🚧 bugwarrior with taskwarrior3

.forgejo/workflows/nix_build.yaml

@@ -48,8 +48,8 @@ jobs:
           rm .ssh_key
       - name: nix build orbi
         run: nix build .#nixosConfigurations.orbi.config.system.build.toplevel
-        #      - name: nix build cream
+      - name: nix build cream
-        #        run: nix build .#nixosConfigurations.cream.config.system.build.toplevel
+        run: nix build .#nixosConfigurations.cream.config.system.build.toplevel
       - name: nix build cherry
         run: nix build .#nixosConfigurations.cherry.config.system.build.toplevel
       - name: nix build chungus

components/chaospott.nix

@@ -13,7 +13,7 @@ with lib;
   };
 
   config = mkIf (config.components.chaospott.enable && config.components.gui.audio.enable) {
-    services.pulseaudio.zeroconf.discovery.enable = true;
+    hardware.pulseaudio.zeroconf.discovery.enable = true;
     environment.systemPackages = with pkgs; [
       paprefs
     ];

components/default.nix

@@ -5,6 +5,7 @@
     ./gui
     ./mainUser.nix
     ./media
+    ./monitor
     ./network
     ./nixos
     ./terminal

components/gui/audio.nix

@@ -12,54 +12,46 @@ with lib;
     default = config.components.gui.enable;
   };
 
-  config = mkMerge [
+  config = mkIf (config.components.gui.audio.enable) {
-    (mkIf (config.components.gui.audio.enable) {
 
-      security.rtkit.enable = true;
+    security.rtkit.enable = true;
-      hardware.bluetooth = {
-        enable = true;
-        powerOnBoot = true;
-      };
 
-      environment.systemPackages = with pkgs; [
+    hardware.pulseaudio.enable = false;
-        alsa-utils
 
-        # PulseAudio control
+    hardware.bluetooth = {
-        # ------------------
+      enable = true;
-        ponymix
+      powerOnBoot = true;
-        pavucontrol
+    };
-        lxqt.pavucontrol-qt
-      ];
 
-      services.pipewire = {
+    environment.systemPackages = with pkgs; [
-        #enable = true;
+      alsa-utils
-        systemWide = true;
+      alsaUtils
-        alsa.enable = true;
-        alsa.support32Bit = true;
-        pulse.enable = true;
-        jack.enable = true;
-      };
 
-      environment.etc = {
+      # PulseAudio control
-        "wireplumber/bluetooth.lua.d/51-bluez-config.lua".text = ''
+      # ------------------
-          bluez_monitor.properties = {
+      ponymix
-            ["bluez5.enable-sbc-xq"] = true,
+      pavucontrol
-            ["bluez5.enable-msbc"] = true,
+      lxqt.pavucontrol-qt
-            ["bluez5.enable-hw-volume"] = true,
+    ];
-            ["bluez5.headset-roles"] = "[ hsp_hs hsp_ag hfp_hf hfp_ag ]"
-          }
-        '';
-      };
-    })
 
-    {
+    services.pipewire = {
+      enable = true;
+      systemWide = true;
+      alsa.enable = true;
+      alsa.support32Bit = true;
+      pulse.enable = true;
+      jack.enable = true;
+    };
 
-      # this is always true
+    environment.etc = {
-      # seems other options enable this one
+      "wireplumber/bluetooth.lua.d/51-bluez-config.lua".text = ''
-      services.pipewire.enable = config.components.gui.audio.enable;
+        bluez_monitor.properties = {
-      services.pulseaudio.enable = false;
+          ["bluez5.enable-sbc-xq"] = true,
-
+          ["bluez5.enable-msbc"] = true,
-    }
+          ["bluez5.enable-hw-volume"] = true,
-
+          ["bluez5.headset-roles"] = "[ hsp_hs hsp_ag hfp_hf hfp_ag ]"
-  ];
+        }
+      '';
+    };
+  };
 }

components/gui/browser.nix

@@ -8,14 +8,11 @@ in
 
     programs.chromium.extensions = [
       "nngceckbapebfimnlniiiahkandclblb" # bitwarden
-      # "edibdbjcniadpccecjdfdjjppcpchdlm" # I still don't care about cookies
+      "edibdbjcniadpccecjdfdjjppcpchdlm" # I still don't care about cookies
       "gcbommkclmclpchllfjekcdonpmejbdp" # https everywhere
       "cjpalhdlnbpafiamejdnhcphjbkeiagm" # ublock origin
       "dbepggeogbaibhgnhhndojpepiihcmeb" # vimium
       "jinjaccalgkegednnccohejagnlnfdag" # Violentmonkey
-      # "dpplabbmogkhghncfbfdeeokoefdjegm" # Proxy SwitchySharp
-      # "mooikfkahbdckldjjndioackbalphokd" # Selenium IDE
-      # "hnkcfpcejkafcihlgbojoidoihckciin" # Referer Control
     ];
 
     # overwrite use zram on small RAM systems

components/gui/default.nix

@@ -16,9 +16,8 @@ with lib;
     ./browser.nix
     ./cups.nix
     ./home-manager
-    ./kde.nix
     ./kmonad.nix
-    ./noti.nix # todo: make this different (use password store and such)
+    #./noti.nix # todo: make this different (use password store and such)
     ./pass.nix
     ./steam.nix
     ./suspend.nix

components/gui/kde.nix

@@ -1,19 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-{
-
-  options.components.gui.kde.enable = lib.mkOption {
-    type = lib.types.bool;
-    default = config.components.gui.enable;
-  };
-
-  config = lib.mkIf (config.components.gui.kde.enable) {
-
-    services.desktopManager.plasma6.enable = true;
-
-  };
-}

components/gui/noti.nix

@@ -16,41 +16,29 @@ with lib;
   # todo : put this in `/homes`
   config = mkIf (config.components.gui.noti.enable) {
 
-    clan.core.facts.services.noti = {
+    sops.secrets.pushover_user_key = { };
-      secret."noti.yaml" = { };
+    sops.secrets.pushover_api_key = { };
-      generator = {
+    sops.templates."noti.yaml".owner = config.users.users.mainUser.name;
-        prompt = "noti.yaml";
+    sops.templates."noti.yaml".group = config.users.users.mainUser.group;
-        path = with pkgs; [ coreutils ];
+    sops.templates."noti.yaml".content = ''
-        script = ''
+      pushover:
-          echo "$prompt_value" > "$secrets"/noti.yaml
+        userKey: ${config.sops.placeholder.pushover_user_key}
-        '';
+        apiToken: ${config.sops.placeholder.pushover_api_key}
-      };
+    '';
-    };
-
-    systemd.tmpfiles.settings.noti = {
-      # don't like to use a non tmpfs here, but does not work another way
-      "${config.users.users.mainUser.home}/.config/noti/noti.yaml"."C+" = {
-        user = config.users.users.mainUser.name;
-        group = config.users.users.mainUser.group;
-        mode = "400";
-        argument = config.clan.core.facts.services.noti.secret."noti.yaml".path;
-      };
-    };
-
-    #    sops.secrets.pushover_user_key = { };
-    #    sops.secrets.pushover_api_key = { };
-    #    sops.templates."noti.yaml".owner = config.users.users.mainUser.name;
-    #    sops.templates."noti.yaml".group = config.users.users.mainUser.group;
-    #    sops.templates."noti.yaml".content = ''
-    #      pushover:
-    #        userKey: ${config.sops.placeholder.pushover_user_key}
-    #        apiToken: ${config.sops.placeholder.pushover_api_key}
-    #    '';
 
     home-manager.users.mainUser = {
-      programs.noti.enable = true;
+      home.packages = [
-      #      xdg.configFile."noti/noti.yaml".target = "/run/facts/mainUser.noti.yaml";
+        (pkgs.writers.writeBashBin "noti" ''
-    };
+          ${pkgs.noti}/bin/noti --file ${config.sops.templates."noti.yaml".path} "$@"
+        '')
+        (pkgs.writers.writeBashBin "noti-pushover" ''
+          ${pkgs.noti}/bin/noti --pushover --file ${config.sops.templates."noti.yaml".path} "$@"
+        '')
+      ];
 
+      ## not working :(
+      #programs.noti.enable = true;
+      #xdg.configFile."noti/noti.yaml".source = toString config.sops.templates."noti.yaml".path;
+    };
   };
 }

components/gui/steam.nix

@@ -18,6 +18,8 @@ with lib;
         /var/run/wrappers/bin/sudo -u steam -i ${pkgs.steam}/bin/steam $@
       '')
       pkgs.xorg.xhost
+      # to use xbox controllers
+      pkgs.xboxdrv
     ];
 
     users.users.steam = {

components/gui/xorg/default.nix

@@ -14,85 +14,72 @@ with lib;
     default = config.components.gui.enable;
   };
 
-  options.components.gui.xorg.lightdm.enable = mkOption {
+  config = mkIf (config.components.gui.xorg.enable && config.components.gui.enable) {
-    type = lib.types.bool;
-    default = config.components.gui.xorg.enable;
-  };
 
-  options.components.gui.xorg.sddm.enable = mkOption {
+    # system.custom.fonts.enable = true;
-    type = lib.types.bool;
+    services.displayManager = {
-    default = !config.components.gui.xorg.lightdm.enable;
+      defaultSession = lib.mkDefault "none+i3";
-  };
+      autoLogin.enable = lib.mkDefault true;
+      autoLogin.user = config.users.users.mainUser.name;
+    };
 
-  config = mkMerge [
+    services.xserver = {
 
-    (mkIf (config.components.gui.xorg.lightdm.enable && config.components.gui.xorg.enable) {
+      enable = true;
 
-      services.displayManager = {
+      displayManager = {
-        defaultSession = "none+i3";
+        lightdm.enable = lib.mkDefault true;
-        autoLogin.enable = lib.mkDefault true;
-        autoLogin.user = config.users.users.mainUser.name;
       };
 
-      services.xserver.displayManager.lightdm.enable = true;
+      desktopManager.xterm.enable = false;
+      windowManager.i3.enable = true;
 
-    })
+      # mouse/touchpad
+      # --------------
 
-    (mkIf (config.components.gui.xorg.sddm.enable && config.components.gui.xorg.enable) {
+    };
 
-      services.xserver.displayManager.sddm.enable = true;
+    services.libinput = {
-
+      enable = true;
-    })
+      touchpad = {
-
+        disableWhileTyping = true;
-    (mkIf (config.components.gui.xorg.enable && config.components.gui.enable) {
+        tapping = true;
-
+        scrollMethod = "twofinger";
-      services.xserver.enable = true;
+        accelSpeed = "1.3";
-
+        naturalScrolling = true;
-      services.xserver.windowManager.i3.enable = true;
+        horizontalScrolling = true;
-
-      services.libinput = {
-        enable = true;
-        touchpad = {
-          disableWhileTyping = true;
-          tapping = true;
-          scrollMethod = "twofinger";
-          accelSpeed = "1.3";
-          naturalScrolling = true;
-          horizontalScrolling = true;
-        };
       };
+    };
 
-      # Packages
+    # Packages
-      # --------
+    # --------
-      environment.systemPackages = with pkgs; [
+    environment.systemPackages = with pkgs; [
 
-        xclip
+      xclip
-        #xtrlock-pam
+      xtrlock-pam
-        xorg.xev
+      xorg.xev
 
-        dmenu
+      dmenu
-        arandr
+      arandr
-        xcalib
+      xcalib
-        flameshot
+      flameshot
-        feh
+      feh
 
-      ];
+    ];
 
-      # Xresources config
+    # Xresources config
-      # -----------------
+    # -----------------
-      # spread the Xresource config
+    # spread the Xresource config
-      # across different files
+    # across different files
-      # just add a file into `/etc/X11/Xresource.d/` and it will be
+    # just add a file into `/etc/X11/Xresource.d/` and it will be
-      # evaluated.
+    # evaluated.
-      services.xserver.displayManager.sessionCommands = ''
+    services.xserver.displayManager.sessionCommands = ''
-        for file in `ls /etc/X11/Xresource.d/`
+      for file in `ls /etc/X11/Xresource.d/`
-        do
+      do
-          ${pkgs.xorg.xrdb}/bin/xrdb -merge /etc/X11/Xresource.d/$file
+        ${pkgs.xorg.xrdb}/bin/xrdb -merge /etc/X11/Xresource.d/$file
-        done
+      done
-      '';
+    '';
-      environment.etc."/X11/Xresource.d/.keep".text = "";
+    environment.etc."/X11/Xresource.d/.keep".text = "";
 
-    })
+  };
-
-  ];
 }

components/mainUser.nix

@@ -73,20 +73,16 @@ in
         uid = cfg.uid;
         home = "/home/${cfg.userName}";
         initialPassword = cfg.userName;
-        extraGroups =
+        extraGroups = [
-          [
+          "wheel"
-            "wheel"
+          "networkmanager"
-            "networkmanager"
+          "transmission"
-            "transmission"
+          "wireshark"
-            "wireshark"
+          "audio"
-            "audio"
+          "pipewire"
-            "pipewire"
+          "input"
-            "input"
+          "dialout"
-            "dialout"
+        ] ++ dockerGroup ++ vboxGroup ++ cfg.extraGroups;
-          ]
-          ++ dockerGroup
-          ++ vboxGroup
-          ++ cfg.extraGroups;
         openssh.authorizedKeys.keyFiles = cfg.authorizedKeyFiles;
         group = config.users.groups.mainUser.name;
       };

components/media/video.nix

@@ -136,7 +136,7 @@ in
     home-manager.sharedModules = [
       {
         programs.obs-studio = {
-          enable = false;
+          enable = true;
           plugins = with pkgs.obs-studio-plugins; [
             obs-backgroundremoval
             obs-vaapi
@@ -161,17 +161,17 @@ in
       # obs studio stuff
       obs-cli
       v4l-utils
-      #obs-cmd
+      obs-cmd
 
       # to record your screen
       # ---------------------
-      #simplescreenrecorder
+      simplescreenrecorder
       screenKey
       #obs-studio
 
       # to transcode video material
       # ---------------------------
-      #      handbrake
+      handbrake
       ffmpeg-full
 
     ];

components/monitor/container.nix

@@ -0,0 +1,18 @@
+{ lib, config, ... }:
+with lib;
+with types;
+{
+  imports = [
+    ./default.nix
+    ../timezone.nix
+  ];
+
+  config = {
+    components.monitor.enable = mkDefault true;
+    components.monitor.metrics.enable = mkDefault false;
+    components.monitor.opentelemetry.enable = false;
+
+    services.journald.extraConfig = "SystemMaxUse=1G";
+  };
+
+}

components/monitor/default.nix

@@ -0,0 +1,32 @@
+{ lib, config, ... }:
+with lib;
+with types;
+{
+
+  options.components.monitor = {
+    enable = mkOption {
+      type = bool;
+      default = true;
+    };
+    metrics.enable = mkOption {
+      type = bool;
+      default = config.components.monitor.enable;
+    };
+    logs.enable = mkOption {
+      type = bool;
+      default = config.components.monitor.enable;
+    };
+  };
+
+  imports = [
+    ./logs-promtail.nix
+    ./metrics-export-zfs.nix
+    ./metrics-netdata.nix
+    ./metrics-prometheus.nix
+    ./metrics-telegraf.nix
+    ./opentelemetry.nix
+  ];
+
+  config = mkIf config.components.monitor.enable { };
+
+}

