Lock file maintenance

Reviewed-on: #2

.gitea/workflows/nix-flake-check.yaml

@@ -0,0 +1,14 @@
+name: nix flake check
+on:
+  push:
+    branches:
+      - 'renovate/**'
+
+jobs:
+  nix-flake-update:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+      - run: /root/.nix-profile/bin/nix flake check --all-systems

.sops.yaml

@@ -2,7 +2,7 @@ keys:
   - &user_patrick 5FA64909521A5C85992F26E0F819AEFF941BB849
   - &host_celestia age1vadwmwh8ckfal7j83gwrwn9324gqufwgkxskznhp9v867amndcwqgp2w6t
   - &host_primordial age12u7ayy2q5dps2pcpc6z7962pz07jxv3tt03hna6jyumlu4fdjvtqdg2n3e
-  - &host_laptop age1fhnujflp29sekvwjgw0ue2hnmjum3fpcj80vly0rkt07u9xwlf7ql25mkk
+  - &host_framework age18kc63lpfutqlw505fkqagumqup6dtpudajeaheueuaf0frjpdc3suz49qk
 creation_rules:
   - path_regex: nixos/celestia/secrets\.yaml$
     key_groups:
@@ -16,3 +16,9 @@ creation_rules:
       - *user_patrick
       age:
       - *host_primordial
+  - path_regex: nixos/framework/secrets\.yaml$
+    key_groups:
+    - pgp:
+      - *user_patrick
+      age:
+      - *host_framework

flake.nix

@@ -3,16 +3,28 @@
 
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-23.11";
-
     flake-utils.url = "github:numtide/flake-utils";
+
+    lanzaboote = {
+      url = "github:nix-community/lanzaboote";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    nur = {
+      url = "github:nix-community/NUR";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     deploy = {
       url = "github:serokell/deploy-rs";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    nurpkgs.url = "github:nix-community/NUR";
-    sops-nix.url = "github:Mic92/sops-nix";
-    lanzaboote.url = "github:nix-community/lanzaboote";
+
     home-manager = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -23,26 +35,8 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    rycee-nurpkgs = {
-      url = "gitlab:rycee/nur-expressions?dir=pkgs/firefox-addons";
-      inputs = {
-        nixpkgs.follows = "nixpkgs";
-        flake-utils.follows = "flake-utils";
-      };
-    };
-
-    nixpkgs-f2k = {
-      url = "github:fortuneteller2k/nixpkgs-f2k";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    devenv = {
-      url = "github:cachix/devenv/latest";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     nixvim = {
-      url = "git+ssh://gitea@git.fuckwit.dev/fuckwit/nixvim";
+      url = "git+https://git.fuckwit.dev/fuckwit/nixvim";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };

home-modules/firefox/default.nix

@@ -0,0 +1,111 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  inherit (lib) mkOption mkEnableOption mkPackageOption types;
+
+  defaultExtensions = with pkgs.nur.repos.rycee.firefox-addons; [
+    bitwarden
+    darkreader
+    i-dont-care-about-cookies
+    privacy-badger
+    ublock-origin
+  ];
+
+  defaultSettings = {
+    "app.normandy.first_run" = false;
+    "app.shield.optoutstudies.enabled" = false;
+
+    # disable updates (pretty pointless with nix)
+    "app.update.channel" = "default";
+
+    "browser.contentblocking.category" = "standard"; # "strict"
+    "browser.ctrlTab.recentlyUsedOrder" = false;
+
+    "browser.download.viewableInternally.typeWasRegistered.svg" = true;
+    "browser.download.viewableInternally.typeWasRegistered.webp" = true;
+    "browser.download.viewableInternally.typeWasRegistered.xml" = true;
+
+    "browser.search.region" = "DE";
+
+    "browser.shell.checkDefaultBrowser" = false;
+    "browser.tabs.loadInBackground" = true;
+    "browser.urlbar.placeholderName" = "EnteEnteLauf";
+    "browser.urlbar.showSearchSuggestionsFirst" = false;
+
+    # disable all the annoying quick actions
+    "browser.urlbar.quickactions.enabled" = false;
+    "browser.urlbar.quickactions.showPrefs" = false;
+    "browser.urlbar.shortcuts.quickactions" = false;
+    "browser.urlbar.suggest.quickactions" = false;
+
+    "distribution.searchplugins.defaultLocale" = "en-US";
+
+    "doh-rollout.balrog-migration-done" = true;
+    "doh-rollout.doneFirstRun" = true;
+
+    "general.useragent.locale" = "en-US";
+
+    "extensions.activeThemeID" = "firefox-compact-dark@mozilla.org";
+
+    "extensions.extensions.activeThemeID" = "firefox-compact-dark@mozilla.org";
+    "extensions.update.enabled" = false;
+    "extensions.webcompat.enable_picture_in_picture_overrides" = true;
+    "extensions.webcompat.enable_shims" = true;
+    "extensions.webcompat.perform_injections" = true;
+    "extensions.webcompat.perform_ua_overrides" = true;
+
+    "privacy.donottrackheader.enabled" = true;
+    "browser.translations.enable" = false;
+
+    # Yubikey
+    "security.webauth.u2f" = true;
+    "security.webauth.webauthn" = true;
+    "security.webauth.webauthn_enable_softtoken" = false;
+    "security.webauth.webauthn_enable_usbtoken" = true;
+
+    "toolkit.legacyUserProfileCustomizations.stylesheets" = true;
+    "layout.word_select.stop_at_punctuation" = false;
+  };
+
+  cfg = config.personal.firefox;
+in {
+  options.personal.firefox = {
+    enable = mkEnableOption "Apply personal firefox defaults.";
+    package = mkPackageOption pkgs "firefox-bin" {};
+
+    extraExtensions = mkOption {
+      type = types.listOf types.package;
+      default = [];
+      description = "Extra Firefox extensions to install.";
+    };
+
+    settings = mkOption {
+      type = types.attrsOf ((pkgs.formats.json {}).type
+        // {
+          description = "Preferences (int, bool, string, and also attrs, list, float as a JSON string)";
+        });
+      default = defaultSettings;
+      description = "Attribute set of preferences.";
+    };
+  };
+
+  config = {
+    programs.firefox = lib.mkIf cfg.enable {
+      enable = true;
+      package = cfg.package;
+
+      profiles = {
+        default = {
+          isDefault = true;
+          id = 0;
+          userChrome = builtins.readFile ./userChrome.css;
+          extensions = defaultExtensions ++ cfg.extraExtensions;
+          inherit (cfg) settings;
+        };
+      };
+    };
+  };
+}

