Update 2025-01-15

Enable incus on lift
Tailscale client routing features
2025-01-15 19:42:54 +01:00 · 2025-01-12 18:35:31 +01:00 · 2025-01-04 18:19:10 +01:00 · 2025-01-02 16:55:40 +01:00 · 2025-01-02 15:26:12 +01:00 · 2025-01-02 14:46:29 +01:00
28 changed files with 985 additions and 633 deletions
--- a/.sops.yaml
+++ b/.sops.yaml
@ -1,9 +0,0 @@
-keys:
-  - &admin_age age1xy66lg9eh572ge0y7zzh34f78s8l9hnkxhg3r4gn98ph95mz25tszgerul
-  - &tien_age age12j6x69evhvh6ljngq4lgesnezf7hwafc33z7nj9urnsl5xzlhp5sf6szck
-creation_rules:
-  - path_regex: tien/secrets.yaml$
-    key_groups:
-    - age:
-      - *admin_age
-      - *tien_age
--- a/configuration.nix
+++ b/configuration.nix
@ -1,238 +0,0 @@
-# Edit this configuration file to define what should be installed on
-# your system.  Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running ‘nixos-help’).
-
-{ config, pkgs, lib, ... }:
-
-{
-  imports = [
-    nixos/desktop/printing
-  ];
-
-  # Bootloader.
-  boot.loader.grub.enable = true;
-  boot.loader.grub.device = "/dev/sda";
-  boot.loader.grub.useOSProber = false;
-
-  # Setup keyfile
-  boot.initrd.secrets = {
-    "/crypto_keyfile.bin" = null;
-  };
-
-  # Enable grub cryptodisk
-  boot.loader.grub.enableCryptodisk = true;
-
-  boot.initrd.luks.devices."luks-efc0285c-812e-4946-936b-37e737fb72eb".keyFile = "/crypto_keyfile.bin";
-
-  # allow crosscompiling for raspberrypi
-  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
-
-  networking.hostName = "lift";
-  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
-
-  networking.networkmanager.enable = true;
-  systemd.network.wait-online.enable = false;
-  boot.initrd.systemd.network.wait-online.enable = false;
-
-  nix.settings.experimental-features = ["nix-command" "flakes"];
-
-  # Set your time zone.
-  time.timeZone = "Europe/Berlin";
-
-  # Select internationalisation properties.
-  i18n.defaultLocale = "en_US.UTF-8";
-
-  i18n.extraLocaleSettings = {
-    LC_ADDRESS = "de_DE.UTF-8";
-    LC_IDENTIFICATION = "de_DE.UTF-8";
-    LC_MEASUREMENT = "de_DE.UTF-8";
-    LC_MONETARY = "de_DE.UTF-8";
-    LC_NAME = "de_DE.UTF-8";
-    LC_NUMERIC = "de_DE.UTF-8";
-    LC_PAPER = "de_DE.UTF-8";
-    LC_TELEPHONE = "de_DE.UTF-8";
-    LC_TIME = "de_DE.UTF-8";
-  };
-
-
-  # Configure console keymap
-  console.keyMap = "de-latin1-nodeadkeys";
-
-  # Enable scanning
-  hardware.sane.enable = true;
-  hardware.keyboard.zsa.enable = true;
-  hardware.graphics.enable = true;
-
-  # bluetooth
-  hardware.bluetooth.enable = true;
-
-  # hardware.pulseaudio.enable = false;
-  security.rtkit.enable = true;
-
-  # Define a user account. Don't forget to set a password with ‘passwd’.
-  users.users.rothe = {
-    isNormalUser = true;
-    description = "rothe";
-    extraGroups = [ "networkmanager" "wheel" "video" "scanner" "lp" "incus-admin" "dialout" ];
-    shell = pkgs.fish;
-    packages = with pkgs; [
-      chromium
-      firefox
-      logseq
-      thunderbird
-    ];
-  };
-
-  nixpkgs.config.permittedInsecurePackages = [
-    "electron-27.3.11"
-  ];
-  nixpkgs.config.allowUnfree = true;
-
-  environment.systemPackages = with pkgs; [
-    ack
-    avrdude
-    bind
-    calibre
-    cmake
-    cryptsetup
-    curl
-    dracula-theme
-    evince
-    ffmpeg
-    fish
-    foot
-    fzf
-    gammastep
-    gcc
-    gimp
-    git
-    glib
-    eog
-    nautilus
-    simple-scan
-    gnucash
-    gnumake
-    gnupg
-    google-cloud-sdk
-    inkscape
-    ispell
-    keychain
-    libreoffice
-    hugo
-    mosquitto
-    mypy
-    nmap
-    pass-secret-service
-    pavucontrol
-    portfolio
-    prusa-slicer
-    pulseaudio
-    signal-desktop
-    spotify
-    sqlite
-    syncthing
-    tailscale
-    tmux
-    tree
-    unzip
-    vim-full
-    vlc
-    wally-cli
-    wayshot
-    wdisplays
-    wget
-    wl-clipboard
-    xdg-utils
-    yt-dlp
-  ];
-
-  xdg.portal = {
-    enable = true;
-    wlr.enable = true;
-    # gtk portal needed to make gtk apps happy
-    extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
-    config.common.default = "*";
-  };
-
-  programs = {
-    fish.enable = true;
-    gnupg.agent = {
-        enable = true;
-        enableSSHSupport = true;
-    };
-    light.enable = true;
-  };
-  # List services that you want to enable:
-  services.resolved = {
-    enable = true;
-  };
-  services.pcscd.enable = true;
-  # xdg-desktop-portal works by exposing a series of D-Bus interfaces
-  # known as portals under a well-known name
-  # (org.freedesktop.portal.Desktop) and object path
-  # (/org/freedesktop/portal/desktop).
-  # The portal interfaces include APIs for file access, opening URIs,
-  # printing and others.
-  services.dbus.enable = true;
-  services.pipewire = {
-    enable = true;
-    alsa.enable = true;
-    pulse.enable = true;
-  };
-  services.passSecretService.enable = true;
-  services.tailscale.enable = true;
-  services.gvfs.enable = true;
-
-  services.greetd = {
-    enable = true;
-    settings = {
-      default_session = {
-        command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --asterisks --cmd sway";
-        user = "rothe";
-      };
-    };
-  };
-
-
-  services.blueman.enable = true;
-  services.fwupd.enable = true;
-  services.syncthing = {
-    enable = true;
-    user = "rothe";
-    group = "users";
-    dataDir = "/home/rothe";
-    overrideFolders = false;
-    overrideDevices = false;
-  };
-
-  networking.nftables = {
-    enable = true;
-  };
-  networking.firewall.trustedInterfaces = [ "incusbr0" ];
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "23.05"; # Did you read the comment?
