-            "electron-24.8.6" # for bitwarden
+            "python-2.7.18.8"
           ];
 
           overlays = [
             (_self: _super: {
-              unstable = import nixpkgs-unstable {
+              # todo : remove this, we are on unstable in the future
+              unstable = import nixpkgs {
                 inherit system;
                 config.allowUnfree = true;
               };
-              legacy_2211 = import nixpkgs-legacy_2211 { inherit system; };
               legacy_2205 = import nixpkgs-legacy_2205 { inherit system; };
-              legacy_2105 = nixpkgs-legacy_2105 { inherit system; };
+              legacy_2211 = import nixpkgs-legacy_2211 { inherit system; };
-              legacy_2305 = nixpkgs-legacy_2105 { inherit system; };
+              legacy_2305 = import nixpkgs-legacy_2305 { inherit system; };
+              legacy_2311 = import nixpkgs-legacy_2311 { inherit system; };
               polygon-art = polygon-art.packages.${system};
               landingpage = landingpage.packages.${system}.plain;
-              trilium-server = nixpkgs-unstable.legacyPackages.${system}.trilium-server;
               kmonad = kmonad.packages.${system}.kmonad;
               tasksh = taskshell.packages.${system}.tasksh;
               overviewer = overviewer.packages.${system}.overviewer;
-              smoke = smoke.packages.${system}.default;
             })
             (import ./nixos/pkgs)
           ];
@@ -184,57 +171,73 @@
         { name
         , host
         , modules
-          #, nixpackages ? meta.nixpkgs
         }: {
 
           clan.networking.targetHost = lib.mkDefault "root@${host}";
-          clanCore.machineIcon = null; # Optional, a path to an image file
-
-          #nixpkgs.pkgs = nixpackages;
           nixpkgs.pkgs = meta.pkgs;
           nixpkgs.hostPlatform = meta.system;
+          clanCore.facts.secretStore = "password-store";
 
           imports = modules ++ defaultModules ++ [
-            {
+            ./nixos/machines/${name}/configuration.nix
+            # clan core configuration
+            ({ pkgs, ... }: {
               imports = [
-                ./nixos/machines/${name}/configuration.nix
+                # this magically adds all my machines in the zero tier network
-                (sopsModule name)
+                # and makes the controller accept them.
+                # will automatic look into `/machines/<name>/facts/zerotier-ip
+                inputs.clan-core.clanModules.zerotier-static-peers
+                # Statically configure the host names of machines based on their respective zerotier-ip.
+                inputs.clan-core.clanModules.static-hosts
+                # generate ssh host keys with facts
+                inputs.clan-core.clanModules.sshd
               ];
-            }
+              clan.static-hosts.topLevelDomain = "gummybear";
+              environment.systemPackages = [
+                clan-core.packages.${pkgs.system}.clan-cli
+              ];
+            })
           ];
         };
 
       defaultModules = [
-        ({ pkgs, lib, ... }: {
+        # make flake inputs accessiable in NixOS
-          # todo : check if this is still needed
+        {
-          nix = {
+          _module.args.self = self;
-            # no channesl needed this way
+          _module.args.inputs = self.inputs;
-            nixPath = [ "nixpkgs=${pkgs.path}" ];
+        }
-            # make flakes available
+        # ssh keys
-            package = pkgs.nixUnstable;
+        ({ config, ... }: {
-            extraOptions = ''
+          users.users.root.openssh.authorizedKeys.keyFiles = [
-              experimental-features = nix-command flakes
+          # master key
-            '';
+            ./nixos/assets/ssh/palo_rsa.pub
-          };
+            # backup key
+            "${config.clanCore.clanDir}/machines/chungus/facts/syncoid.ssh.id_ed25519.pub"
+          ];
         })
-        { nix.settings.substituters = [ "https://cache.nixos.org/" ]; }
+        # configure nix
+        ({ pkgs, ... }:
+          {
+            nix.settings.substituters = [ "https://cache.nixos.org/" ];
+            nix.settings.experimental-features = [ "nix-command" "flakes" ];
+            nix.settings.max-jobs = 1;
+            # no channesl needed this way
+            nix.nixPath = [ "nixpkgs=${pkgs.path}" ];
+          })
+        # some modules I always use
+        permown.nixosModules.permown
+        kmonad.nixosModules.default
+        # some default things I always want
         ({ pkgs, ... }: {
           boot.tmp.useTmpfs = lib.mkDefault true;
-          environment.systemPackages = [ nixpkgs-fmt.defaultPackage.${pkgs.system} ];
+          environment.systemPackages = [
-          imports = [
+            pkgs.nixpkgs-fmt
-            permown.nixosModules.permown
-            disko.nixosModules.disko
-            kmonad.nixosModules.default
-            grocy-scanner.nixosModule
           ];
         })
       ];
 
-      homeManagerModules = { pkgs, config, ... }: {
+      stylixModules = { pkgs, config, ... }: {
-        imports = [
+        imports = [ stylix.nixosModules.stylix ];
-          home-manager.nixosModules.home-manager
-          stylix.nixosModules.stylix
-        ];
         stylix.base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-light-medium.yaml";
         stylix.image = ./nixos/assets/wallpaper.png;
         stylix.fonts = {
@@ -254,22 +257,29 @@
             package = pkgs.noto-fonts-emoji;
             name = "Noto Color Emoji";
           };
+          sizes.popups = 15;
         };
+        # todo: remove this if not needed anymore
+        #home-manager.sharedModules = [
+        #  { stylix.targets.bemenu.enable = false; }
+        #];
 
-        home-manager.useGlobalPkgs = true;
-        home-manager.useUserPackages = true;
-        home-manager.sharedModules = [
-          doom-emacs-nix.hmModule
-          home-manager-utils.hmModule
-          { stylix.targets.bemenu.enable = false; }
-        ];
-        home-manager.users.mainUser.home.stateVersion = "22.11";
-        home-manager.users.root.home.stateVersion = "22.11";
       };
 
-      sopsModule = name: { lib, ... }: {
+      homeManagerModules = { pkgs, config, ... }: {
-        #imports = [ sops-nix.nixosModules.sops ];
+        imports = [
-        sops.defaultSopsFile = lib.mkForce "${secrets}/secrets/${name}.yaml";
+          home-manager.nixosModules.home-manager
+        ];
+        home-manager.extraSpecialArgs = {
+          inherit private_assets;
+          assets = ./nixos/assets;
+        };
+        home-manager.useGlobalPkgs = true;
+        home-manager.useUserPackages = true;
+        home-manager.backupFileExtension = "backup";
+        home-manager.sharedModules = [
+          home-manager-utils.hmModule
+        ];
       };
 
     in
@@ -286,34 +296,56 @@
 
       # Define your clan
       clan = {
-        # Clan wide settings. (Required)
+        # Clan wide settings.
         clanName = "gummybears"; # Ensure to choose a unique name.
         specialArgs = meta.specialArgs;
 
         machines = {
           sternchen = clanSetup {
             name = "sternchen";
-            host = "sternchen.secure";
+            #host = "sternchen.secure";
+            host = "192.168.178.25";
             modules = [
               nixos-hardware.nixosModules.lenovo-thinkpad-x220
               homeManagerModules
+              stylixModules
+              { home-manager.users.mainUser.gui.enable = true; }
+              {
+                home-manager.users.mainUser = import ./nixos/homes/tina;
+                home-manager.users.root = import ./nixos/homes/root;
+              }
+              # todo : strange overrides, this should be an option kinda an be changed on another level (the homes/<name> folders or something)
+              ({ lib, ... }: {
+                home-manager.sharedModules = [
+                  {
+                    programs.atuin.enable = lib.mkForce false;
+                  }
+                ];
+              })
+              {
+                clanCore.machineDescription = "LaLaptop";
+              }
             ];
           };
 
           cream = clanSetup {
             name = "cream";
-            #host = "1.2.3.4";
             host = "cream.private";
             modules = [
               nixos-hardware.nixosModules.framework-12th-gen-intel
               retiolum.nixosModules.retiolum
-              private_assets.nixosModules.jobrad
+              private_assets.nixosModules.cream
+              private_assets.nixosModules.yubikey
               homeManagerModules
+              stylixModules
               { home-manager.users.mainUser.gui.enable = true; }
               {
                 home-manager.users.mainUser = import ./nixos/homes/palo;
                 home-manager.users.root = import ./nixos/homes/root;
               }
+              {
+                clanCore.machineDescription = "Laptop";
+              }
             ];
           };
 
@@ -323,11 +355,16 @@
             modules = [
               nixos-hardware.nixosModules.framework-13th-gen-intel
               homeManagerModules
+              stylixModules
+              private_assets.nixosModules.yubikey
               { home-manager.users.mainUser.gui.enable = true; }
               {
                 home-manager.users.mainUser = import ./nixos/homes/palo;
                 home-manager.users.root = import ./nixos/homes/root;
               }
+              {
+                clanCore.machineDescription = "Laptop";
+              }
             ];
           };
 
@@ -336,42 +373,57 @@
             host = "chungus.private";
             modules = [
               homeManagerModules
+              stylixModules
               retiolum.nixosModules.retiolum
+              private_assets.nixosModules.chungus
+              #srvos.nixosModules.server
+              #srvos.nixosModules.mixins-terminfo
               {
                 home-manager.users.mainUser = import ./nixos/homes/palo;
                 home-manager.users.root = import ./nixos/homes/root;
               }
+              {
+                clanCore.machineDescription = "Home Server";
+              }
             ];
           };
 
           orbi = clanSetup {
             name = "orbi";
             host = "orbi.private";
+            # host = "95.216.66.212";
             modules = [
+              {
+                clan.networking.zerotier.controller = {
+                  enable = true;
+                  public = false;
+                };
+              }
               homeManagerModules
+              stylixModules
               srvos.nixosModules.hardware-hetzner-online-intel
               srvos.nixosModules.server
               srvos.nixosModules.mixins-terminfo
-              { home-manager.sharedModules = [{ programs.doom-emacs.enable = false; }]; }
+              {
+                # not needed for servers in general
+                boot.initrd.systemd.emergencyAccess = false;
+                systemd.enableEmergencyMode = false;
+              }
               {
                 home-manager.users.mainUser = import ./nixos/homes/palo;
                 home-manager.users.root = import ./nixos/homes/root;
               }
+              {
+                clanCore.machineDescription = "Internet Server";
+              }
+              {
+                # can be removed when this is fixed https://github.com/nix-community/srvos/issues/434
+                system.switch.enableNg = false;
+                system.switch.enable = true;
+              }
             ];
           };
 