home-modules/firefox/userChrome.css

@@ -0,0 +1,76 @@
+/* Source file https://github.com/MrOtherGuy/firefox-csshacks/tree/master/chrome/toolbars_below_content_v2.css made available under Mozilla Public License v. 2.0
+See the above repository for updates as well as full license text. */
+
+/* This requires Firefox 133
+ * By default tabs will be the top-most toolbar, but you can set the following pref to move them to bottom:
+ * userchrome.toolbars-below-content.tabs-at-bottom.enabled
+ */
+
+#navigator-toolbox{
+  display: contents;
+  --uc-navbar-height: 40px;
+}
+:root[uidensity="compact"] #navigator-toolbox{
+  --uc-navbar-height: 34px;
+}
+#main-window > body > #browser,
+.global-notificationbox,
+ #tab-notification-deck,
+ #toolbar-menubar{
+  order: -1;
+}
+
+#TabsToolbar{
+  max-height: calc((var(--tab-min-height) + 2 * var(--tab-block-margin,0px)) * var(--multirow-n-rows,1));
+}
+#toolbar-menubar,
+#TabsToolbar{
+  background: inherit !important;
+}
+@media (-moz-platform: linux){
+  :root[sizemode="normal"][customtitlebar] #toolbar-menubar{
+    border-top-left-radius: inherit;
+    border-top-right-radius: inherit;
+  }
+  #toolbar-menubar,
+  #TabsToolbar{
+    opacity: 1 !important;
+    will-change: unset !important;
+  }
+  #notification-popup[side="top"]{
+    margin-top: calc(-2 * var(--panel-padding-block) - 40px - 32px - 8.5em) !important;
+  }
+  #permission-popup[side="top"]{
+    margin-top: calc(-2 * var(--panel-padding-block) - 2.5em);
+  }
+}
+
+#nav-bar,
+#PersonalToolbar{
+  background-image: linear-gradient(var(--toolbar-bgcolor),var(--toolbar-bgcolor)), var(--lwt-additional-images,var(--toolbar-bgimage)) !important;
+  background-position: top,var(--lwt-background-alignment);
+  background-position-y: calc(0px - var(--tab-min-height) - 2*var(--tab-block-margin,0px));
+  background-repeat: repeat,var(--lwt-background-tiling);
+}
+:root[lwtheme-image] #nav-bar,
+:root[lwtheme-image] #PersonalToolbar{
+  background-image: linear-gradient(var(--toolbar-bgcolor),var(--toolbar-bgcolor)),var(--lwt-header-image), var(--lwt-additional-images,var(--toolbar-bgimage)) !important;
+}
+#PersonalToolbar{
+  background-position-y: calc(0px - var(--tab-min-height) - 2*var(--tab-block-margin,0px) - var( --uc-navbar-height));
+}
+#urlbar[breakout][breakout-extend]{
+  display: flex !important;
+  flex-direction: column-reverse !important;
+  transform: translateY(calc(var(--urlbar-container-height) - 100%));
+}
+#urlbar[breakout-extend]:not([usertyping]) > .urlbar-input-container::after{
+  display: flex;
+  content: "";
+  height: calc(var(--urlbar-min-height) - 2px - 2 * var(--urlbar-container-padding));
+}
+.urlbarView-body-inner{ border-top-style: none !important; }
+
+#TabsToolbar{
+  order: 3
+}

home-modules/modules-list.nix

@@ -1,5 +1,6 @@
 {...}: {
   imports = [
+    ./firefox
     ./firefox-webapp.nix
   ];
 }

home/configurations.nix

@@ -1,29 +1,18 @@
 {
   nixpkgs,
-  nurpkgs,
+  nur,
   home-manager,
-  devenv,
   nixvim,
   ...
 }: let
   pkgs = import nixpkgs rec {
     system = "x86_64-linux";
-    overlays = [(final: prev: {nixvim = nixvim.packages.${system}.default;})];
-  };
-
-  nur = import nurpkgs {
-    inherit pkgs;
-    nurpkgs = pkgs;
+    overlays = [(final: prev: {nixvim = nixvim.packages.${system}.default;}) nur.overlays.default];
   };
 in {
   work = home-manager.lib.homeManagerConfiguration {
     inherit pkgs;
 
-    extraSpecialArgs = {
-      inherit devenv; # TODO: Remove dependency on devenv
-      ff-addons = nur.repos.rycee.firefox-addons;
-    };
-
     modules = [
       ../home-modules/modules-list.nix
       ./work
@@ -33,12 +22,8 @@ in {
   framework = home-manager.lib.homeManagerConfiguration {
     inherit pkgs;
 
-    extraSpecialArgs = {
-      ff-addons = nur.repos.rycee.firefox-addons;
-    };
-
     modules = [
-      # ../home-modules/modules-list.nix
+      ../home-modules/modules-list.nix
       ./framework
     ];
   };

home/framework/default.nix

@@ -28,6 +28,8 @@
     ./programs
   ];
 
+  services.udiskie.enable = true;
+
   accounts.email.accounts = {
     patrick = {
       primary = true;

home/framework/programs/alacritty/default.nix

@@ -0,0 +1,35 @@
+{...}: {
+  programs.alacritty = {
+    enable = true;
+
+    settings = {
+      general.live_config_reload = true;
+      env.TERM = "xterm-256color";
+      bell.duration = 0;
+      cursor.style = "Block";
+
+      scrolling = {
+        history = 10000;
+        multiplier = 3;
+      };
+
+      window = {
+        opacity = 0.9;
+      };
+
+      mouse.bindings = [
+        {
+          mouse = "Middle";
+          action = "PasteSelection";
+        }
+      ];
+
+      colors = {
+        primary = {
+          background = "0x000000";
+          foreground = "0xeaeaea";
+        };
+      };
+    };
+  };
+}