components/monitor/logs-promtail.nix

@@ -0,0 +1,185 @@
+{ config, lib, ... }:
+with lib;
+with types;
+let
+  cfg = config.components.monitor.promtail;
+in
+{
+  options.components.monitor.promtail = {
+    enable = mkOption {
+      type = lib.types.bool;
+      default = config.components.monitor.logs.enable;
+    };
+    port = mkOption {
+      type = int;
+      default = 3500;
+      description = "port to provide promtail export";
+    };
+  };
+
+  config = mkMerge [
+
+    (mkIf config.components.monitor.opentelemetry.enable {
+      services.opentelemetry-collector.settings = {
+        receivers.loki = {
+          protocols.http.endpoint = "127.0.0.1:${toString cfg.port}";
+          use_incoming_timestamp = true;
+        };
+        service.pipelines.logs.receivers = [ "loki" ];
+      };
+    })
+
+    (mkIf config.components.monitor.promtail.enable {
+      services.promtail = {
+        enable = true;
+        configuration = {
+          server.disable = true;
+          positions.filename = "/var/cache/promtail/positions.yaml";
+
+          clients = [
+            { url = "http://127.0.0.1:${toString cfg.port}/loki/api/v1/push"; }
+          ];
+
+          scrape_configs =
+
+            let
+              _replace = index: replacement: ''{{ Replace .Value "${toString index}" "${replacement}" 1 }}'';
+              _elseif = index: ''{{ else if eq .Value "${toString index}" }}'';
+              _if = index: ''{{ if eq .Value "${toString index}" }}'';
+              _end = ''{{ end }}'';
+              elseblock = index: replacement: "${_elseif index}${_replace index replacement}";
+              ifblock = index: replacement: "${_if index}${_replace index replacement}";
+              createTemplateLine =
+                list:
+                "${
+                  concatStrings (
+                    imap0 (
+                      index: replacement: if index == 0 then ifblock index replacement else elseblock index replacement
+                    ) list
+                  )
+                }${_end}";
+            in
+            [
+              {
+                job_name = "journal";
+                journal = {
+                  json = true;
+                  max_age = "12h";
+                  labels.job = "systemd-journal";
+                };
+                pipeline_stages = [
+                  {
+                    # Set of key/value pairs of JMESPath expressions. The key will be
+                    # the key in the extracted data while the expression will be the value,
+                    # evaluated as a JMESPath from the source data.
+                    json.expressions = {
+                      # journalctl -o json | jq and you'll see these
+                      boot_id = "_BOOT_ID";
+                      facility = "SYSLOG_FACILITY";
+                      facility_label = "SYSLOG_FACILITY";
+                      instance = "_HOSTNAME";
+                      msg = "MESSAGE";
+                      priority = "PRIORITY";
+                      priority_label = "PRIORITY";
+                      transport = "_TRANSPORT";
+                      unit = "_SYSTEMD_UNIT";
+                      # coredump
+                      #coredump_cgroup = "COREDUMP_CGROUP";
+                      #coredump_exe = "COREDUMP_EXE";
+                      #coredump_cmdline = "COREDUMP_CMDLINE";
+                      #coredump_uid = "COREDUMP_UID";
+                      #coredump_gid = "COREDUMP_GID";
+                    };
+                  }
+                  {
+                    # Set the unit (defaulting to the transport like audit and kernel)
+                    template = {
+                      source = "unit";
+                      template = "{{if .unit}}{{.unit}}{{else}}{{.transport}}{{end}}";
+                    };
+                  }
+                  {
+                    # Normalize session IDs (session-1234.scope -> session.scope) to limit number of label values
+                    replace = {
+                      source = "unit";
+                      expression = "^(session-\\d+.scope)$";
+                      replace = "session.scope";
+                    };
+                  }
+                  {
+                    # Map priority to human readable
+                    template = {
+                      source = "priority_label";
+                      #template = ''{{ if eq .Value "0" }}{{ Replace .Value "0" "emerg" 1 }}{{ else if eq .Value "1" }}{{ Replace .Value "1" "alert" 1 }}{{ else if eq .Value "2" }}{{ Replace .Value "2" "crit" 1 }}{{ else if eq .Value "3" }}{{ Replace .Value "3" "err" 1 }}{{ else if eq .Value "4" }}{{ Replace .Value "4" "warning" 1 }}{{ else if eq .Value "5" }}{{ Replace .Value "5" "notice" 1 }}{{ else if eq .Value "6" }}{{ Replace .Value "6" "info" 1 }}{{ else if eq .Value "7" }}{{ Replace .Value "7" "debug" 1 }}{{ end }}'';
+                      template = createTemplateLine [
+                        "emergency"
+                        "alert"
+                        "critical"
+                        "error"
+                        "warning"
+                        "notice"
+                        "info"
+                        "debug"
+                      ];
+                    };
+                  }
+                  {
+                    # Map facility to human readable
+                    template = {
+                      source = "facility_label";
+                      template = createTemplateLine [
+                        "kern" # Kernel messages
+                        "user" # User-level messages
+                        "mail" # Mail system	Archaic POSIX still supported and sometimes used (for more mail(1))
+                        "daemon" # System daemons	All daemons, including systemd and its subsystems
+                        "auth" # Security/authorization messages	Also watch for different facility 10
+                        "syslog" # Messages generated internally by syslogd	For syslogd implementations (not used by systemd, see facility 3)
+                        "lpr" # Line printer subsystem (archaic subsystem)
+                        "news" # Network news subsystem (archaic subsystem)
+                        "uucp" # UUCP subsystem (archaic subsystem)
+                        "clock" # Clock daemon	systemd-timesyncd
+                        "authpriv" # Security/authorization messages	Also watch for different facility 4
+                        "ftp" # FTP daemon
+                        "-" # NTP subsystem
+                        "-" # Log audit
+                        "-" # Log alert
+                        "cron" # Scheduling daemon
+                        "local0" # Local use 0 (local0)
+                        "local1" # Local use 1 (local1)
+                        "local2" # Local use 2 (local2)
+                        "local3" # Local use 3 (local3)
+                        "local4" # Local use 4 (local4)
+                        "local5" # Local use 5 (local5)
+                        "local6" # Local use 6 (local6)
+                        "local7" # Local use 7 (local7)
+                      ];
+                    };
+                  }
+                  {
+                    # Key is REQUIRED and the name for the label that will be created.
+                    # Value is optional and will be the name from extracted data whose value
+                    # will be used for the value of the label. If empty, the value will be
+                    # inferred to be the same as the key.
+                    labels = {
+                      boot_id = "";
+                      facility = "";
+                      facility_label = "";
+                      instance = "";
+                      priority = "";
+                      priority_label = "";
+                      transport = "";
+                      unit = "";
+                    };
+                  }
+                  {
+                    # Write the proper message instead of JSON
+                    output.source = "msg";
+                  }
+                ];
+              }
+            ];
+        };
+      };
+    })
+  ];
+}

components/monitor/metrics-export-zfs.nix

@@ -0,0 +1,39 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+with lib;
+with types;
+{
+  options.components.monitor.exporters.zfs.enable = mkOption {
+    type = lib.types.bool;
+    default = config.components.monitor.metrics.enable;
+  };
+
+  config = mkMerge [
+    (mkIf config.components.monitor.exporters.zfs.enable {
+
+      services.telegraf.extraConfig.inputs.zfs = { };
+
+      services.prometheus.exporters.zfs.enable = true;
+      services.opentelemetry-collector.settings = {
+        receivers.prometheus.config.scrape_configs = [
+          {
+            job_name = "zfs";
+            scrape_interval = "10s";
+            static_configs = [
+              {
+                targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.zfs.port}" ];
+              }
+            ];
+          }
+        ];
+        service.pipelines.metrics.receivers = [ "prometheus" ];
+      };
+
+    })
+  ];
+
+}

components/monitor/metrics-netdata.nix

@@ -0,0 +1,40 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+with lib;
+with types;
+{
+  options.components.monitor.netdata = {
+    enable = mkOption {
+      type = bool;
+      default = config.components.monitor.metrics.enable;
+    };
+  };
+
+  config = mkIf config.components.monitor.netdata.enable {
+
+    # netdata sink
+    services.opentelemetry-collector.settings.receivers.prometheus.config.scrape_configs = [
+      {
+        job_name = "netdata";
+        scrape_interval = "10s";
+        metrics_path = "/api/v1/allmetrics";
+        params.format = [ "prometheus" ];
+        static_configs = [ { targets = [ "127.0.0.1:19999" ]; } ];
+      }
+    ];
+
+    # https://docs.netdata.cloud/daemon/config/
+    services.netdata = {
+      enable = lib.mkDefault true;
+      config = {
+        global = {
+          "memory mode" = "ram";
+        };
+      };
+    };
+  };
+}

components/monitor/metrics-prometheus.nix

@@ -0,0 +1,45 @@
+{ config, lib, ... }:
+with lib;
+with types;
+let
+  cfg = config.components.monitor.prometheus;
+in
+{
+  options.components.monitor.prometheus = {
+    enable = mkOption {
+      type = lib.types.bool;
+      default = config.components.monitor.metrics.enable;
+    };
+    port = mkOption {
+      type = int;
+      default = 8090;
+      description = "port to provide Prometheus export";
+    };
+  };
+
+  config = mkMerge [
+
+    (mkIf config.components.monitor.prometheus.enable {
+      services.prometheus = {
+        checkConfig = "syntax-only";
+        enable = true;
+      };
+    })
+
+    (mkIf config.components.monitor.prometheus.enable {
+      services.opentelemetry-collector.settings = {
+        exporters.prometheus.endpoint = "127.0.0.1:${toString cfg.port}";
+        service.pipelines.metrics.exporters = [ "prometheus" ];
+      };
+      services.prometheus.scrapeConfigs = [
+        {
+          job_name = "opentelemetry";
+          metrics_path = "/metrics";
+          scrape_interval = "10s";
+          static_configs = [ { targets = [ "localhost:${toString cfg.port}" ]; } ];
+        }
+      ];
+    })
+
+  ];
+}

components/monitor/metrics-telegraf.nix

@@ -0,0 +1,57 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+with lib;
+with types;
+let
+  cfg = config.components.monitor.telegraf;
+in
+{
+  options.components.monitor.telegraf = {
+    enable = mkOption {
+      type = lib.types.bool;
+      default = config.components.monitor.metrics.enable;
+    };
+    influxDBPort = mkOption {
+      type = int;
+      default = 8088;
+      description = "Port to listen on influxDB input";
+    };
+  };
+
+  config = lib.mkMerge [
+    (mkIf config.components.monitor.telegraf.enable {
+      # opentelemetry wireing
+      services.opentelemetry-collector.settings = {
+        receivers.influxdb.endpoint = "127.0.0.1:${toString cfg.influxDBPort}";
+        service.pipelines.metrics.receivers = [ "influxdb" ];
+      };
+      services.telegraf.extraConfig.outputs.influxdb_v2.urls = [
+        "http://127.0.0.1:${toString cfg.influxDBPort}"
+      ];
+    })
+
+    (mkIf config.components.monitor.telegraf.enable {
+
+      systemd.services.telegraf.path = [ pkgs.inetutils ];
+
+      services.telegraf = {
+        enable = true;
+        extraConfig = {
+          # https://github.com/influxdata/telegraf/tree/master/plugins/inputs < all them plugins
+          inputs = {
+            cpu = { };
+            diskio = { };
+            processes = { };
+            system = { };
+            systemd_units = { };
+            ping = [ { urls = [ "10.100.0.1" ]; } ]; # actually important to make machine visible over wireguard
+          };
+        };
+      };
+    })
+  ];
+}

components/monitor/opentelemetry.nix

@@ -0,0 +1,218 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+with lib;
+with types;
+let
+  cfg = config.components.monitor.opentelemetry;
+in
+{
+  options.components.monitor.opentelemetry = {
+    enable = mkOption {
+      type = bool;
+      default = config.components.monitor.enable;
+      description = "weather or not to use opentelemetry";
+    };
+    receiver.endpoint = mkOption {
+      type = nullOr str;
+      default = null;
+      description = "endpoint to receive the opentelementry data from other collectors";
+    };
+    exporter.endpoint = mkOption {
+      type = nullOr str;
+      default = null;
+      description = "endpoint to ship opentelementry data too";
+    };
+    exporter.debug = mkOption {
+      type = nullOr (enum [
+        "logs"
+        "metrics"
+      ]);
+      default = null;
+      description = "enable debug exporter.";
+    };
+    metrics.endpoint = mkOption {
+      type = str;
+      default = "127.0.0.1:8100";
+      description = "endpoint on where to provide opentelementry metrics";
+    };
+  };
+
+  config = mkMerge [
+
+    (mkIf config.components.monitor.opentelemetry.enable {
+      services.opentelemetry-collector = {
+        enable = true;
+        package = pkgs.opentelemetry-collector-contrib;
+      };
+    })
+
+    # add default tags to metrics
+    # todo : make sure we filter out metrics from otlp receivers
+    (mkIf config.components.monitor.enable {
+      services.opentelemetry-collector.settings = {
+
+        processors = {
+
+          # https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/processor/resourcedetectionprocessor/README.md
+          "resourcedetection/system" = {
+            detectors = [ "system" ];
+            override = false;
+            system.hostname_sources = [ "os" ];
+          };
+
+          metricstransform.transforms = [
+            {
+              include = ".*";
+              match_type = "regexp";
+              action = "update";
+              operations = [
+                {
+                  action = "add_label";
+                  new_label = "machine";
+                  new_value = config.networking.hostName;
+                }
+              ];
+            }
+          ];
+        };
+      };
+    })
+    (mkIf config.components.monitor.metrics.enable {
+      services.opentelemetry-collector.settings = {
+        service.pipelines.metrics.processors = [
+          "metricstransform"
+          "resourcedetection/system"
+        ];
+      };
+    })
+    (mkIf config.components.monitor.logs.enable {
+      services.opentelemetry-collector.settings = {
+        service.pipelines.logs.processors = [ "resourcedetection/system" ];
+      };
+    })
+
+    (mkIf (config.components.monitor.opentelemetry.exporter.debug != null) {
+      services.opentelemetry-collector.settings = {
+        exporters.debug = {
+          verbosity = "detailed";
+          sampling_initial = 5;
+          sampling_thereafter = 200;
+        };
+        service.pipelines.${config.components.monitor.opentelemetry.exporter.debug} = {
+          exporters = [ "debug" ];
+        };
+
+      };
+    })
+
+    # ship to next instance
+    (mkIf (config.components.monitor.opentelemetry.exporter.endpoint != null) {
+      services.opentelemetry-collector.settings = {
+        exporters.otlp = {
+          endpoint = cfg.exporter.endpoint;
+          tls.insecure = true;
+        };
+      };
+    })
+    (mkIf
+      (
+        config.components.monitor.opentelemetry.exporter.endpoint != null
+        && config.components.monitor.logs.enable
+      )
+      {
+        services.opentelemetry-collector.settings = {
+          service.pipelines.logs.exporters = [ "otlp" ];
+        };
+      }
+    )
+    (mkIf
+      (
+        config.components.monitor.opentelemetry.exporter.endpoint != null
+        && config.components.monitor.metrics.enable
+      )
+      {
+        services.opentelemetry-collector.settings = {
+          service.pipelines.metrics.exporters = [ "otlp" ];
+        };
+      }
+    )
+
+    # ship from other instance
+    (mkIf (config.components.monitor.opentelemetry.receiver.endpoint != null) {
+      services.opentelemetry-collector.settings = {
+        receivers.otlp.protocols.grpc.endpoint = cfg.receiver.endpoint;
+      };
+    })
+    (mkIf
+      (
+        config.components.monitor.opentelemetry.receiver.endpoint != null
+        && config.components.monitor.logs.enable
+      )
+      {
+        services.opentelemetry-collector.settings = {
+          service.pipelines.logs.receivers = [ "otlp" ];
+        };
+      }
+    )
+    (mkIf
+      (
+        config.components.monitor.opentelemetry.receiver.endpoint != null
+        && config.components.monitor.metrics.enable
+      )
+      {
+        services.opentelemetry-collector.settings = {
+          service.pipelines.metrics.receivers = [ "otlp" ];
+        };
+      }
+    )
+
+    # scrape opentelemetry-colectors metrics
+    # todo: this should be collected another way (opentelemetry internal?)
+    # todo : enable me only when metrics.endpoint is set.
+    (mkIf config.components.monitor.metrics.enable {
+      services.opentelemetry-collector.settings = {
+        receivers = {
+          prometheus.config.scrape_configs = [
+            {
+              job_name = "otelcol";
+              scrape_interval = "10s";
+              static_configs = [
+                {
+                  targets = [ cfg.metrics.endpoint ];
+                }
+              ];
+              metric_relabel_configs = [
+                {
+                  source_labels = [ "__name__" ];
+                  regex = ".*grpc_io.*";
+                  action = "drop";
+                }
+              ];
+            }
+          ];
+        };
+
+        service = {
+          pipelines.metrics = {
+            receivers = [ "prometheus" ];
+          };
+
+          # todo : this should be automatically be collected
+          # open telemetries own metrics?
+          telemetry.metrics.address = cfg.metrics.endpoint;
+        };
+
+      };
+    })
+    (mkIf (!config.components.monitor.metrics.enable) {
+      services.opentelemetry-collector.settings = {
+        service.telemetry.metrics.level = "none";
+      };
+    })
+  ];
+
+}

components/network/hosts.nix

@@ -1,9 +1,5 @@
-{ clanLib, ... }:
 {
   networking.extraHosts = ''
     95.216.66.212 orbi.public
   '';
-  services.openssh.knownHosts = {
-    "orbi.public".publicKey = clanLib.readFact "ssh.id_ed25519.pub" "orbi";
-  };
 }

components/network/nginx.nix

@@ -175,7 +175,7 @@ with lib;
                   ];
                 })
                 (entry { machine = "cherry"; })
-                #(entry { machine = "cream"; })
+                (entry { machine = "cream"; })
                 (entry { machine = "mobi"; })
                 (entry { machine = "bobi"; })
                 {

components/network/sshd/default.nix

@@ -8,6 +8,7 @@
 with lib;
 with types;
 let
+  defaultRootKeyFiles = [ "${assets}/mrvandalo_rsa.pub" ];
   cfg = config.components.network.sshd;
 
   # maybe ascii-image-converter is also nice here
@@ -29,6 +30,11 @@ in
       type = bool;
       default = true;
     };
+    rootKeyFiles = mkOption {
+      type = with types; listOf path;
+      default = [ ];
+      description = "keys to root login";
+    };
     onlyTincAccess = mkOption {
       type = bool;
       default = false;
@@ -36,13 +42,6 @@ in
         make sure ssh is only available trough the tinc
       '';
     };
-    allowMosh = mkOption {
-      type = bool;
-      default = true;
-      description = ''
-        make mosh port available
-      '';
-    };
   };
 
   config = mkMerge [
@@ -65,27 +64,18 @@ in
         # settings.LoginGraceTime = 0;
       };
 
+      users.users.root.openssh.authorizedKeys.keyFiles = cfg.rootKeyFiles ++ defaultRootKeyFiles;
+
       # todo enable again when I can it's possible to set the `-q` ssh option in clan
       #services.openssh.banner = builtins.readFile sshBanner;
 
     })
 
     (mkIf (cfg.onlyTincAccess && cfg.enable) {
-      # fixme: this is not working
       networking.firewall.extraCommands = ''
         iptables --table nat --append PREROUTING ! --in-interface tinc.+ --protocol tcp --match tcp --dport 22 --jump REDIRECT --to-ports 0
       '';
     })
-
-    (mkIf (cfg.allowMosh && cfg.enable) {
-      networking.firewall.allowedUDPPortRanges = [
-        {
-          from = 60000;
-          to = 61000;
-        }
-      ];
-    })
-
   ];
 
 }

components/network/sshd/known-hosts-manual.nix

@@ -15,18 +15,11 @@ in
     services.openssh.knownHosts = {
       orbi = {
         hostNames = [
+          "git.ingolf-wagner.de"
           "95.216.66.212"
         ];
         publicKey = publicKey "orbi";
       };
-
-      forgejo = {
-        hostNames = [
-          "[git.ingolf-wagner.de]:2222"
-        ];
-        publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDQVomwXedtY4ZAKA1Bcsz6Ud2Ys3mjjGJXLcWQLceXKmmAQfOWqqLrTddhrLjmZImS3HTexGK7iNmYYCd/lG+7j1rMebmk3cddH6qr/4WB5SSexbLV4/vlk18kia6O+52ybrMzejwcfr9qNEg+bkrmc4btsWcT/w21vRyOzsmRRnk+S54prLGtiCypFqwGYnyr6HPXO3lqCLHIR/XurcFvh/aM/RGusWh889TXA39FezDcV6OZisZTTC4BBoUAS8r6XJnrIahZJmfEHp/FbKJV0pShCCQXtpkUBu7g6B2T+8u91fY4kc8O293XhaxjTBfkZH2lGodppGG12vAQSeznppbzlT82uTx80jyt7Hw/IAjn9j8D+iKC7fA9qawVz+p1UtqHQd43+8gOSiHILOUMhVxp7ZrfhYmaiOKrkR4+Juc9P2UsqrAvxS1WaYT4KaEZfze7/DCdK0h2SSY2jgCU9sNeJG6M4s/pPj+iI/O+AagHfBZ+bF2y+OKEZOW4J+OpqnEY3lANdxsMsD9PwBpAVAn9FAJzAy+gfXINu0wqGhtA3qWM0QVjcSXsfQJQ2XrbMPd9+pvOl1Ej5SSbjXYcPt9dXWl+L69dbU5qb8WRGl2ZxloUaRcOrOkmhybwI/61LfaGzLslnNn8ARjJgzu9xSipT5D4cZ1FgB9ezqC73Q==";
-      };
-
     };
 