-
-  virtualisation = {
-    incus.enable = false;
-    podman.enable = true;
-  };
-
-  programs.nh = {
-    enable = true;
-    clean.enable = true;
-    clean.extraArgs = "--keep-since 4d --keep 3";
-    flake = "/home/rothe/src/nixos-config";
-  };
-
-  programs.steam = {
-    enable = true;
-    remotePlay.openFirewall = true;
-    dedicatedServer.openFirewall = true;
-    localNetworkGameTransfers.openFirewall = true;
-  };
-}
--- a/flake.lock
+++ b/flake.lock
@ -1,15 +1,39 @@
 {
  "nodes": {
-    "disko": {
+    "deploy-rs": {
      "inputs": {
-        "nixpkgs": "nixpkgs"
+        "flake-compat": "flake-compat",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "utils": "utils"
      },
      "locked": {
-        "lastModified": 1733168902,
-        "narHash": "sha256-8dupm9GfK+BowGdQd7EHK5V61nneLfr9xR6sc5vtDi0=",
+        "lastModified": 1727447169,
+        "narHash": "sha256-3KyjMPUKHkiWhwR91J1YchF6zb6gvckCAY1jOE+ne0U=",
+        "owner": "serokell",
+        "repo": "deploy-rs",
+        "rev": "aa07eb05537d4cd025e2310397a6adcedfe72c76",
+        "type": "github"
+      },
+      "original": {
+        "owner": "serokell",
+        "repo": "deploy-rs",
+        "type": "github"
+      }
+    },
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1736711425,
+        "narHash": "sha256-8hKhPQuMtXfJi+4lPvw3FBk/zSJVHeb726Zo0uF1PP8=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "785c1e02c7e465375df971949b8dcbde9ec362e5",
+        "rev": "f720e64ec37fa16ebba6354eadf310f81555cc07",
        "type": "github"
      },
      "original": {
@ -18,6 +42,116 @@
        "type": "github"
      }
    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "nixvim",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1736143030,
+        "narHash": "sha256-+hu54pAoLDEZT9pjHlqL9DNzWz0NbUn8NEAHP7PQPzU=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "b905f6fc23a9051a6e1b741e1438dbfc0634c6de",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1705309234,
+        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_3"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "ghostty": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "nixpkgs-stable": "nixpkgs-stable",
+        "nixpkgs-unstable": "nixpkgs-unstable",
+        "zig": "zig"
+      },
+      "locked": {
+        "lastModified": 1736911212,
+        "narHash": "sha256-OLly4X2kN1tDb2gMYcWeim6uJECPoc52ltJsz1iD5Ug=",
+        "owner": "ghostty-org",
+        "repo": "ghostty",
+        "rev": "ff9414d9ea7b16a375d41cde8f6f193de7e5db72",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ghostty-org",
+        "repo": "ghostty",
+        "type": "github"
+      }
+    },
    "home-manager": {
      "inputs": {
        "nixpkgs": [
@ -25,11 +159,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1733050161,
-        "narHash": "sha256-lYnT+EYE47f5yY3KS/Kd4pJ6CO9fhCqumkYYkQ3TK20=",
+        "lastModified": 1736373539,
+        "narHash": "sha256-dinzAqCjenWDxuy+MqUQq0I4zUSfaCvN9rzuCmgMZJY=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "62d536255879be574ebfe9b87c4ac194febf47c5",
+        "rev": "bd65bc3cde04c16755955630b344bc9e35272c56",
        "type": "github"
      },
      "original": {
@ -39,29 +173,41 @@
        "type": "github"
      }
    },
-    "nixpkgs": {
+    "ixx": {
+      "inputs": {
+        "flake-utils": [
+          "nixvim",
+          "nuschtosSearch",
+          "flake-utils"
+        ],
+        "nixpkgs": [
+          "nixvim",
+          "nuschtosSearch",
+          "nixpkgs"
+        ]
+      },
      "locked": {
-        "lastModified": 1732238832,
-        "narHash": "sha256-sQxuJm8rHY20xq6Ah+GwIUkF95tWjGRd1X8xF+Pkk38=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "8edf06bea5bcbee082df1b7369ff973b91618b8d",
+        "lastModified": 1729958008,
+        "narHash": "sha256-EiOq8jF4Z/zQe0QYVc3+qSKxRK//CFHMB84aYrYGwEs=",
+        "owner": "NuschtOS",
+        "repo": "ixx",
+        "rev": "9fd01aad037f345350eab2cd45e1946cc66da4eb",
        "type": "github"
      },
      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
+        "owner": "NuschtOS",
+        "ref": "v0.0.6",
+        "repo": "ixx",
        "type": "github"
      }
    },
-    "nixpkgs_2": {
+    "nixpkgs": {
      "locked": {
-        "lastModified": 1733261153,
-        "narHash": "sha256-eq51hyiaIwtWo19fPEeE0Zr2s83DYMKJoukNLgGGpek=",
+        "lastModified": 1736867362,
+        "narHash": "sha256-i/UJ5I7HoqmFMwZEH6vAvBxOrjjOJNU739lnZnhUln8=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "b681065d0919f7eb5309a93cea2cfa84dec9aa88",
+        "rev": "9c6b49aeac36e2ed73a8c472f1546f6d9cf1addc",
        "type": "github"
      },
      "original": {
@ -71,45 +217,185 @@
        "type": "github"
      }
    },
-    "nixpkgs_3": {
+    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1731763621,
-        "narHash": "sha256-ddcX4lQL0X05AYkrkV2LMFgGdRvgap7Ho8kgon3iWZk=",
-        "owner": "NixOS",
+        "lastModified": 1733423277,
+        "narHash": "sha256-TxabjxEgkNbCGFRHgM/b9yZWlBj60gUOUnRT/wbVQR8=",
+        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "c69a9bffbecde46b4b939465422ddc59493d3e4d",
+        "rev": "e36963a147267afc055f7cf65225958633e536bf",
        "type": "github"
      },
      "original": {
-        "owner": "NixOS",
+        "owner": "nixos",
+        "ref": "release-24.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-unstable": {
+      "locked": {
+        "lastModified": 1733229606,
+        "narHash": "sha256-FLYY5M0rpa5C2QAE3CKLYAM6TwbKicdRK6qNrSHlNrE=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "566e53c2ad750c84f6d31f9ccb9d00f823165550",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
        "ref": "nixpkgs-unstable",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
-    "root": {
+    "nixvim": {
      "inputs": {
-        "disko": "disko",
-        "home-manager": "home-manager",
-        "nixpkgs": "nixpkgs_2",
-        "sops-nix": "sops-nix"
-      }
-    },
-    "sops-nix": {
-      "inputs": {
-        "nixpkgs": "nixpkgs_3"
+        "devshell": [],
+        "flake-compat": [],
+        "flake-parts": "flake-parts",
+        "git-hooks": [],
+        "home-manager": [],
+        "nix-darwin": [],
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "nuschtosSearch": "nuschtosSearch",
+        "treefmt-nix": []
      },
      "locked": {
-        "lastModified": 1732186149,
-        "narHash": "sha256-N9JGWe/T8BC0Tss2Cv30plvZUYoiRmykP7ZdY2on2b0=",
-        "owner": "mic92",
-        "repo": "sops-nix",
-        "rev": "53c853fb1a7e4f25f68805ee25c83d5de18dc699",
+        "lastModified": 1736598792,
+        "narHash": "sha256-G6/9vT12RAxkNWQPEX9p8tTx/i8jJcmISpbVDGbEPGc=",