home/framework/programs/default.nix

@@ -1,4 +1,5 @@
 [
+  ./alacritty
   ./firefox
   ./hyprland
   {

home/framework/programs/firefox/default.nix

@@ -1,92 +1,5 @@
-{
-  pkgs,
-  lib,
-  stdenv,
-  specialArgs,
-  ...
-}: let
-  extensions = with specialArgs.ff-addons; [
-    bitwarden
-    darkreader
-    i-dont-care-about-cookies
-    privacy-badger
-    ublock-origin
-    tree-style-tab
-    # tridactyl
-  ];
-
-  customChrome = builtins.readFile ./userChrome.css;
-
-  userChrome = customChrome;
-
-  # ~/.mozilla/firefox/PROFILE_NAME/prefs.js | user.js
-  settings = {
-    "app.normandy.first_run" = false;
-    "app.shield.optoutstudies.enabled" = false;
-
-    # disable updates (pretty pointless with nix)
-    "app.update.channel" = "default";
-
-    "browser.contentblocking.category" = "standard"; # "strict"
-    "browser.ctrlTab.recentlyUsedOrder" = false;
-
-    "browser.download.viewableInternally.typeWasRegistered.svg" = true;
-    "browser.download.viewableInternally.typeWasRegistered.webp" = true;
-    "browser.download.viewableInternally.typeWasRegistered.xml" = true;
-
-    "browser.search.region" = "DE";
-
-    "browser.shell.checkDefaultBrowser" = false;
-    "browser.tabs.loadInBackground" = true;
-    "browser.urlbar.placeholderName" = "EnteEnteLauf";
-    "browser.urlbar.showSearchSuggestionsFirst" = false;
-
-    # disable all the annoying quick actions
-    "browser.urlbar.quickactions.enabled" = false;
-    "browser.urlbar.quickactions.showPrefs" = false;
-    "browser.urlbar.shortcuts.quickactions" = false;
-    "browser.urlbar.suggest.quickactions" = false;
-
-    "distribution.searchplugins.defaultLocale" = "en-US";
-
-    "doh-rollout.balrog-migration-done" = true;
-    "doh-rollout.doneFirstRun" = true;
-
-    "general.useragent.locale" = "en-US";
-
-    "extensions.activeThemeID" = "firefox-compact-dark@mozilla.org";
-
-    "extensions.extensions.activeThemeID" = "firefox-compact-dark@mozilla.org";
-    "extensions.update.enabled" = false;
-    "extensions.webcompat.enable_picture_in_picture_overrides" = true;
-    "extensions.webcompat.enable_shims" = true;
-    "extensions.webcompat.perform_injections" = true;
-    "extensions.webcompat.perform_ua_overrides" = true;
-
-    "privacy.donottrackheader.enabled" = true;
-    "browser.translations.enable" = false;
-
-    # Yubikey
-    "security.webauth.u2f" = true;
-    "security.webauth.webauthn" = true;
-    "security.webauth.webauthn_enable_softtoken" = false;
-    "security.webauth.webauthn_enable_usbtoken" = true;
-
-    "toolkit.legacyUserProfileCustomizations.stylesheets" = true;
-    "layout.word_select.stop_at_punctuation" = false;
-  };
-in {
-  programs.firefox = {
+{...}: {
+  personal.firefox = {
     enable = true;
-
-    package = pkgs.firefox-bin;
-
-    profiles = {
-      default = {
-        isDefault = true;
-        id = 0;
-        inherit extensions settings userChrome;
-      };
-    };
   };
 }

home/framework/programs/firefox/userChrome.css

@@ -1,88 +0,0 @@
-/* Source file https://github.com/MrOtherGuy/firefox-csshacks/tree/master/chrome/toolbars_below_content.css made available under Mozilla Public License v. 2.0
-See the above repository for updates as well as full license text. */
-
-/* Moves tabs toolbar, bookmarks toolbar and main toolbar to the bottom of the window, and makes tabs be the bottom-most toolbar */
-
-/* By default, menubar will stay on top with two options to select it's behavior - see below */
-
-@-moz-document url(chrome://browser/content/browser.xhtml){
-  
-  #titlebar{ -moz-appearance: none !important; }
-
-  #navigator-toolbox > div{ display: contents }
-  .global-notificationbox,
-  #mainPopupSet,
-  #browser,
-  #customization-container,
-  #tab-notification-deck{
-    order: -1;
-  }
-
-  /* Remove the next row if you want tabs to be the top-most row */
-  #titlebar{
-    order: 2;
-  } 
-
-  #toolbar-menubar{
-    position: fixed;
-    display: flex;
-    width: 100vw;
-    top: 0px;
-    -moz-window-dragging: drag;
-  }
-  /* Remove bottom border that won't do anything useful when at bottom of the window */
-  #navigator-toolbox{ border-bottom: none !important; }
-
-  #toolbar-menubar > spacer{ flex-grow: 1 }
-
-  #urlbar[breakout][breakout-extend]{
-    display: flex !important;
-    flex-direction: column-reverse;
-    bottom: 0px !important; /* Change to 3-5 px if using compact_urlbar_megabar.css depending on toolbar density */
-    top: auto !important;
-  }
-
-  .urlbarView-body-inner{ border-top-style: none !important; }
-
-  /* Yeah, removes window controls. Likely not wanted on bottom row  */
-  #TabsToolbar > .titlebar-buttonbox-container{ display: none }
-  #toolbar-menubar > .titlebar-buttonbox-container{ order: 1000 }
-
-  /* Fix panels sizing */
-  .panel-viewstack{ max-height: unset !important; }
-
-  /* Fullscreen mode support */
-  :root[sizemode="fullscreen"] #navigator-toolbox{ margin-top: 0 !important }
-  :root[sizemode="fullscreen"] #navigator-toolbox[style*="margin-top"]{ visibility: collapse }
-  #fullscr-toggler{ bottom: 0; top: unset !important; }
-  
-  /* These three rules exist for compatibility with autohide_toolbox.css */
-  #navigator-toolbox{ bottom: 0px; transform-origin: bottom }
-  #main-window > body > box{ margin-top: 0 !important; }
-  #toolbar-menubar{ z-index: 1; background-color: var(--lwt-accent-color,black); }
-  
-  :root[BookmarksToolbarOverlapsBrowser] #navigator-toolbox{
-    margin-block: calc(-1 * var(--bookmarks-toolbar-height)) 0 !important;
-  }
-  :root[BookmarksToolbarOverlapsBrowser] .newTabBrowserPanel{
-    padding-block: 0 var(--bookmarks-toolbar-height) !important;
-  }
-  
-  /**************
-  Menubar options - By default, menubar is overlayed on top of web-content
-  ***************/
-
- /* Uncomment the following if you want static menubar on top of the window (make menubar enabled)
-  * Use when menubar is enabled to always show it */
-  
-  /*
-  #browser,#customization-container{ padding-top: var(--uc-menubar-spacer,28px) }
-  */
-  
-  /* OR, uncomment the following if you want menubar to appear below content, above tabs toolbar */
-  
-  #toolbar-menubar{ position: static; display: flex; margin-top: 0px !important; background-color: transparent }
-
-  /* set to "column-reverse" (without quotes) if you want tabs above menubar with the above option */
-  #titlebar{ flex-direction: column }
-}