-          robi = clanSetup {
-            name = "robi";
-            host = "robi.private";
-            modules = [
-              homeManagerModules
-              { home-manager.sharedModules = [{ programs.doom-emacs.enable = false; }]; }
-              {
-                home-manager.users.mainUser = import ./nixos/homes/palo;
-                home-manager.users.root = import ./nixos/homes/root;
-              }
-            ];
-          };
         };
 
       };
@@ -379,40 +431,3 @@
     });
 
 }
-
-
-#  devShells.${system}.default =
-#    pkgs.mkShell {
-#      buildInputs = [
-#        nixpkgs-fmt.defaultPackage.${system}
-#        nixos-anywhere.packages.${system}.nixos-anywhere
-#      ];
-#    };
-
-#apps = nixinate.nixinate.x86_64-linux self;
-
-#  packages = with nixpkgs.lib; {
-#    ${system} =
-#      let
-#        vms = mapAttrs'
-#          (host: sys: {
-#            name = "vm-${host}";
-#            value = sys.config.system.build.vm;
-#          })
-#          self.nixosConfigurations;
-#        sds = mapAttrs'
-#          (host: sys: {
-#            name = "sd-${host}";
-#            value = sys.config.system.build.sdImage;
-#          })
-#          (filterAttrs
-#            (n: hasAttrByPath [ "config" "system" "build" "sdImage" ])
-#            self.nixosConfigurations);
-#      in
-#      vms // sds;
-#  };
-
-#  nixosConfigurations =
-#    };
-
-

machines/cherry/facts/ssh.id_ed25519.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIICsH/mPf/uURkv0UmDi/Bkm04aFbDbfzxRWT6oNSj/P nixbld@cherry

machines/cherry/facts/zerotier-ip

@@ -0,0 +1 @@
+fd88:5dd8:2cf1:64aa:6999:934f:7234:bb56

machines/chungus/facts/ssh.id_ed25519.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIqf2nOj4bC13KG6S/+QbTbKftes2qFWsEZeC5wq7TC+ nixbld@cherry

machines/chungus/facts/syncoid.ssh.id_ed25519.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICrdJ4EXJ0HeZXTb4AzRKQeAORBWwcawOxj4EJhV62De nixbld@cherry

machines/chungus/facts/zerotier-ip

@@ -0,0 +1 @@
+fd88:5dd8:2cf1:64aa:6999:93af:db91:b46f

machines/cream/facts/zerotier-ip

@@ -0,0 +1 @@
+fd88:5dd8:2cf1:64aa:6999:935d:b965:865b

machines/orbi/facts/zerotier-ip

@@ -0,0 +1 @@
+fd88:5dd8:2cf1:64aa:6999:9388:5dd8:2cf1

machines/orbi/facts/zerotier-network-id

@@ -0,0 +1 @@
+885dd82cf164aa69

machines/sternchen/facts/zerotier-ip

@@ -0,0 +1 @@
+fd88:5dd8:2cf1:64aa:6999:9381:db7f:b93e

nixos/assets/0001-make-atuin-on-zfs-fast-again.patch

@@ -1,6 +1,6 @@
-From b75e6fd3159896966dce2cf3af5b5be7e286ce1a Mon Sep 17 00:00:00 2001
+From 4797a2f62ab3d2716d313aa4a3170ba9672a93b6 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
-Date: Mon, 6 Nov 2023 15:56:26 +0100
+Date: Fri, 22 Mar 2024 08:46:07 +0100
 Subject: [PATCH] make atuin on zfs fast again
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
@@ -8,38 +8,38 @@ Content-Transfer-Encoding: 8bit
 
 Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
 ---
- atuin-client/src/database.rs            | 3 ++-
+ atuin-client/src/database.rs            | 4 ++--
- atuin-client/src/record/sqlite_store.rs | 3 ++-
+ atuin-client/src/record/sqlite_store.rs | 2 ++
  2 files changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/atuin-client/src/database.rs b/atuin-client/src/database.rs
-index c4b45302..29006d59 100644
+index b0bcae31..d8db492b 100644
 --- a/atuin-client/src/database.rs
 +++ b/atuin-client/src/database.rs
-@@ -130,7 +130,8 @@ pub async fn new(path: impl AsRef<Path>) -> Result<Self> {
+@@ -137,9 +137,9 @@ pub async fn new(path: impl AsRef<Path>, timeout: f64) -> Result<Self> {
          }
- 
+
          let opts = SqliteConnectOptions::from_str(path.as_os_str().to_str().unwrap())?
 -            .journal_mode(SqliteJournalMode::Wal)
 +            .journal_mode(SqliteJournalMode::Memory)
+             .optimize_on_close(true, None)
+-            .synchronous(SqliteSynchronous::Normal)
 +            .synchronous(sqlx::sqlite::SqliteSynchronous::Off)
+             .with_regexp()
              .create_if_missing(true);
- 
+
-         let pool = SqlitePoolOptions::new().connect_with(opts).await?;
 diff --git a/atuin-client/src/record/sqlite_store.rs b/atuin-client/src/record/sqlite_store.rs
-index db709f20..eaed6f7a 100644
+index 6333bb27..1f25a55b 100644
 --- a/atuin-client/src/record/sqlite_store.rs
 +++ b/atuin-client/src/record/sqlite_store.rs
-@@ -37,7 +37,8 @@ pub async fn new(path: impl AsRef<Path>) -> Result<Self> {
+@@ -42,6 +42,8 @@ pub async fn new(path: impl AsRef<Path>, timeout: f64) -> Result<Self> {
-         }
+
- 
          let opts = SqliteConnectOptions::from_str(path.as_os_str().to_str().unwrap())?
--            .journal_mode(SqliteJournalMode::Wal)
+             .journal_mode(SqliteJournalMode::Wal)
 +            .journal_mode(SqliteJournalMode::Memory)
 +            .synchronous(sqlx::sqlite::SqliteSynchronous::Off)
+             .foreign_keys(true)
              .create_if_missing(true);
- 
-         let pool = SqlitePoolOptions::new().connect_with(opts).await?;
--- 
-2.42.0
 
+--
+2.43.1

nixos/components/gui/default.nix

@@ -13,12 +13,12 @@ with lib;
     ./fonts.nix
     ./home-manager
     ./kmonad.nix
-    ./noti.nix
+    #./noti.nix
     ./pass.nix
     ./steam.nix
     ./suspend.nix
-    ./taskwarrior.nix
     ./vscode.nix
+    ./wayland.nix
     ./xorg
   ];
 

nixos/components/gui/kmonad.nix

@@ -14,8 +14,8 @@
     users.users.mainUser.extraGroups = [ "input" ];
 
     services.xserver = {
-      layout = "us";
+      xkb.layout = "us";
-      xkbOptions = "compose:ralt";
+      xkb.options = "compose:ralt";
     };
 
     services.kmonad = {
@@ -81,7 +81,7 @@
         {
           nativ = keyboard "/dev/input/by-path/platform-i8042-serio-0-event-kbd" [ "lctl" "lmet" "lalt" ];
           dasKeyboard = keyboard "/dev/input/by-id/usb-Metadot_-_Das_Keyboard_Das_Keyboard-event-kbd" [ "lctl" "lmet" "lalt" ];
-          uhk = keyboard "/dev/input/by-id/usb-Ultimate_Gadget_Laboratories_UHK_60_v2-if01-event-kbd" [ "lctl" "lmet" "lalt" ];
+          uhk = keyboard "/dev/input/by-id/usb-Ultimate_Gadget_Laboratories_UHK_60_v2-event-kbd" [ "lctl" "lmet" "lalt" ];
         };
     };
   };

nixos/components/gui/noti.nix

@@ -1,4 +1,5 @@
 # notify me when a command is finished
+# todo : secret managment is shit
 { config, pkgs, lib, ... }:
 with lib;
 {
@@ -7,6 +8,7 @@ with lib;
     default = config.components.gui.enable;
   };
 
+  # todo : put this in `/homes`
   config = mkIf (config.components.gui.noti.enable) {
 
     sops.secrets.pushover_user_key = { };

nixos/components/gui/taskwarrior.nix

@@ -1,90 +0,0 @@
-{ config, pkgs, lib, ... }:
-with lib;
-with types;
-let
-  mkMagicMergeOption = { description ? "", example ? { }, default ? { }, apply ? id, ... }:
-    mkOption {
-      inherit example description default apply;
-      type = with lib.types;
-        let
-          valueType = nullOr
-            (oneOf [
-              bool
-              int
-              float
-              str
-              (attrsOf valueType)
-              (listOf valueType)
-            ]) // {
-            description = "bool, int, float or str";
-            emptyValue.value = { };
-          };
-        in
-        valueType;
-    };
-in
-
-{
-  options.components.gui.taskwarrior.enable = mkOption {
-    type = bool;
-    default = config.components.gui.enable;
-  };
-
-  options.components.gui.taskwarrior.config = mkMagicMergeOption {
-    type = attrs;
-    default = { };
-  };
-
-  config = mkIf (config.components.gui.taskwarrior.enable) {
-
-    environment.systemPackages = with pkgs; [
-
-      unstable.taskwarrior-tui
-      taskwarrior
-      timewarrior
-      miller
-      tasksh
-      (pkgs.writeShellScriptBin "tsak" ''${pkgs.taskwarrior}/bin/task "$@"'')
-
-      (pkgs.writers.writeBashBin "calendar" ''
-        ${pkgs.taskwarrior}/bin/task calendar
-        ${pkgs.taskwarrior}/bin/task calendar_report
-      '')
-
-      unstable.vit
-      (pkgs.writers.writeBashBin "active" "${unstable.taskwarrior-tui}/bin/taskwarrior-tui -r active")
-      (pkgs.writers.writeBashBin "todo" "${unstable.taskwarrior-tui}/bin/taskwarrior-tui -r todo")
-
-      taskwarrior-hooks
-      vdirsyncer
-      khal
-      (pkgs.writers.writeBashBin "kalendar" ''
-        ${pkgs.vdirsyncer}/bin/vdirsyncer sync
-        ${pkgs.khal}/bin/ikhal
-      '')
-
-      # todo : before deleting this, put it in trilium
-      (python3Packages.bugwarrior.overrideAttrs (old: {
-        version = "develop";
-        src = pkgs.fetchFromGitHub {
-          owner = "ralphbean";
-          repo = "bugwarrior";
-          rev = "eb19a702a698f9c8c3ce2a1fe41f35872d9ae398";
-          sha256 = "sha256-Geon+ddE58WJ10L4unotzvmZj1Ye0yjZHVQgrR2YWgE=";
-        };
-        propagatedBuildInputs = old.propagatedBuildInputs ++ [
-          python3Packages.pydantic
-          python3Packages.tomli
-          python3Packages.email-validator
-          python3Packages.packaging
-        ];
-      }))
-    ];
-
-    #home-manager.users.mainUser.home.file.".config/bugwarrior/bugwarriorrc".source = ./bugwarriorc.ini;
-    #home-manager.users.mainUser.home.file.".config/bugwarrior/bugwarriorrc".source = (pkgs.formats.toml { }).generate "bugwarriorrc.toml" config.components.gui.taskwarrior.config;
-    home-manager.users.mainUser.home.file.".config/bugwarrior/bugwarrior.toml".source = (pkgs.formats.toml { }).generate "bugwarriorrc.toml" config.components.gui.taskwarrior.config;
-
-  };
-
-}

nixos/components/gui/wayland.nix

@@ -0,0 +1,13 @@
+{ config, pkgs, lib, ... }:
+with lib;
+{
+
+  options.components.gui.wayland.enable = mkOption {
+    type = lib.types.bool;
+    default = ! config.components.gui.xorg.enable;
+  };
+
+  config = mkIf config.components.gui.wayland.enable {
+    programs.hyprland.enable = true;
+  };
+}

nixos/components/gui/xorg/default.nix

@@ -4,46 +4,48 @@ with lib;
 
   imports = [ ./xlock.nix ];
 