   };

components/network/syncthing.nix

@@ -43,7 +43,6 @@ with lib;
       in
       clanMachines
       // (device "iPhone" "RPQBSRB-DYEUUWQ-EAPMBA2-PL4MJ73-Y4F4ZTH-TAD7DUE-GEK56BG-HYW6YAF")
-      // (device "iPad" "NEGOJYU-EEDRM4E-XVZUKFO-63LAIOO-WHFFS2V-3SH3KR2-VYEFQLW-4QOFBQU")
       // (device "bumba" "JS7PWTO-VKFGBUP-GNFLSWP-MGFJ2KH-HLO2LKW-V3RPCR6-PCB5SQC-42FCKQZ");
 
     settings.folders = {
@@ -61,7 +60,7 @@ with lib;
         path = lib.mkDefault "/tmp/books";
         devices = [
           "chungus"
-          #          "cream"
+          "cream"
           "cherry"
         ];
         versioning = {
@@ -74,7 +73,7 @@ with lib;
         path = lib.mkDefault "/tmp/desktop";
         devices = [
           "chungus"
-          #          "cream"
+          "cream"
           "cherry"
         ];
       };
@@ -83,7 +82,7 @@ with lib;
         path = lib.mkDefault "/tmp/finance";
         devices = [
           "chungus"
-          #          "cream"
+          "cream"
           "cherry"
         ];
         versioning = {
@@ -103,9 +102,9 @@ with lib;
         enable = lib.mkDefault false;
         path = lib.mkDefault "/tmp/logseq";
         devices = [
-          "cherry"
           "chungus"
-          "iPad"
+          "cream"
+          "cherry"
           "iPhone"
         ];
       };
@@ -122,7 +121,7 @@ with lib;
         path = lib.mkDefault "/tmp/oscar_cpap";
         devices = [
           "chungus"
-          #          "cream"
+          "cream"
           "cherry"
         ];
       };
@@ -131,7 +130,7 @@ with lib;
         path = lib.mkDefault "/tmp/password-store";
         devices = [
           "chungus"
-          #          "cream"
+          "cream"
           "cherry"
         ];
         versioning = {
@@ -144,7 +143,7 @@ with lib;
         enable = lib.mkDefault false;
         path = lib.mkDefault "/tmp/password-store";
         devices = [
-          #          "cream"
+          "cream"
           "cherry"
           "orbi"
         ];

components/network/tinc/private.nix

@@ -14,7 +14,7 @@ let
     bobi = "10.23.42.25";
     cherry = "10.23.42.29";
     chungus = "10.23.42.28";
-    #    cream = "10.23.42.27";
+    cream = "10.23.42.27";
     mobi = "10.23.42.23";
     orbi = "10.23.42.100";
   };
@@ -28,7 +28,6 @@ let
     "photoprism.orbi" = hosts.orbi;
     # chungus
     "video.chungus" = hosts.chungus;
-    "music.chungus" = hosts.chungus;
     "de.tts.chungus" = hosts.chungus;
     "en.tts.chungus" = hosts.chungus;
     "flix.chungus" = hosts.chungus;
@@ -68,10 +67,10 @@ in
           subnets = [ { address = hosts.bobi; } ];
           settings.Ed25519PublicKey = "jwvNd4oAgz2cWEI74VTVYU1qgPWq823/a0iEDqJ8KMD";
         };
-        #        cream = {
+        cream = {
-        #          subnets = [ { address = hosts.cream; } ];
+          subnets = [ { address = hosts.cream; } ];
-        #          settings.Ed25519PublicKey = Ed25519PublicKey "cream";
+          settings.Ed25519PublicKey = Ed25519PublicKey "cream";
-        #        };
+        };
         cherry = {
           subnets = [ { address = hosts.cherry; } ];
           settings.Ed25519PublicKey = Ed25519PublicKey "cherry";

components/network/tinc/secret.nix

@@ -12,7 +12,7 @@ let
   port = 721;
   hosts = {
     cherry = "10.123.42.29";
-    #    cream = "10.123.42.27";
+    cream = "10.123.42.27";
     robi = "10.123.42.123";
     sternchen = "10.123.42.25";
     sterni = "10.123.42.24";
@@ -35,10 +35,10 @@ in
           subnets = [ { address = hosts.sternchen; } ];
           settings.Ed25519PublicKey = "Z567IKl00Kw5JFBNwMvjL33QYe2hRoNtQcNIDFRPReB";
         };
-        #        cream = {
+        cream = {
-        #          subnets = [ { address = hosts.cream; } ];
+          subnets = [ { address = hosts.cream; } ];
-        #          settings.Ed25519PublicKey = "Y/YRA90mAlNEmdhUWlUTHjjsco6d6hlvW11sPtarIdL";
+          settings.Ed25519PublicKey = "Y/YRA90mAlNEmdhUWlUTHjjsco6d6hlvW11sPtarIdL";
-        #        };
+        };
         cherry = {
           subnets = [ { address = hosts.cherry; } ];
           settings.Ed25519PublicKey = "BsPIrZjbzn0aryC0HO3OXSb4oFCMmzNDmMDQmxUXUuC";
@@ -80,13 +80,13 @@ in
   );
 
   services.openssh.knownHosts = {
-    #    "cream.${network}" = {
+    "cream.${network}" = {
-    #      hostNames = [
+      hostNames = [
-    #        "cream.${network}"
+        "cream.${network}"
-    #        hosts.cream
+        hosts.cream
-    #      ];
+      ];
-    #      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIConHiCL7INgAhuN6Z9TqP0zP+xNpdV7+OHwUca4IRDD";
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIConHiCL7INgAhuN6Z9TqP0zP+xNpdV7+OHwUca4IRDD";
-    #    };
+    };
     "sternchen.${network}" = {
       hostNames = [
         "sterni.${network}"

components/network/wireguard.nix

@@ -25,8 +25,6 @@ with lib;
   config = {
     networking.extraHosts = ''
       10.100.0.1 cache.orbi.wg0
-      10.100.0.1 orbi.wg0
-      10.100.0.2 chungus.wg0
     '';
   };
 

components/terminal/default.nix

@@ -17,6 +17,7 @@ with lib;
     ./direnv.nix
     ./git.nix
     ./heygpt.nix
+    ./hoard.nix
     ./remote-install.nix
     ./wtf.nix
     ./zsh.nix

components/terminal/hoard.nix

@@ -0,0 +1,83 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+with lib;
+let
+  hoardSrc = pkgs.fetchFromGitHub {
+    owner = "Hyde46";
+    repo = "hoard";
+    rev = "v1.3.1";
+    sha256 = "sha256-Gm3X6/g5JQJEl7wRvWcO4j5XpROhtfRJ72LNaUeZRGc=";
+  };
+in
+{
+  options.components.terminal.hoard.enable = mkOption {
+    type = lib.types.bool;
+    default = config.components.terminal.enable;
+  };
+
+  config = mkIf (config.components.terminal.hoard.enable) {
+
+    # todo : sync via syncthing
+    #backup.dirs = [
+    #  "/root/.config/hoard"
+    #  "/home/palo/.config/hoard"
+    #];
+
+    environment.systemPackages = [ pkgs.legacy_2211.hoard ];
+
+    home-manager.users.mainUser = {
+      xdg.configFile."hoard/config.yml".text = builtins.toJSON {
+        version = "1.0.1";
+        default_namespace = "default";
+        config_home_path = "/home/palo/.config/hoard";
+        trove_path = "/home/palo/.config/hoard/trove.yml";
+        query_prefix = " >";
+        primary_color = [
+          87
+          142
+          87
+        ];
+        secondary_color = [
+          203
+          184
+          144
+        ];
+        tertiary_color = [
+          30
+          30
+          30
+        ];
+        command_color = [
+          30
+          30
+          30
+        ];
+        parameter_token = "#";
+        read_from_current_directory = true;
+      };
+      programs.zsh.initExtra = ''
+        export HOARD_NOBIND=1
+        source ${hoardSrc}/src/shell/hoard.zsh
+        bindkey '^x' _hoard_list_widget
+      '';
+    };
+
+    # use showkey -a
+    # Ctrl-h is equivalent to Ctrl-Backspace (for some reason)
+    programs.zsh.interactiveShellInit = ''
+      export HOARD_NOBIND=1
+      source ${hoardSrc}/src/shell/hoard.zsh
+      bindkey '^x' _hoard_list_widget
+    '';
+    programs.bash.interactiveShellInit = ''
+      export HOARD_NOBIND=1
+      source ${hoardSrc}/src/shell/hoard.bash
+      bind -x '"\C-x": __hoard_list'
+    '';
+
+  };
+}

components/terminal/wtf.nix

@@ -23,7 +23,7 @@ let
           ${pkgs.iw}/bin/iw dev \
             | ${pkgs.gnused}/bin/sed -n 's/^\s*Interface\s\+\([0-9a-z]\+\)$/\1/p'
         ); do
-          inet=$(${pkgs.iproute2}/bin/ip addr show $dev \
+          inet=$(${pkgs.iproute}/bin/ip addr show $dev \
             | ${pkgs.gnused}/bin/sed -n 's/.*inet \([0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+\).*/\1/p') \
             || unset inet
           ssid=$(${pkgs.iw}/bin/iw dev $dev link \

components/timezone.nix

@@ -3,4 +3,7 @@
   # some system stuff
   # -----------------
   time.timeZone = "Europe/Berlin";
+  #time.timeZone = "Pacific/Auckland";
+  #time.timeZone = "Asia/Singapore";
+  #time.timeZone = "Asia/Makassar";
 }

components/virtualisation/docker.nix

@@ -15,7 +15,6 @@ with lib;
   config = mkIf config.components.virtualisation.docker.enable {
 
     virtualisation.docker.enable = true;
-    virtualisation.docker.extraPackages = [ pkgs.zfs ];
 
   };
 

components/virtualisation/podman.nix

@@ -12,20 +12,13 @@ with lib;
     default = config.components.virtualisation.enable;
   };
 
-  config = mkMerge [
+  config = mkIf config.components.virtualisation.podman.enable {
-    (mkIf config.components.virtualisation.podman.enable {
 
-      virtualisation.podman.enable = true;
+    virtualisation.podman.enable = true;
 
-      # make sure /var/lib/containers/storage is a zfs dataset
+    # make sure /var/lib/containers/storage is a zfs dataset
-      virtualisation.podman.extraPackages = [ pkgs.zfs ];
+    virtualisation.podman.extraPackages = [ pkgs.zfs ];
 
-    })
+  };
-    (mkIf (config.components.virtualisation.podman.enable && (!config.virtualisation.docker.enable)) {
-      virtualisation.podman.dockerCompat = true;
-      virtualisation.podman.dockerSocket.enable = true;
-    })
-
-  ];
 
 }

components/virtualisation/virtualbox.nix

@@ -14,13 +14,10 @@ with lib;
 
   config = mkIf config.components.virtualisation.virtualbox.enable {
 
-    virtualisation.virtualbox.host.enable = true;
+    virtualisation.virtualbox = {
-    virtualisation.virtualbox.host.enableExtensionPack = true;
+      host.enable = true;
-    virtualisation.virtualbox.guest.enable = true;
+      guest.enable = true;
-    virtualisation.virtualbox.guest.dragAndDrop = true;
+    };
-
-    # https://discourse.nixos.org/t/issue-with-virtualbox-in-24-11/57607/2
-    boot.kernelParams = [ "kvm.enable_virt_at_load=0" ];
 
     users.extraGroups.vboxusers.members = [ config.users.users.mainUser.name ];
 

features/network/fail2ban.nix

@@ -16,6 +16,7 @@ with lib;
       environment.systemPackages = [ pkgs.fail2ban ];
       services.fail2ban = {
         enable = true;
+        #package = pkgs.legacy_2311.fail2ban;
         jails = { };
       };
     })

flake.nix

@@ -10,40 +10,37 @@
     clan-fact-generators.url = "github:mrvandalo/clan-fact-generators";
     flake-parts.inputs.nixpkgs-lib.follows = "nixpkgs";
     flake-parts.url = "github:hercules-ci/flake-parts";
-    healthchecks.inputs.nixpkgs.follows = "nixpkgs";
-    healthchecks.url = "github:mrvandalo/nixos-healthchecks";
-    #healthchecks.url = "git+file:///home/palo/dev/nixos/healthcheck";
     home-manager-utils.inputs.home-manager.follows = "home-manager";
     home-manager-utils.url = "github:mrvandalo/home-manager-utils";
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
     home-manager.url = "github:nix-community/home-manager";
+    kmonad.inputs.nixpkgs.follows = "nixpkgs"; # fixme: kmonad crashes every now and than and the keyboard is not usable anymore.
+    kmonad.url = "github:kmonad/kmonad?dir=nix"; # todo: mabye use https://github.com/jtroo/kanata instead
     landingpage.url = "github:mrVanDalo/landingpage";
+    nixos-anywhere.url = "github:nix-community/nixos-anywhere";
     nix-topology.inputs.nixpkgs.follows = "nixpkgs";
     nix-topology.url = "github:oddlama/nix-topology";
-    nixos-anywhere.url = "github:nix-community/nixos-anywhere";
     nixos-hardware.url = "github:nixos/nixos-hardware";
+    nixpkgs-legacy_2211.url = "github:nixos/nixpkgs/nixos-22.11";
+    nixpkgs-legacy_2311.url = "github:nixos/nixpkgs/nixos-23.11";
+    nixpkgs-legacy_2405.url = "github:nixos/nixpkgs/nixos-24.05";
     nixpkgs-unstable-small.url = "github:nixos/nixpkgs/nixos-unstable-small";
-    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
     permown.inputs.nixpkgs.follows = "nixpkgs";
     permown.url = "github:mrVanDalo/module.permown";
     polygon-art.url = "git+https://git.ingolf-wagner.de/palo/polygon-art.git";
     private-parts.inputs.nixpkgs.follows = "nixpkgs"; # only private input
-    private-parts.url = "git+ssh://forgejo@git.ingolf-wagner.de:2222/palo/nixos-private-parts.git?ref=main";
+    private-parts.url = "git+ssh://forgejo@git.ingolf-wagner.de/palo/nixos-private-parts.git?ref=main";
     #private-parts.url = "git+file:///home/palo/dev/nixos/nixos-private-parts";
-    share-http.inputs.nixpkgs.follows = "nixpkgs"; # only private input
+    retiolum.url = "github:Mic92/retiolum";
-    share-http.url = "git+ssh://forgejo@git.ingolf-wagner.de:2222/palo/share-host.git?ref=main";
     srvos.url = "github:nix-community/srvos";
     stylix.inputs.home-manager.follows = "home-manager";
     stylix.inputs.nixpkgs.follows = "nixpkgs";
     stylix.url = "github:danth/stylix";
-    taskwarrior.url = "github:mrvandalo/taskwarrior-flake";
+    taskshell.inputs.nixpkgs.follows = "nixpkgs";
-    #taskwarrior.url = "git+file:///home/palo/dev/nixos/taskwarrior-flake";
+    taskshell.url = "github:mrvandalo/taskshell";
-    telemetry.inputs.nixpkgs.follows = "nixpkgs";
-    telemetry.url = "github:mrvandalo/nixos-telemetry";
-    #telemetry.url = "git+file:///home/palo/dev/nixos/nixos-telemetry";
     treefmt-nix.inputs.nixpkgs.follows = "nixpkgs";
     treefmt-nix.url = "github:numtide/treefmt-nix";
-    devshell.url = "github:numtide/devshell";
 
     # smoke test framwork to trigger tests (enable if I  want to use it for real)
     #smoke = {
@@ -55,29 +52,30 @@
 
   outputs =
     inputs@{
+      self,
       clan-core,
       clan-fact-generators,
-      devshell,
       flake-parts,
-      healthchecks,
       home-manager,
       home-manager-utils,
+      kmonad,
       landingpage,
-      nix-topology,
       nixos-anywhere,
       nixos-hardware,
       nixpkgs,
+      nixpkgs-legacy_2211,
+      nixpkgs-legacy_2311,
+      nixpkgs-legacy_2405,
       nixpkgs-unstable-small,
       permown,
       polygon-art,
       private-parts,
-      self,
+      retiolum,
-      share-http,
       srvos,
       stylix,
-      taskwarrior,
+      taskshell,
-      telemetry,
       treefmt-nix,
+      nix-topology,
     }:
 
     let
@@ -95,10 +93,6 @@
               "python-2.7.18.8"
               "electron-27.3.11" # for logseq
               "electron-28.3.3" # for logseq
-              "aspnetcore-runtime-wrapped-6.0.36" # for jellyfin
-              "aspnetcore-runtime-6.0.36" # for jellyfin
-              "dotnet-sdk-wrapped-6.0.428" # for jellyfin
-              "dotnet-sdk-6.0.428" # for jellyfin
             ];
           in
           import nixpkgs {
@@ -114,19 +108,33 @@
                     inherit allowUnfree permittedInsecurePackages;
                   };
                 };
+                legacy_2211 = import nixpkgs-legacy_2211 {
+                  inherit system;
+                  config = {
+                    inherit allowUnfree permittedInsecurePackages;
+                  };
+                };
+                legacy_2311 = import nixpkgs-legacy_2311 {
+                  inherit system;
+                  config = {
+                    inherit allowUnfree permittedInsecurePackages;
+                  };
+                };
+                legacy_2405 = import nixpkgs-legacy_2405 {
+                  inherit system;
+                  config = {
+                    inherit allowUnfree permittedInsecurePackages;
+                  };
+                };
                 polygon-art = polygon-art.packages.${system};
                 landingpage = landingpage.packages.${system}.plain;
-                share-via-http = share-http.packages.${system}.default;
+                kmonad = kmonad.packages.${system}.kmonad;
-                inherit (taskwarrior.packages.${system})
+                tasksh = taskshell.packages.${system}.tasksh;
-                  bugwarrior
-                  tasksh
-                  taskwarrior-hooks
-                  ;
-                healthchecks = self.packages.${system}.healthchecks;
                 inherit (self.packages.${system})
                   otpmenu
+                  taskwarrior-hooks
                   nsxiv
-                  systemctl-find-service-config
+                  bugwarrior
                   ;
               })
             ];
@@ -158,7 +166,6 @@
           nixpkgs.pkgs = meta.pkgs;
           nixpkgs.hostPlatform = meta.system;
           clan.core.facts.secretStore = "password-store";
-          clan.core.vars.settings.secretStore = "password-store";
 
           imports =
             modules
@@ -206,26 +213,25 @@
           ];
         };
 