home/framework/programs/hyprland/default.nix

@@ -1,19 +1,84 @@
 {pkgs, ...}: {
-  wayland.windowManager.hyprland = let
-    locker = "${pkgs.swaylock}/bin/swaylock";
-    set-dpms = "${pkgs.hyprland}/bin/hyprctl dispatcher dpms";
-    locked-dpms = pkgs.writeShellScript "locked-dpms.sh" ''
-      ${pkgs.swayidle}/bin/swayidle -w \
-        timeout 10 'if pgrep -x swaylock; then ${set-dpms} off; fi' \
-        resume '${set-dpms} on'
-    '';
-    idle-script = pkgs.writeShellScript "idle-lock.sh" ''
-      ${pkgs.swayidle}/bin/swayidle -w \
-        timeout 300 '${locker} -f' \
-        timeout 330 '${set-dpms} off' \
-        resume '${set-dpms} on'
-    '';
-  in {
+  services.hypridle = {
+    enable = true;
+
+    settings = {
+      general = {
+        lock_cmd = "pidof hyprlock || hyprlock";
+      };
+
+      listener = [
+        {
+          timeout = 300;
+          on-timeout = "loginctl lock-session";
+        }
+        {
+          timeout = 330;
+          on-timeout = "hyprctl dispatch dpms off";
+          on-resume = "hyprctl dispatch dpms on";
+        }
+      ];
+    };
+  };
+
+  programs.hyprlock = {
+    enable = true;
+    settings = {
+      background = {
+        monitor = "";
+        path = "screenshot";
+
+        blur_passes = 2;
+        blur_size = 7;
+        noise = 1.17e-2;
+      };
+
+      auth.fingerprint.enabled = true;
+
+      label = [
+        {
+          monitor = "";
+          text = "$TIME";
+          color = "rgba(242, 243, 244, 0.75)";
+          font_size = 95;
+          position = "0, 300";
+          halign = "center";
+          valign = "center";
+        }
+        {
+          monitor = "";
+          text = ''cmd[update:1000] echo $(date +"%A, %B %d")'';
+          color = "rgba(242, 243, 244, 0.75)";
+          font_size = 22;
+          position = "0, 200";
+          halign = "center";
+          valign = "center";
+        }
+      ];
+
+      input-field = {
+        monitor = "";
+        size = "200,50";
+        outline_thickness = 2;
+        dots_size = 0.2;
+        dots_spacing = 0.35;
+        dots_center = true;
+        outer_color = "rgba(0, 0, 0, 0)";
+        inner_color = "rgba(0, 0, 0, 0.2)";
+        font_color = "rgb(111, 45, 104)";
+        fade_on_empty = false;
+        rounding = -1;
+        check_color = "rgb(30, 107, 204)";
+        placeholder_text = ''<i><span foreground="##cdd6f4">Input Password...</span></i>'';
+        hide_input = false;
+        position = "0, -100";
+        halign = "center";
+        valign = "center";
+      };
+    };
+  };
+
+  wayland.windowManager.hyprland = {
     enable = true;
     settings = {
       "$mod" = "SUPER";
@@ -28,8 +93,6 @@
       exec-once = [
         "${pkgs.waybar}/bin/waybar"
         "${pkgs.mako}/bin/mako"
-        idle-script
-        locked-dpms
       ];
 
       input = {
@@ -49,10 +112,12 @@
 
       decoration = {
         rounding = 5;
-        drop_shadow = true;
-        shadow_range = 4;
-        shadow_render_power = 3;
-        "col.shadow" = "rgba(1a1a1aee)";
+        shadow = {
+          enabled = true;
+          range = 4;
+          render_power = 3;
+          color = "rgba(1a1a1aee)";
+        };
 
         blur = {
           enabled = true;
@@ -81,7 +146,7 @@
           "$mod, return, exec, ${pkgs.alacritty}/bin/alacritty"
           "$mod, D, exec, ${pkgs.rofi-wayland}/bin/rofi -show drun"
           "$mod SHIFT, Q, killactive, "
-          "$mod, L, exec, ${locker}"
+          "$mod, L, exec, loginctl lock-session"
           "$mod, V, togglefloating, "
           "$mod, F, fullscreen, 1"
           "$mod, P, pseudo, # dwindle"

home/work/default.nix

@@ -1,7 +1,7 @@
 {
   config,
   pkgs,
-  devenv,
+  # devenv,
   ...
 }: {
   home = {

home/work/pkgs.nix

@@ -1,15 +1,10 @@
 {pkgs, ...}:
 with pkgs; [
   age # Modern encryption tool with small explicit keys
-  arandr # simple GUI for xrandr
   atuin
   dig # dns command-line tool
   fd # "find" for files
-  # geckodriver # remote controll firefox
-  helix # modal editor
   htop # process monitor
-  hyperfine # command-line benchmarking tool
-  # i3lock # screen locker
   imagemagick # selection screenshot stuff
   just # just a command runner
   keepassxc # password manager
@@ -22,21 +17,14 @@ with pkgs; [
   mtr # traceroute
   mumble # voice call client
   ncdu # disk space info (a better du)
-  # neovim-unwrapped # best code editor on the planet
   networkmanagerapplet # systray applet for NetworkManager
-  # nitrogen # wallpapger manager
-  nushell # A modern shell written in Rust
   ouch # painless compression and decompression for your terminal
   pavucontrol # pulseaudio volume control
   playerctl # music player controller
   podman-compose # podman manager
-  restic # incremental backup tool
   ripgrep # fast grep
-  # rocketchat-desktop # company chat
   sops # Mozilla sops (Secrets OPerationS) is an editor of encrypted files
   thunderbird # email client
-  # xclip # clipboard support
-  # xsel # clipboard support (also for neovim)
   zeal # offline documentation browser
   zellij # A terminal workspace with batteries included
   wl-clipboard

home/work/programs/alacritty/default.nix

@@ -3,8 +3,7 @@
     enable = true;
 
     settings = {
-      live_config_reload = true;
-
+      general.live_config_reload = true;
       env.TERM = "xterm-256color";
       bell.duration = 0;
       cursor.style = "Block";