-  config = mkIf config.components.gui.enable {
+  options.components.gui.xorg.enable = mkOption {
+    type = lib.types.bool;
+    default = config.components.gui.enable;
+  };
+
+  config = mkIf config.components.gui.xorg.enable {
 
     # system.custom.fonts.enable = true;
+    services.displayManager = {
+      defaultSession = lib.mkDefault "none+i3";
+      autoLogin.enable = lib.mkDefault true;
+      autoLogin.user = config.users.users.mainUser.name;
+    };
 
     services.xserver = {
 
       enable = true;
 
       displayManager = {
-        defaultSession = lib.mkDefault "none+i3";
-        autoLogin.enable = lib.mkDefault true;
-        autoLogin.user = config.users.users.mainUser.name;
         lightdm.enable = lib.mkDefault true;
       };
 
-      desktopManager = {
+      desktopManager.xterm.enable = false;
-        xterm.enable = false;
+      windowManager.i3.enable = true;
-      };
-      windowManager = {
-        xmonad.enable = true;
-        xmonad.enableContribAndExtras = true;
-        i3.enable = true;
-      };
 
       # mouse/touchpad
       # --------------
-      libinput = {
-        enable = true;
-        touchpad = {
-          disableWhileTyping = true;
-          tapping = true;
-          scrollMethod = "twofinger";
-          accelSpeed = "1.3";
-          naturalScrolling = true;
-          horizontalScrolling = true;
-        };
-      };
 
     };
 
+    services.libinput = {
+      enable = true;
+      touchpad = {
+        disableWhileTyping = true;
+        tapping = true;
+        scrollMethod = "twofinger";
+        accelSpeed = "1.3";
+        naturalScrolling = true;
+        horizontalScrolling = true;
+      };
+    };
+
     # Packages
     # --------
     environment.systemPackages = with pkgs; [

nixos/components/gui/xorg/xlock.nix

@@ -11,7 +11,7 @@ let
 
 in
 {
-  config = mkIf config.components.gui.enable {
+  config = mkIf config.components.gui.xorg.enable {
     environment.systemPackages = [
       lockProgram
       (pkgs.makeDesktopItem {

nixos/components/monitor/container.nix

@@ -0,0 +1,15 @@
+{ lib, config, ... }:
+with lib;
+with types;
+{
+  imports = [ ./default.nix ];
+
+  config = {
+    components.monitor.enable = mkDefault true;
+    components.monitor.metrics.enable = mkDefault false;
+    components.monitor.opentelemetry.enable = false;
+
+    services.journald.extraConfig = "SystemMaxUse=1G";
+  };
+
+}

nixos/components/monitor/default.nix

@@ -1,20 +1,32 @@
-{ lib, ... }:
+{ lib, config, ... }:
 with lib;
 with types;
 {
 
-
   options.components.monitor = {
     enable = mkOption {
       type = bool;
       default = true;
     };
+    metrics.enable = mkOption {
+      type = bool;
+      default = config.components.monitor.enable;
+    };
+    logs.enable = mkOption {
+      type = bool;
+      default = config.components.monitor.enable;
+    };
   };
 
   imports = [
-    ./netdata.nix
+    ./logs-promtail.nix
+    ./metrics-export-zfs.nix
+    ./metrics-netdata.nix
+    ./metrics-prometheus.nix
+    ./metrics-telegraf.nix
+    ./opentelemetry.nix
   ];
 
-
   config = mkIf config.components.monitor.enable { };
+
 }

nixos/components/monitor/logs-promtail.nix

@@ -0,0 +1,178 @@
+{ config, lib, ... }:
+with lib;
+with types;
+let
+  cfg = config.components.monitor.promtail;
+in
+{
+  options.components.monitor.promtail = {
+    enable = mkOption {
+      type = lib.types.bool;
+      default = config.components.monitor.logs.enable;
+    };
+    port = mkOption {
+      type = int;
+      default = 3500;
+      description = "port to provide promtail export";
+    };
+  };
+
+  config = mkMerge [
+
+    (mkIf config.components.monitor.opentelemetry.enable {
+      services.opentelemetry-collector.settings = {
+        receivers.loki = {
+          protocols.http.endpoint = "127.0.0.1:${toString cfg.port}";
+          use_incoming_timestamp = true;
+        };
+        service.pipelines.logs.receivers = [ "loki" ];
+      };
+    })
+
+    (mkIf config.components.monitor.promtail.enable {
+      services.promtail = {
+        enable = true;
+        configuration = {
+          server. disable = true;
+          positions.filename = "/var/cache/promtail/positions.yaml";
+
+          clients = [
+            { url = "http://127.0.0.1:${toString cfg.port}/loki/api/v1/push"; }
+          ];
+
+          scrape_configs =
+
+            let
+              _replace = index: replacement: ''{{ Replace .Value "${toString index}" "${replacement}" 1 }}'';
+              _elseif = index: ''{{ else if eq .Value "${toString index}" }}'';
+              _if = index: ''{{ if eq .Value "${toString index}" }}'';
+              _end = ''{{ end }}'';
+              elseblock = index: replacement: "${_elseif index}${_replace index replacement}";
+              ifblock = index: replacement: "${_if index}${_replace index replacement}";
+              createTemplateLine = list: "${concatStrings (imap0 (index: replacement: if index == 0 then ifblock index replacement else elseblock index replacement) list)}${_end}";
+            in
+            [
+              {
+                job_name = "journal";
+                journal = {
+                  json = true;
+                  max_age = "12h";
+                  labels.job = "systemd-journal";
+                };
+                pipeline_stages = [
+                  {
+                    # Set of key/value pairs of JMESPath expressions. The key will be
+                    # the key in the extracted data while the expression will be the value,
+                    # evaluated as a JMESPath from the source data.
+                    json.expressions = {
+                      # journalctl -o json | jq and you'll see these
+                      boot_id = "_BOOT_ID";
+                      facility = "SYSLOG_FACILITY";
+                      facility_label = "SYSLOG_FACILITY";
+                      instance = "_HOSTNAME";
+                      msg = "MESSAGE";
+                      priority = "PRIORITY";
+                      priority_label = "PRIORITY";
+                      transport = "_TRANSPORT";
+                      unit = "_SYSTEMD_UNIT";
+                      # coredump
+                      #coredump_cgroup = "COREDUMP_CGROUP";
+                      #coredump_exe = "COREDUMP_EXE";
+                      #coredump_cmdline = "COREDUMP_CMDLINE";
+                      #coredump_uid = "COREDUMP_UID";
+                      #coredump_gid = "COREDUMP_GID";
+                    };
+                  }
+                  {
+                    # Set the unit (defaulting to the transport like audit and kernel)
+                    template = {
+                      source = "unit";
+                      template = "{{if .unit}}{{.unit}}{{else}}{{.transport}}{{end}}";
+                    };
+                  }
+                  {
+                    # Normalize session IDs (session-1234.scope -> session.scope) to limit number of label values
+                    replace = {
+                      source = "unit";
+                      expression = "^(session-\\d+.scope)$";
+                      replace = "session.scope";
+                    };
+                  }
+                  {
+                    # Map priority to human readable
+                    template = {
+                      source = "priority_label";
+                      #template = ''{{ if eq .Value "0" }}{{ Replace .Value "0" "emerg" 1 }}{{ else if eq .Value "1" }}{{ Replace .Value "1" "alert" 1 }}{{ else if eq .Value "2" }}{{ Replace .Value "2" "crit" 1 }}{{ else if eq .Value "3" }}{{ Replace .Value "3" "err" 1 }}{{ else if eq .Value "4" }}{{ Replace .Value "4" "warning" 1 }}{{ else if eq .Value "5" }}{{ Replace .Value "5" "notice" 1 }}{{ else if eq .Value "6" }}{{ Replace .Value "6" "info" 1 }}{{ else if eq .Value "7" }}{{ Replace .Value "7" "debug" 1 }}{{ end }}'';
+                      template = createTemplateLine [
+                        "emergency"
+                        "alert"
+                        "critical"
+                        "error"
+                        "warning"
+                        "notice"
+                        "info"
+                        "debug"
+                      ];
+                    };
+                  }
+                  {
+                    # Map facility to human readable
+                    template =
+                      {
+                        source = "facility_label";
+                        template = createTemplateLine [
+                          "kern" # Kernel messages
+                          "user" # User-level messages
+                          "mail" # Mail system	Archaic POSIX still supported and sometimes used (for more mail(1))
+                          "daemon" # System daemons	All daemons, including systemd and its subsystems
+                          "auth" # Security/authorization messages	Also watch for different facility 10
+                          "syslog" # Messages generated internally by syslogd	For syslogd implementations (not used by systemd, see facility 3)
+                          "lpr" # Line printer subsystem (archaic subsystem)
+                          "news" # Network news subsystem (archaic subsystem)
+                          "uucp" # UUCP subsystem (archaic subsystem)
+                          "clock" # Clock daemon	systemd-timesyncd
+                          "authpriv" # Security/authorization messages	Also watch for different facility 4
+                          "ftp" # FTP daemon
+                          "-" # NTP subsystem
+                          "-" # Log audit
+                          "-" # Log alert
+                          "cron" # Scheduling daemon
+                          "local0" # Local use 0 (local0)
+                          "local1" # Local use 1 (local1)
+                          "local2" # Local use 2 (local2)
+                          "local3" # Local use 3 (local3)
+                          "local4" # Local use 4 (local4)
+                          "local5" # Local use 5 (local5)
+                          "local6" # Local use 6 (local6)
+                          "local7" # Local use 7 (local7)
+                        ];
+                      };
+                  }
+                  {
+                    # Key is REQUIRED and the name for the label that will be created.
+                    # Value is optional and will be the name from extracted data whose value
+                    # will be used for the value of the label. If empty, the value will be
+                    # inferred to be the same as the key.
+                    labels = {
+                      boot_id = "";
+                      facility = "";
+                      facility_label = "";
+                      instance = "";
+                      priority = "";
+                      priority_label = "";
+                      transport = "";
+                      unit = "";
+                    };
+                  }
+                  {
+                    # Write the proper message instead of JSON
+                    output.source = "msg";
+                  }
+                ];
+              }
+            ];
+        };
+      };
+    })
+  ];
+}