-      defaultAuthorizedKeys =
-        { config, pkgs, ... }:
-        {
-          users.users.root.openssh.authorizedKeys.keyFiles = [
-            # yubikey key
-            ./assets/mrvandalo_rsa.pub
-            # backup key
-            "${config.clan.core.settings.directory}/machines/chungus/facts/ssh.syncoid.id_ed25519.pub"
-            "${config.clan.core.settings.directory}/machines/chungus/facts/ssh.rbackup.id_ed25519.pub"
-            "${config.clan.core.settings.directory}/machines/chungus/facts/ssh.paperless-ngx.id_ed25519.pub"
-          ];
-          environment.systemPackages = [ pkgs.borgbackup ];
-        };
-
       defaultModules = [
         # make flake inputs accessiable in NixOS
         {
           _module.args.self = self;
           _module.args.inputs = self.inputs;
         }
+        # ssh keys
+        (
+          { config, ... }:
+          {
+            users.users.root.openssh.authorizedKeys.keyFiles = [
+              # master key
+              ./assets/mrvandalo_rsa.pub
+              # backup key
+              "${config.clan.core.clanDir}/machines/chungus/facts/ssh.syncoid.id_ed25519.pub"
+              "${config.clan.core.clanDir}/machines/chungus/facts/ssh.rbackup.id_ed25519.pub"
+            ];
+          }
+        )
         {
           # disable emergency mode everywhere, although it might be needed on laptops
           boot.initrd.systemd.emergencyAccess = false;
@@ -250,9 +256,7 @@
               "nix-command"
               "flakes"
             ];
-            # https://nix.dev/manual/nix/2.17/advanced-topics/cores-vs-jobs
             nix.settings.max-jobs = 1;
-            nix.settings.cores = 4;
             # no channesl needed this way
             nix.nixPath = [ "nixpkgs=${pkgs.path}" ];
 
@@ -265,23 +269,20 @@
               ./components
               ./features
               #./modules
-              clan-core.nixosModules.clanCore
+              inputs.clan-core.nixosModules.clanCore
-              telemetry.nixosModules.telemetry
               {
-                clan.core.settings.directory = ./.; # fixes issues with clanCore https://git.clan.lol/clan/clan-core/issues/1979
+                clan.core.clanDir = ./.; # fixes issues with clanCore https://git.clan.lol/clan/clan-core/issues/1979
               }
               # inputs.stylix.nixosModules.stylix # fixme: not working
               permown.nixosModules.permown
+              kmonad.nixosModules.default
               home-manager.nixosModules.home-manager
+              # retiolum.nixosModules.retiolum # fixme: not working
             ];
 
             boot.loader.systemd-boot.configurationLimit = lib.mkDefault 10;
             boot.loader.generic-extlinux-compatible.configurationLimit = lib.mkDefault 10;
             boot.loader.grub.configurationLimit = lib.mkDefault 10;
-            environment.systemPackages = [
-              pkgs.systemctl-find-service-config
-              pkgs.healthchecks
-            ];
           }
         )
         # My Structure
@@ -291,8 +292,8 @@
         #./system/all # todo : spread this across features and components
 
         # some modules I always use
-        telemetry.nixosModules.telemetry
         permown.nixosModules.permown
+        kmonad.nixosModules.default
         # some default things I always want
         (
           { pkgs, ... }:
@@ -321,28 +322,25 @@
               # https://github.com/danth/stylix/issues/543
               stylix.targets.hyprpaper.enable = lib.mkForce false;
               stylix.targets.hyprland.enable = lib.mkForce false;
-              stylix.targets.swaylock.enable = lib.mkForce false;
-              stylix.targets.qt.platform = "qtct";
-
-              # running into strange problems
-              # fixme: remove if possible
-              stylix.targets.vim.enable = lib.mkForce false;
             }
           ];
           stylix.fonts = {
             serif = {
-              package = pkgs.nerd-fonts.ubuntu;
+              package = pkgs.nerdfonts.override { fonts = [ "Ubuntu" ]; };
               name = "Ubuntu";
             };
             sansSerif = {
-              package = pkgs.nerd-fonts.ubuntu;
+              package = pkgs.nerdfonts.override { fonts = [ "Ubuntu" ]; };
               name = "Ubuntu";
             };
             monospace = {
-              package = pkgs.nerd-fonts.jetbrains-mono;
+              package = pkgs.nerdfonts.override { fonts = [ "JetBrainsMono" ]; };
               name = "JetBrains Mono";
             };
-            emoji = config.stylix.fonts.monospace;
+            emoji = {
+              package = pkgs.noto-fonts-emoji;
+              name = "Noto Color Emoji";
+            };
             sizes.popups = 15;
           };
         };
@@ -361,7 +359,6 @@
           home-manager.backupFileExtension = "backup";
           home-manager.sharedModules = [
             home-manager-utils.hmModule
-            taskwarrior.hmModules.bugwarrior
           ];
         };
 
@@ -378,10 +375,9 @@
         systems = [ "x86_64-linux" ];
         imports = [
           clan-core.flakeModules.default
-          healthchecks.flakeModule
           ./nix/formatter.nix
-          ./nix/devshells.nix
           ./nix/packages
+          ./nix/verify
           ./nix/topology
         ];
 
@@ -393,13 +389,35 @@
 
           machines = {
 
+            cream = clanSetup {
+              name = "cream";
+              host = "cream.bear";
+              modules = [
+                zerotierModules
+                nixos-hardware.nixosModules.framework-12th-gen-intel
+                retiolum.nixosModules.retiolum
+                private-parts.nixosModules.cream
+                homeManagerModules
+                stylixModules
+                { home-manager.users.mainUser.gui.enable = true; }
+                {
+                  home-manager.users.mainUser = import ./homes/palo;
+                  home-manager.users.root = import ./homes/root;
+                }
+                {
+                  clan.core.machineDescription = "Laptop";
+                }
+              ];
+            };
+
             cherry = clanSetup {
               name = "cherry";
               host = "cherry.bear";
               modules = [
-                healthchecks.nixosModules.default
+                self.nixosModules.verify
                 zerotierModules
                 nixos-hardware.nixosModules.framework-13th-gen-intel
+                retiolum.nixosModules.retiolum
                 private-parts.nixosModules.cherry
                 homeManagerModules
                 stylixModules
@@ -409,17 +427,8 @@
                   home-manager.users.root = import ./homes/root;
                 }
                 {
-                  clan.core.settings.machine.description = "Laptop";
+                  clan.core.machineDescription = "Laptop";
                 }
-                (
-                  { config, ... }:
-                  {
-                    # keys only to access cherry
-                    users.users.root.openssh.authorizedKeys.keyFiles = [
-                      "${config.clan.core.settings.directory}/machines/cherry/facts/ssh.root.cherry.id_ed25519.pub"
-                    ];
-                  }
-                )
               ];
             };
 
@@ -427,28 +436,20 @@
               name = "chungus";
               host = "chungus.bear";
               modules = [
-                healthchecks.nixosModules.default
+                self.nixosModules.verify
                 zerotierModules
                 zerotierControllerModule
                 homeManagerModules
                 stylixModules
+                retiolum.nixosModules.retiolum
                 private-parts.nixosModules.chungus
                 {
                   home-manager.users.mainUser = import ./homes/palo;
                   home-manager.users.root = import ./homes/root;
                 }
                 {
-                  clan.core.settings.machine.description = "Home Server";
+                  clan.core.machineDescription = "Home Server";
                 }
-                (
-                  { config, ... }:
-                  {
-                    # keys only to access chungus
-                    users.users.root.openssh.authorizedKeys.keyFiles = [
-                      "${config.clan.core.settings.directory}/machines/cherry/facts/ssh.root.chungus.id_ed25519.pub"
-                    ];
-                  }
-                )
               ];
             };
 
@@ -457,13 +458,11 @@
               host = "orbi.bear";
               #host = "95.216.66.212";
               modules = [
-                defaultAuthorizedKeys
+                self.nixosModules.verify
-                healthchecks.nixosModules.default
                 homeManagerModules
                 stylixModules
                 zerotierModules
                 srvos.nixosModules.hardware-hetzner-online-intel
-                private-parts.nixosModules.orbi
                 #srvos.nixosModules.server
                 #srvos.nixosModules.mixins-terminfo
                 {
@@ -471,7 +470,7 @@
                   home-manager.users.root = import ./homes/root;
                 }
                 {
-                  clan.core.settings.machine.description = "Internet Server";
+                  clan.core.machineDescription = "Internet Server";
                 }
               ];
             };
@@ -481,7 +480,6 @@
               #host = "167.235.205.150";
               host = "95.217.18.54";
               modules = [
-                defaultAuthorizedKeys
                 homeManagerModules
                 stylixModules
                 srvos.nixosModules.hardware-hetzner-cloud
@@ -493,7 +491,7 @@
                   home-manager.users.root = import ./homes/root;
                 }
                 {
-                  clan.core.settings.machine.description = "Dummy Internet Server";
+                  clan.core.machineDescription = "Dummy Internet Server";
                 }
               ];
             };
@@ -503,7 +501,6 @@
               #host = "usbstick.bear";
               host = "10.100.0.100";
               modules = [
-                defaultAuthorizedKeys
                 homeManagerModules
                 stylixModules
                 zerotierModules
@@ -513,7 +510,7 @@
                   home-manager.users.root = import ./homes/root;
                 }
                 {
-                  clan.core.settings.machine.description = "USB-Stick for Backup";
+                  clan.core.machineDescription = "USB-Stick for Backup";
                 }
               ];
             };

homes/common/default.nix

@@ -1,14 +1,12 @@
 { lib, ... }:
 {
-
   imports = [
     ./editor.nix
     ./network.nix
-    ./starship-rs
+    ./oh-my-posh
     ./packages.nix
     ./terminal.nix
     ./zfs.nix
   ];
-
   options.gui.enable = lib.mkEnableOption "should GUI packages be anabled?";
 }

homes/common/editor.nix

@@ -4,6 +4,7 @@
     enable = true;
     defaultEditor = lib.mkDefault true;
   };
-  #  enable = true;
+  programs.helix = {
-  #};
+    enable = true;
+  };
 }

homes/common/oh-my-posh/default.nix

@@ -0,0 +1,15 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+with lib;
+{
+  programs.oh-my-posh = {
+    enable = true;
+    # https://ohmyposh.dev/docs/themes
+    #useTheme = "gmay"; # ganz nice, aber farben sind ein bisl schrill
+    settings = builtins.fromJSON (builtins.readFile ./gmay.json);
+  };
+}

homes/common/oh-my-posh/gmay.json

@@ -0,0 +1,121 @@
+{
+  "$schema": "https://raw.githubusercontent.com/JanDeDobbeleer/oh-my-posh/main/themes/schema.json",
+  "blocks": [
+    {
+      "alignment": "left",
+      "segments": [
+        {
+          "background": "#076678",
+          "foreground": "#EBDBB2",
+          "leading_diamond": "\ue0b6",
+          "style": "diamond",
+          "template": " {{ if .WSL }}WSL at {{ end }}{{.Icon}} ",
+          "type": "os"
+        },
+        {
+          "background": "#AF3A03",
+          "foreground": "#EBDBB2",
+          "powerline_symbol": "\ue0b0",
+          "style": "powerline",
+          "template": " \uf0e7 ",
+          "type": "root"
+        },
+        {
+          "background": "#076678",
+          "foreground": "#EBDBB2",
+          "powerline_symbol": "\ue0b0",
+          "style": "powerline",
+          "template": " {{ if .SSHSession }}\ueba9 {{ end }}{{ .UserName }}@{{ .HostName }} ",
+          "type": "session"
+        },
+        {
+          "background": "#B57614",
+          "foreground": "#EBDBB2",
+          "powerline_symbol": "\ue0b0",
+          "properties": {
+            "style": "full"
+          },
+          "style": "powerline",
+          "template": " \ue5ff {{ .Path }} ",
+          "type": "path"
+        },
+        {
+          "background": "#79740E",
+          "foreground": "#EBDBB2",
+          "powerline_symbol": "\ue0b0",
+          "properties": {
+            "time_format": "2006-01-02 15:04:05"
+          },
+          "style": "powerline",
+          "template": " {{ .CurrentDate | date .Format }} ",
+          "type": "time"
+        },
+        {
+          "type": "project",
+          "style": "powerline",
+          "powerline_symbol": "",
+          "foreground": "#193549",
+          "background": "#ffeb3b",
+          "template": " {{ if .Error }}{{ .Error }}{{ else }}{{ if .Version }} {{.Version}}{{ end }} {{ if .Name }}{{ .Name }}{{ end }}{{ end }} "
+        },
+        {
+          "type": "git",
+          "style": "powerline",
+          "powerline_symbol": "",
+          "background": "#427b58",
+          "foreground": "#EBDBB2",
+          "background_templates": [
+            "{{ if or (.Working.Changed) (.Staging.Changed) }}#8f3f71{{ end }}",
+            "{{ if and (gt .Ahead 0) (gt .Behind 0) }}#076678{{ end }}",
+            "{{ if gt .Ahead 0 }}#076678{{ end }}",
+            "{{ if gt .Behind 0 }}#076678{{ end }}"
+          ],
+          "template": "{{ .UpstreamIcon }}{{ .HEAD }}{{if .BranchStatus }} {{ .BranchStatus }}{{ end }}{{ if .Working.Changed }}  {{ .Working.String }}{{ end }}{{ if and (.Working.Changed) (.Staging.Changed) }} |{{ end }}{{ if .Staging.Changed }}  {{ .Staging.String }}{{ end }}{{ if gt .StashCount 0 }}  {{ .StashCount }}{{ end }}",
+          "properties": {
+            "fetch_status": true,
+            "fetch_upstream_icon": true,
+            "untracked_modes": {
+              "/Users/user/Projects/oh-my-posh/": "no"
+            },
+            "source": "cli",
+            "mapped_branches": {
+              "feat/*": "🚀 ",
+              "bug/*": "🐛 "
+            }
+          }
+        },
+        {
+          "background": "#427B58",
+          "background_templates": [
+            "{{ if gt .Code 0 }}#9D0006{{ end }}"
+          ],
+          "foreground": "#EBDBB2",
+          "leading_diamond": "<transparent,background>\ue0b0</>",
+          "properties": {
+            "always_enabled": true
+          },
+          "style": "diamond",
+          "template": " \ueb05 ",
+          "trailing_diamond": "\ue0b4",
+          "type": "status"
+        }
+      ],
+      "type": "prompt"
+    },
+    {
+      "alignment": "left",
+      "newline": true,
+      "segments": [
+        {
+          "foreground": "#076678",
+          "style": "plain",
+          "template": "\uf0a9 ",
+          "type": "text"
+        }
+      ],
+      "type": "prompt"
+    }
+  ],
+  "final_space": true,
+  "version": 2
+}

homes/common/oh-my-posh/gruvbox.json

@@ -0,0 +1,69 @@
+{
+  "$schema": "https://raw.githubusercontent.com/JanDeDobbeleer/oh-my-posh/main/themes/schema.json",
+  "blocks": [
+    {
+      "alignment": "left",
+      "segments": [
+        {
+          "background": "#3A3A3A",
+          "foreground": "#ffffff",
+          "style": "powerline",
+          "template": "{{ if .WSL }}WSL at{{ end }} {{.Icon}} ",
+          "type": "os"
+        },
+        {
+          "background": "#fbf1c7",
+          "background_templates": [
+            "{{ if .Root }}#af3a03{{ end }}"
+          ],
+          "foreground": "#282828",
+          "foreground_templates": [
+            "{{ if .Root }}#fbf1c7{{ end }}"
+          ],
+          "powerline_symbol": "\ue0b0",
+          "style": "powerline",
+          "template": " {{ if .SSHSession }} {{ end }}{{ .HostName }} ",
+          "type": "session"
+        },
+        {
+          "background": "#458588",
+          "foreground": "#282828",
+          "powerline_symbol": "\ue0b0",
+          "properties": {
+            "style": "full"
+          },
+          "style": "powerline",
+          "template": " {{ .Path }} ",
+          "type": "path"
+        },
+        {
+          "background": "#98971A",
+          "background_templates": [
+            "{{ if or (.Working.Changed) (.Staging.Changed) }}#FF9248{{ end }}",
+            "{{ if and (gt .Ahead 0) (gt .Behind 0) }}#ff4500{{ end }}",
+            "{{ if gt .Ahead 0 }}#B388FF{{ end }}",
+            "{{ if gt .Behind 0 }}#B388FF{{ end }}"
+          ],
+          "foreground": "#282828",
+          "leading_diamond": "\ue0b6",
+          "powerline_symbol": "\ue0b0",
+          "properties": {
+            "branch_max_length": 25,
+            "fetch_stash_count": true,
+            "fetch_status": true,
+            "branch_icon": "\uE0A0 ",
+            "branch_identical_icon": "\u25CF"
+          },
+          "style": "powerline",
+          "template": " {{ .HEAD }}{{if .BranchStatus }} {{ .BranchStatus }}{{ end }}{{ if .Working.Changed }} \uf044 {{ .Working.String }}{{ end }}{{ if and (.Working.Changed) (.Staging.Changed) }} |{{ end }}{{ if .Staging.Changed }} \uf046 {{ .Staging.String }}{{ end }}{{ if gt .StashCount 0 }} \ueb4b {{ .StashCount }}{{ end }} ",
+          "trailing_diamond": "\ue0b4",
+          "type": "git"
+        }
+      ],
+      "type": "prompt"
+    }
+  ],
+  "console_title_template": "{{ .Folder }}",
+  "final_space": true,
+  "version": 2
+}

homes/common/packages.nix

@@ -23,9 +23,7 @@ with lib;
 
         gimoji
 
-        #tldr
+        tldr
-        tealdeer
-        navi # cheatsheet manager
 
         bandwhich # todo : put this to common/networking.nix
 
@@ -39,12 +37,8 @@ with lib;
         (writers.writeBashBin "vulnix-system" ''
           ${vulnix}/bin/vulnix --profile /nix/var/nix/profiles/system
         '')
-
-        # cpu load monitor
-        glances
       ];
 