home/work/programs/firefox/default.nix

@@ -1,106 +1,6 @@
-{
-  pkgs,
-  lib,
-  stdenv,
-  specialArgs,
-  ...
-}: let
-  extensions = with specialArgs.ff-addons; [
-    bitwarden
-    darkreader
-    i-dont-care-about-cookies
-    privacy-badger
-    ublock-origin
-    # tree-style-tab
-    # tridactyl
-    keepassxc-browser
-  ];
-
-  userChrome = builtins.readFile ./userChrome.css;
-
-  # ~/.mozilla/firefox/PROFILE_NAME/prefs.js | user.js
-  settings = {
-    "app.normandy.first_run" = false;
-    "app.shield.optoutstudies.enabled" = false;
-
-    # disable updates (pretty pointless with nix)
-    "app.update.channel" = "default";
-
-    "browser.contentblocking.category" = "standard"; # "strict"
-    "browser.ctrlTab.recentlyUsedOrder" = false;
-
-    "browser.download.viewableInternally.typeWasRegistered.svg" = true;
-    "browser.download.viewableInternally.typeWasRegistered.webp" = true;
-    "browser.download.viewableInternally.typeWasRegistered.xml" = true;
-
-    "browser.search.region" = "DE";
-
-    "browser.shell.checkDefaultBrowser" = false;
-    "browser.tabs.loadInBackground" = true;
-    "browser.urlbar.placeholderName" = "EnteEnteLauf";
-    "browser.urlbar.showSearchSuggestionsFirst" = false;
-
-    # disable all the annoying quick actions
-    "browser.urlbar.quickactions.enabled" = false;
-    "browser.urlbar.quickactions.showPrefs" = false;
-    "browser.urlbar.shortcuts.quickactions" = false;
-    "browser.urlbar.suggest.quickactions" = false;
-
-    # disable tab preview on hover
-    "browser.tabs.hoverPreview.enabled" = false;
-    "browser.tabs.hoverPreview.showThumbnails" = false;
-
-    "distribution.searchplugins.defaultLocale" = "en-US";
-
-    "doh-rollout.balrog-migration-done" = true;
-    "doh-rollout.doneFirstRun" = true;
-
-    "general.useragent.locale" = "en-US";
-
-    "extensions.activeThemeID" = "firefox-compact-dark@mozilla.org";
-
-    "extensions.extensions.activeThemeID" = "firefox-compact-dark@mozilla.org";
-    "extensions.update.enabled" = false;
-    "extensions.webcompat.enable_picture_in_picture_overrides" = true;
-    "extensions.webcompat.enable_shims" = true;
-    "extensions.webcompat.perform_injections" = true;
-    "extensions.webcompat.perform_ua_overrides" = true;
-
-    "privacy.donottrackheader.enabled" = true;
-
-    # Yubikey
-    "security.webauth.u2f" = true;
-    "security.webauth.webauthn" = true;
-    "security.webauth.webauthn_enable_softtoken" = false;
-    "security.webauth.webauthn_enable_usbtoken" = true;
-
-    "network.dns.ipv4OnlyDomains" = "google.com";
-
-    "toolkit.legacyUserProfileCustomizations.stylesheets" = true;
-    "layout.word_select.stop_at_punctuation" = false;
-  };
-in {
-  programs.firefox = {
+{pkgs, ...}: {
+  personal.firefox = {
     enable = true;
-
-    package = pkgs.firefox-bin;
-
-    profiles = {
-      default = {
-        isDefault = true;
-        id = 0;
-        inherit extensions settings userChrome;
-      };
-    };
-
-    # webapps = {
-    #   rocket-chat = {
-    #     url = "https://chat.hetzner.company";
-    #     id = 1;
-
-    #     genericName = "Internet Messenger";
-    #     categories = ["Network" "InstantMessaging"];
-    #   };
-    # };
+    extraExtensions = with pkgs.nur.repos.rycee.firefox-addons; [keepassxc-browser];
   };
 }

home/work/programs/firefox/userChrome.css

@@ -1,88 +0,0 @@
-/* Source file https://github.com/MrOtherGuy/firefox-csshacks/tree/master/chrome/toolbars_below_content.css made available under Mozilla Public License v. 2.0
-See the above repository for updates as well as full license text. */
-
-/* Moves tabs toolbar, bookmarks toolbar and main toolbar to the bottom of the window, and makes tabs be the bottom-most toolbar */
-
-/* By default, menubar will stay on top with two options to select it's behavior - see below */
-
-@-moz-document url(chrome://browser/content/browser.xhtml){
-  
-  #titlebar{ -moz-appearance: none !important; }
-
-  #navigator-toolbox > div{ display: contents }
-  .global-notificationbox,
-  #mainPopupSet,
-  #browser,
-  #customization-container,
-  #tab-notification-deck{
-    order: -1;
-  }
-
-  /* Remove the next row if you want tabs to be the top-most row */
-  #titlebar{
-    order: 2;
-  } 
-
-  #toolbar-menubar{
-    position: fixed;
-    display: flex;
-    width: 100vw;
-    top: 0px;
-    -moz-window-dragging: drag;
-  }
-  /* Remove bottom border that won't do anything useful when at bottom of the window */
-  #navigator-toolbox{ border-bottom: none !important; }
-
-  #toolbar-menubar > spacer{ flex-grow: 1 }
-
-  #urlbar[breakout][breakout-extend]{
-    display: flex !important;
-    flex-direction: column-reverse;
-    bottom: 0px !important; /* Change to 3-5 px if using compact_urlbar_megabar.css depending on toolbar density */
-    top: auto !important;
-  }
-
-  .urlbarView-body-inner{ border-top-style: none !important; }
-
-  /* Yeah, removes window controls. Likely not wanted on bottom row  */
-  #TabsToolbar > .titlebar-buttonbox-container{ display: none }
-  #toolbar-menubar > .titlebar-buttonbox-container{ order: 1000 }
-
-  /* Fix panels sizing */
-  .panel-viewstack{ max-height: unset !important; }
-
-  /* Fullscreen mode support */
-  :root[sizemode="fullscreen"] #navigator-toolbox{ margin-top: 0 !important }
-  :root[sizemode="fullscreen"] #navigator-toolbox[style*="margin-top"]{ visibility: collapse }
-  #fullscr-toggler{ bottom: 0; top: unset !important; }
-  
-  /* These three rules exist for compatibility with autohide_toolbox.css */
-  #navigator-toolbox{ bottom: 0px; transform-origin: bottom }
-  #main-window > body > box{ margin-top: 0 !important; }
-  #toolbar-menubar{ z-index: 1; background-color: var(--lwt-accent-color,black); }
-  
-  :root[BookmarksToolbarOverlapsBrowser] #navigator-toolbox{
-    margin-block: calc(-1 * var(--bookmarks-toolbar-height)) 0 !important;
-  }
-  :root[BookmarksToolbarOverlapsBrowser] .newTabBrowserPanel{
-    padding-block: 0 var(--bookmarks-toolbar-height) !important;
-  }
-  
-  /**************
-  Menubar options - By default, menubar is overlayed on top of web-content
-  ***************/
-
- /* Uncomment the following if you want static menubar on top of the window (make menubar enabled)
-  * Use when menubar is enabled to always show it */
-  
-  /*
-  #browser,#customization-container{ padding-top: var(--uc-menubar-spacer,28px) }
-  */
-  
-  /* OR, uncomment the following if you want menubar to appear below content, above tabs toolbar */
-  
-  #toolbar-menubar{ position: static; display: flex; margin-top: 0px !important; background-color: transparent }
-
-  /* set to "column-reverse" (without quotes) if you want tabs above menubar with the above option */
-  #titlebar{ flex-direction: column }
-}