nixos/components/monitor/metrics-export-zfs.nix

@@ -0,0 +1,32 @@
+{ pkgs, config, lib, ... }:
+with lib;
+with types;
+{
+  options.components.monitor.exporters.zfs.enable = mkOption {
+    type = lib.types.bool;
+    default = config.components.monitor.metrics.enable;
+  };
+
+  config = mkMerge [
+    (mkIf config.components.monitor.exporters.zfs.enable {
+
+      services.telegraf.extraConfig.inputs.zfs = { };
+
+      services.prometheus.exporters.zfs.enable = true;
+      services.opentelemetry-collector.settings = {
+        receivers.prometheus.config.scrape_configs = [
+          {
+            job_name = "zfs";
+            scrape_interval = "10s";
+            static_configs = [{
+              targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.zfs.port}" ];
+            }];
+          }
+        ];
+        service.pipelines.metrics.receivers = [ "prometheus" ];
+      };
+
+    })
+  ];
+
+}

nixos/components/monitor/metrics-netdata.nix

@@ -0,0 +1,35 @@
+{ lib, pkgs, config, ... }:
+with lib;
+with types;
+{
+  options.components.monitor.netdata = {
+    enable = mkOption {
+      type = bool;
+      default = config.components.monitor.metrics.enable;
+    };
+  };
+
+  config = mkIf config.components.monitor.netdata.enable {
+
+    # netdata sink
+    services.opentelemetry-collector.settings.receivers.prometheus.config.scrape_configs = [
+      {
+        job_name = "netdata";
+        scrape_interval = "10s";
+        metrics_path = "/api/v1/allmetrics";
+        params.format = [ "prometheus" ];
+        static_configs = [{ targets = [ "127.0.0.1:19999" ]; }];
+      }
+    ];
+
+    # https://docs.netdata.cloud/daemon/config/
+    services.netdata = {
+      enable = lib.mkDefault true;
+      config = {
+        global = {
+          "memory mode" = "ram";
+        };
+      };
+    };
+  };
+}

nixos/components/monitor/metrics-prometheus.nix

@@ -0,0 +1,45 @@
+{ config, lib, ... }:
+with lib;
+with types;
+let
+  cfg = config.components.monitor.prometheus;
+in
+{
+  options.components.monitor.prometheus = {
+    enable = mkOption {
+      type = lib.types.bool;
+      default = config.components.monitor.metrics.enable;
+    };
+    port = mkOption {
+      type = int;
+      default = 8090;
+      description = "port to provide Prometheus export";
+    };
+  };
+
+  config = mkMerge [
+
+    (mkIf config.components.monitor.prometheus.enable {
+      services.prometheus = {
+        checkConfig = "syntax-only";
+        enable = true;
+      };
+    })
+
+    (mkIf config.components.monitor.prometheus.enable {
+      services.opentelemetry-collector.settings = {
+        exporters.prometheus.endpoint = "127.0.0.1:${toString cfg.port}";
+        service.pipelines.metrics.exporters = [ "prometheus" ];
+      };
+      services.prometheus.scrapeConfigs = [
+        {
+          job_name = "opentelemetry";
+          metrics_path = "/metrics";
+          scrape_interval = "10s";
+          static_configs = [{ targets = [ "localhost:${toString cfg.port}" ]; }];
+        }
+      ];
+    })
+
+  ];
+}

nixos/components/monitor/metrics-telegraf.nix

@@ -0,0 +1,50 @@
+{ config, pkgs, lib, ... }:
+with lib;
+with types;
+let
+  cfg = config.components.monitor.telegraf;
+in
+{
+  options.components.monitor.telegraf = {
+    enable = mkOption {
+      type = lib.types.bool;
+      default = config.components.monitor.metrics.enable;
+    };
+    influxDBPort = mkOption {
+      type = int;
+      default = 8088;
+      description = "Port to listen on influxDB input";
+    };
+  };
+
+  config = lib.mkMerge [
+    (mkIf config.components.monitor.telegraf.enable {
+      # opentelemetry wireing
+      services.opentelemetry-collector.settings = {
+        receivers.influxdb.endpoint = "127.0.0.1:${toString cfg.influxDBPort}";
+        service.pipelines.metrics.receivers = [ "influxdb" ];
+      };
+      services.telegraf.extraConfig.outputs.influxdb_v2.urls = [ "http://127.0.0.1:${toString cfg.influxDBPort}" ];
+    })
+
+    (mkIf config.components.monitor.telegraf.enable {
+
+      systemd.services.telegraf.path = [ pkgs.inetutils ];
+
+      services.telegraf = {
+        enable = true;
+        extraConfig = {
+          # https://github.com/influxdata/telegraf/tree/master/plugins/inputs < all them plugins
+          inputs = {
+            cpu = { };
+            diskio = { };
+            processes = { };
+            system = { };
+            systemd_units = { };
+            ping = [{ urls = [ "10.100.0.1" ]; }]; # actually important to make machine visible over wireguard
+          };
+        };
+      };
+    })
+  ];
+}

nixos/components/monitor/netdata.nix

@@ -1,33 +0,0 @@
-{ lib, pkgs, config, ... }:
-with lib;
-with types;
-{
-
-  config = lib.mkIf config.components.monitor.enable {
-
-    services.netdata = {
-      enable = lib.mkDefault true;
-      # https://docs.netdata.cloud/daemon/config/
-      config = {
-        global = {
-          "memory mode" = "ram";
-        };
-      };
-      #configDir."python.d.conf" = pkgs.writeText "python.d.conf" ''
-      #  example: yes
-      #  default_run: no
-      #  samba: yes
-      #'';
-    };
-
-    # add samba to path of python plugin
-    #systemd.services.netdata.path = [ pkgs.sudo pkgs.samba ];
-    #systemd.services.netdata.serviceConfig.CapabilityBoundingSet = [ "~" ];
-    #security.sudo.extraConfig = ''
-    #  netdata ALL=(root) NOPASSWD: ${pkgs.samba}/bin/smbstatus
-    #  netdata ALL=(root) NOPASSWD: /run/current-system/sw/bin/smbstatus
-    #'';
-
-
-  };
-}

nixos/components/monitor/opentelemetry.nix

@@ -0,0 +1,205 @@
+{ pkgs, config, lib, ... }:
+with lib;
+with types;
+let
+  cfg = config.components.monitor.opentelemetry;
+in
+{
+  options.components.monitor.opentelemetry = {
+    enable = mkOption {
+      type = bool;
+      default = config.components.monitor.enable;
+      description = "weather or not to use opentelemetry";
+    };
+    receiver.endpoint = mkOption {
+      type = nullOr str;
+      default = null;
+      description = "endpoint to receive the opentelementry data from other collectors";
+    };
+    exporter.endpoint = mkOption {
+      type = nullOr str;
+      default = null;
+      description = "endpoint to ship opentelementry data too";
+    };
+    exporter.debug = mkOption {
+      type = nullOr (enum [ "logs" "metrics" ]);
+      default = null;
+      description = "enable debug exporter.";
+    };
+    metrics.endpoint = mkOption {
+      type = str;
+      default = "127.0.0.1:8100";
+      description = "endpoint on where to provide opentelementry metrics";
+    };
+  };
+
+  config = mkMerge [
+
+    (mkIf config.components.monitor.opentelemetry.enable {
+      services.opentelemetry-collector = {
+        enable = true;
+        package = pkgs.unstable.opentelemetry-collector-contrib;
+      };
+    })
+
+    # add default tags to metrics
+    # todo : make sure we filter out metrics from otlp receivers
+    (mkIf config.components.monitor.enable {
+      services.opentelemetry-collector.settings = {
+
+        processors = {
+
+          # https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/processor/resourcedetectionprocessor/README.md
+          "resourcedetection/system" = {
+            detectors = [ "system" ];
+            override = false;
+            system.hostname_sources = [ "os" ];
+          };
+
+          metricstransform.transforms = [
+            {
+              include = ".*";
+              match_type = "regexp";
+              action = "update";
+              operations = [{
+                action = "add_label";
+                new_label = "machine";
+                new_value = config.networking.hostName;
+              }];
+            }
+          ];
+        };
+      };
+    })
+    (mkIf config.components.monitor.metrics.enable {
+      services.opentelemetry-collector.settings = {
+        service.pipelines.metrics.processors = [
+          "metricstransform"
+          "resourcedetection/system"
+        ];
+      };
+    })
+    (mkIf config.components.monitor.logs.enable {
+      services.opentelemetry-collector.settings = {
+        service.pipelines.logs.processors = [ "resourcedetection/system" ];
+      };
+    })
+
+
+    (mkIf (config.components.monitor.opentelemetry.exporter.debug != null) {
+      services.opentelemetry-collector.settings = {
+        exporters.debug = {
+          verbosity = "detailed";
+          sampling_initial = 5;
+          sampling_thereafter = 200;
+        };
+        service.pipelines.${config.components.monitor.opentelemetry.exporter.debug} = {
+          exporters = [ "debug" ];
+        };
+
+      };
+    })
+
+    # ship to next instance
+    (mkIf (config.components.monitor.opentelemetry.exporter.endpoint != null) {
+      services.opentelemetry-collector.settings = {
+        exporters.otlp = {
+          endpoint = cfg.exporter.endpoint;
+          tls.insecure = true;
+        };
+      };
+    })
+    (mkIf
+      (
+        config.components.monitor.opentelemetry.exporter.endpoint != null &&
+        config.components.monitor.logs.enable
+      )
+      {
+        services.opentelemetry-collector.settings = {
+          service.pipelines.logs.exporters = [ "otlp" ];
+        };
+      })
+    (mkIf
+      (
+        config.components.monitor.opentelemetry.exporter.endpoint != null &&
+        config.components.monitor.metrics.enable
+      )
+      {
+        services.opentelemetry-collector.settings = {
+          service.pipelines.metrics.exporters = [ "otlp" ];
+        };
+      })
+
+    # ship from other instance
+    (mkIf (config.components.monitor.opentelemetry.receiver.endpoint != null) {
+      services.opentelemetry-collector.settings = {
+        receivers.otlp.protocols.grpc.endpoint = cfg.receiver.endpoint;
+      };
+    })
+    (mkIf
+      (
+        config.components.monitor.opentelemetry.receiver.endpoint != null &&
+        config.components.monitor.logs.enable
+      )
+      {
+        services.opentelemetry-collector.settings = {
+          service.pipelines.logs.receivers = [ "otlp" ];
+        };
+      })
+    (mkIf
+      (
+        config.components.monitor.opentelemetry.receiver.endpoint != null &&
+        config.components.monitor.metrics.enable
+      )
+      {
+        services.opentelemetry-collector.settings = {
+          service.pipelines.metrics.receivers = [ "otlp" ];
+        };
+      })
+
+
+
+    # scrape opentelemetry-colectors metrics
+    # todo: this should be collected another way (opentelemetry internal?)
+    # todo : enable me only when metrics.endpoint is set.
+    (mkIf config.components.monitor.metrics.enable {
+      services.opentelemetry-collector.settings = {
+        receivers = {
+          prometheus.config.scrape_configs = [
+            {
+              job_name = "otelcol";
+              scrape_interval = "10s";
+              static_configs = [{
+                targets = [ cfg.metrics.endpoint ];
+              }];
+              metric_relabel_configs = [
+                {
+                  source_labels = [ "__name__" ];
+                  regex = ".*grpc_io.*";
+                  action = "drop";
+                }
+              ];
+            }
+          ];
+        };
+
+        service = {
+          pipelines.metrics = {
+            receivers = [ "prometheus" ];
+          };
+
+          # todo : this should be automatically be collected
+          # open telemetries own metrics?
+          telemetry.metrics.address = cfg.metrics.endpoint;
+        };
+
+      };
+    })
+    (mkIf (! config.components.monitor.metrics.enable) {
+      services.opentelemetry-collector.settings = {
+        service.telemetry.metrics.level = "none";
+      };
+    })
+  ];
+
+}