-      # cpu load monitor
       programs.btop.enable = true;
 
     }

homes/common/starship-rs/default.nix

@@ -1,33 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}:
-with lib;
-with config.lib.stylix.colors.withHashtag;
-
-{
-  programs.starship = {
-    enable = true;
-    # download presets from : https://starship.rs/presets/
-    settings = builtins.fromTOML ((builtins.readFile ./gruvbox-rainbow.toml)) // {
-      palettes.stylix = {
-        color_fg0 = base01;
-        color_terminal_fg = base05;
-        color_terminal_bg = base00;
-        color_bg1 = base04;
-        color_bg2 = base02;
-        color_bg3 = base03;
-        color_blue = base0D;
-        color_aqua = base0C;
-        color_green = base0B;
-        color_orange = base0F;
-        color_purple = base0E;
-        color_red = base08;
-        color_yellow = base0A;
-      };
-    };
-  };
-
-}

homes/common/starship-rs/gruvbox-rainbow.toml

@@ -1,184 +0,0 @@
-"$schema" = 'https://starship.rs/config-schema.json'
-
-format = """
-$os\
-$username\
-$hostname \
-[](bg:color_yellow fg:color_terminal_bg)\
-$directory\
-[](fg:color_yellow bg:color_aqua)\
-$git_branch\
-$git_status\
-[](fg:color_aqua bg:color_blue)\
-$c\
-$rust\
-$golang\
-$nodejs\
-$php\
-$java\
-$kotlin\
-$haskell\
-$python\
-[](fg:color_blue bg:color_bg3)\
-$docker_context\
-$conda\
-[](fg:color_bg3 bg:color_bg1)\
-$time\
-[ ](fg:color_bg1)\
-$character"""
-
-palette = 'stylix' # we use stylix instead of gruvbox_dark
-
-# todo : use stylix/base16 scheme
-[palettes.gruvbox_dark]
-color_fg0 = '#fbf1c7'
-color_terminal_bg = '#fbf1c7' # original background
-color_terminal_fg = '#3c3836' # original foreground
-color_bg1 = '#3c3836'
-color_bg2 = '#665c54'
-color_bg3 = '#665c54'
-color_blue = '#458588'
-color_aqua = '#689d6a'
-color_green = '#98971a'
-color_orange = '#d65d0e'
-color_purple = '#b16286'
-color_red = '#cc241d'
-color_yellow = '#d79921'
-
-[os]
-disabled = false
-style = "bold bg:color_blue fg:color_terminal_bg"
-#format = "[$symbol ]($style)"
-format = "[](color_blue)[$symbol ]($style)[ ](fg:color_blue bg:color_terminal_bg)"
-
-
-[os.symbols]
-Alpine = ""
-Amazon = ""
-Android = ""
-Arch = "󰣇"
-Artix = "󰣇"
-CentOS = ""
-Debian = "󰣚"
-EndeavourOS = ""
-Fedora = "󰣛"
-Gentoo = "󰣨"
-Linux = "󰌽"
-Macos = "󰀵"
-Manjaro = ""
-Mint = "󰣭"
-NixOS = ""
-Pop = ""
-Raspbian = "󰐿"
-RedHatEnterprise = "󱄛"
-Redhat = "󱄛"
-SUSE = ""
-Ubuntu = "󰕈"
-Windows = "󰍲"
-
-[username]
-show_always = true
-style_user = "bg:color_terminal_bg fg:color_terminal_fg"
-style_root = "bg:color_terminal_bg fg:color_red bold"
-format = '[$user]($style)'
-
-[hostname]
-ssh_only = true
-style = "bg:color_terminal_bg fg:color_terminal_fg"
-ssh_symbol = "@"
-format = "[$ssh_symbol$hostname]($style)"
-
-[directory]
-style = "fg:color_fg0 bg:color_yellow"
-format = "[ $path ]($style)"
-truncation_length = 3
-truncation_symbol = "…/"
-
-[directory.substitutions]
-"Documents" = "󰈙 "
-"Downloads" = " "
-"Music" = "󰝚 "
-"Pictures" = " "
-"Developer" = "󰲋 "
-"dev" = "󰲋 "
-
-[git_branch]
-symbol = ""
-style = "bg:color_aqua"
-format = '[[ $symbol $branch ](fg:color_fg0 bg:color_aqua)]($style)'
-
-[git_status]
-style = "bg:color_aqua"
-format = '[[($all_status$ahead_behind )](fg:color_fg0 bg:color_aqua)]($style)'
-
-[nodejs]
-symbol = ""
-style = "bg:color_blue"
-format = '[[ $symbol( $version) ](fg:color_fg0 bg:color_blue)]($style)'
-
-[c]
-symbol = " "
-style = "bg:color_blue"
-format = '[[ $symbol( $version) ](fg:color_fg0 bg:color_blue)]($style)'
-
-[rust]
-symbol = ""
-style = "bg:color_blue"
-format = '[[ $symbol( $version) ](fg:color_fg0 bg:color_blue)]($style)'
-
-[golang]
-symbol = ""
-style = "bg:color_blue"
-format = '[[ $symbol( $version) ](fg:color_fg0 bg:color_blue)]($style)'
-
-[php]
-symbol = ""
-style = "bg:color_blue"
-format = '[[ $symbol( $version) ](fg:color_fg0 bg:color_blue)]($style)'
-
-[java]
-symbol = ""
-style = "bg:color_blue"
-format = '[[ $symbol( $version) ](fg:color_fg0 bg:color_blue)]($style)'
-
-[kotlin]
-symbol = ""
-style = "bg:color_blue"
-format = '[[ $symbol( $version) ](fg:color_fg0 bg:color_blue)]($style)'
-
-[haskell]
-symbol = ""
-style = "bg:color_blue"
-format = '[[ $symbol( $version) ](fg:color_fg0 bg:color_blue)]($style)'
-
-[python]
-symbol = ""
-style = "bg:color_blue"
-format = '[[ $symbol( $version) ](fg:color_fg0 bg:color_blue)]($style)'
-
-[docker_context]
-symbol = ""
-style = "bg:color_bg3"
-format = '[[ $symbol( $context) ](fg:color_fg0 bg:color_bg3)]($style)'
-
-[conda]
-style = "bg:color_bg3"
-format = '[[ $symbol( $environment) ](fg:color_fg0 bg:color_bg3)]($style)'
-
-[time]
-disabled = false
-time_format = "%R"
-style = "bg:color_bg1"
-format = '[[  $time ](fg:color_fg0 bg:color_bg1)]($style)'
-
-[line_break]
-disabled = false
-
-[character]
-disabled = false
-success_symbol = "[](fg:color_bg2)[ ](bold fg:color_terminal_fg bg:color_bg2)[](fg:color_bg2)"
-error_symbol = "[](fg:color_bg2)[ ](bold fg:color_red bg:color_bg2)[](fg:color_bg2)"
-vimcmd_symbol = '[](bold fg:color_green)'
-vimcmd_replace_one_symbol = '[](bold fg:color_purple)'
-vimcmd_replace_symbol = '[](bold fg:color_purple)'
-vimcmd_visual_symbol = '[](bold fg:color_yellow)'

homes/common/terminal.nix

@@ -37,4 +37,29 @@
     enableZshIntegration = true;
   };
 
+  # provide better `Ctrl+r` command in terminal
+  programs.atuin = {
+    enable = true;
+    enableBashIntegration = true;
+    enableZshIntegration = true;
+    #package = pkgs.atuin;
+    package = pkgs.legacy_2405.atuin.overrideAttrs (_old: {
+      # as cursed as doing mitigations=off in the kernel command line
+      patches = [ "${assets}/0001-make-atuin-on-zfs-fast-again.patch" ];
+    });
+    settings = {
+      auto_sync = true;
+      sync_frequency = "5m";
+      sync_address = "http://chungus.private:8888";
+      search_mode = "fuzzy";
+      style = "full";
+      inline_height = 20;
+      keymap_mode = "vim-normal";
+
+      # With workspace filtering enabled, Atuin will filter for commands executed
+      # in any directory within a git repository tree.
+      workspaces = true;
+
+    };
+  };
 }

homes/palo/atuin.nix

@@ -1,28 +0,0 @@
-{
-
-  # provide better `Ctrl+r` command in terminal
-  programs.atuin = {
-    enable = true;
-    enableBashIntegration = true;
-    enableZshIntegration = true;
-    daemon.enable = true;
-    settings = {
-      auto_sync = true;
-      sync_frequency = "5m";
-      sync_address = "http://chungus.private:8888";
-      search_mode = "fuzzy";
-      style = "full";
-      inline_height = 20;
-      keymap_mode = "vim-normal";
-
-      # because the daemon can't remember my mode (with  Ctrl-r)
-      filter_mode = "directory";
-
-      # With workspace filtering enabled, Atuin will filter for commands executed
-      # in any directory within a git repository tree.
-      workspaces = true;
-
-    };
-  };
-
-}

homes/palo/default.nix

@@ -3,7 +3,6 @@
 
   imports = [
     ../common
-    ./atuin.nix
     ./git.nix
     ./gpg.nix
     ./gui
@@ -13,7 +12,7 @@
     ./stylix.nix
     ./taskwarrior.nix
     ./tmux.nix
-    #./zellij.nix
+    ./zellij.nix
   ];
 
   home.stateVersion = "22.11";

homes/palo/git.nix

@@ -14,7 +14,6 @@ with pkgs;
       "*.swp"
       "*~"
       ".idea"
-      "*.iml"
       ".*penis.*"
       "result"
       ".envrc"

homes/palo/i3.nix

@@ -87,37 +87,36 @@ in
               format = "$icon $percentage $time";
             }
             { block = "uptime"; }
-            # interferes with `bugwarrior pull`
+            {
-            #            {
+              block = "taskwarrior";
-            #              block = "taskwarrior";
+              interval = 60;
-            #              interval = 60;
+              format = " $icon $count.eng(w:3) todo ";
-            #              format = " $icon $count.eng(w:3) todo ";
+              format_singular = " $icon 1 task ";
-            #              format_singular = " $icon 1 task ";
+              format_everything_done = "";
-            #              format_everything_done = "";
+              warning_threshold = 10;
-            #              warning_threshold = 10;
+              critical_threshold = 20;
-            #              critical_threshold = 20;
+              filters = [
-            #              filters = [
+                {
-            #                {
+                  name = "active";
-            #                  name = "active";
+                  filter = "+PENDING and ( +ACTIVE or +DUETODAY or +TODAY or +OVERDUE )";
-            #                  filter = "+PENDING and ( +ACTIVE or +DUETODAY or +TODAY or +OVERDUE )";
+                }
-            #                }
+              ];
-            #              ];
+            }
-            #            }
+            {
-            #            {
+              block = "taskwarrior";
-            #              block = "taskwarrior";
+              interval = 60;
-            #              interval = 60;
+              format = " $icon $count.eng(w:2) ";
-            #              format = " $icon $count.eng(w:2) ";
+              format_singular = " $icon 1 task ";
-            #              format_singular = " $icon 1 task ";
+              format_everything_done = "";
-            #              format_everything_done = "";
+              warning_threshold = 3;
-            #              warning_threshold = 3;
+              critical_threshold = 5;
-            #              critical_threshold = 5;
+              filters = [
-            #              filters = [
+                {
-            #                {
+                  name = "started";
-            #                  name = "started";
+                  filter = "+PENDING and +ACTIVE";
-            #                  filter = "+PENDING and +ACTIVE";
+                }
-            #                }
+              ];
-            #              ];
+            }
-            #            }
             {
               block = "time";
               interval = 60;
@@ -126,7 +125,7 @@ in
             {
               block = "tea_timer";
               format = " $icon {$minutes:$seconds |}";
-              done_cmd = "${pkgs.noti}/bin/noti -o -t 'Timer Finished' || ${pkgs.noti}/bin/noti -t 'Timer Finished'";
+              done_cmd = "${pkgs.noti}/bin/noti -t 'Timer Finished'";
             }
           ];
         };
@@ -214,12 +213,9 @@ in
               "XF86MonBrightnessDown" = "exec --no-startup-id ${pkgs.brightnessctl}/bin/brightnessctl set 5%-";
 
               # --- Pulse/Pipewire Audio controls --- #
-              "XF86AudioRaiseVolume" =
+              "XF86AudioRaiseVolume" = "exec --no-startup-id ${pkgs.pulseaudio}/bin/pactl set-sink-volume @DEFAULT_SINK@ +5%";
-                "exec --no-startup-id ${pkgs.pulseaudio}/bin/pactl set-sink-volume @DEFAULT_SINK@ +5%";
+              "XF86AudioLowerVolume" = "exec --no-startup-id ${pkgs.pulseaudio}/bin/pactl set-sink-volume @DEFAULT_SINK@ -5%";
-              "XF86AudioLowerVolume" =
+              "XF86AudioMute" = "exec --no-startup-id ${pkgs.pulseaudio}/bin/pactl set-sink-mute @DEFAULT_SINK@ toggle";
-                "exec --no-startup-id ${pkgs.pulseaudio}/bin/pactl set-sink-volume @DEFAULT_SINK@ -5%";
-              "XF86AudioMute" =
-                "exec --no-startup-id ${pkgs.pulseaudio}/bin/pactl set-sink-mute @DEFAULT_SINK@ toggle";
 
               "${modifier}+Return" = "exec ${cfg.config.terminal}";
               "${modifier}+Shift+q" = "exit";
@@ -237,9 +233,6 @@ in
               "${modifier}+Shift+Up" = "move up";
               "${modifier}+Shift+Right" = "move right";
 
-              # sticky window toggle
-              "${modifier}+Shift+s" = "sticky toggle";
-
               "${modifier}+h" = "split h";
               "${modifier}+v" = "split v";
               "${modifier}+f" = "fullscreen toggle";
@@ -322,8 +315,7 @@ in
               "${modifier}+space" = "exec ${rofi}/bin/rofi -show drun -display-drun ''";
               "${modifier}+Shift+c" = "reload";
               "${modifier}+Shift+r" = "restart";
-              "${modifier}+Shift+e" =
+              "${modifier}+Shift+e" = "exec i3-nagbar -t warning -m 'Do you want to exit i3?' -b 'Yes' 'i3-msg exit'";
-                "exec i3-nagbar -t warning -m 'Do you want to exit i3?' -b 'Yes' 'i3-msg exit'";
 
               "${modifier}+r" = "mode resize";
 

homes/palo/packages/development.nix

@@ -16,11 +16,9 @@ with lib;
 
         # general
         jetbrains.idea-ultimate
-        vscode
+        #vscode
 
-        #zed-editor
+        zed-editor
-
-        # minicom # for flipper zero
 
         #jetbrains.mps
         #jetbrains.datagrip
@@ -47,6 +45,8 @@ with lib;
         termtosvg
         vhs
 
+        #legacy_2311.blockdiag
+
         # nomad
         #nomad
         #vault
@@ -106,7 +106,7 @@ with lib;
           tmux
 
           nethogs
-          #netsniff-ng # build problems
+          netsniff-ng
           iftop
 
           # shell
@@ -114,7 +114,6 @@ with lib;
           yq-go
           gojq
           jq
-          fx
           ijq
           miller
 

homes/palo/packages/graphics.nix

@@ -6,45 +6,23 @@
 }:
 with pkgs;
 with lib;
-let
-  use_override = false;
-  bambu-studio =
-    if use_override then
-      pkgs.bambu-studio.overrideAttrs (old: rec {
-        version = "01.10.02.76";
-        src = pkgs.fetchFromGitHub {
-          owner = "bambulab";
-          repo = "BambuStudio";
-          rev = "v${version}";
-          hash = "sha256-LvAi3I5lnnumhOUagyej28uVy0Lgd3e19HNQXOUWSvQ=";
-        };
-      })
-    else
-      pkgs.bambu-studio;
-in
 {
   config = mkIf config.gui.enable {
 
     home.packages = [
 
-      #pureref
+      pureref
       gimp
       inkscape
       imagemagick
       blender
       lightburn
-
+      colorpicker
-      # to convert HEIC -> JPG
-      # heif-dec -q 92 <name>.HEIC
-      libheif
-      darktable
 
       # CAD & 3D Plotting
       openscad
       fstl
-
+      legacy_2311.cura
-      orca-slicer
-      bambu-studio
 
       qrencode
 

homes/palo/packages/logseq.nix

@@ -9,7 +9,7 @@ with lib;
 {
   config = mkIf config.gui.enable {
     home.packages = [
-      pkgs.logseq
+      pkgs.legacy_2405.logseq
     ];
     #home.file.".config/Logseq/Preferences".source = (pkgs.formats.json { }).generate "LogseqPreferences.json"
     #  {

homes/palo/packages/media.nix

@@ -11,9 +11,6 @@ with lib;
 