+        "owner": "nix-community",
+        "repo": "nixvim",
+        "rev": "2004ff4547f11d25da78f393fe797dde2b831ce7",
        "type": "github"
      },
      "original": {
-        "owner": "mic92",
-        "repo": "sops-nix",
+        "owner": "nix-community",
+        "ref": "nixos-24.11",
+        "repo": "nixvim",
+        "type": "github"
+      }
+    },
+    "nuschtosSearch": {
+      "inputs": {
+        "flake-utils": "flake-utils_2",
+        "ixx": "ixx",
+        "nixpkgs": [
+          "nixvim",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1735854821,
+        "narHash": "sha256-Iv59gMDZajNfezTO0Fw6LHE7uKAShxbvMidmZREit7c=",
+        "owner": "NuschtOS",
+        "repo": "search",
+        "rev": "836908e3bddd837ae0f13e215dd48767aee355f0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NuschtOS",
+        "repo": "search",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "deploy-rs": "deploy-rs",
+        "disko": "disko",
+        "ghostty": "ghostty",
+        "home-manager": "home-manager",
+        "nixpkgs": "nixpkgs",
+        "nixvim": "nixvim"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_3": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1701680307,
+        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "zig": {
+      "inputs": {
+        "flake-compat": [
+          "ghostty"
+        ],
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "ghostty",
+          "nixpkgs-stable"
+        ]
+      },
+      "locked": {
+        "lastModified": 1717848532,
+        "narHash": "sha256-d+xIUvSTreHl8pAmU1fnmkfDTGQYCn2Rb/zOwByxS2M=",
+        "owner": "mitchellh",
+        "repo": "zig-overlay",
+        "rev": "02fc5cc555fc14fda40c42d7c3250efa43812b43",
+        "type": "github"
+      },
+      "original": {
+        "owner": "mitchellh",
+        "repo": "zig-overlay",
        "type": "github"
      }
    }
--- a/flake.nix
+++ b/flake.nix
@ -2,14 +2,29 @@
  description = "NixOS configuration flake";

  inputs = {
-    disko.url = "github:nix-community/disko";
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
+    deploy-rs.url = "github:serokell/deploy-rs";
+    deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
+    disko.url = "github:nix-community/disko";
+    disko.inputs.nixpkgs.follows = "nixpkgs";
    home-manager.url = "github:nix-community/home-manager/release-24.11";
    home-manager.inputs.nixpkgs.follows = "nixpkgs";
-    sops-nix.url = "github:mic92/sops-nix";
+    ghostty.url = "github:ghostty-org/ghostty";
+    nixvim = {
+      url = "github:nix-community/nixvim/nixos-24.11";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        devshell.follows = "";
+        flake-compat.follows = "";
+        git-hooks.follows = "";
+        home-manager.follows = "";
+        nix-darwin.follows = "";
+        treefmt-nix.follows = "";
+      };
+    };
  };

-  outputs = inputs@{ self, nixpkgs,...}:
+  outputs = { self, nixpkgs, home-manager, deploy-rs, disko, nixvim, ghostty, ...}:
    let
      system = "x86_64-linux";
      pkgs = nixpkgs.legacyPackages.${system};
@ -18,50 +33,70 @@
        lift = nixpkgs.lib.nixosSystem {
          inherit system;
          modules = [
-            ./configuration.nix
-            ./sway.nix
-            ./hardware-configuration.nix
+            ./hosts/lift
+          ];
+        };
+        veil = nixpkgs.lib.nixosSystem {
+          inherit system;
+          modules = [
+            ./hosts/veil
          ];
        };
        tien = nixpkgs.lib.nixosSystem {
-          system = "x86_64-linux";
-          specialArgs = { inherit inputs; };
+          inherit system;
          modules = [
-            inputs.disko.nixosModules.disko
-            ./vps-configuration.nix
-            ./vps-hardware-configuration.nix
+            disko.nixosModules.disko
+            ./hosts/tien/configuration.nix
+            ./hosts/tien/hardware-configuration.nix
          ];
        };
      };
      homeConfigurations = {
-        "rothe@lift" = inputs.home-manager.lib.homeManagerConfiguration {
+        "rothe@lift" = home-manager.lib.homeManagerConfiguration {
          inherit pkgs;
-          modules = [ 
-            ./home/rothe.nix
+          modules = [
+            ./home/terminal
            ./home/wayland
+            nixvim.homeManagerModules.nixvim
          ];
          extraSpecialArgs = {
            mail = nixpkgs.lib.strings.concatStrings ["mail" "@" "johannes-rothe.de"];
+            inherit ghostty;
          };
        };
-        "rothe@johannes-powermachine" = inputs.home-manager.lib.homeManagerConfiguration {
+        "rothe@veil" = home-manager.lib.homeManagerConfiguration {
          inherit pkgs;
-          modules = [ 
-            ./home/rothe.nix
+          modules = [
+            ./home/terminal
+            ./home/wayland
+            nixvim.homeManagerModules.nixvim
          ];
          extraSpecialArgs = {
            mail = nixpkgs.lib.strings.concatStrings ["mail" "@" "johannes-rothe.de"];
+            inherit ghostty;
          };
        };
-        "rothe@pdemu1cml000301" = inputs.home-manager.lib.homeManagerConfiguration {
+        "rothe@pdemu1cml000301" = home-manager.lib.homeManagerConfiguration {
          inherit pkgs;
-          modules = [ 
-            ./home/rothe.nix
+          modules = [
+            ./home/terminal
+            nixvim.homeManagerModules.nixvim
          ];
          extraSpecialArgs = {
            mail = nixpkgs.lib.strings.concatStrings ["rothe" "@" "magazino.eu"];
          };
        };
      };
+      deploy.nodes.tien = let
+        hostname = "tien";
+      in {
+        hostname = hostname;
+        profiles.system = {
+          sshUser = "root";
+          path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.${hostname};
+        };
+      };
+
+    checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
    };
 }
--- a/home/rothe.nix
+++ b/home/rothe.nix
@ -1,26 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-  home.username = "rothe";
-  home.homeDirectory = "/home/rothe";
-
-  imports = [
-    ./terminal
-  ];
-
-  # Add extra variables like $EDITOR
-  home.sessionVariables = {
-  };
-
-  # This value determines the Home Manager release that your configuration is
-  # compatible with. This helps avoid breakage when a new Home Manager release
-  # introduces backwards incompatible changes.
-  #
-  # You should not change this value, even if you update Home Manager. If you do
-  # want to update the value, then make sure to first check the Home Manager
-  # release notes.
-  home.stateVersion = "23.05"; # Please read the comment before changing.
-
-  # Let Home Manager install and manage itself.