nixos/components/network/hosts.nix

@@ -1,6 +1,5 @@
 {
   networking.extraHosts = ''
-    144.76.13.147 robi
+    95.216.66.212 orbi.public
-    95.216.66.212 orbi
   '';
 }

nixos/components/network/nginx.nix

@@ -33,23 +33,37 @@ with lib;
 
         # for loki logging
         commonHttpConfig = ''
-          log_format logfmt escape=json 'timestamp=$time_iso8601 '
+          log_format logfmt
-            'facility=nginx '
+            'timestamp="$time_iso8601" '
-            'src_addr=$remote_addr '
+            'facility="nginx" '
-            'body_bytes_sent=$body_bytes_sent '
+            'src_addr="$remote_addr" '
-            'request_time=$request_time '
+            'body_bytes_sent="$body_bytes_sent" '
-            'response_status=$status '
+            'request_time="$request_time" '
-            'request="$request" '
+            'response_status="$status" '
             'request_method="$request_method" '
+            'request="$request" '
             'host="$host" '
             'upstream_cache_status="$upstream_cache_status" '
             'upstream_addr="$upstream_addr" '
             'http_x_forwarded_for="$http_x_forwarded_for" '
             'http_referrer="$http_referer" '
-            'http_user_agent="$http_user_agent"';
+            'http_user_agent="$http_user_agent" ';
+
+           log_format json_combined escape=json
+             '{'
+                '"time_local":"$time_local",'
+                '"remote_addr":"$remote_addr",'
+                '"remote_user":"$remote_user",'
+                '"request":"$request",'
+                '"status": "$status",'
+                '"body_bytes_sent":"$body_bytes_sent",'
+                '"request_time":"$request_time",'
+                '"http_referrer":"$http_referer",'
+                '"http_user_agent":"$http_user_agent"'
+              '}';
 
           # log to local journald
-          access_log syslog:server=unix:/dev/log logfmt;
+          access_log syslog:server=unix:/dev/log,nohostname logfmt;
         '';
 
       };

nixos/components/network/sshd/default.nix

@@ -82,7 +82,8 @@ in
 
       users.users.root.openssh.authorizedKeys.keyFiles = cfg.rootKeyFiles ++ defaultRootKeyFiles;
 
-      services.openssh.banner = builtins.readFile sshBanner;
+      # todo enable again when I can it's possible to set the `-q` ssh option in clan
+      #services.openssh.banner = builtins.readFile sshBanner;
 
     })
 

nixos/components/network/syncthing.nix

@@ -31,18 +31,13 @@ with lib; {
       // (device "cream" "MQVKATH-THTPET5-KYAT7XX-BOIIIBA-P7OOF7Y-IWAUN53-S2VNVOY-BZWTGQK")
       // (device "cherry" "WX2HZQ7-WAOL6YR-QJYFS2L-SVUJQB4-SKHZHVE-J7XCWLQ-6GRATXX-VJUMOAH")
       // (device "chungus" "GZGW2YW-6RRUPDN-LFAOATC-56FS7LH-YC7R32N-LVA5JUX-3LSBYOX-BFR67QZ")
+      // (device "iPhone" "APFS6SA-VVTARXU-3WHHRZG-TE5N3T4-X4IC76V-T67EKZ6-NLGP3TW-EZYXYAH")
+      // (device "iPad" "JDDNVYD-H3WMSSS-WZ745KL-7QEGN6O-ZSGQLQU-YBR2L42-7FO7KJ4-BXPYDA5")
       // {
         bumba = {
           name = "windows-bumba";
           id = "JS7PWTO-VKFGBUP-GNFLSWP-MGFJ2KH-HLO2LKW-V3RPCR6-PCB5SQC-42FCKQZ";
         };
-      }
-      // {
-        mors = {
-          name = "lassulus-mors";
-          id = "ZPRS57K-YK32ROQ-7A6MRAV-VOYXQ3I-CQCXISZ-C5PCV2A-GSFLG3I-K7UGGAH";
-          addresses = [ "tcp://mors.r:22000" ];
-        };
       };
 
     settings.folders = {
@@ -54,16 +49,6 @@ with lib; {
         path = lib.mkDefault "/tmp/audiobooks";
         devices = [ "chungus" "orbi" ];
       };
-      logseq = {
-        enable = lib.mkDefault false;
-        path = lib.mkDefault "/tmp/logseq";
-        devices = [ "chungus" "cream" "cherry" ];
-      };
-      lectures = {
-        enable = lib.mkDefault false;
-        path = lib.mkDefault "/tmp/lectures";
-        devices = [ "chungus" "orbi" ];
-      };
       books = {
         enable = lib.mkDefault false;
         path = lib.mkDefault "/tmp/books";
@@ -73,15 +58,6 @@ with lib; {
           params.keep = "2";
         };
       };
-      password-store = {
-        enable = lib.mkDefault false;
-        path = lib.mkDefault "/tmp/password-store";
-        devices = [ "chungus" "cream" "mobi" "bobi" "cherry" ];
-        versioning = {
-          type = "simple";
-          params.keep = "10";
-        };
-      };
       desktop = {
         enable = lib.mkDefault false;
         path = lib.mkDefault "/tmp/desktop";
@@ -90,22 +66,51 @@ with lib; {
       finance = {
         enable = lib.mkDefault false;
         path = lib.mkDefault "/tmp/finance";
-        devices = [ "chungus" "cream" "mobi" "bobi" ];
+        devices = [ "chungus" "cream" "mobi" "bobi" "cherry" ];
+        versioning = {
+          type = "simple";
+          params.keep = "10";
+        };
+      };
+      flix = {
+        enable = lib.mkDefault false;
+        path = lib.mkDefault "/tmp/flix";
+        devices = [ "chungus" "orbi" ];
+      };
+      logseq = {
+        enable = lib.mkDefault false;
+        path = lib.mkDefault "/tmp/logseq";
+        devices = [ "chungus" "cream" "cherry" "iPhone" "iPad" ];
+      };
+      lectures = {
+        enable = lib.mkDefault false;
+        path = lib.mkDefault "/tmp/lectures";
+        devices = [ "chungus" "orbi" ];
+      };
+      oscar_cpap = {
+        enable = lib.mkDefault false;
+        path = lib.mkDefault "/tmp/oscar_cpap";
+        devices = [ "chungus" "cream" "cherry" ];
+      };
+      password-store = {
+        enable = lib.mkDefault false;
+        path = lib.mkDefault "/tmp/password-store";
+        devices = [ "chungus" "cream" "mobi" "bobi" "cherry" ];
         versioning = {
           type = "simple";
           params.keep = "10";
         };
       };
       # todo remove if zfs is is used
-      nextcloud_backup = {
+      #nextcloud_backup = {
-        enable = lib.mkDefault false;
+      #  enable = lib.mkDefault false;
-        path = lib.mkDefault "/tmp/lost-fotos";
+      #  path = lib.mkDefault "/tmp/lost-fotos";
-        devices = [ "chungus" "robi" ];
+      #  devices = [ "chungus" "robi" ];
-        versioning = {
+      #  versioning = {
-          type = "simple";
+      #    type = "simple";
-          params.keep = "2";
+      #    params.keep = "2";
-        };
+      #  };
-      };
+      #};
     };
   };
 

nixos/components/network/tinc/private.nix

@@ -24,6 +24,7 @@ let
     "sonarr.orbi" = hosts.orbi;
     "radarr.orbi" = hosts.orbi;
     "prowlarr.orbi" = hosts.orbi;
+    "photoprism.orbi" = hosts.orbi;
     # robi
     "grafana.robi" = hosts.robi;
     "loki.robi" = hosts.robi;
@@ -49,23 +50,23 @@ let
     "minio.chungus" = hosts.chungus;
     "sync.chungus" = hosts.chungus;
     "tdarr.chungus" = hosts.chungus;
-    "trilium.chungus" = hosts.chungus;
     "tts.chungus" = hosts.chungus;
     "paperless.chungus" = hosts.chungus;
-    # cream
-    "trilium.cream" = hosts.cream;
   };
   network = "private";
 in
 {
   networking.firewall.trustedInterfaces = [ "tinc.${network}" ];
 