     (mkIf config.gui.enable {
       home.packages = [
-
-        pkgs.share-via-http
-
         pkgs.freetube
         pkgs.vlc
 

homes/palo/packages/nextcloud.nix

@@ -7,7 +7,7 @@
 with pkgs;
 with lib;
 let
-  nextcloud-client = pkgs.nextcloud-client;
+  nextcloud-client = pkgs.legacy_2311.nextcloud-client;
 
   nextcloudSync =
     folder:
@@ -51,7 +51,6 @@ in
       (nextcloudSync "Kunstbuch")
       (nextcloudSync "Flipper")
       (nextcloudSync "AWS-SolutionArchitect-Professional")
-      (nextcloudSync "windows")
 
       borrow
 

homes/palo/packages/packages.nix

@@ -55,14 +55,6 @@ with lib;
       #seamly2d
       #valentina
 
-      # xorg/x11 macros
-      # ---------------
-      # wait 2 secs, than record mouse movements (use Ctrl-C to stop recording)
-      # > cnee --record --mouse -o ./mouse-events.xnl --time 2
-      # replay 3 times the mouse movements (zsh only)
-      # > repeat 3 cnee --time 2 --replay -f ./mouse-events.xnl
-      xnee
-
     ];
 
   };

homes/palo/packages/social.nix

@@ -9,10 +9,11 @@ with lib;
 {
 
   config = mkIf config.gui.enable {
-    programs.obs-studio.enable = false;
+    programs.obs-studio.enable = true;
     home.packages = [
       emoji-picker
       signal-desktop
+      legacy_2311.fluffychat
     ];
 
   };

homes/palo/stylix.nix

@@ -1,6 +1,8 @@
 { pkgs, config, ... }:
 {
 
+  stylix.targets.swaylock.enable = config.gui.enable;
+
   stylix.base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-light-medium.yaml";
 
   stylix.fonts = {

homes/palo/taskwarrior.nix

@@ -7,22 +7,100 @@
 with lib;
 with types;
 let
+  mkMagicMergeOption =
+    {
+      description ? "",
+      example ? { },
+      default ? { },
+      apply ? id,
+      ...
+    }:
+    mkOption {
+      inherit
+        example
+        description
+        default
+        apply
+        ;
+      type =
+        with lib.types;
+        let
+          valueType =
+            nullOr (oneOf [
+              bool
+              int
+              float
+              str
+              (attrsOf valueType)
+              (listOf valueType)
+            ])
+            // {
+              description = "bool, int, float or str";
+              emptyValue.value = { };
+            };
+        in
+        valueType;
+    };
 
+  #taskwarrior-tui = pkgs.legacy_2311.taskwarrior-tui;
   taskwarrior-tui = pkgs.taskwarrior-tui;
+
   taskwarrior = pkgs.taskwarrior3;
 
 in
 
 {
 
-  config = mkIf config.gui.enable {
+  # bugwarrior (a bit fiddly)
+  imports = [
+    {
 
-    bugwarrior.enable = true;
+      options.bugwarrior.config = mkMagicMergeOption {
+        type = attrs;
+        default = { };
+      };
+
+      config = mkIf config.gui.enable {
+        home.file.".config/bugwarrior/bugwarrior.toml".source =
+          (pkgs.formats.toml { }).generate "bugwarriorrc.toml"
+            (
+              {
+                general.taskrc = pkgs.writeText "taskrc" "data.location=$HOME/.bugwarrior";
+              }
+              // config.bugwarrior.config
+            );
+        home.packages = [
+          pkgs.bugwarrior
+          #export TASKRC=$HOME/.bugwarrior/${pkgs.writeText "bugwarrior.taskrc" "data.location=$HOME/.bugwarrior"}
+          (pkgs.writers.writeBashBin "bugwarrior-sync" ''
+            set -eo pipefail
+
+            mkdir -p $HOME/.bugwarrior
+            touch $HOME/.bugwarrior/taskrc
+
+            export TASKRC=$HOME/.bugwarrior/taskrc
+            export TASKDATA=$HOME/.bugwarrior
+            echo "bugwarrior pull" | ${pkgs.boxes}/bin/boxes -d ansi
+            ${pkgs.bugwarrior}/bin/bugwarrior pull "$@"
+            echo "task export" | ${pkgs.boxes}/bin/boxes -d ansi
+            ${pkgs.taskwarrior}/bin/task export > $HOME/.bugwarrior/bugwarrior.json
+
+            unset TASKRC
+            unset TASKDATA
+            echo "task import" | ${pkgs.boxes}/bin/boxes -d ansi
+            ${taskwarrior}/bin/task import rc.hooks=0 $HOME/.bugwarrior/bugwarrior.json
+          '')
+        ];
+      };
+
+    }
+  ];
+
+  config = mkIf config.gui.enable {
 
     home.packages = [
 
       pkgs.timewarrior
-      pkgs.bugwarrior
 
       taskwarrior
       pkgs.tasksh

homes/tina/stylix.nix

@@ -1,6 +1,8 @@
 { pkgs, config, ... }:
 {
 
+  stylix.targets.swaylock.enable = config.gui.enable;
+
   stylix.base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-light-medium.yaml";
 
   stylix.fonts = {

images/lib/remote-access.nix

@@ -0,0 +1,148 @@
+{
+  # cat ~/.ssh/id_rsa.pub
+  publicSshKey ? "",
+  # remote-install-get-hiddenReceiver
+  hiddenReceiver ? "",
+}:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+
+  imports = [
+    {
+      # system setup
+      networking.hostName = "liveos";
+
+      users.extraUsers = {
+        root = {
+          openssh.authorizedKeys.keys = [ publicSshKey ];
+        };
+      };
+    }
+    {
+      # installed packages
+      environment.systemPackages = with pkgs; [
+        #style
+        most
+        rxvt_unicode.terminfo
+
+        #monitoring tools
+        htop
+        iotop
+
+        #network
+        iptables
+        iftop
+        nmap
+
+        #stuff for dl
+        aria2
+
+        #neat utils
+        pciutils
+        psmisc
+        tmux
+        usbutils
+        git
+
+        #unpack stuff
+        p7zip
+        unzip
+        unrar
+
+        #data recovery
+        ddrescue
+        ntfs3g
+        dosfstools
+      ];
+    }
+    {
+      # bash configuration
+      programs.bash = {
+        enableCompletion = true;
+        interactiveShellInit = ''
+          HISTCONTROL='erasedups:ignorespace'
+          HISTSIZE=65536
+          HISTFILESIZE=$HISTSIZE
+
+          shopt -s checkhash
+          shopt -s histappend histreedit histverify
+          shopt -s no_empty_cmd_completion
+          complete -d cd
+        '';
+        promptInit = ''
+          if test $UID = 0; then
+            PS1='\[\033[1;31m\]\w\[\033[0m\] '
+            PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
+          elif test $UID = 1337; then
+            PS1='\[\033[1;32m\]\w\[\033[0m\] '
+            PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
+          else
+            PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
+            PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
+          fi
+          if test -n "$SSH_CLIENT"; then
+            PS1='\[\033[35m\]\h'" $PS1"
+            PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
+          fi
+        '';
+      };
+    }
+    {
+      # ssh configuration
+      services.openssh.enable = true;
+      services.openssh.passwordAuthentication = false;
+      systemd.services.sshd.wantedBy = lib.mkForce [ "multi-user.target" ];
+    }
+    {
+      # hidden ssh announce
+      config =
+        let
+          torDirectory = "/var/lib/tor";
+          hiddenServiceDir = torDirectory + "/onion/hidden-ssh";
+        in
+        {
+          services.tor = {
+            enable = true;
+            client.enable = true;
+            relay.onionServices.hidden-ssh = {
+              version = 3;
+              map = [
+                {
+                  port = 22;
+                  target.port = 22;
+                }
+              ];
+            };
+          };
+          systemd.services.hidden-ssh-announce = {
+            description = "irc announce hidden ssh";
+            after = [
+              "tor.service"
+              "network-online.target"
+            ];
+            wants = [ "tor.service" ];
+            wantedBy = [ "multi-user.target" ];
+            serviceConfig = {
+              ExecStart = pkgs.writers.writeDash "irc-announce-ssh" ''
+                set -efu
+                until test -e ${hiddenServiceDir}/hostname; do
+                  echo "still waiting for ${hiddenServiceDir}/hostname"
+                  sleep 1
+                done
+                until ${pkgs.tor}/bin/torify ${pkgs.netcat-openbsd}/bin/nc -z ${hiddenReceiver} 1337; do sleep 1; done && \
+                  echo "torify ssh root@$(cat ${hiddenServiceDir}/hostname) -i ~/.ssh/id_rsa" | ${pkgs.tor}/bin/torify ${pkgs.nmap}/bin/ncat ${hiddenReceiver} 1337
+              '';
+              PrivateTmp = "true";
+              User = "tor";
+              Type = "oneshot";
+            };
+          };
+        };
+    }
+  ];
+}

images/machine-init-configuration.nix

@@ -0,0 +1,61 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+
+    "${builtins.fetchTarball "https://github.com/nix-community/disko/archive/master.tar.gz"}/module.nix"
+    (import ./disko-config.nix { })
+  ];
+
+  networking.hostName = "nixos";
+
+  boot.supportedFilesystems = [ "zfs" ];
+  # head -c4 /dev/urandom | od -A none -t x4
+  networking.hostId = "4750e4b8";
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.tmpOnTmpfs = true; # make /tmp a tmpfs (performance!)
+
+  networking.networkmanager.enable = true;
+
+  # Set your time zone.
+  time.timeZone = "Europe/Berlin";
+
+  environment.systemPackages = with pkgs; [
+    vim
+    wget
+    htop
+    silver-searcher
+  ];
+
+  environment.extraInit = ''
+    # use vi shortcuts
+    # ----------------
+    set -o vi
+    EDITOR=vim
+  '';
+
+  services.openssh.enable = true;
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC6uza62+Go9sBFs3XZE2OkugBv9PJ7Yv8ebCskE5WYPcahMZIKkQw+zkGI8EGzOPJhQEv2xk+XBf2VOzj0Fto4nh8X5+Llb1nM+YxQPk1SVlwbNAlhh24L1w2vKtBtMy277MF4EP+caGceYP6gki5+DzlPUSdFSAEFFWgN1WPkiyUii15Xi3QuCMR8F18dbwVUYbT11vwNhdiAXWphrQG+yPguALBGR+21JM6fffOln3BhoDUp2poVc5Qe2EBuUbRUV3/fOU4HwWVKZ7KCFvLZBSVFutXCj5HuNWJ5T3RuuxJSmY5lYuFZx9gD+n+DAEJt30iXWcaJlmUqQB5awcB1S2d9pJ141V4vjiCMKUJHIdspFrI23rFNYD9k2ZXDA8VOnQE33BzmgF9xOVh6qr4G0oEpsNqJoKybVTUeSyl4+ifzdQANouvySgLJV/pcqaxX1srSDIUlcM2vDMWAs3ryCa0aAlmAVZIHgRhh6wa+IXW8gIYt+5biPWUuihJ4zGBEwkyVXXf2xsecMWCAGPWPDL0/fBfY9krNfC5M2sqxey2ShFIq+R/wMdaI7yVjUCF2QIUNiIdFbJL6bDrDyHnEXJJN+rAo23jUoTZZRv7Jq3DB/A5H7a73VCcblZyUmwMSlpg3wos7pdw5Ctta3zQPoxoAKGS1uZ+yTeZbPMmdbw== contact@ingolf-wagner.de"
+  ];
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "22.11"; # Did you read the comment?
+
+}

images/remote-install/README.md

@@ -0,0 +1,19 @@
+# remote installation iso
+
+- `./config.nix` : to generate the installation image
+- `./remote-service.nix` : tor configuration you have to start on your machine.
+
+## Steps
+
+- import `./remote-service.nix` in your `/etc/nixos/configuration.nix`
+- `nixos-rebuild switch`
+- run `remote-install-get-hiddenReceiver` and enter the result in `./config.nix`
+  as `hiddenReceiver`
+- set the public key in `./config.nix`
+- run `nixos-generate -f install-iso -c ./config.nix`
+- prepare the usb stick : `sudo if=<path of the iso> of=/dev/<device> bs=4096`
+- boot the usb-stick at the new machine
+- run `remote-install-start-service`
+- after some time you will see a you can use to login to the new machine.
+
+Now you can do the normal installations procedure.

images/remote-install/config.nix

@@ -0,0 +1,35 @@
+{ pkgs, lib, ... }:
+let
+
+  remote-access = import ../lib/remote-access.nix {
+
+    # cat ~/.ssh/id_rsa.pub
+    publicSshKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC6uza62+Go9sBFs3XZE2OkugBv9PJ7Yv8ebCskE5WYPcahMZIKkQw+zkGI8EGzOPJhQEv2xk+XBf2VOzj0Fto4nh8X5+Llb1nM+YxQPk1SVlwbNAlhh24L1w2vKtBtMy277MF4EP+caGceYP6gki5+DzlPUSdFSAEFFWgN1WPkiyUii15Xi3QuCMR8F18dbwVUYbT11vwNhdiAXWphrQG+yPguALBGR+21JM6fffOln3BhoDUp2poVc5Qe2EBuUbRUV3/fOU4HwWVKZ7KCFvLZBSVFutXCj5HuNWJ5T3RuuxJSmY5lYuFZx9gD+n+DAEJt30iXWcaJlmUqQB5awcB1S2d9pJ141V4vjiCMKUJHIdspFrI23rFNYD9k2ZXDA8VOnQE33BzmgF9xOVh6qr4G0oEpsNqJoKybVTUeSyl4+ifzdQANouvySgLJV/pcqaxX1srSDIUlcM2vDMWAs3ryCa0aAlmAVZIHgRhh6wa+IXW8gIYt+5biPWUuihJ4zGBEwkyVXXf2xsecMWCAGPWPDL0/fBfY9krNfC5M2sqxey2ShFIq+R/wMdaI7yVjUCF2QIUNiIdFbJL6bDrDyHnEXJJN+rAo23jUoTZZRv7Jq3DB/A5H7a73VCcblZyUmwMSlpg3wos7pdw5Ctta3zQPoxoAKGS1uZ+yTeZbPMmdbw==";
+
+    # remote-install-get-hiddenReceiver
+    hiddenReceiver = "";
+
+  };
+in
+{
+
+  imports = [ remote-access ];
+
+  # network configuration
+  # ---------------------
+
+  # no wifi
+  #networking.networkmanager.enable = true;
+
+  # wifi
+  networking.wireless.enable = true;
+  networking.wireless.networks."ssid".psk = "password";
+
+  # configuration
+  environment.extraInit = ''
+    # use vi shortcuts
+    # ----------------
+    set -o vi
+    EDITOR=vim
+  '';
+}

images/remote-install/remote-install.nix

@@ -0,0 +1,18 @@
+# installs scripts and tor to provide an announcement service for nixos-remote installation.
+{
+  services.tor = {
+    enable = true;
+    client.enable = true;
+    relay.onionServices.liveos.map = [ { port = 1337; } ];
+  };
+
+  environment.systemPackages = [
+    (pkgs.writeShellScriptBin "remote-install-start-service" ''
+      echo "starting announcment server to receive remote-install iso onion id"
+      ${pkgs.nmap}/bin/ncat -k -l -p 1337
+    '')
+    (pkgs.writeShellScriptBin "remote-install-get-hiddenReceiver" ''
+      sudo cat /var/lib/tor/onion/liveos/hostname
+    '')
+  ];
+}

images/translate-setup/README.md

@@ -0,0 +1,34 @@
+# Create a easy to use Image for translation
+
+using [nixos-generators](https://github.com/nix-community/nixos-generators).
+
+## generate easy to use iso
+
+```
+nixos-generate -f install-iso -c config.nix
+```
+
+## generate vmware image
+
+```
+nixos-generate -f vmware -c config.nix
+```
+
+## run locally using qcow
+
+```
+nixos-generate --run -c config.nix
+```
+
+## how to install nixos-generators
+
+```
+nix-shell -I nixpkgs=channel:nixos-unstable -p nixos-generators
+```
+
+## how to start download service
+
+```
+iptables -F # kill firewall
+python -m http.server 80 # nix-shell -p python3Full
+```

images/translate-setup/audio.nix

@@ -0,0 +1,22 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+{
+  users.users.mainUser.extraGroups = [
+    "audio"
+    "pipewire"
+  ];
+
+  hardware.pulseaudio = {
+    enable = true;
+    package = pkgs.pulseaudioFull;
+  };
+
+  environment.systemPackages = with pkgs; [
+    alsaUtils
+    pavucontrol
+  ];
+}

images/translate-setup/config.nix

@@ -0,0 +1,63 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+{
+
+  imports = [
+    ./x11.nix
+    ./audio.nix
+  ];
+
+  #networking.networkmanager.enable = true;
+  #networking.wireless.enable = false;
+
+  # configuration
+  environment.extraInit = ''
+    # use vi shortcuts
+    # ----------------
+    set -o vi
+    EDITOR=vim
+  '';
+
+  services.xserver.displayManager.sessionCommands = ''
+    ${pkgs.mumble}/bin/mumble mumble://name@lassul.us/party/hard &
+    ${pkgs.vlc}/bin/vlc &
+    ${pkgs.pavucontrol}/bin/pavucontrol &
+  '';
+
+  networking.hostName = "translate";
+
+  programs.bash = {
+    enableCompletion = true;
+    interactiveShellInit = ''
+      HISTCONTROL='erasedups:ignorespace'
+      HISTSIZE=65536
+      HISTFILESIZE=$HISTSIZE
+
+      shopt -s checkhash
+      shopt -s histappend histreedit histverify
+      shopt -s no_empty_cmd_completion
+      complete -d cd
+    '';
+    promptInit = ''
+      if test $UID = 0; then
+        PS1='\[\033[1;31m\]\w\[\033[0m\] '
+        PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
+      elif test $UID = 1337; then
+        PS1='\[\033[1;32m\]\w\[\033[0m\] '
+        PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
+      else
+        PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
+        PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
+      fi
+      if test -n "$SSH_CLIENT"; then
+        PS1='\[\033[35m\]\h'" $PS1"
+        PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
+      fi
+    '';
+  };
+
+}