home/work/programs/hyprland/default.nix

@@ -1,19 +1,82 @@
 {pkgs, ...}: {
-  wayland.windowManager.hyprland = let
-    locker = "${pkgs.swaylock}/bin/swaylock";
-    set-dpms = "${pkgs.hyprland}/bin/hyprctl dispatcher dpms";
-    locked-dpms = pkgs.writeShellScript "locked-dpms.sh" ''
-      ${pkgs.swayidle}/bin/swayidle -w \
-        timeout 10 'if pgrep -x swaylock; then ${set-dpms} off; fi' \
-        resume '${set-dpms} on'
-    '';
-    idle-script = pkgs.writeShellScript "idle-lock.sh" ''
-      ${pkgs.swayidle}/bin/swayidle -w \
-        timeout 300 '${locker} -f' \
-        timeout 330 '${set-dpms} off' \
-        resume '${set-dpms} on'
-    '';
-  in {
+  services.hypridle = {
+    enable = true;
+
+    settings = {
+      general = {
+        lock_cmd = "pidof hyprlock || hyprlock";
+      };
+
+      listener = [
+        {
+          timeout = 300;
+          on-timeout = "loginctl lock-session";
+        }
+        {
+          timeout = 330;
+          on-timeout = "hyprctl dispatch dpms off";
+          on-resume = "hyprctl dispatch dpms on";
+        }
+      ];
+    };
+  };
+
+  programs.hyprlock = {
+    enable = true;
+    settings = {
+      background = {
+        monitor = "";
+        path = "screenshot";
+
+        blur_passes = 2;
+        blur_size = 7;
+        noise = 1.17e-2;
+      };
+
+      label = [
+        {
+          monitor = "";
+          text = "$TIME";
+          color = "rgba(242, 243, 244, 0.75)";
+          font_size = 95;
+          position = "0, 300";
+          halign = "center";
+          valign = "center";
+        }
+        {
+          monitor = "";
+          text = ''cmd[update:1000] echo $(date +"%A, %B %d")'';
+          color = "rgba(242, 243, 244, 0.75)";
+          font_size = 22;
+          position = "0, 200";
+          halign = "center";
+          valign = "center";
+        }
+      ];
+
+      input-field = {
+        monitor = "";
+        size = "200,50";
+        outline_thickness = 2;
+        dots_size = 0.2;
+        dots_spacing = 0.35;
+        dots_center = true;
+        outer_color = "rgba(0, 0, 0, 0)";
+        inner_color = "rgba(0, 0, 0, 0.2)";
+        font_color = "rgb(111, 45, 104)";
+        fade_on_empty = false;
+        rounding = -1;
+        check_color = "rgb(30, 107, 204)";
+        placeholder_text = ''<i><span foreground="##cdd6f4">Input Password...</span></i>'';
+        hide_input = false;
+        position = "0, -100";
+        halign = "center";
+        valign = "center";
+      };
+    };
+  };
+
+  wayland.windowManager.hyprland = {
     enable = true;
 
     settings = {
@@ -22,16 +85,12 @@
       exec-once = [
         "${pkgs.waybar}/bin/waybar"
         "${pkgs.mako}/bin/mako"
-        idle-script
-        locked-dpms
       ];
 
       monitor = [
         "eDP-1,1920x1080,0x0,1.333333" # Laptop screen
         "desc:Dell Inc. DELL P2723DE 79RFH14,2560x1440,1440x0,1"
         "desc:Dell Inc. DELL P2723DE 39RFH14,2560x1440,4000x0,1"
-        # "desc:LG Electronics LG ULTRAWIDE 0x000219F2,2560x1080,1440x0,1" # Primary @home
-        # "desc:Fujitsu Siemens Computers GmbH B22W-6 LED YV3U164923,1680x1050,4000x0,1" # Secondary @home
         ",preferred,auto,1" # Automatically configure everything else
       ];
 
@@ -63,10 +122,12 @@
 
       decoration = {
         rounding = 5;
-        drop_shadow = true;
-        shadow_range = 4;
-        shadow_render_power = 3;
-        "col.shadow" = "rgba(1a1a1aee)";
+        shadow = {
+          enabled = true;
+          range = 4;
+          render_power = 3;
+          color = "rgba(1a1a1aee)";
+        };
 
         blur = {
           enabled = true;
@@ -95,7 +156,7 @@
           "$mod, return, exec, ${pkgs.alacritty}/bin/alacritty"
           "$mod, D, exec, ${pkgs.rofi-wayland}/bin/rofi -show drun"
           "$mod SHIFT, Q, killactive, "
-          "$mod, L, exec, ${locker}"
+          "$mod, L, exec, loginctl lock-session"
           "$mod, V, togglefloating, "
           "$mod, F, fullscreen, 1"
           "$mod, P, pseudo, # dwindle"
@@ -122,10 +183,6 @@
         "$mod, mouse:273, resizewindow"
       ];
 
-      bindl = [
-        "$mod SHIFT, L, exec, ${locker}"
-      ];
-
       windowrulev2 = [
         # KeePassXC
         "float,class:(org.keepassxc.KeePassXC)"

home/work/programs/tmate/.tmate.conf

@@ -1,8 +1,10 @@
 set -g history-limit 50000
-set -g default-terminal "screen-256color"
 set -g mouse on
 set -sg escape-time 50
 
+set -g default-terminal "xterm-256color"
+set -as terminal-overrides ",xterm-*:Tc"
+
 unbind C-b
 set-option -g prefix C-a
 bind-key C-a send-prefix

nixos/celestia/configuration.nix

@@ -52,6 +52,14 @@ in {
   ];
   boot.kernelModules = ["amd-pstate"];
 
+  # *arr services are not yet all updated to .NET 8
+  nixpkgs.config.permittedInsecurePackages = [
+    "aspnetcore-runtime-6.0.36"
+    "aspnetcore-runtime-wrapped-6.0.36"
+    "dotnet-sdk-6.0.428"
+    "dotnet-sdk-wrapped-6.0.428"
+  ];
+
   system.stateVersion = "23.11"; # Did you read the comment?
   networking = {
     hostName = "celestia";
@@ -84,6 +92,9 @@ in {
     zfs
     lm_sensors
     ffmpeg
+    rtl_433
+    dump1090
+    rtl-sdr
   ];
 
   users.users."root".openssh.authorizedKeys.keys = [
@@ -201,21 +212,21 @@ in {
         url = "https://git.fuckwit.dev";
         tokenFile = config.sops.secrets."act-runner-token".path;
         labels = [
-          "native:host"
-        ];
-        hostPackages = with pkgs; [
-          bash
-          coreutils
-          curl
-          wget
-          gnused
-          gitMinimal
+          "nix:docker://nixos/nix:latest"
         ];
+        # hostPackages = with pkgs; [
+        #   bash
+        #   coreutils
+        #   curl
+        #   wget
+        #   gnused
+        #   gitMinimal
+        # ];
       };
     };
 
     restic = let
-      mkBackup = repo: paths: exclude: {
+      mkBackup = repo: paths: exclude: pruneOpts: {
         repository = "sftp:u169497-sub5@u169497.your-storagebox.de:${repo}";
         passwordFile = config.sops.secrets."restic_${repo}_repository_password".path;
         initialize = true;
@@ -224,6 +235,7 @@ in {
         ];
         paths = paths;
         exclude = exclude;
+        pruneOpts = pruneOpts;
         timerConfig = {
           OnCalendar = "00:05";
           RandomizedDelaySec = "1h";
@@ -231,8 +243,8 @@ in {
       };
     in {
       backups = {
-        documents = mkBackup "documents" ["/tank/documents"] [];
-        images = mkBackup "images" ["/tank/images"] ["/tank/images/import"];
+        documents = mkBackup "documents" ["/tank/documents"] [] ["-d 7" "-w 5" "-m 12"];
+        images = mkBackup "images" ["/tank/images"] ["/tank/images/import"] ["-d 7" "-w 5" "-m 12"];
       };
     };
 