-  programs.home-manager.enable = true;
-}
--- a/home/terminal/default.nix
+++ b/home/terminal/default.nix
@ -1,7 +1,16 @@
-{ config, pkgs, lib, mail, ... }:
+{ config, pkgs, mail, ... }:

 {
+  imports = [ ./nixvim ];
+
  config = {
+    home.username = "rothe";
+    home.homeDirectory = "/home/rothe";
+
+    # Add extra variables like $EDITOR
+    home.sessionVariables = {
+    };
+
    home.packages = with pkgs; [
      black
      devenv
@ -17,12 +26,16 @@
      python311
      python311Packages.flake8
      python311Packages.ipython
+      ripgrep
      rusti-cal
      roboto-mono
      silver-searcher
      shellcheck
      sops
-      (nerdfonts.override { fonts = [ "RobotoMono" ]; })
+      (nerdfonts.override { fonts = [
+        "JetBrainsMono"
+        "RobotoMono"
+      ]; })
    ];
    fonts.fontconfig.enable = true;

@ -35,11 +48,13 @@
      fish_add_path ~/go/bin/
      export DEBFULLNAME="Johannes Rothe"
      export DEBEMAIL="${mail}"
+      export GIT_EDITOR="nvim"
      export GIT_AUTHOR_NAME="Johannes Rothe"
      export GIT_AUTHOR_EMAIL="${mail}"
      export GIT_COMMITTER_NAME="Johannes Rothe"
      export GIT_COMMITTER_EMAIL="${mail}"
      export VAULT_ADDR="https://passwords.magazino.eu:8201"
+      export NIX_PATH=$HOME/.nix-defexpr/channels
      '';
      shellAliases = {
        "..." = "cd ../..";
@ -241,7 +256,21 @@
    programs.direnv = {
      enable = true;
    };
+
+    home.file = {
+      "${config.xdg.configHome}/ghostty/config".source = ./ghostty/config;
+    };
+
+    # This value determines the Home Manager release that your configuration is
+    # compatible with. This helps avoid breakage when a new Home Manager release
+    # introduces backwards incompatible changes.
+    #
+    # You should not change this value, even if you update Home Manager. If you do
+    # want to update the value, then make sure to first check the Home Manager
+    # release notes.
+    home.stateVersion = "23.05"; # Please read the comment before changing.
+
+    # Let Home Manager install and manage itself.
+    programs.home-manager.enable = true;
  };
-
 }
-
--- a/home/terminal/ghostty/config
+++ b/home/terminal/ghostty/config
@ -0,0 +1,4 @@
+title = " "
+window-decoration = false
+theme = "MaterialDarker"
+confirm-close-surface = false
--- a/home/terminal/nixvim/default.nix
+++ b/home/terminal/nixvim/default.nix
@ -0,0 +1,131 @@
+{ pkgs, ... }:
+{
+  imports = [
+    ./telescope.nix
+  ];
+  programs.nixvim = {
+    colorscheme = "sonokai";
+    enable = true;
+    extraPlugins = [
+      pkgs.vimPlugins.indentLine
+      pkgs.vimPlugins.nvim-lspconfig
+      pkgs.vimPlugins.polyglot
+      pkgs.vimPlugins.sonokai
+      pkgs.vimPlugins.vim-better-whitespace
+      (pkgs.vimUtils.buildVimPlugin {
+        pname = "lualine-so-fancy.nvim";
+        version = "HEAD";
+        src = pkgs.fetchFromGitHub {
+          owner = "meuter";
+          repo = "lualine-so-fancy.nvim";
+          rev = "45197358e5274d301d98638bf079f3437d6eacf8";
+          sha256 = "sha256-j6XI4cw1ouYEvSiKdam8RAqxefDqeLwe37Qir/UO+8g=";
+        };
+      })
+    ];
+    globals = {
+      mapleader = ",";
+      sonokai_style = "atlantis";
+      sonokai_disable_italic_comment = 1;
+    };
+    keymaps = [
+      {
+        key = "<leader>rm";
+        action = "<cmd>RenderMarkdown toggle<CR>";
+      }
+      {
+        key = "<leader>g";
+        action = "<cmd>Git<CR>";
+      }
+      {
+        key = "<leader>gp";
+        action = "<cmd>Git push<CR>";
+      }
+      {
+        key = "<leader>gl";
+        action = "<cmd>Git log<CR>";
+      }
+      {
+        key = "<leader>gbl";
+        action = "<cmd>Git blame<CR>";
+      }
+      {
+        key = "<leader>gbr";
+        action = "<cmd>Git branch<CR>";
+      }
+    ];
+    opts = {
+      colorcolumn = "88";
+      cursorline = true;
+      number = true;
+      spell = true;
+      termguicolors = true;
+      textwidth = 80;
+    };
+    plugins = {
+      cmp = {
+        enable = true;  # Completion
+        autoEnableSources = true;
+        settings.sources = [
+          { name = "nvim_lsp"; }
+          { name = "path"; }
+          { name = "buffer"; }
+        ];
+        settings.mapping = {
+          "<C-d>" = "cmp.mapping.scroll_docs(-2)";
+          "<C-f>" = "cmp.mapping.scroll_docs(2)";
+          "<C-Space>" = "cmp.mapping.complete()";
+          "<C-e>" = "cmp.mapping.close()";
+          "<Tab>" = "cmp.mapping(cmp.mapping.select_next_item({behavior = cmp.SelectBehavior.Select}), {'i', 's'})";
+          "<S-Tab>" = "cmp.mapping(cmp.mapping.select_prev_item({behavior = cmp.SelectBehavior.Select}), {'i', 's'})";
+          "<CR>" = "cmp.mapping.confirm({ select = false, behavior = cmp.ConfirmBehavior.Replace })";
+        };
+      };
+      committia.enable = true;  # Enhanced git commits
+      fugitive.enable = true;
+      gitsigns.enable = true;  # Show git change in first line
+      guess-indent.enable = true;  # Guess indent of the file
+      lsp.enable = true;
+      lsp.servers = {
+        bashls.enable = true;
+        dockerls.enable = true;
+        gitlab_ci_ls.enable = true;
+        gitlab_ci_ls.package = pkgs.gitlab-ci-ls;
+        gopls.enable = true;
+        helm_ls.enable = true;
+        jsonls.enable = true;
+        nixd.enable = true;
+        pylsp = {
+          enable = true;
+          settings.plugins = {
+            black.enabled = true;
+            isort.enabled = true;
+            ruff.enabled = true;
+            ruff.formatEnabled = false;
+          };
+        };
+        terraformls = {
+          enable = true;
+          rootDir = "require('lspconfig.util').root_pattern('.git', '.terraform')";
+        };
+        tflint.enable = true;
+        yamlls.enable = true;
+      };
+      lsp-format.enable = true;  # Automatically format on save
+      lsp-lines.enable = true;  # Display LSP hints in lines
+      lsp-signature.enable = true;  # Show function signature when typing
+      lualine.enable = true;  # Status line
+      lualine.settings.sections = {
+        lualine_a = [ "fancy_mode" ];
+        lualine_b = [ "fancy_branch" "fancy_diff" ];
+        lualine_c = [ "fancy_cwd" "filename" ];
+        lualine_x = [ "fancy_diagnostics" "fancy_searchcount" ];
+        lualine_y = [ "fancy_filetype" ];
+        lualine_z = [ "fancy_lsp_servers" ];
+      };
+      render-markdown.enable = true;
+      treesitter.enable = true;
+      web-devicons.enable = true;
+    };
+  };
+}
--- a/home/terminal/nixvim/telescope.nix
+++ b/home/terminal/nixvim/telescope.nix