-  sops.secrets.tinc_ed25519_key = { };
+  clanCore.facts.services.tinc_private = {
+    secret."tinc_private.ed25519_key" = { };
+    generator.script = "";
+  };
 
   #  nix-shell -p tinc_pre --run "tinc --config . generate-keys 4096"
   services.tinc.networks = {
     ${network} = {
-      ed25519PrivateKeyFile = config.sops.secrets.tinc_ed25519_key.path;
+      ed25519PrivateKeyFile = config.clanCore.facts.services.tinc_private.secret."tinc_private.ed25519_key".path;
       interfaceType = "tap";
       extraConfig = ''
         LocalDiscovery = yes
@@ -129,55 +130,4 @@ in
 
   networking.extraHosts = concatStringsSep "\n" (mapAttrsToList (name: ip: "${ip} ${name}.${network}") (hosts // subDomains));
 
-  services.openssh.knownHosts = {
-    "orbi" = {
-      hostNames = [
-        "orbi.${network}"
-        hosts.orbi
-        "orbi"
-        "95.216.66.212"
-        "git.ingolf-wagner.de"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICTqV5ch4BokqDniDgCquRwfTz6aXXMTdZovIvqShfLV";
-    };
-    "robi" = {
-      hostNames = [
-        "robi.${network}"
-        hosts.robi
-        "robi"
-        "144.76.13.147"
-        "taskd.ingolf-wagner.de"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK2PGX6cZuBUGX4VweMzi0aRh4uQ61yngCzZGcK3w5XV";
-    };
-    "sterni.${network}" = {
-      hostNames = [ "sterni.${network}" hosts.sterni ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEQRH4gzT4vWSx3KN80ePPYhSPZRUae/qSyEym6pJTht";
-    };
-    "cream.${network}" = {
-      hostNames = [ "cream.${network}" hosts.cream ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIConHiCL7INgAhuN6Z9TqP0zP+xNpdV7+OHwUca4IRDD";
-    };
-    "cherry.${network}" = {
-      hostNames = [ "cherry.${network}" hosts.cream ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEUXkewyZ94A7CeCyVvN0KCqPn+8x1BZaGWMAojlfCXO";
-    };
-    "pepe.${network}" = {
-      hostNames = [ "pepe.${network}" hosts.pepe ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJPlva+Vdj8WmQPlbQLN3qicMz5AAsyTzK53BincxtAz";
-    };
-    "chungus.${network}" = {
-      hostNames = [ "chungus.${network}" hosts.chungus ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP9jrbOJbgapreRjttyOKWv5vxGMThn7kAwlk8WnSyL9";
-    };
-    "bobi.${network}" = {
-      hostNames = [ "bobi.${network}" hosts.bobi ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK0haepNVEaocfWh6kwVc4QsSg2iqO5k+hjarphBqMVk";
-    };
-    "mobi.${network}" = {
-      hostNames = [ "mobi.${network}" hosts.mobi ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE3G7TwCoxcVfwhGL0913RtacEeokqKtufhzzkCxpPxk";
-    };
-  };
-
 }

nixos/components/network/wifi.nix

@@ -14,14 +14,13 @@ with types;
 
     networking.networkmanager.enable = true;
     networking.networkmanager.wifi.powersave = lib.mkDefault true;
-    networking.networkmanager.extraConfig = ''
+
-      # The number of times a connection activation should be automatically tried
+    # The number of times a connection activation should be automatically tried
-      # before switching to another one. This value applies only to connections
+    # before switching to another one. This value applies only to connections
-      # that can auto-connect and have a connection. autoconnect-retries property set to -1.
+    # that can auto-connect and have a connection. autoconnect-retries property set to -1.
-      # If not specified, connections will be tried 4 times.
+    # If not specified, connections will be tried 4 times.
-      # Setting this value to 1 means to try activation once, without retry.
+    # Setting this value to 1 means to try activation once, without retry.
-      autoconnect-retries-default=999
+    networking.networkmanager.settings.main.autoconnect-retries-default = 999;
-    '';
 
 
     hardware.enableRedistributableFirmware = true;

nixos/components/network/wireguard.nix

@@ -11,5 +11,17 @@ with lib;
     };
   };
 
+  # todo: use networking.wireguard  instead of networking wg-quick
+  # with dynamicEndpointRefreshSeconds
+  #config = {
+  #  systemd.services.wg-quick-wg0.serviceConfig = {
+  #    Restart = "always";
+  #    RestartSec = 50;
+  #    Type = mkForce "simple";
+  #    RemainAfterExit = mkForce false;
+  #  };
+  #};
+
+
 }
 

nixos/components/nixos/upgrade-diff.nix

@@ -1,5 +1,5 @@
 # MIT Jörg Thalheim - https://github.com/Mic92/dotfiles/blob/c6cad4e57016945c4816c8ec6f0a94daaa0c3203/nixos/modules/upgrade-diff.nix
-{ config, lib, ... }:
+{ config, lib, pkgs, ... }:
 {
 
   options.components.nixos.update-diff.enable = lib.mkOption {
@@ -13,7 +13,7 @@
       text = ''
         if [[ -e /run/current-system ]]; then
           echo "--- diff to current-system"
-          ${config.nix.package}/bin/nix --extra-experimental-features nix-command store diff-closures /run/current-system "$systemConfig"
+          ${pkgs.nvd}/bin/nvd --nix-bin-dir=${config.nix.package}/bin diff /run/current-system "$systemConfig"
           echo "---"
         fi
       '';

nixos/components/yubikey.nix

@@ -14,14 +14,7 @@ with lib;
   config = mkIf config.components.yubikey.enable {
 
     services.pcscd.enable = true;
-    services.udev.packages = [
+    services.udev.packages = [ pkgs.yubikey-personalization ];
-
-      pkgs.yubikey-personalization
-
-      # additional services, but I just want gpg
-      # pkgs.libu2f-host
-
-    ];
 
     environment.systemPackages = [
 
@@ -43,6 +36,7 @@ with lib;
 
     ];
 
+
     ## managed by home-manager now
     #environment.shellInit = ''
     #  export GPG_TTY="$(tty)"

nixos/homes/common/default.nix

@@ -3,6 +3,7 @@
   imports = [
     ./packages.nix
     ./terminal.nix
+    ./zfs.nix
   ];
   options.gui.enable = lib.mkEnableOption "should GUI packages be anabled?";
 }

nixos/homes/common/packages.nix

@@ -11,6 +11,7 @@ with lib;
         ipcalc
 
         units
+        difftastic
 
         parallel
 

nixos/homes/common/terminal.nix

@@ -1,4 +1,4 @@
-{ lib, pkgs, ... }:
+{ lib, pkgs, assets, ... }:
 {
 
   programs.zsh = {
@@ -18,7 +18,7 @@
   # a better cat
   programs.bat = {
     enable = true;
-    config.theme = "gruvbox-light";
+    #config.theme = "gruvbox-light";
   };
 
   home.shellAliases.cat = "${pkgs.bat}/bin/bat --theme='gruvbox-light'";
@@ -36,12 +36,11 @@
     enable = true;
     enableBashIntegration = true;
     enableZshIntegration = true;
-    package = pkgs.unstable.atuin;
+    #package = pkgs.unstable.atuin;
-    # todo not needed anymore
+    package = pkgs.unstable.atuin.overrideAttrs (_old: {
-    #package = pkgs.unstable.atuin.overrideAttrs (_old: {
+      # as cursed as doing mitigations=off in the kernel command line
-    #  # as cursed as doing mitigations=off in the kernel command line
+      patches = [ "${assets}/0001-make-atuin-on-zfs-fast-again.patch" ];
-    #  patches = [ ./0001-make-atuin-on-zfs-fast-again.patch ];
+    });
-    #});
     settings = {
       auto_sync = true;
       sync_frequency = "5m";

nixos/homes/common/zfs.nix

@@ -0,0 +1,27 @@
+{ config, pkgs, lib, ... }:
+with pkgs;
+with lib;
+{
+  config = mkMerge [
+    {
+      home.packages = [
+        (
+          let
+            options = [
+              "name"
+              "mountpoint"
+              "compression"
+              "com.sun:auto-snapshot:yearly"
+              "com.sun:auto-snapshot:monthly"
+              "com.sun:auto-snapshot:daily"
+              "com.sun:auto-snapshot:hourly"
+            ];
+          in
+          pkgs.writers.writeBashBin "zfs-overview" ''
+            ${pkgs.zfs}/bin/zfs list -o ${concatStringsSep "," options} "$@"
+          ''
+        )
+      ];
+    }
+  ];
+}

nixos/homes/palo/default.nix

@@ -2,16 +2,16 @@
 
   imports = [
     ../common
-    ./doom-emacs.nix
+    ./editor.nix
     ./git.nix
     ./gpg.nix
+    #./hyperland.nix
     ./i3.nix
     ./packages
     ./ssh.nix
     ./stylix.nix
+    ./taskwarrior.nix
     ./tmux.nix
-    ./vim.nix
-    ./yubikey.nix
     ./zellij.nix
   ];
 

nixos/homes/palo/editor.nix

@@ -0,0 +1,11 @@
+{
+  programs.vim = {
+    enable = true;
+    defaultEditor = true;
+  };
+
+  programs.helix = {
+    enable = true;
+    # defaultEditor = true;
+  };
+}

nixos/homes/palo/git.nix

@@ -23,6 +23,7 @@ with pkgs;
   home.packages = [
     pre-commit
     gita
+    git-repo-updater
     tig
     lazygit
     git-crypt

nixos/homes/palo/gpg.nix

@@ -26,6 +26,6 @@
     # sshKeys = [];
     defaultCacheTtl = 30;
     defaultCacheTtlSsh = 30;
-
+    pinentryPackage = pkgs.pinentry-gtk2;
   };
 }