@@ -324,6 +336,8 @@ in {
       settings = {
         PHOTOPRISM_ADMIN_USER = "root";
         PHOTOPRISM_DEFAULT_LOCALE = "de";
+        PHOTOPRISM_DETECT_NSFW = "true";
+        PHOTOPRISM_UPLOAD_NSFW = "true";
       };
     };
 
@@ -424,6 +438,8 @@ in {
   };
 
   hardware = {
+    rtl-sdr.enable = true;
+
     fancontrol = {
       enable = true;
       config = ''

nixos/celestia/hardware-configuration.nix

@@ -21,7 +21,6 @@
     forceImportRoot = false;
     extraPools = ["tank"];
   };
-  boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
 
   fileSystems."/" = {
     device = "/dev/disk/by-uuid/3652c231-d679-42dd-80f1-e9afccb4ca13";
@@ -34,6 +33,7 @@
       allowDiscards = true;
       keyFileSize = 4096;
       keyFile = "/dev/disk/by-id/usb-Generic_Flash_Disk_D5A325A0-0:0";
+      tryEmptyPassphrase = true;
     };
   };
 

nixos/configurations.nix

@@ -1,9 +1,7 @@
 {
   self,
   nixpkgs,
-  nixpkgs-stable,
   sops-nix,
-  home-manager,
   lanzaboote,
   simple-nixos-mailserver,
   inputs,
@@ -92,7 +90,7 @@ in {
     np = nixpkgs;
     system = "x86_64-linux";
     ip = "192.168.1.11";
-    # remoteBuild = false;
+    remoteBuild = false;
     file = ./celestia/configuration.nix;
   };
 

nixos/framework/configuration.nix

@@ -6,6 +6,8 @@
   ...
 }: {
   imports = [./hardware-configuration.nix];
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.secrets."tailscale-auth-key" = {};
 
   boot.bootspec.enable = true;
   boot.loader.systemd-boot.enable = lib.mkForce false;
@@ -33,21 +35,26 @@
     extraPackages = [pkgs.vaapiVdpau];
   };
 
+  hardware.rtl-sdr.enable = true;
+
   hardware.bluetooth.enable = true;
 
   security.pam.services.swaylock = {};
+  security.pam.services.hyprlock = {};
 
   fonts.packages = with pkgs; [
     font-awesome
-    (nerdfonts.override {fonts = ["FiraMono"];})
+    nerd-fonts.fira-mono
     mypkgs.comic-mono
   ];
 
   services = {
     illum.enable = true;
     fwupd.enable = true;
-    fprintd.enable = false; # currently broken
+    fprintd.enable = true; # currently broken
     pcscd.enable = true;
+    udisks2.enable = true;
+
     tlp = {
       enable = true;
       settings = {
@@ -97,6 +104,14 @@
       lidSwitchExternalPower = "ignore";
       extraConfig = "HoldoffTimeoutSec=300s";
     };
+
+    tailscale = {
+      enable = true;
+      extraUpFlags = [
+        "--accept-routes=true"
+      ];
+      authKeyFile = config.sops.secrets."tailscale-auth-key".path;
+    };
   };
 
   services.pipewire = {
@@ -111,7 +126,7 @@
 
   users.users.patrick = {
     isNormalUser = true;
-    extraGroups = ["wheel"];
+    extraGroups = ["wheel" "plugdev"];
   };
 
   environment.systemPackages = with pkgs; [

nixos/framework/secrets.yaml

@@ -0,0 +1,33 @@
+tailscale-auth-key: ENC[AES256_GCM,data:jReYmVBmruNXXOlB9ep1Vx84XSKA8JAPReuxXglPMNDCUOIaX2S7zPuxAJp4KYhE91CnCNzprW/rdGejMw==,iv:251dyqcTqRh6N/lM07spgcyBnsxvwTdhKXdM45hepTc=,tag:/JqRTN80TJmA3H06Efbx8A==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age18kc63lpfutqlw505fkqagumqup6dtpudajeaheueuaf0frjpdc3suz49qk
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGQ29IUmRFcjNXNFRVZDh5
+            ZGE0YUJxYmFITHJ1N1RtVkNHbnpBYS9IM0g0CmFWak94ZE9BR2x2cHhrTkxxVWVn
+            czlRNUJoSm5FUVVPQVdXMnp6V1dMRjAKLS0tIFNUWVNCMEhjbEpjUXhRS05QTFpL
+            bk1raG5pVE10ZEh1RXdYUXY0ZkVkUW8K5JWNqbd6k6slfOR9xfc6a58tdouElwlX
+            w4MzIE7dUlqYux4MxbTzXhnX/A3D2oXg60Ya5rKqakgnAYvWlNwwAw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-11-25T15:49:24Z"
+    mac: ENC[AES256_GCM,data:GQcgu7CWkUPrcsYlSK8rbnZIu3Ph/q5ohEt2F46Q5afEh2j0aQQfdlO7suFUmO93qoQ4Z4qo6HmSsqajR5QTMvWMjERSdAYh8WiX64zgnxzYD32GCLjvtp3NSraIHy5RsnX/+4vNDsGVq1pJIEr6McWuvxuuZ3cT2JbHiui8cGI=,iv:GkHo9aM6JXM1+kY42au7Rm3fJrqOnncKLxLC52JrVUw=,tag:7Ua+LTsfihrr+qcVhKvJPA==,type:str]
+    pgp:
+        - created_at: "2024-11-25T15:46:53Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4DMGJRmcuHhnsSAQdAIUNST8klTbwju58Y6yBe8tZtn0yK4hCrocSfV5qAOz8w
+            eDZyWmShWVeAMIksZPJthyq2GmExd6S+BPjgn6sLmeaDBHzUsLV2lexpGSTif6MW
+            1GgBCQIQVijI8dBnboVzsQHN1Yaj9Ntfb++u29TBmYiXLm455jsr/Aqwp8I9ZM0P
+            tMPkxT6kHebICXpsbZvkSxv3kaPK1+TBGZkk8VEZxZZBl7NpvCAKufOiCHU/sH8I
+            UOJGtqbpiWwqJQ==
+            =qjQD
+            -----END PGP MESSAGE-----
+          fp: 5FA64909521A5C85992F26E0F819AEFF941BB849
+    unencrypted_suffix: _unencrypted
+    version: 3.9.1

nixos/laptop/configuration.nix

@@ -17,7 +17,7 @@
       preLVM = true;
     };
   };
-  boot.kernelPackages = pkgs.linuxPackages_6_11;
+  boot.kernelPackages = pkgs.linuxPackages_6_6;
 
   i18n.defaultLocale = "en_US.UTF-8";
   time.timeZone = "Europe/Berlin";
@@ -135,7 +135,7 @@
 
   fonts.packages = with pkgs; [
     font-awesome
-    (nerdfonts.override {fonts = ["FiraMono"];})
+    nerd-fonts.fira-mono
     mypkgs.comic-mono
   ];
 

nixos/primordial/configuration.nix

@@ -14,6 +14,7 @@ in {
   sops.secrets."keycloak_db_pw" = {};
   sops.secrets."restic_mail_repository_password" = {};
   sops.secrets."restic_ssh_key" = {};
+  sops.secrets."act-runner-token" = {};
 
   imports = [
     ./mail.nix
@@ -231,6 +232,22 @@ in {
       lfs.enable = true;
     };
 