@ -0,0 +1,29 @@
+{ ... }:
+{
+  programs.nixvim = {
+    plugins.telescope = {
+      enable = true;
+      extensions = {
+        file-browser.enable = true;
+        frecency.enable = true;
+        fzf-native.enable = true;
+      };
+      keymaps = {
+        # https://github.com/nvim-telescope/telescope.nvim?tab=readme-ov-file#pickers
+        # File pickers
+        "<leader>t" = "file_browser";
+        "<leader>ff" = "find_files";
+        "<leader>fg" = "live_grep";
+        # Vim pickers
+        "<leader>r" = "command_history";
+        "<leader>fo" = "oldfiles";
+        "<leader>fs" = "spell_suggest";
+        # Treesitter pickers
+        "<leader>ft" = "treesitter";
+        # Git pickers
+        "<leader>fgs" = "git_status";
+        # LSP 
+      };
+    };
+  };
+}
--- a/home/wayland/default.nix
+++ b/home/wayland/default.nix
@ -1,42 +1,15 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, ghostty, ... }:

 {
  home.packages = with pkgs; [
+    brightnessctl
    flameshot
+    ghostty.packages.x86_64-linux.default
+    pulseaudio
+    swaybg
    swaylock
  ];

-  programs.foot = {
-    enable = true;
-    settings = {
-      main = {
-        font = "Roboto Mono Nerd Font:size=10";
-        dpi-aware = "no";
-      };
-      # nordiq from https://codeberg.org/dnkl/foot/src/branch/master/themes/
-      colors = {
-        background = "2E3440";
-        foreground = "D8DEE9";
-        regular0 = "5b6272";
-        regular1 = "bf616a";
-        regular2 = "a3be8c";
-        regular3 = "ebcb8b";
-        regular4 = "81a1c1";
-        regular5 = "b48ead";
-        regular6 = "88c0d0";
-        regular7 = "e5e9f0";
-        bright0 = "5E5C64";
-        bright1 = "F66151";
-        bright2 = "33DA7A";
-        bright3 = "E9AD0C";
-        bright4 = "2A7BDE";
-        bright5 = "C061CB";
-        bright6 = "33C7DE";
-        bright7 = "FFFFFF";
-      };
-    };
-  };
-
  programs.rofi = {
    enable = true;
    font = "Roboto Mono Nerd Font 10";
@ -202,6 +175,7 @@
        "--release Print" = "exec flameshot gui";
        "Mod1+l" = "exec swaylock -f -i ${wallpaper} -s fill";
        "${modifier}+m" = "scratchpad show";
+        "${modifier}+Return" = "exec ghostty";
        "XF86MonBrightnessDown" = "exec light -U 10";
        "XF86MonBrightnessUp" = "exec light -A 10";
        "XF86AudioRaiseVolume" = "exec 'pactl set-sink-volume @DEFAULT_SINK@ +1%'";
--- a/hosts/lift/configuration.nix
+++ b/hosts/lift/configuration.nix
@ -0,0 +1,66 @@
+{ pkgs, ... }:
+
+{
+  # Bootloader.
+  boot.loader.grub.enable = true;
+  boot.loader.grub.device = "/dev/sda";
+  boot.loader.grub.useOSProber = false;
+
+  # Setup keyfile
+  boot.initrd.secrets = {
+    "/crypto_keyfile.bin" = null;
+  };
+
+  # Enable grub cryptodisk
+  boot.loader.grub.enableCryptodisk = true;
+
+  boot.initrd.luks.devices."luks-efc0285c-812e-4946-936b-37e737fb72eb".keyFile = "/crypto_keyfile.bin";
+
+  networking.hostName = "lift";
+
+  networking.networkmanager.enable = true;
+  systemd.network.wait-online.enable = false;
+  boot.initrd.systemd.network.wait-online.enable = false;
+
+
+  # bluetooth
+  hardware.bluetooth.enable = true;
+
+  environment.systemPackages = with pkgs; [
+    avrdude
+    cryptsetup
+    ffmpeg
+    fzf
+    gammastep
+    glib
+    gnupg
+    ispell
+    keychain
+    hugo
+    mosquitto
+    mypy
+    sqlite
+  ];
+
+  services.pcscd.enable = true;
+  services.passSecretService.enable = true;
+
+  services.blueman.enable = true;
+
+  networking.nftables = {
+    enable = true;
+  };
+  networking.firewall.trustedInterfaces = [ "incusbr0" ];
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
+
+  virtualisation = {
+    incus.enable = true;
+    podman.enable = true;
+  };
+}
--- a/hosts/lift/default.nix
+++ b/hosts/lift/default.nix
@ -0,0 +1,12 @@
+{...}:
+{
+  imports = [
+    ./configuration.nix
+    ./hardware-configuration.nix
+    ../../modules/terminal/base.nix
+    ../../modules/terminal/user.nix
+    ../../modules/graphical/base.nix
+    ../../modules/graphical/printing.nix
+    ../../modules/graphical/steam.nix
+  ];
+}
--- a/hosts/lift/hardware-configuration.nix
+++ b/hosts/lift/hardware-configuration.nix
--- a/hosts/tien/configuration.nix
+++ b/hosts/tien/configuration.nix
@ -0,0 +1,75 @@
+{  modulesPath, lib, pkgs, ... }:
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+    (modulesPath + "/profiles/qemu-guest.nix")
+    ./disk-config.nix
+  ];
+  boot.loader.grub = {
+    # no need to set devices, disko will add all devices that have a EF02 partition to the list already
+    # devices = [ ];
+    efiSupport = true;
+    efiInstallAsRemovable = true;
+  };
+
+  environment.systemPackages = with pkgs; [
+    curl
+  ];
+
+  networking.hostName = "tien";
+  # do not use DHCP, as dashserv provisions IPs using cloud-init (see service below)
+  networking.useDHCP = pkgs.lib.mkForce false;
+  networking.firewall = {
+    enable = true;
+    allowedTCPPorts = [ 80 443 ];
+    trustedInterfaces = [ "tailscale0" ];
+  };
+
+  services.caddy = {
+    enable = true;
+    email = lib.strings.concatStrings ["mail" "@" "johannes-rothe.de"];
+    virtualHosts = {
+      "johannes-rothe.de".extraConfig = ''
+        reverse_proxy base:11112
+      '';
+      "www.johannes-rothe.de".extraConfig = ''
+        reverse_proxy base:11112
+      '';
+      "cloud.johannes-rothe.de".extraConfig = ''
+        reverse_proxy base:5002
+      '';
+      "feeds.johannes-rothe.de".extraConfig = ''
+        reverse_proxy base:1990
+      '';
+      "git.johannes-rothe.de".extraConfig = ''
+        reverse_proxy base:3001
+      '';
+      "radicale.johannes-rothe.de".extraConfig = ''
+        reverse_proxy base:5232
+      '';
+    };
+  };
+
+  services.cloud-init = {
+    enable = true;
+    network.enable = true;
+    settings = {
+      hostname = "tien";
+    };
+  };
+
+  services.searx = {
+    enable = true;
+    redisCreateLocally = true;
+    settings.server = {
+      bind_address = "0.0.0.0";
+      port = 8888;
+      secret_key = "localonly";
+    };
+  };
+
+
+  services.tailscale.enable = true;
+
+  system.stateVersion = "24.05";
+}
--- a/hosts/tien/disk-config.nix
+++ b/hosts/tien/disk-config.nix
--- a/hosts/tien/hardware-configuration.nix
+++ b/hosts/tien/hardware-configuration.nix
--- a/hosts/veil/configuration.nix
+++ b/hosts/veil/configuration.nix
@ -0,0 +1,19 @@
+{ ... }:
+
+{
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "veil";
+
+  networking.networkmanager.enable = true;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "24.11"; # Did you read the comment?