images/translate-setup/x11.nix

@@ -0,0 +1,60 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+{
+
+  services.xserver = {
+    enable = true;
+    desktopManager = {
+      xterm.enable = false;
+      xfce.enable = true;
+    };
+    displayManager = {
+      defaultSession = "xfce";
+      sddm = {
+        enable = true;
+        autoLogin = {
+          enable = true;
+          relogin = true;
+          user = config.users.users.mainUser.name;
+        };
+      };
+      sessionCommands = ''
+        ${pkgs.mumble}/bin/mumble &
+        ${pkgs.vlc}/bin/vlc &
+        ${pkgs.pavucontrol}/bin/pavucontrol &
+      '';
+    };
+
+    # mouse/touchpad
+    # --------------
+    libinput = {
+      enable = true;
+      disableWhileTyping = true;
+      tapping = true;
+      scrollMethod = "twofinger";
+      accelSpeed = "2";
+    };
+
+  };
+
+  users.users.mainUser = {
+    isNormalUser = true;
+    name = "translator";
+    uid = 1001;
+    initialPassword = "translate";
+  };
+
+  # Packages
+  # --------
+  environment.systemPackages = with pkgs; [
+    flameshot
+    pavucontrol
+    mumble
+    vlc
+  ];
+
+}

images/usb-init-configuration.nix

@@ -0,0 +1,58 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+  ];
+
+  networking.hostName = "nixos";
+
+  # grub configuraton
+  # -----------------
+  boot.loader.grub.enable = true;
+  boot.loader.grub.efiSupport = true;
+  boot.loader.grub.device = "/dev/sdb";
+  boot.loader.grub.efiInstallAsRemovable = true;
+  boot.tmpOnTmpfs = true;
+
+  networking.networkmanager.enable = true;
+
+  # Set your time zone.
+  time.timeZone = "Europe/Berlin";
+
+  environment.systemPackages = with pkgs; [
+    vim
+    wget
+    htop
+    silver-searcher
+  ];
+
+  environment.extraInit = ''
+    # use vi shortcuts
+    # ----------------
+    set -o vi
+    EDITOR=vim
+  '';
+
+  services.openssh.enable = true;
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC6uza62+Go9sBFs3XZE2OkugBv9PJ7Yv8ebCskE5WYPcahMZIKkQw+zkGI8EGzOPJhQEv2xk+XBf2VOzj0Fto4nh8X5+Llb1nM+YxQPk1SVlwbNAlhh24L1w2vKtBtMy277MF4EP+caGceYP6gki5+DzlPUSdFSAEFFWgN1WPkiyUii15Xi3QuCMR8F18dbwVUYbT11vwNhdiAXWphrQG+yPguALBGR+21JM6fffOln3BhoDUp2poVc5Qe2EBuUbRUV3/fOU4HwWVKZ7KCFvLZBSVFutXCj5HuNWJ5T3RuuxJSmY5lYuFZx9gD+n+DAEJt30iXWcaJlmUqQB5awcB1S2d9pJ141V4vjiCMKUJHIdspFrI23rFNYD9k2ZXDA8VOnQE33BzmgF9xOVh6qr4G0oEpsNqJoKybVTUeSyl4+ifzdQANouvySgLJV/pcqaxX1srSDIUlcM2vDMWAs3ryCa0aAlmAVZIHgRhh6wa+IXW8gIYt+5biPWUuihJ4zGBEwkyVXXf2xsecMWCAGPWPDL0/fBfY9krNfC5M2sqxey2ShFIq+R/wMdaI7yVjUCF2QIUNiIdFbJL6bDrDyHnEXJJN+rAo23jUoTZZRv7Jq3DB/A5H7a73VCcblZyUmwMSlpg3wos7pdw5Ctta3zQPoxoAKGS1uZ+yTeZbPMmdbw== contact@ingolf-wagner.de"
+  ];
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "22.11"; # Did you read the comment?
+
+}

images/windows-rescue/README.md

@@ -0,0 +1,14 @@
+# To Fix Windows Issues
+
+## reset password
+
+- use `sfdisk -l` to list partitions
+- find the partition which holds `Windows/System32/config`
+- mount it `mkdir -p /media/sda2; mount /dev/sda2 /media/sda2`
+- `cd /media/sda2/Windows/System32/config`
+- list SAM database `chntpw -l SAM`
+- edit SAM database `chntpw -i SAM`
+- reboot
+
+more details
+[here](https://opensource.com/article/18/3/how-reset-windows-password-linux).

images/windows-rescue/config.nix

@@ -0,0 +1,51 @@
+# NixOS livesystem to reset windows passwords
+# Step by step guide : https://opensource.com/article/18/3/how-reset-windows-password-linux
+# $ nixos-generator -f iso -c config.nix
+{ pkgs, ... }:
+let
+  wifi = {
+    ssid = "";
+    plainTextPassword = "";
+  };
+  remote-access = import ../lib/remote-access.nix {
+    publicSshKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC6uza62+Go9sBFs3XZE2OkugBv9PJ7Yv8ebCskE5WYPcahMZIKkQw+zkGI8EGzOPJhQEv2xk+XBf2VOzj0Fto4nh8X5+Llb1nM+YxQPk1SVlwbNAlhh24L1w2vKtBtMy277MF4EP+caGceYP6gki5+DzlPUSdFSAEFFWgN1WPkiyUii15Xi3QuCMR8F18dbwVUYbT11vwNhdiAXWphrQG+yPguALBGR+21JM6fffOln3BhoDUp2poVc5Qe2EBuUbRUV3/fOU4HwWVKZ7KCFvLZBSVFutXCj5HuNWJ5T3RuuxJSmY5lYuFZx9gD+n+DAEJt30iXWcaJlmUqQB5awcB1S2d9pJ141V4vjiCMKUJHIdspFrI23rFNYD9k2ZXDA8VOnQE33BzmgF9xOVh6qr4G0oEpsNqJoKybVTUeSyl4+ifzdQANouvySgLJV/pcqaxX1srSDIUlcM2vDMWAs3ryCa0aAlmAVZIHgRhh6wa+IXW8gIYt+5biPWUuihJ4zGBEwkyVXXf2xsecMWCAGPWPDL0/fBfY9krNfC5M2sqxey2ShFIq+R/wMdaI7yVjUCF2QIUNiIdFbJL6bDrDyHnEXJJN+rAo23jUoTZZRv7Jq3DB/A5H7a73VCcblZyUmwMSlpg3wos7pdw5Ctta3zQPoxoAKGS1uZ+yTeZbPMmdbw==";
+    hiddenReceiver = "";
+  };
+in
+{
+
+  imports = [ remote-access ];
+
+  environment.systemPackages = [
+    pkgs.chntpw
+    pkgs.ntfs3g
+  ];
+
+  networking.dhcpcd.enable = true;
+  networking.wireless = {
+    enable = true;
+    networks."${wifi.ssid}".psk = wifi.plainTextPassword;
+  };
+
+  environment.extraInit = ''
+    # use vi shortcuts
+    # ----------------
+    set -o vi
+    EDITOR=vim
+  '';
+
+  services.xserver = {
+    enable = true;
+    displayManager.auto.enable = true;
+
+    desktopManager = {
+      default = "xfce";
+      xterm.enable = false;
+      xfce.enable = true;
+      xfce.extraSessionCommands = ''
+        ${pkgs.midori}/bin/midori https://opensource.com/article/18/3/how-reset-windows-password-linux &
+        ${pkgs.xfce.terminal}/bin/xfce4-terminal &
+      '';
+    };
+  };
+}

images/yubikey-image.nix

@@ -0,0 +1,75 @@
+# NixOS livesystem to generate yubikeys in an air-gapped manner
+# screenshot: https://dl.thalheim.io/wmxIqucOEo2xuLk0Ut45fQ/yubikey-live-system.png
+# $ nix-shell -p nixos-generate --run "nixos-generate -f iso -c yubikey-image.nix"
+{ pkgs, ... }:
+let
+  guide = pkgs.stdenv.mkDerivation {
+    name = "yubikey-guide-2019-01-21.html";
+    src = pkgs.fetchFromGitHub {
+      owner = "drduh";
+      repo = "YubiKey-Guide";
+      rev = "035d98ebbed54a0218ccbf23905054d32f97508e";
+      sha256 = "0rzy06a5xgfjpaklxdgrxml24d0vhk78lb577l3z4x7a2p32dbyq";
+    };
+    buildInputs = [ pkgs.pandoc ];
+    installPhase = "pandoc --highlight-style pygments -s --toc README.md -o $out";
+  };
+in
+{
+  environment.interactiveShellInit = ''
+    export GNUPGHOME=/run/user/$(id -u)/gnupghome
+    if [ ! -d $GNUPGHOME ]; then
+      mkdir $GNUPGHOME
+    fi
+    cp ${
+      pkgs.fetchurl {
+        url = "https://raw.githubusercontent.com/drduh/config/662c16404eef04f506a6a208f1253fee2f4895d9/gpg.conf";
+        sha256 = "118fmrsn28fz629y7wwwcx7r1wfn59h3mqz1snyhf8b5yh0sb8la";
+      }
+    } "$GNUPGHOME/gpg.conf"
+    echo "\$GNUPGHOME has been set up for you. Generated keys will be in $GNUPGHOME."
+  '';
+
+  environment.systemPackages = with pkgs; [
+    yubikey-personalization
+    yubikey-personalization-gui
+    yubikey-manager
+    yubikey-manager-qt
+    cryptsetup
+    pwgen
+    midori
+    paperkey
+    gnupg
+    ctmg
+  ];
+
+  services.udev.packages = with pkgs; [ yubikey-personalization ];
+  services.pcscd.enable = true;
+  users.extraUsers.root.initialHashedPassword = "";
+
+  # make sure we are air-gapped
+  networking.wireless.enable = false;
+  networking.dhcpcd.enable = false;
+
+  services.getty.helpLine = "The 'root' account has an empty password.";
+
+  services.displayManager = {
+    defaultSession = "xfce";
+    autoLogin = {
+      enable = true;
+      user = "root";
+    };
+  };
+  services.xserver = {
+    enable = true;
+    desktopManager = {
+      xterm.enable = false;
+      xfce.enable = true;
+    };
+    displayManager = {
+      sessionCommands = ''
+        ${pkgs.midori}/bin/midori ${guide} &
+      '';
+    };
+  };
+}

machines/cherry/configuration.nix

@@ -13,19 +13,18 @@
     ./syncthing.nix
 
     ./network-tinc.nix
+    ./network-tinc_retiolum.nix
     ./network-wireguard-wg0.nix
     ./network-wireguard-wg1.nix
 
     ./37c3.nix
     ./topology.nix
 
-    ./ssh-chungus.nix
-    ./ssh-cherry.nix
-
-    ./ferdium.nix
-
   ];
 
+  #time.timeZone = lib.mkForce "Asia/Bangkok";
+  time.timeZone = lib.mkForce "Asia/Tokyo";
+
   #clan.core.facts.services =
   #  let
   #    promptKey = key:
@@ -46,10 +45,8 @@
   #  (promptKey "pushover.api_key");
 
   components.virtualisation.enable = true;
-  components.virtualisation.qemu.enable = false;
 
   components.gui.enable = true;
-  #components.gui.audio.enable = false;
   components.mainUser.enable = true;
   components.media.enable = true;
   components.media.tts-client.enable = false;
@@ -57,8 +54,9 @@
   components.network.wifi.enable = true;
   components.terminal.enable = true;
 
-  telemetry.enable = true;
+  components.monitor.enable = true;
-  telemetry.apps.opentelemetry.exporter.endpoint = "10.100.0.1:4317"; # orbi
+  components.monitor.opentelemetry.exporter.endpoint = "10.100.0.1:4317"; # orbi
+  #components.monitor.opentelemetry.exporter.debug = "logs";
 
   home-manager.users.mainUser.home.sessionPath = [ "$HOME/.timewarrior/scripts" ];
   # todo: move to homemanager
@@ -68,20 +66,24 @@
         "terranix"
         "my_github"
         "logseq"
-        #"trello" # todo make it work
+        #"nextcloud-deck"
       ];
       log_level = "INFO";
       static_fields = [ "priority" ];
       merge_annotations = false;
+      taskrc = pkgs.writeText "taskrc" ''
+        data.location=$HOME/.bugwarrior
+      '';
     };
-    trello = {
+    nextcloud-deck = {
-      service = "trello";
+      service = "deck";
-      token = "@oracle:eval:${pkgs.pass}/bin/pass show bugwarrior/trello/token";
+      base_uri = "https://nextcloud.ingolf-wagner.de";
-      add_tags = "bugwarrior_pull,trello";
+      username = "palo";
+      password = "@oracle:eval:${pkgs.pass}/bin/pass show bugwarrior/nextcloud-deck/palo";
     };
     logseq = {
       service = "logseq";
-      add_tags = "bugwarrior_pull,logseq";
+      add_tags = "bugwarrior,logseq";
       description_template = "{{logseqtitle}}";
     };
     terranix = {
@@ -91,31 +93,29 @@
       username = "mrVanDalo";
       default_priority = "";
       description_template = "{{githubtitle}} {{githuburl}}";
-      add_tags = "bugwarrior_pull,github";
+      add_tags = "bugwarrior,github";
       project_template = "terranix";
       involved_issues = true;
       query = "org:terranix is:open";
       include_user_issues = false;
       include_user_repos = false;
     };
-    # todo: add gmail
-    # todo: add trello
     my_github = {
       service = "github";
       login = "mrVanDalo";
       token = "@oracle:eval:${pkgs.pass}/bin/pass development/github/mrVanDalo/bugwarriorAccessToken";
       username = "mrVanDalo";
       description_template = "{{githubtitle}} {{githuburl}}";
-      add_tags = "bugwarrior_pull,github";
+      add_tags = "bugwarrior,github";
       include_user_issues = true;
       include_user_repos = true;
       exclude_repos = [
         "azubi"
         "csv-to-qif"
         "stepp0r"
-        "nix-shell-mix"
       ];
     };
+    # todo : add github issues
   };
 
   users.users.mainUser.extraGroups = [ "pipewire" ];
@@ -137,20 +137,20 @@
     };
   };
 
-  #  security.wrappers = {
+  security.wrappers = {
-  #    pmount = {
+    pmount = {
-  #      source = "${pkgs.pmount}/bin/pmount";
+      source = "${pkgs.pmount}/bin/pmount";
-  #      setuid = true;
+      setuid = true;
-  #      owner = "root";
+      owner = "root";
-  #      group = "root";
+      group = "root";
-  #    };
+    };
-  #    pumount = {
+    pumount = {
-  #      source = "${pkgs.pmount}/bin/pumount";
+      source = "${pkgs.pmount}/bin/pumount";
-  #      setuid = true;
+      setuid = true;
-  #      owner = "root";
+      owner = "root";
-  #      group = "root";
+      group = "root";
-  #    };
+    };
-  #  };
+  };
 
   services.printing.enable = true;
 

machines/cherry/facts/ssh.root.cherry.id_ed25519.pub

@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINjJvuEviWlnptuKqA8MQ3QVVdvEGaez1VmShaj56QTg root@cherry

machines/cherry/facts/ssh.root.chungus.id_ed25519.pub

@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDhrmPLOY18azllQEsK+je42aaqnpHm0k3f0bjQEnQXW palo@cherry

machines/cherry/ferdium.nix

@@ -1,49 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-with lib;
-let
-  ferdium = pkgs.writeShellScriptBin "ferdium" ''
-    /var/run/wrappers/bin/sudo -u ferdium -i ${pkgs.ferdium}/bin/ferdium $@
-  '';
-in
-
-{
-
-  environment.systemPackages = [
-
-    ferdium
-    (pkgs.makeDesktopItem {
-      terminal = false;
-      exec = "${ferdium}/bin/ferdium";
-      name = "ferdium";
-      desktopName = "Ferdium";
-      icon = "${pkgs.ferdium}/share/icons/hicolor/512x512/apps/ferdium.png";
-    })
-
-    pkgs.xorg.xhost
-  ];
-
-  users.users.ferdium = {
-    isNormalUser = false;
-    isSystemUser = true;
-    home = "/home/ferdium";
-    createHome = true;
-    extraGroups = [
-      "audio"
-      "input"
-      "video"
-      "pipewire"
-    ];
-    group = "ferdium";
-    shell = pkgs.bashInteractive;
-  };
-  users.groups.ferdium = { };
-
-  security.sudo.extraConfig = ''
-    ${config.users.extraUsers.mainUser.name} ALL=(ferdium) NOPASSWD: ALL
-  '';
-}

machines/cherry/hardware-configuration/graphics.nix

@@ -5,13 +5,17 @@
   hardware.graphics.enable = true;
   hardware.graphics.extraPackages = with pkgs; [
     intel-media-driver # LIBVA_DRIVER_NAME=iHD
-    #intel-vaapi-driver # For older processors. LIBVA_DRIVER_NAME=i965
+    #vaapi-intel-hybrid
+    intel-vaapi-driver # For older processors. LIBVA_DRIVER_NAME=i965
+    #vaapiIntel # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
+    #vaapiVdpau
+    #libvdpau-va-gl
   ];
-  #hardware.graphics.enable32Bit = true;
+  hardware.graphics.enable32Bit = true;
-  #hardware.graphics.extraPackages32 = with pkgs.pkgsi686Linux; [ intel-vaapi-driver ];
+  hardware.graphics.extraPackages32 = with pkgs.pkgsi686Linux; [ intel-vaapi-driver ];
 
-  environment.systemPackages = [
+  environment.sessionVariables = {
-    pkgs.libva-utils # for CLI tools like : vainfo
+    LIBVA_DRIVER_NAME = "i965";
-  ];
+  }; # Optionally, set the environment variable
 
 }

machines/cherry/network-tinc.nix

@@ -1,18 +1,10 @@
-{ pkgs, config, ... }:
+{ config, ... }:
 {
 
   tinc.private.enable = true;
   tinc.private.ipv4 = "10.23.42.29";
 
-  healthchecks.localCommands.ping-private = pkgs.writers.writeBash "ping-private" ''
-    ping -c 1 -W 5 ${config.tinc.private.ipv4}
-  '';
-
   tinc.secret.enable = true;
   tinc.secret.ipv4 = "10.123.42.29";
 