+    gitea-actions-runner.instances = {
+      docker-runner = {
+        enable = true;
+        name = "primordial-docker";
+        url = "https://git.fuckwit.dev";
+        tokenFile = config.sops.secrets."act-runner-token".path;
+        labels = [
+          "ubuntu-latest:docker://node:16-bullseye"
+        ];
+        settings = {
+          runner.capacity = 5;
+          cache.enabled = false;
+        };
+      };
+    };
+
     grafana = {
       enable = true;
 
@@ -297,6 +314,8 @@ in {
     # };
   };
 
+  virtualisation.podman.enable = true;
+
   users.users."root".openssh.authorizedKeys.keys = [
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP8zNAXScQ4FoWNxF4+ALJXMSi3EbpqZP5pO9kfg9t8o patrick@NBG1-DC3-PC20-2017-10-24"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPflDQOANGhgtfo2psRwSFtY5ETHX/bsDmqrho3iX9jt root@arschlinux"

nixos/primordial/secrets.yaml

@@ -2,6 +2,7 @@ gitea.env: ENC[AES256_GCM,data:wkSPzLQtL3vGNIjG+jG6I3+R7wLBBdXeaCHbKxMbpVOldo8zr
 keycloak_db_pw: ENC[AES256_GCM,data:1oBqzpFokAmjkT770YKYwzCllaGTprtDR9W4B/+V6ZUXPhJ1R9DNWZHqpQ==,iv:dK36GBiDj12HVjUkZqTVk/rR6s1sf6dmQTk1ZJQwi+I=,tag:6Ix9QSf+A0U82sG0z8wSmw==,type:str]
 restic_mail_repository_password: ENC[AES256_GCM,data:B2XAP9tnztl/c7HB7bHywfJcwV9sLahfqCfI0TajWaWHPhRsZow4yxhn813FN4pINb5i1kYyiRG/sMXMKAFo9g==,iv:pQnVRVtuhcVtH/Kot9hcx8DSA4qlkksuUiY8HaOawfk=,tag:4lbmh8bQDSVNbI06/gNUlQ==,type:str]
 restic_ssh_key: ENC[AES256_GCM,data:HpS73OEFvqSLYg8Qh1syJEjCfv5og5VxxzK2VPmAFRk5BzM4xF3Dn0cmJtQpwMMwaRGRWFdCTMrQCBWRrLgDt7wUyMpBn1HivLr4nwEOU4oDStv+1zKmrNbWLSYw3TbHoNJ2K+C46lfpV9CBdb+8dmv2vto6HoKFrOYc5/ftYd7lD9zMhueAMCc3q7aPsIFGb2TRGNz1wrF6Cn9ew1Oqh/P7xlUuIgS0kAKRrybhiIO9IUgQsTV3qqZIXogP4Yy2OLSyhbtDuvtLAncL2pJ/ZsGme47G8HoFomyqEIf0eq7YKqlpTqKPbbnxfWSlWYGg+l9OtCJOeyp5oEZ6sjPNdTUYjpcVZpHNEEa2zkaZzRj5Jo/GIiJfCu4F0kk4opbqEUTeDQHgesylxwpd/v5zaplGEqpYZ7y/DAud+YUw7XWYWjy60kjlZdkbKwrL/Cg4dxWY8Cc7v42Ve7aADgSEpEhwo5rHxM3JSVHHHunfC6y+/Qin26wQZhF1w+d8/yqSaJidx6FsDSipGCJtXa9liIG7oG2vUlmYm4rE,iv:d/AFzPAJGSGv1WzQY4+p8mImFoWKkaoMRtIBNAYiU0E=,tag:mdE/e2VX5zdrFT43NZaYNQ==,type:str]
+act-runner-token: ENC[AES256_GCM,data:QEiYYYg8fZQIwVPT+vG2Eo8JO9y5PgVJBm5E1UlujANigQKvVkhPbVtulIB1Fg==,iv:V88x7xqYlbZuawPFU824bZtvM/b44BBVIjhnmtdYCwo=,tag:PgQcH1nkRpHCiBBMCSXfxg==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -17,8 +18,8 @@ sops:
             V1h2NGxyNVc3WnF2ZFBpQm1oK1AzeGcK4GoD2E8nwOl/WKtgMgs0Y1Q8abRX4mpy
             GdHGDQUWvySCisJo4JXsooYkLjOyKvir+vcVbX4nDd4L1W2OMULkrg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-11-17T19:36:07Z"
-    mac: ENC[AES256_GCM,data:htvYIuHrOZ8jyVPVW7mVeTtf1eefwYkkZJ0l3xLFsVcCBlU3CjDgx+J9WN0kHw6TP+cP/+StYOtAthFe6UpoF8pmCvI+dKysrN6iLmqZySmh576YOY0Aq83WO4UOawZbarx8VUqTFdBrdp2bnMEjJ4bYvoTRuvAkQZocP8BK460=,iv:W8W8IZeviuUjE1Zz0x5m1/py/Zmx6rwl1ndVXfaR+DE=,tag:QXj9FZVk+H8ztI1VEFLyOQ==,type:str]
+    lastmodified: "2025-01-10T21:24:52Z"
+    mac: ENC[AES256_GCM,data:8zOgUn3QPUk6pZxaAVYN+yxIBRAihG9UpHEWSR37gQUT2hYG6ddHDBF56u0G0Hmpa2jUHUNw7hKe2YH7UVxc84Gmsv2oAQL6TPhgtwDBazViF0N9imt3+SEphx0t9Is58pzgFNp7uqy45GaoFtuQ1DIQOG090mHTLHZpnf1YL8o=,iv:EDNwgcGDqAZK4ZSQHxTjyLGhwKkK/TriyeL1FJ6J/Cs=,tag:5WZk+MnZb0kLrVrs601SiA==,type:str]
     pgp:
         - created_at: "2024-01-25T11:10:44Z"
           enc: |-
@@ -33,4 +34,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: 5FA64909521A5C85992F26E0F819AEFF941BB849
     unencrypted_suffix: _unencrypted
-    version: 3.9.1
+    version: 3.9.2

outputs.nix

@@ -2,7 +2,6 @@
   self,
   flake-utils,
   nixpkgs,
-  nurpkgs,
   deploy,
   home-manager,
   ...

renovate.json

@@ -0,0 +1,12 @@
+{
+  "nix": {
+    "enabled": true
+  },
+  "lockFileMaintenance": {
+    "enabled": true,
+    "schedule": [
+      "at any time"
+    ]
+  },
+  "automerge": true
+}