+
+}
--- a/hosts/veil/default.nix
+++ b/hosts/veil/default.nix
@ -0,0 +1,13 @@
+{...}:
+{
+  imports = [
+    ./configuration.nix
+    ./hardware-configuration.nix
+    ../../modules/terminal/base.nix
+    ../../modules/terminal/user.nix
+    ../../modules/graphical/amdgpu.nix
+    ../../modules/graphical/base.nix
+    ../../modules/graphical/printing.nix
+    ../../modules/graphical/steam.nix
+  ];
+}
--- a/hosts/veil/hardware-configuration.nix
+++ b/hosts/veil/hardware-configuration.nix
@ -0,0 +1,39 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/4dda19d7-0520-424e-87e6-771fbfed6ec4";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/AB15-6303";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp7s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp6s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
--- a/modules/graphical/amdgpu.nix
+++ b/modules/graphical/amdgpu.nix
@ -0,0 +1,6 @@
+{...}:
+{
+  boot.initrd.kernelModules = [ "amdgpu" ];
+  # for Southern Islands (SI i.e. GCN 1) cards
+  boot.kernelParams = [ "radeon.si_support=0" "amdgpu.si_support=1" ];
+}
--- a/modules/graphical/base.nix
+++ b/modules/graphical/base.nix
@ -0,0 +1,91 @@
+{pkgs, ...}:
+{
+  hardware.sane.enable = true;
+  hardware.graphics.enable = true;
+
+  environment.systemPackages = with pkgs; [
+    calibre
+    chromium
+    dracula-theme
+    eog
+    evince
+    firefox
+    gimp
+    inkscape
+    libreoffice
+    logseq
+    nautilus
+    orca-slicer
+    pavucontrol
+    portfolio
+    pulseaudio
+    signal-desktop
+    simple-scan
+    spotify
+    syncthing
+    thunderbird
+    vlc
+    wayshot
+    wdisplays
+    wl-clipboard
+    xdg-utils
+    yt-dlp
+  ];
+
+  # Workaround for logseq
+  nixpkgs.config.permittedInsecurePackages = [
+    "electron-27.3.11"
+  ];
+
+  programs = {
+    light.enable = true;
+    sway.enable = true;
+  };
+
+  security.rtkit.enable = true;
+
+  services = {
+    dbus.enable = true;
+    gvfs.enable = true;
+    greetd = {
+      enable = true;
+      settings = {
+        default_session = {
+          command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --asterisks --cmd sway";
+          user = "rothe";
+        };
+      };
+    };
+    pipewire = {
+      enable = true;
+      alsa.enable = true;
+      pulse.enable = true;
+    };
+    syncthing = {
+      enable = true;
+      user = "rothe";
+      group = "users";
+      dataDir = "/home/rothe";
+      overrideFolders = false;
+      overrideDevices = false;
+    };
+  };
+
+  programs = {
+    # Helper for nixos output
+    nh = {
+      enable = true;
+      clean.enable = true;
+      clean.extraArgs = "--keep-since 4d --keep 3";
+      flake = "/home/rothe/src/nixos-config";
+    };
+  };
+
+  xdg.portal = {
+    enable = true;
+    wlr.enable = true;
+    # gtk portal needed to make gtk apps happy
+    extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
+    config.common.default = "*";
+  };
+}
--- a/nixos/desktop/printing/default.nix
+++ b/nixos/desktop/printing/default.nix
@ -1,4 +1,4 @@
-{ inputs, lib, config, pkgs, ... }: {
+{ pkgs, ... }: {
  # Enable CUPS to print documents.
  services.printing.enable = true;

@ -10,7 +10,8 @@
  };

  services.printing.drivers = [
-    (pkgs.writeTextDir "share/cups/model/kyocera_fs-1300d.ppd" (builtins.readFile ../../../files/kyocera_fs-1300d.ppd))
+    (pkgs.writeTextDir "share/cups/model/kyocera_fs-1300d.ppd"
+    (builtins.readFile ../../files/kyocera_fs-1300d.ppd))
  ];
  hardware.printers = {
  ensurePrinters = [
--- a/modules/graphical/steam.nix
+++ b/modules/graphical/steam.nix
@ -0,0 +1,9 @@
+{...}:
+{
+  programs.steam = {
+    enable = true;
+    remotePlay.openFirewall = true;
+    dedicatedServer.openFirewall = true;
+    localNetworkGameTransfers.openFirewall = true;
+  };
+}
--- a/modules/terminal/base.nix
+++ b/modules/terminal/base.nix
@ -0,0 +1,54 @@
+{pkgs, ...}:
+{
+  nix.settings.experimental-features = ["nix-command" "flakes"];
+
+  time.timeZone = "Europe/Berlin";
+
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "de_DE.UTF-8";
+    LC_IDENTIFICATION = "de_DE.UTF-8";
+    LC_MEASUREMENT = "de_DE.UTF-8";
+    LC_MONETARY = "de_DE.UTF-8";
+    LC_NAME = "de_DE.UTF-8";
+    LC_NUMERIC = "de_DE.UTF-8";
+    LC_PAPER = "de_DE.UTF-8";
+    LC_TELEPHONE = "de_DE.UTF-8";
+    LC_TIME = "de_DE.UTF-8";
+  };
+
+  console.keyMap = "de-latin1-nodeadkeys";
+  nixpkgs.config.allowUnfree = true;
+
+  environment.systemPackages = with pkgs; [
+    bind
+    cmake
+    curl
+    gcc
+    git
+    gnumake
+    nmap
+    tmux
+    tree
+    unzip
+    wget
+  ];
+
+  hardware.keyboard.zsa.enable = true;
+
+  programs = {
+    fish.enable = true;
+    gnupg.agent = {
+        enable = true;
+        enableSSHSupport = true;
+    };
+  };
+
+  services = {
+    fwupd.enable = true;
+    resolved.enable = true;
+    tailscale.enable = true;
+    tailscale.useRoutingFeatures = "client";