nixos/homes/palo/hyperland.nix

@@ -0,0 +1,161 @@
+{ pkgs, ... }:
+{
+
+  home.file.".config/hypr/hyperland.conf".text = ''
+    autogenerated = 1 # remove this line to remove the warning
+    # See https://wiki.hyprland.org/Configuring/Monitors/
+    monitor=,preferred,auto,auto
+
+    # Some default env vars.
+    env = XCURSOR_SIZE,24
+
+    # For all categories, see https://wiki.hyprland.org/Configuring/Variables/
+    input {
+        kb_layout = us
+        kb_variant =
+        kb_model =
+        kb_options =
+        kb_rules =
+
+        follow_mouse = 1
+
+        touchpad {
+            natural_scroll = no
+        }
+
+        sensitivity = 0 # -1.0 - 1.0, 0 means no modification.
+    }
+
+    general {
+        # See https://wiki.hyprland.org/Configuring/Variables/ for more
+
+        gaps_in = 5
+        gaps_out = 20
+        border_size = 2
+        col.active_border = rgba(33ccffee) rgba(00ff99ee) 45deg
+        col.inactive_border = rgba(595959aa)
+
+        layout = dwindle
+
+        # Please see https://wiki.hyprland.org/Configuring/Tearing/ before you turn this on
+        allow_tearing = false
+    }
+
+    decoration {
+        # See https://wiki.hyprland.org/Configuring/Variables/ for more
+
+        rounding = 10
+
+        blur {
+            enabled = true
+            size = 3
+            passes = 1
+        }
+
+        drop_shadow = yes
+        shadow_range = 4
+        shadow_render_power = 3
+        col.shadow = rgba(1a1a1aee)
+    }
+
+    animations {
+        enabled = yes
+
+        # Some default animations, see https://wiki.hyprland.org/Configuring/Animations/ for more
+
+        bezier = myBezier, 0.05, 0.9, 0.1, 1.05
+
+        animation = windows, 1, 7, myBezier
+        animation = windowsOut, 1, 7, default, popin 80%
+        animation = border, 1, 10, default
+        animation = borderangle, 1, 8, default
+        animation = fade, 1, 7, default
+        animation = workspaces, 1, 6, default
+    }
+
+    dwindle {
+        # See https://wiki.hyprland.org/Configuring/Dwindle-Layout/ for more
+        pseudotile = yes # master switch for pseudotiling. Enabling is bound to mainMod + P in the keybinds section below
+        preserve_split = yes # you probably want this
+    }
+
+    master {
+        # See https://wiki.hyprland.org/Configuring/Master-Layout/ for more
+        new_is_master = true
+    }
+
+    gestures {
+        # See https://wiki.hyprland.org/Configuring/Variables/ for more
+        workspace_swipe = off
+    }
+
+    misc {
+        # See https://wiki.hyprland.org/Configuring/Variables/ for more
+        force_default_wallpaper = -1 # Set to 0 to disable the anime mascot wallpapers
+    }
+
+    # Example per-device config
+    # See https://wiki.hyprland.org/Configuring/Keywords/#executing for more
+    device:epic-mouse-v1 {
+        sensitivity = -0.5
+    }
+
+    # See https://wiki.hyprland.org/Configuring/Keywords/ for more
+    $mainMod = SUPER
+
+    # Example binds, see https://wiki.hyprland.org/Configuring/Binds/ for more
+    bind = $mainMod, enter, exec, alacritty
+    bind = $mainMod, C, killactive,
+    bind = $mainMod, Q, exit,
+    bind = $mainMod, E, exec, dolphin
+    bind = $mainMod, V, togglefloating,
+    bind = $mainMod, R, exec, wofi --show drun
+    bind = $mainMod, P, pseudo, # dwindle
+    bind = $mainMod, J, togglesplit, # dwindle
+
+    # Move focus with mainMod + arrow keys
+    bind = $mainMod, left, movefocus, l
+    bind = $mainMod, right, movefocus, r
+    bind = $mainMod, up, movefocus, u
+    bind = $mainMod, down, movefocus, d
+
+    # Switch workspaces with mainMod + [0-9]
+    bind = $mainMod, 1, workspace, 1
+    bind = $mainMod, 2, workspace, 2
+    bind = $mainMod, 3, workspace, 3
+    bind = $mainMod, 4, workspace, 4
+    bind = $mainMod, 5, workspace, 5
+    bind = $mainMod, 6, workspace, 6
+    bind = $mainMod, 7, workspace, 7
+    bind = $mainMod, 8, workspace, 8
+    bind = $mainMod, 9, workspace, 9
+    bind = $mainMod, 0, workspace, 10
+
+    # Move active window to a workspace with mainMod + SHIFT + [0-9]
+    bind = $mainMod SHIFT, 1, movetoworkspace, 1
+    bind = $mainMod SHIFT, 2, movetoworkspace, 2
+    bind = $mainMod SHIFT, 3, movetoworkspace, 3
+    bind = $mainMod SHIFT, 4, movetoworkspace, 4
+    bind = $mainMod SHIFT, 5, movetoworkspace, 5
+    bind = $mainMod SHIFT, 6, movetoworkspace, 6
+    bind = $mainMod SHIFT, 7, movetoworkspace, 7
+    bind = $mainMod SHIFT, 8, movetoworkspace, 8
+    bind = $mainMod SHIFT, 9, movetoworkspace, 9
+    bind = $mainMod SHIFT, 0, movetoworkspace, 10
+
+    # Example special workspace (scratchpad)
+    bind = $mainMod, S, togglespecialworkspace, magic
+    bind = $mainMod SHIFT, S, movetoworkspace, special:magic
+
+    # Scroll through existing workspaces with mainMod + scroll
+    bind = $mainMod, mouse_down, workspace, e+1
+    bind = $mainMod, mouse_up, workspace, e-1
+
+    # Move/resize windows with mainMod + LMB/RMB and dragging
+    bindm = $mainMod, mouse:272, movewindow
+    bindm = $mainMod, mouse:273, resizewindow
+
+  '';
+
+}
+

nixos/homes/palo/i3.nix

@@ -3,6 +3,8 @@ let
 
   cfg = config.xsession.windowManager.i3;
 
+  rofi = pkgs.rofi.override { plugins = [ pkgs.rofi-emoji pkgs.rofi-calc pkgs.xdotool ]; };
+
   backgroundCommand = pkgs.writers.writeDash "background" ''
     ${pkgs.xorg.xrandr}/bin/xrandr | grep " connected" | grep "primary" | \
       ${pkgs.gnused}/bin/sed -E "s/primary //" | \
@@ -37,6 +39,7 @@ in
         fixXhost
         pkgs.autorandr
         pkgs.polygon-art.polygon-art
+        pkgs.xdotool # needed for rofi-emoji
       ];
 
 
@@ -154,7 +157,8 @@ in
             };
           startup =
             [
-              { command = "${pkgs.albert}/bin/albert"; always = true; }
+              { command = "${pkgs.jellyfin-mpv-shim}/bin/jellyfin-mpv-shim"; always = false; }
+              { command = "${pkgs.networkmanagerapplet}/bin/nm-applet --indicator"; always = true; }
               { command = toString backgroundCommand; always = true; }
               {
                 command = toString (pkgs.writers.writeDash "xsettings" ''
@@ -258,7 +262,7 @@ in
                   set -o pipefail
                   ${pkgs.i3}/bin/i3-msg -t get_workspaces | \
                   ${pkgs.jq}/bin/jq --raw-output '.[] | .name' | \
-                  ${pkgs.rofi}/bin/rofi -dmenu -p 'Select Workspace' | \
+                  ${rofi}/bin/rofi -dmenu -p 'Select Workspace  ' | \
                   while read line
                   do
                     ${pkgs.i3}/bin/i3-msg workspace "$line"
@@ -274,7 +278,7 @@ in
                   set -o pipefail
                   ${pkgs.i3}/bin/i3-msg -t get_workspaces | \
                   ${pkgs.jq}/bin/jq --raw-output '.[] | .name' | \
-                  ${pkgs.rofi}/bin/rofi -dmenu -p 'Move to Workspace' | \
+                  ${rofi}/bin/rofi -dmenu -p 'Move to Workspace  ' | \
                   while read line
                   do
                     ${pkgs.i3}/bin/i3-msg move container to workspace "$line"
@@ -283,6 +287,7 @@ in
               in
               "exec ${script}";
 
+            "${cfg.config.modifier}+space" = "exec ${rofi}/bin/rofi -show drun -display-drun ''";
             "${cfg.config.modifier}+Shift+c" = "reload";
             "${cfg.config.modifier}+Shift+r" = "restart";
             "${cfg.config.modifier}+Shift+e" = "exec i3-nagbar -t warning -m 'Do you want to exit i3?' -b 'Yes' 'i3-msg exit'";
@@ -476,6 +481,19 @@ in
       };
     };
 
+    # rofi > albert
+    programs.rofi = {
+      enable = true;
+      cycle = true;
+      package = rofi;
+      # pass.enable = true;
+      extraConfig = {
+        modi = "drun,calc,emoji,combi";
+        show-icons = true;
+        terminal = "alacritty";
+      };
+    };
+
     xdg.configFile."albert/albert.conf".text = ''
       [General]
       hotkey=Meta+Space

nixos/homes/palo/packages/development.nix

@@ -40,6 +40,14 @@ with lib;
 
         mermaid-cli
 
+        # terminal code to image/movie renderer
+        vhs
+        carbon-now-cli
+        asciinema
+        asciinema-scenario
+        asciinema
+
+        marp-cli # markdown to presentation framework
       ];
     })
     {
@@ -76,6 +84,7 @@ with lib;
           gojq
           jq
           ijq
+          miller
 
           # nomad
           unstable.nomad

nixos/homes/palo/packages/graphics.nix

@@ -16,12 +16,15 @@ with lib;
       blender
       lightburn
       darktable
+      colorpicker
 
       # CAD & 3D Plotting
       openscad
       freecad
       cura
 
+      qrencode
+
     ];
 
   };

nixos/homes/palo/packages/logseq.nix

@@ -4,15 +4,15 @@ with lib;
 {
   config = mkIf config.gui.enable {
     home.packages = [
-      unstable.logseq
+      logseq
     ];
-    home.file.".config/Logseq/Preferences".source = (pkgs.formats.json { }).generate "LogseqPreferences.json"
+    #home.file.".config/Logseq/Preferences".source = (pkgs.formats.json { }).generate "LogseqPreferences.json"
-      {
+    #  {
-        spellcheck = {
+    #    spellcheck = {
-          dictionaries = [ "en-US" "de-DE" ];
+    #      dictionaries = [ "en-US" "de-DE" ];
-          dictionary = "";
+    #      dictionary = "";
-        };
+    #    };
-      };
+    #  };
   };
 
 }

nixos/homes/palo/packages/nextcloud.nix

@@ -46,10 +46,6 @@ in
 
       borrow
 
-      (pkgs.writeShellScriptBin "nixFlakes" ''
-        exec ${pkgs.nixUnstable}/bin/nix --experimental-features "nix-command flakes" "$@"
-      '')
-
       nextcloud-client
 