-  healthchecks.localCommands.ping-secret = pkgs.writers.writeBash "ping-secret" ''
-    ping -c 1 -W 5 ${config.tinc.secret.ipv4}
-  '';
-
 }

machines/cherry/network-tinc_retiolum.nix

@@ -0,0 +1,29 @@
+{ config, factsGenerator, ... }:
+{
+
+  clan.core.facts.services.tinc_retiolum = factsGenerator.tinc { name = "retiolum"; };
+
+  networking.retiolum.port = 720;
+  networking.retiolum.nodename = "cherry";
+
+  services.tinc.networks.retiolum = {
+    ed25519PrivateKeyFile =
+      config.clan.core.facts.services.tinc_retiolum.secret."tinc.retiolum.ed25519_key.priv".path;
+    rsaPrivateKeyFile =
+      config.clan.core.facts.services.tinc_retiolum.secret."tinc.retiolum.rsa_key.priv".path;
+  };
+
+  #fileSystems."/retiolum/sicily" = {
+  #  device = "//sicily.r/tonne";
+  #  fsType = "cifs";
+  #  options = [
+  #    "guest"
+  #    "nofail"
+  #    "noauto"
+  #    "ro"
+  #    "rsize=16777216"
+  #    "cache=loose"
+  #    "x-systemd.after=network.target"
+  #  ];
+  #};
+}

machines/cherry/network-wireguard-wg0.nix

@@ -1,16 +1,10 @@
 {
-  pkgs,
   config,
   factsGenerator,
   clanLib,
   ...
 }:
 {
-
-  healthchecks.localCommands.ping-wg0 = pkgs.writers.writeBash "ping-wg0" ''
-    ping -c 1 -W 5 ${config.clan.core.facts.services.wireguard_ip.public."wireguard.wg0.ip".value}
-  '';
-
   networking.firewall.allowedUDPPorts = [ 51820 ];
   clan.core.facts.services.wireguard = factsGenerator.wireguard { name = "wg0"; };
   clan.core.facts.services.wireguard_ip = factsGenerator.public {
@@ -18,9 +12,6 @@
     "wireguard.wg0.ip" = "10.100.0.7";
   };
 
-  # actually important to make machine visible over wireguard
-  services.telegraf.extraConfig.inputs.ping = [ { urls = [ "10.100.0.1" ]; } ];
-
   # Enable WireGuard
   networking.wg-quick.interfaces = {
     # Hub and Spoke Setup

machines/cherry/ssh-cherry.nix

@@ -1,46 +0,0 @@
-{
-  config,
-  factsGenerator,
-  lib,
-  ...
-}:
-let
-  hostname = "cherry";
-in
-{
-
-  # Defines the root SSH key to be used exclusively for accessing a secure machine.
-  # The need for this arises because deployments using the 'clan' command-line tool (e.g. 'clan machines update')
-  # make use of the 'ssh -A' option, which forwards the SSH agent from the client to the target machine.
-  # If the target machine becomes compromised by an attacker,
-  # they could potentially leverage the forwarded SSH agent to access the secure machine.
-  # This file prevents that scenario by restricting access strictly to the defined SSH key,
-  # which is only used to access the secure machine, so no other ssh-agent will contain this ssh key
-
-  clan.core.facts.services."ssh.root.${hostname}" = factsGenerator.ssh {
-    name = "root.${hostname}";
-  };
-
-  systemd.tmpfiles.settings.mainUser = {
-    "/run/facts/ssh.root.${hostname}.id_ed25519"."C+" = {
-      user = config.users.users.mainUser.name;
-      group = config.users.users.mainUser.group;
-      mode = "400";
-      argument =
-        config.clan.core.facts.services."ssh.root.${hostname}".secret."ssh.root.${hostname}.id_ed25519".path;
-    };
-  };
-
-  home-manager.users.mainUser.programs.ssh.matchBlocks =
-    lib.genAttrs
-      [
-        "${hostname}.bear"
-        "${hostname}.private"
-        "${hostname}.wg0"
-      ]
-      (name: {
-        identityFile = "/run/facts/ssh.root.${hostname}.id_ed25519";
-        identitiesOnly = true;
-      });
-
-}

machines/cherry/ssh-chungus.nix

@@ -1,46 +0,0 @@
-{
-  config,
-  factsGenerator,
-  lib,
-  ...
-}:
-let
-  hostname = "chungus";
-in
-{
-
-  # Defines the root SSH key to be used exclusively for accessing a secure machine.
-  # The need for this arises because deployments using the 'clan' command-line tool (e.g. 'clan machines update')
-  # make use of the 'ssh -A' option, which forwards the SSH agent from the client to the target machine.
-  # If the target machine becomes compromised by an attacker,
-  # they could potentially leverage the forwarded SSH agent to access the secure machine.
-  # This file prevents that scenario by restricting access strictly to the defined SSH key,
-  # which is only used to access the secure machine, so no other ssh-agent will contain this ssh key
-
-  clan.core.facts.services."ssh.root.${hostname}" = factsGenerator.ssh {
-    name = "root.${hostname}";
-  };
-
-  systemd.tmpfiles.settings.mainUser = {
-    "/run/facts/ssh.root.${hostname}.id_ed25519"."C+" = {
-      user = config.users.users.mainUser.name;
-      group = config.users.users.mainUser.group;
-      mode = "400";
-      argument =
-        config.clan.core.facts.services."ssh.root.${hostname}".secret."ssh.root.${hostname}.id_ed25519".path;
-    };
-  };
-
-  home-manager.users.mainUser.programs.ssh.matchBlocks =
-    lib.genAttrs
-      [
-        "${hostname}.bear"
-        "${hostname}.private"
-        "${hostname}.wg0"
-      ]
-      (name: {
-        identityFile = "/run/facts/ssh.root.${hostname}.id_ed25519";
-        identitiesOnly = true;
-      });
-
-}

machines/cherry/syncthing.nix

@@ -6,7 +6,7 @@
 }:
 {
 
-  healthchecks.http.syncthing-gui = {
+  verify.http.syncthing-gui = {
     url = config.services.syncthing.guiAddress;
     expectedContent = "syncthing";
   };

machines/chungus/configuration.nix

@@ -15,8 +15,9 @@
 
     ./packages.nix
 
+    ./network-tinc-retiolum.nix # make sure no service is open for this vpn!
     ./network-tinc.nix
-    ./network-wireguard-wg0.nix
+    ./network-wireguard.nix
 
     ./hass-mqtt.nix
     ./hass-zigbee2mqtt.nix
@@ -45,9 +46,6 @@
 
     ./service-atuin.nix
     ./service-forgejo.nix
-    ./service-paperless-backup.nix
-    ./service-paperless-healthchecks.nix
-    ./service-paperless-tika.nix
     ./service-paperless.nix
     ./service-s3.nix
     #./service-taskwarrior.nix
@@ -70,13 +68,11 @@
   features.boot.ssh.kernelModules = [ "e1000e" ];
   features.boot.tor.enable = true;
 
-  telemetry.enable = true;
+  components.monitor.enable = true;
-  telemetry.apps.opentelemetry.receiver.endpoint = "0.0.0.0:4317";
+  components.monitor.opentelemetry.receiver.endpoint = "0.0.0.0:4317";
   networking.firewall.interfaces.wg0.allowedTCPPorts = [ 4317 ];
   networking.firewall.interfaces.wg0.allowedUDPPorts = [ 4317 ];
 
-  healthchecks.closed.wg0.host = "10.100.0.2";
-
   services.printing.enable = false;
 
   networking.hostName = "chungus";

machines/chungus/facts/ssh.paperless-ngx.id_ed25519.pub

@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH5cHogtLN70T5g7b30r2RR4l6TEFB4t8O8FZ+NMUTfj paperless@chungus

machines/chungus/facts/ssh.rbackup.id_ed25519.pub

@@ -1 +1 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJrcZBnx2h1cOlpHImuYhOu08gUdchzbKwbmOMUd54f3 rbackup@chungus
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJrcZBnx2h1cOlpHImuYhOu08gUdchzbKwbmOMUd54f3 nixbld@cream

machines/chungus/facts/ssh.syncoid.id_ed25519.pub

@@ -1 +1 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJHGxMlaCoAyD/lIYAxEts7vyWYJ7ut4P9Cjw7mvAPiL syncoid@chungus
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJHGxMlaCoAyD/lIYAxEts7vyWYJ7ut4P9Cjw7mvAPiL nixbld@cream

machines/chungus/facts/syncoid.ssh.id_ed25519.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICrdJ4EXJ0HeZXTb4AzRKQeAORBWwcawOxj4EJhV62De nixbld@cherry

machines/chungus/hass.nix

@@ -2,7 +2,6 @@
   config,
   lib,
   pkgs,
-  zerotierInterface,
   ...
 }:
 {
@@ -18,6 +17,5 @@
 
   networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8123 ];
   networking.firewall.interfaces.wg0.allowedUDPPorts = [ 8123 ];
-  networking.firewall.interfaces.${zerotierInterface}.allowedTCPPorts = [ 8123 ];
 
 }

machines/chungus/media-audiobookshelf.nix

@@ -2,68 +2,43 @@
   config,
   lib,
   pkgs,
-  zerotierInterface,
   ...
 }:
+with pkgs;
 let
+  port = 8000;
   group = "media";
-  port = 9002;
 in
 {
-
-  healthchecks.http.audiobookshelf-via-zerotier = {
-    url = "${config.networking.hostName}.${config.clan.static-hosts.topLevelDomain}:${toString port}";
-    expectedContent = "audiobookshelf";
-  };
-
-  networking.firewall.interfaces.${zerotierInterface}.allowedTCPPorts = [ port ];
-
   users.users.audiobookshelf = {
     isSystemUser = true;
-    group = lib.mkForce group;
+    group = group;
   };
 
-  #  systemd.services.audiobookshelf = {
+  # make available in retiolum
-  #    enable = true;
+  #networking.firewall.interfaces."tinc.retiolum".allowedTCPPorts = [ port ];
-  #    description = "Self-hosted audiobook server for managing and playing audiobooks";
+  #networking.firewall.interfaces."tinc.retiolum".allowedUDPPorts = [ port ];
-  #    serviceConfig = {
-  #      Type = "simple";
-  #      WorkingDirectory = "/srv/audiobookshelf";
-  #      ExecStart = "${audiobookshelf}/bin/audiobookshelf --port ${toString port}";
-  #      ExecReload = "${util-linux}/bin/kill -HUP $MAINPID";
-  #      Restart = "always";
-  #      User = config.users.users.audiobookshelf.name;
-  #      Group = config.users.users.audiobookshelf.group;
-  #    };
-  #    wantedBy = [ "multi-user.target" ];
-  #    requires = [ "network.target" ];
-  #  };
 
-  services.audiobookshelf = {
+  networking.firewall.interfaces.enp0s31f6.allowedTCPPorts = [ port ];
-    enable = true;
+  networking.firewall.interfaces.enp0s31f6.allowedUDPPorts = [ port ];
-    port = 8000;
-  };
 
-  services.nginx = {
+  networking.firewall.interfaces.wg0.allowedTCPPorts = [ port ];
+  networking.firewall.interfaces.wg0.allowedUDPPorts = [ port ];
+
+  systemd.services.audiobookshelf = {
     enable = true;
-    recommendedProxySettings = true;
+    description = "Self-hosted audiobook server for managing and playing audiobooks";
-    virtualHosts."audiobookshelf.${config.networking.hostName}.${config.clan.static-hosts.topLevelDomain}" =
+    serviceConfig = {
-      {
+      Type = "simple";
-        listen = [
+      WorkingDirectory = "/srv/audiobookshelf";
-          {
+      ExecStart = "${audiobookshelf}/bin/audiobookshelf --port ${toString port}";
-            addr = "[::]";
+      ExecReload = "${util-linux}/bin/kill -HUP $MAINPID";
-            port = port;
+      Restart = "always";
-            ssl = false;
+      User = config.users.users.audiobookshelf.name;
-          }
+      Group = config.users.users.audiobookshelf.group;
-        ];
+    };
-        locations."/" = {
+    wantedBy = [ "multi-user.target" ];
-          proxyPass = "http://127.0.0.1:${toString config.services.audiobookshelf.port}";
+    requires = [ "network.target" ];
-          proxyWebsockets = true;
-          extraConfig = ''
-            proxy_redirect http:// $scheme://;
-          '';
-        };
-      };
   };
 
 }

machines/chungus/media-castget.nix

@@ -4,7 +4,7 @@ let
 in
 {
   services.castget = {
-    enable = false;
+    enable = true;
     user = "media";
     feeds = {
       Alternativlos = {

machines/chungus/media-jellyfin.nix

@@ -7,15 +7,11 @@
 {
   services.jellyfin = {
     enable = true;
-    openFirewall = true;
+    openFirewall = true; # todo: will open for retiolum as well
     group = "media";
     user = "media";
   };
 
-  healthchecks.http.jellyfin = {
-    url = "flix.${config.networking.hostName}.private";
-  };
-
   services.nginx = {
     enable = true;
     virtualHosts."flix.${config.networking.hostName}.private" = {

machines/chungus/media-navidrome.nix

@@ -2,53 +2,17 @@
   config,
   lib,
   pkgs,
-  zerotierInterface,
   ...
 }:
 {
 
-  healthchecks.http.navidrome-tinc = {
-    url = "${config.networking.hostName}.private:${toString config.services.navidrome.settings.Port}/app/#/login";
-    expectedContent = "Navidrome";
-  };
-
-  healthchecks.http.navidrome-via-zerotier = {
-    url = "${config.networking.hostName}.${config.clan.static-hosts.topLevelDomain}:${toString config.services.navidrome.settings.Port}/app/#/login";
-    expectedContent = "Navidrome";
-  };
-
-  networking.firewall.interfaces.${zerotierInterface}.allowedTCPPorts = [
-    config.services.navidrome.settings.Port
-  ];
-
   services.navidrome = {
     enable = true;
     openFirewall = true;
     group = "media";
     user = "media";
-    settings.Address = "[::]";
+    settings.Address = "0.0.0.0";
-    settings.Port = 4533;
     settings.MusicFolder = "/media/arr/lidarr";
   };
 
-  services.nginx = {
-    enable = true;
-    virtualHosts."music.${config.networking.hostName}.private" = {
-      serverAliases = [
-        "music.${config.networking.hostName}.wg0"
-        "music.ingolf-wagner.de"
-      ];
-      locations."/" = {
-        recommendedProxySettings = true;
-        proxyWebsockets = true;
-        proxyPass = "http://localhost:${toString config.services.navidrome.settings.Port}";
-        extraConfig = ''
-          allow ${config.tinc.private.subnet};
-          allow ${config.wireguard.wg0.subnet};
-          deny all;
-        '';
-      };
-    };
-  };
-
 }

machines/chungus/media-syncthing.nix

@@ -6,7 +6,7 @@
 }:
 {
 
-  healthchecks.http.syncthing-gui = {
+  verify.http.syncthing-gui = {
     url = config.services.syncthing.guiAddress;
     expectedContent = "syncthing";
   };

machines/chungus/network-tinc-retiolum.nix

@@ -0,0 +1,14 @@
+{ config, factsGenerator, ... }:
+{
+  clan.core.facts.services.tinc_retiolum = factsGenerator.tinc { name = "retiolum"; };
+
+  networking.retiolum.port = 720;
+  networking.retiolum.nodename = "centauri";
+
+  services.tinc.networks.retiolum = {
+    ed25519PrivateKeyFile =
+      config.clan.core.facts.services.tinc_retiolum.secret."tinc.retiolum.ed25519_key.priv".path;
+    rsaPrivateKeyFile =
+      config.clan.core.facts.services.tinc_retiolum.secret."tinc.retiolum.rsa_key.priv".path;
+  };
+}

machines/chungus/network-tinc.nix

@@ -1,11 +1,6 @@
-{ pkgs, config, ... }:
 {
 
   tinc.private.enable = true;
   tinc.private.ipv4 = "10.23.42.28";
 
-  healthchecks.localCommands.ping-private = pkgs.writers.writeBash "ping-private" ''
-    ping -c 1 -W 5 ${config.tinc.private.ipv4}
-  '';
-
 }

machines/chungus/network-wireguard.nix

@@ -1,16 +1,10 @@
 {
-  pkgs,
   config,
   factsGenerator,
   clanLib,
   ...
 }:
 {
-
-  healthchecks.localCommands.ping-wg0 = pkgs.writers.writeBash "ping-wg0" ''
-    ping -c 1 -W 5 ${config.clan.core.facts.services.wireguard_ip.public."wireguard.wg0.ip".value}
-  '';
-
   networking.firewall.allowedUDPPorts = [ 51820 ];
   clan.core.facts.services.wireguard = factsGenerator.wireguard { name = "wg0"; };
   clan.core.facts.services.wireguard_ip = factsGenerator.public {
@@ -18,9 +12,6 @@
     "wireguard.wg0.ip" = "10.100.0.2";
   };
 
-  # actually important to make machine visible over wireguard
-  services.telegraf.extraConfig.inputs.ping = [ { urls = [ "10.100.0.1" ]; } ];
-
   # Enable WireGuard
   networking.wg-quick.interfaces = {
     # Hub and Spoke Setup

machines/chungus/service-atuin.nix

@@ -1,25 +1,16 @@
 {
-  pkgs,
   config,
+  pkgs,
   assets,
   ...
 }:
 {
-  healthchecks.http.atuin-tinc = {
-    url = "${config.networking.hostName}.private:${toString config.services.atuin.port}";
-    expectedContent = "version";
-  };
-
-  #  healthchecks.http.atuin-wg0 = {
-  #    url = "${config.networking.hostName}.wg0:${toString config.services.atuin.port}";
-  #    expectedContent = "version";
-  #  };
-  #  networking.firewall.interfaces.wg0.allowedTCPPorts = [
-  #    config.services.atuin.port
-  #  ];
-
   services.atuin = {
     enable = true;
+    package = pkgs.legacy_2405.atuin.overrideAttrs (_old: {
+      # as cursed as doing mitigations=off in the kernel command line
+      patches = [ "${assets}/0001-make-atuin-on-zfs-fast-again.patch" ];
+    });
     host = "0.0.0.0";
     maxHistoryLength = 999999;
     openRegistration = false;