+  };
+}
--- a/modules/terminal/user.nix
+++ b/modules/terminal/user.nix
@ -0,0 +1,10 @@
+{pkgs, ...}:
+{
+
+  users.users.rothe = {
+    isNormalUser = true;
+    description = "rothe";
+    extraGroups = [ "networkmanager" "wheel" "video" "scanner" "lp" "incus-admin" "dialout" ];
+    shell = pkgs.fish;
+  };
+}
--- a/nixos/tien/secrets.yaml
+++ b/nixos/tien/secrets.yaml
@ -1,30 +0,0 @@
-foo: ENC[AES256_GCM,data:HqMg,iv:LdYZPucCO7rOgOFtuzSwSoOsW/GvPoysLfZa2w+E03E=,tag:DpE52f6iWiQ691bwJNFBZA==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1xy66lg9eh572ge0y7zzh34f78s8l9hnkxhg3r4gn98ph95mz25tszgerul
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqdkRUVWpSbjVvRUpiUTNj
-            RDQ5aDNKNGZCd0ZGWkczQWRVUWRraTk3bHlvCjQ2ZGtvM3dJQnl0Wjc2ZmJYNGJV
-            QnhuMG1UVEZDUXdMK2M0L3c5Um4rQ28KLS0tIGtQcGVkQktmUkwwbSsrdC8rVnZE
-            T3VhOFF5NGlER2FCQlUrWFN0RHNSeW8KTFwMDtofyqFrnIFs9qy1gHiw8eVX7pcm
-            2k6yLOeyP2NaksDl74OSrmUECxZKMRPspgn1ZlznibDQKyCVXVVKZg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age12j6x69evhvh6ljngq4lgesnezf7hwafc33z7nj9urnsl5xzlhp5sf6szck
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFOGhZQnBld1lEeGNZVkpi
-            TzFKaFJyVVNqKzNQQkN0M3ZWRUlkY1g3SzE4CmlnVVlMbWRTVHd4KzV3ZHNuR21S
-            bmdJZDJ4YzVDZ3JTcDVucmhpd2xJNFUKLS0tIGRzcUt6cjl3UGpldVBTeG01V1dX
-            eWx2UWdkUXdrSkxPT1NXS2xHengreWsKR31+5SpYGOJyd/SFmzrThBWOVt1GU1hr
-            qTQqyc2/XbMQCc/SrYCa/FhRLboKUFkAO2XbMoH5zEwmkFtuCEoNvg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-11-20T21:34:05Z"
-    mac: ENC[AES256_GCM,data:xx007JasOAWh2Os1DKkDQ3QMGmxN3oBpmL/t8/UWleYHVR3CTjYOTiSEguurFFIOqW7sK3ZAxnKbIr3mwDXs2VA1LO6L2UvBA0NaFgP6Qws+YvjF+dzRrxl+fXOMJz5wxOJROYo3VVI4zH7xnI22ENGc7VLDholwbx5EZDbUL7Y=,iv:KZxPU6RbLY2wZIX/hsO8OLweAxGe30LOSHWa9MI1ydA=,tag:oewmLJbInGoX7ZwpljRAkA==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.8.1
--- a/sway.nix
+++ b/sway.nix
@ -1,7 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-  programs.sway = {
-    enable = true;
-  };
-}
--- a/vps-configuration.nix
+++ b/vps-configuration.nix
@ -1,221 +0,0 @@
-{  config, inputs, modulesPath, lib, pkgs, ... }:
-let
-  hostname = "tien";
-in
-{
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-    (modulesPath + "/profiles/qemu-guest.nix")
-    ./vps-disk-config.nix
-    inputs.sops-nix.nixosModules.sops
-  ];
-  boot.loader.grub = {
-    # no need to set devices, disko will add all devices that have a EF02 partition to the list already
-    # devices = [ ];
-    efiSupport = true;
-    efiInstallAsRemovable = true;
-  };
-
-  sops = {
-    defaultSopsFile = ./nixos/tien/secrets.yaml;
-    age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-    secrets = {
-      foo = {};
-    };
-  };
-
-
-  environment.systemPackages = with pkgs; [
-    authelia
-    curl
-    vim
-  ];
-
-  networking.hostName = hostname;
-  # do not use DHCP, as dashserv provisions IPs using cloud-init (see service below)
-  networking.useDHCP = pkgs.lib.mkForce false;
-  networking.firewall = {
-    enable = true;
-    allowedTCPPorts = [ 80 443 ];
-    trustedInterfaces = [ "tailscale0" ];
-  };
-
-  services.authelia.instances.main = {
-    enable = true;
-    secrets = {
-      jwtSecretFile = "${pkgs.writeText "jwtSecretFile" "supersecretkeyissupersecret"}";
-      storageEncryptionKeyFile = "${pkgs.writeText "storageEncryptionKeyFile" "supersecretkeyissupersecret"}";
-      sessionSecretFile = "${pkgs.writeText "sessionSecretFile" "supersecretkeyissupersecret"}";
-    };
-    settings = {
-      theme = "auto";
-      default_redirection_url = "https://auth.johannes-rothe.de";
-
-      server = {
-        host = "127.0.0.1";
-        port = 9091;
-      };
-
-      log = {
-        level = "debug";
-        format = "text";
-      };
-
-      authentication_backend = {
-        #file = {
-        #  path = "/var/lib/authelia-main/users_database.yml";
-        #};
-        password_reset.disable = false;
-        refresh_interval = "1m";
-        ldap = {
-          implementation = "custom";
-          url = "ldap://localhost:3890";
-          timeout = "5s";
-          start_tls = false;
-          base_dn = "dc=accounts,dc=johannes-rothe,dc=de";
-          additional_users_dn = "ou=people";
-          users_filter = "(&({username_attribute}={input})(objectClass=person))";
-          additional_groups_dn = "ou=groups";
-          groups_filter = "(member={dn})";
-          display_name_attribute = "displayName";
-          username_attribute = "uid";
-          group_name_attribute = "cn";
-          mail_attribute = "mail";
-          # "bind_user" should be the username you created for authentication with the "lldap_strict_readonly" permission. It is not recommended to use an actual admin account here.
-          # If you are configuring Authelia to change user passwords, then the account used here needs the "lldap_password_manager" permission instead.