     ];

nixos/homes/palo/packages/packages.nix

@@ -40,12 +40,15 @@ with lib;
       bitwarden
       rbw
 
-      unstable.trilium-desktop # old (use logseq now)
-
       nginx-config-formatter
 
       unstable.yt-dlp
 
+      OSCAR
+
+      # office
+      pdfarranger
+
     ];
 
   };

nixos/homes/palo/packages/social.nix

@@ -6,40 +6,9 @@ with lib;
   config = mkIf config.gui.enable {
     programs.obs-studio.enable = true;
     home.packages = [
-
-      #(pkgs.makeDesktopItem {
-      #  name = "streamdeck-ui";
-      #  desktopName = "Streamdeck";
-      #  exec = "${streamdeck-ui}/bin/streamdeck-ui";
-      #  terminal = false;
-      #})
-      streamdeck-ui
-
       emoji-picker
-
       signal-desktop
-
+      legacy_2311.fluffychat
-      # matrix clients
-      # --------------
-      #element-desktop
-      #fractal
-      #legacy_2205.mirage-im
-      #cinny-desktop
-      fluffychat
-      #(fluffychat.overrideAttrs
-      #  (old: rec {
-      #    version = "1.13.0";
-      #    src = fetchFromGitHub {
-      #      owner = "krille-chan";
-      #      repo = "fluffychat";
-      #      rev = "v${version}";
-      #      hash = "sha256-w29Nxs/d0b18jMvWnrRUjEGqY4jGtuEGodg+ncCAaVc=";
-      #    };
-      #    vendorHash = "";
-      #  })
-      #)
-
-
     ];
 
   };

nixos/homes/palo/ssh.nix

@@ -21,6 +21,9 @@
     "*.private" = {
       user = "root";
     };
+    "*.gummybear" = {
+      user = "root";
+    };
     "*.lan" = {
       user = "root";
     };

nixos/homes/palo/taskwarrior.nix

@@ -0,0 +1,97 @@
+{ config, pkgs, lib, ... }:
+with lib;
+with types;
+let
+  mkMagicMergeOption = { description ? "", example ? { }, default ? { }, apply ? id, ... }:
+    mkOption {
+      inherit example description default apply;
+      type = with lib.types;
+        let
+          valueType = nullOr
+            (oneOf [
+              bool
+              int
+              float
+              str
+              (attrsOf valueType)
+              (listOf valueType)
+            ]) // {
+            description = "bool, int, float or str";
+            emptyValue.value = { };
+          };
+        in
+        valueType;
+    };
+
+
+  taskwarrior-tui = pkgs.legacy_2311.taskwarrior-tui;
+
+in
+
+{
+
+  # bugwarrior (a bit fiddly)
+  imports = [{
+    options.bugwarrior.config = mkMagicMergeOption {
+      type = attrs;
+      default = { };
+    };
+
+    config = {
+      home.file.".config/bugwarrior/bugwarrior.toml".source = (pkgs.formats.toml { }).generate "bugwarriorrc.toml" config.bugwarrior.config;
+      # todo : before deleting this, put it in logseq
+
+      home.packages = [
+        (pkgs.python3Packages.bugwarrior.overrideAttrs (old: {
+          version = "develop";
+          src = pkgs.fetchFromGitHub {
+            owner = "ralphbean";
+            repo = "bugwarrior";
+            rev = "eb19a702a698f9c8c3ce2a1fe41f35872d9ae398";
+            sha256 = "sha256-Geon+ddE58WJ10L4unotzvmZj1Ye0yjZHVQgrR2YWgE=";
+          };
+          propagatedBuildInputs = old.propagatedBuildInputs ++ [
+            pkgs.python3Packages.pydantic
+            pkgs.python3Packages.tomli
+            pkgs.python3Packages.email-validator
+            pkgs.python3Packages.packaging
+          ];
+        }))
+      ];
+
+    };
+
+  }];
+
+  home.packages = with pkgs;
+    [
+
+      taskwarrior
+      taskwarrior-tui
+
+      timewarrior
+      tasksh
+      taskwarrior-hooks
+      (pkgs.writeShellScriptBin "tsak" ''${pkgs.taskwarrior}/bin/task "$@"'')
+
+      unstable.vit
+      (pkgs.writers.writeBashBin "active" "${taskwarrior-tui}/bin/taskwarrior-tui -r active")
+      (pkgs.writers.writeBashBin "todo" "${taskwarrior-tui}/bin/taskwarrior-tui -r todo")
+
+      (pkgs.writers.writeBashBin "calendar" ''
+        ${pkgs.taskwarrior}/bin/task calendar
+        ${pkgs.taskwarrior}/bin/task calendar_report
+      '')
+
+      # todo : belongs to calendar.nix
+      vdirsyncer
+      khal
+      (pkgs.writers.writeBashBin "kalendar" ''
+        ${pkgs.vdirsyncer}/bin/vdirsyncer sync
+        ${pkgs.khal}/bin/ikhal
+      '')
+
+    ];
+
+
+}

nixos/homes/palo/vim.nix

@@ -1,6 +0,0 @@
-{
-  programs.vim = {
-    enable = true;
-    defaultEditor = true;
-  };
-}

nixos/homes/palo/yubikey.nix

@@ -1,4 +0,0 @@
-{ pkgs, osConfig, ... }:
-{
-  pam.yubico.authorizedYubiKeys.path = toString osConfig.sops.secrets.yubikey_u2fAuthFile.path;
-}

nixos/homes/root/default.nix

@@ -1,8 +1,9 @@
 {
   imports = [
     ../common
-    ../palo/doom-emacs.nix
   ];
   gui.enable = false;
 
+  home.stateVersion = "22.11";
+
 }

nixos/homes/tina/default.nix

@@ -1 +1,12 @@
+{ pkgs, ... }:
+{
+  imports = [
+    ../common
+    ./stylix.nix
+    ./logseq.nix
+    ./packages.nix
+    ./kde.nix
+  ];
 
+  home.stateVersion = "22.11";
+}

nixos/homes/tina/kde.nix

@@ -0,0 +1,3 @@
+{
+  stylix.targets.kde.enable = true;
+}

nixos/homes/tina/logseq.nix

@@ -0,0 +1,18 @@
+{ config, lib, pkgs, ... }:
+with pkgs;
+with lib;
+{
+  config = mkIf config.gui.enable {
+    home.packages = [
+      logseq
+    ];
+    home.file.".config/Logseq/Preferences".source = (pkgs.formats.json { }).generate "LogseqPreferences.json"
+      {
+        spellcheck = {
+          dictionaries = [ "en-US" "de-DE" ];
+          dictionary = "";
+        };
+      };
+  };
+
+}

nixos/homes/tina/packages.nix

@@ -0,0 +1,34 @@
+{ config, lib, pkgs, ... }:
+with pkgs;
+with lib;
+{
+
+  config = mkIf config.gui.enable {
+
+    home.packages = [
+
+      tor-browser-bundle-bin
+      #(tor-browser-bundle-bin.overrideAttrs (old: rec {
+      #  version = "11.0.1";
+      #  name = "tor-browser-bundle-${version}";
+      #  src = pkgs.fetchurl {
+      #    url = "https://dist.torproject.org/torbrowser/11.0.1/tor-browser-linux64-11.0.1_en-US.tar.xz";
+      #    sha256 = "1ah69jmfgik063f9gkvyv9d4k706pqihmzc4k7cc95zyd17v8wrs";
+      #  };
+      #}))
+
+      bitwarden
+
+      unstable.yt-dlp
+
+      # office
+      pdfarranger
+      calibre
+
+
+    ];
+
+
+
+  };
+}

nixos/homes/tina/stylix.nix

@@ -0,0 +1,28 @@
+{ pkgs, config, ... }:
+{
+
+  stylix.targets.swaylock.enable = config.gui.enable;
+
+  stylix.base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-light-medium.yaml";
+
+
+  stylix.fonts = {
+    serif = {
+      package = pkgs.ubuntu_font_family;
+      name = "Ubuntu";
+    };
+    sansSerif = {
+      package = pkgs.ubuntu_font_family;
+      name = "Ubuntu";
+    };
+    monospace = {
+      package = pkgs.jetbrains-mono;
+      name = "JetBrains Mono";
+    };
+    emoji = {
+      package = pkgs.noto-fonts-emoji;
+      name = "Noto Color Emoji";
+    };
+  };
+
+}

nixos/legacy/media-tdarr.nix

@@ -31,8 +31,8 @@
     };
   };
 
-  networking.firewall.interfaces.wq0.allowedTCPPorts = [ 8266 ];
+  networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8266 ];
-  networking.firewall.interfaces.wq0.allowedUDPPorts = [ 8266 ];
+  networking.firewall.interfaces.wg0.allowedUDPPorts = [ 8266 ];
 
   networking.firewall.interfaces.enp0s31f6.allowedTCPPorts = [ 8266 ];
   networking.firewall.interfaces.enp0s31f6.allowedUDPPorts = [ 8266 ];

nixos/legacy/media-unmanic.nix

@@ -20,8 +20,8 @@
     };
   };
 
-  #networking.firewall.interfaces.wq0.allowedTCPPorts = [ 8266 ];
+  #networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8266 ];
-  #networking.firewall.interfaces.wq0.allowedUDPPorts = [ 8266 ];
+  #networking.firewall.interfaces.wg0.allowedUDPPorts = [ 8266 ];
 
   #networking.firewall.interfaces.enp0s31f6.allowedTCPPorts = [ 8266 ];
   #networking.firewall.interfaces.enp0s31f6.allowedUDPPorts = [ 8266 ];

nixos/legacy/robi/media-tdarr.nix

@@ -34,8 +34,8 @@
     };
   };
 
-  #networking.firewall.interfaces.wq0.allowedTCPPorts = [ 8266 ];
+  #networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8266 ];
-  #networking.firewall.interfaces.wq0.allowedUDPPorts = [ 8266 ];
+  #networking.firewall.interfaces.wg0.allowedUDPPorts = [ 8266 ];
 
   #networking.firewall.interfaces.enp0s31f6.allowedTCPPorts = [ 8266 ];
   #networking.firewall.interfaces.enp0s31f6.allowedUDPPorts = [ 8266 ];

nixos/legacy/robi/nextcloud.nix

@@ -253,7 +253,7 @@ in
           trustedProxies = [ "144.76.13.147" hostAddress ];
           dbtype = "mysql";
           dbpassFile = "/run/secrets/nextcloud_database_password";
-          dbport = 3306;
+          dbhost = "localhost:3306";
           defaultPhoneRegion = "DE";
         };
       };