-          user = "uid=bind_user,ou=people,dc=accounts,dc=johannes-rothe,dc=de";
-          # Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html
-          password = "REPLACE_ME";
-        };
-      };
-
-      access_control = {
-        default_policy = "one_factor";
-        rules = [
-          #{
-          #  domain = ["auth.example.com"];
-          #  policy = "bypass";
-          #}
-          #{
-          #  domain = ["*.example.com"];
-          #  policy = "one_factor";
-          #}
-        ];
-      };
-
-      session = {
-        name = "authelia_session";
-        expiration = "12h";
-        inactivity = "45m";
-        remember_me_duration = "1M";
-        domain = "example.com";
-        redis.host = "/run/redis-authelia-main/redis.sock";
-      };
-
-      regulation = {
-        max_retries = 3;
-        find_time = "5m";
-        ban_time = "15m";
-      };
-
-      storage = {
-        local = {
-          path = "/var/lib/authelia-main/db.sqlite3";
-        };
-      };
-
-      notifier = {
-        disable_startup_check = false;
-        filesystem = {
-          filename = "/var/lib/authelia-main/notification.txt";
-        };
-      };
-    };
-  };
-
-  services.redis.servers.authelia-main = {
-    enable = true;
-    user = "authelia-main";
-    port = 0;
-    unixSocket = "/run/redis-authelia-main/redis.sock";
-    unixSocketPerm = 600;
-  };
-
-  services.headscale = {
-      enable = true;
-      address = "0.0.0.0";
-      port = 8080;
-      settings = {
-        dns_config.base_domain= "johannes-rothe.de";
-        server_url = "https://headscale.johannes-rothe.de";
-      };
-  };
-
-
-  services.caddy = {
-    enable = true;
-    email = lib.strings.concatStrings ["mail" "@" "johannes-rothe.de"];
-    virtualHosts = {
-      "johannes-rothe.de".extraConfig = ''
-        reverse_proxy base:11112
-      '';
-      "www.johannes-rothe.de".extraConfig = ''
-        reverse_proxy base:11112
-      '';
-      #"accounts.johannes-rothe.de".extraConfig = ''
-      #  reverse_proxy localhost:9095
-      #'';
-      #"auth.johannes-rothe.de".extraConfig = ''
-      #  reverse_proxy localhost:9091
-      #'';
-      "cloud.johannes-rothe.de".extraConfig = ''
-        reverse_proxy base:5002
-      '';
-      "feeds.johannes-rothe.de".extraConfig = ''
-        reverse_proxy base:1990
-      '';
-      "git.johannes-rothe.de".extraConfig = ''
-        reverse_proxy base:3001
-      '';
-      #"headscale.johannes-rothe.de".extraConfig = ''
-      #  reverse_proxy localhost:8080
-      #'';
-      "radicale.johannes-rothe.de".extraConfig = ''
-        reverse_proxy base:5232
-      '';
-    };
-  };
-
-  services.cloud-init = {
-    enable = true;
-    network.enable = true;
-    settings = {
-      hostname = hostname;
-    };
-  };
-
-  services.lldap = {
-    enable = true;
-    settings = {
-      http_host = "127.0.0.1";
-      http_port = 9095;
-      http_url = "https://accounts.johannes-rothe.de";
-      ldap_base_dn= "dc=accounts,dc=johannes-rothe,dc=de";
-    };
-  };
-
-  services.searx = {
-    enable = true;
-    redisCreateLocally = true;
-    settings.server = {
-      bind_address = "0.0.0.0";
-      port = 8888;
-      secret_key = "localonly";
-    };
-  };
-
-
-  services.tailscale.enable = true;
-
-  system.stateVersion = "24.05";
-}
Author	SHA1	Message	Date
Johannes Rothe	6d676499b5	Update 2025-01-15	2025-01-15 19:42:54 +01:00
Johannes Rothe	f9ed56664a	Enable incus on lift	2025-01-12 18:35:31 +01:00
Johannes Rothe	74b621b335	Tailscale client routing features	2025-01-04 18:19:10 +01:00
Johannes Rothe	42d853e493	Replace prusa-slicer with orca-slicer	2025-01-02 16:55:40 +01:00
Johannes Rothe	cb42c46c5c	Veil: fix hardware-configuration	2025-01-02 15:26:12 +01:00
Johannes Rothe	35605ec47c	Move gvfs to graphical base	2025-01-02 14:46:29 +01:00
Johannes Rothe	e00a929820	Add host veil	2025-01-02 13:38:31 +01:00
Johannes Rothe	ad7fc6614e	Modularize nixos config	2025-01-02 13:38:31 +01:00
Johannes Rothe	2a8e761b6c	Replace foot with ghostty terminal	2024-12-28 22:39:36 +01:00
Johannes Rothe	34476e38ed	ghostty: change theme to MaterialDarker	2024-12-28 22:39:00 +01:00
Johannes Rothe	c3f5e6be5b	nvim: lualine add filename	2024-12-28 21:51:28 +01:00
Johannes Rothe	93717eb5f7	Add ghostty terminal	2024-12-28 21:50:39 +01:00
Johannes Rothe	6de02a4c32	home-manager: add some packages	2024-12-23 18:14:42 +01:00
Johannes Rothe	c735356011	Move printing module	2024-12-22 23:54:16 +01:00
Johannes Rothe	99e9229b09	Move hosts to subfolders	2024-12-22 23:49:58 +01:00
Johannes Rothe	58c41ab7ea	flake: update 2024-12-22	2024-12-22 23:12:37 +01:00
Johannes Rothe	e8e186a6f3	flake: add deploy target for tien	2024-12-22 23:11:45 +01:00
Johannes Rothe	ed573a2b12	nvim: more fugitive keys	2024-12-22 16:18:22 +01:00
Johannes Rothe	ecaab24ad6	nvim: add fugitive keymaps	2024-12-22 16:06:37 +01:00
Johannes Rothe	2ff2ab05f2	nvim: enable fugitive	2024-12-22 15:56:17 +01:00
Johannes Rothe	4bdfa8f7bb	nvim: lualine fancy plugin	2024-12-22 15:50:55 +01:00
Johannes Rothe	39e9b52938	nvim: add more language servers	2024-12-22 15:29:09 +01:00
Johannes Rothe	d79368ff44	nvim: replace gitgutter with gitsigns	2024-12-22 14:51:45 +01:00
Johannes Rothe	b6f36c12a0	nvim: highlight trailing whitespaces	2024-12-22 00:23:05 +01:00
Johannes Rothe	9ef7e27f79	nvim: enable spell checker	2024-12-22 00:00:02 +01:00
Johannes Rothe	db1e6d1bad	nvim: enable bash language server	2024-12-21 23:31:12 +01:00
Johannes Rothe	29e40d0d32	nvim: set terraform lsp root dir	2024-12-21 23:30:20 +01:00
Johannes Rothe	4f80dfc9b6	nvim: render markdown plugin	2024-12-21 21:49:19 +01:00
Johannes Rothe	928a557707	nvim: enable more language servers	2024-12-21 19:04:51 +01:00
Johannes Rothe	aec0d3b8f3	nvim: LSP format on save	2024-12-21 18:38:18 +01:00
Johannes Rothe	446e93f23f	Add telescope nvim plugin	2024-12-21 15:08:54 +01:00
Johannes Rothe	082240c343	Start nixvim config	2024-12-21 01:30:34 +01:00
Johannes Rothe	fa03fd3be9	Keep Roboto mono in some programs	2024-12-20 09:19:48 +01:00
Johannes Rothe	0267612512	DPI aware foot	2024-12-20 09:18:16 +01:00
Johannes Rothe	61f5b5876d	Use JetBrains Mono font	2024-12-20 09:06:15 +01:00
Johannes Rothe	72e9bd5b29	Add NIX_PATH variable	2024-12-20 09:05:30 +01:00