Merge branch 'master' into firewall-changes

Reviewed-on: #16

.gitea/workflows/update-flake-lock.yml

@@ -0,0 +1,40 @@
+name: Update flake lock
+
+on:
+  schedule:
+    # Gitea cron schedules use UTC. 07:00 UTC is 03:00 EDT.
+    - cron: "0 7 * * 0"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  update-flake-lock:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Install upstream Nix
+        uses: cachix/install-nix-action@v31
+
+      - name: Update flake lock
+        run: nix flake update
+
+      - name: Commit and push changes
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if git diff --quiet -- flake.lock; then
+            echo "flake.lock is already up to date"
+            exit 0
+          fi
+
+          git config user.name "gitea-actions[bot]"
+          git config user.email "gitea-actions[bot]@noreply.localhost"
+          git add flake.lock
+          git commit -m "chore: update flake lock"
+          git push

defaults/nvim/lua/plugins/user.lua

@@ -1,85 +1,10 @@
-if true then return {} end -- WARN: REMOVE THIS LINE TO ACTIVATE THIS FILE
-
--- You can also add or configure plugins by creating files in this `plugins/` folder
--- Here are some examples:
-
 ---@type LazySpec
 return {
-
+  { "nvim-treesitter/nvim-treesitter" },
-  -- == Examples of Adding Plugins ==
+  { "neovim/nvim-lspconfig" },
-
+  { "kylechui/nvim-surround" },
-  "andweeb/presence.nvim",
+  { "nvim-neo-tree/neo-tree.nvim" },
-  {
+  { "akinsho/toggleterm.nvim" },
-    "ray-x/lsp_signature.nvim",
+  { "nvimtools/none-ls.nvim" },
-    event = "BufRead",
+  { "rebelot/heirline.nvim" },
-    config = function() require("lsp_signature").setup() end,
-  },
-
-  -- == Examples of Overriding Plugins ==
-
-  -- customize alpha options
-  {
-    "goolord/alpha-nvim",
-    opts = function(_, opts)
-      -- customize the dashboard header
-      opts.section.header.val = {
-        " █████  ███████ ████████ ██████   ██████",
-        "██   ██ ██         ██    ██   ██ ██    ██",
-        "███████ ███████    ██    ██████  ██    ██",
-        "██   ██      ██    ██    ██   ██ ██    ██",
-        "██   ██ ███████    ██    ██   ██  ██████",
-        " ",
-        "    ███    ██ ██    ██ ██ ███    ███",
-        "    ████   ██ ██    ██ ██ ████  ████",
-        "    ██ ██  ██ ██    ██ ██ ██ ████ ██",
-        "    ██  ██ ██  ██  ██  ██ ██  ██  ██",
-        "    ██   ████   ████   ██ ██      ██",
-      }
-      return opts
-    end,
-  },
-
-  -- You can disable default plugins as follows:
-  { "max397574/better-escape.nvim", enabled = false },
-
-  -- You can also easily customize additional setup of plugins that is outside of the plugin's setup call
-  {
-    "L3MON4D3/LuaSnip",
-    config = function(plugin, opts)
-      require "astronvim.plugins.configs.luasnip"(plugin, opts) -- include the default astronvim config that calls the setup call
-      -- add more custom luasnip configuration such as filetype extend or custom snippets
-      local luasnip = require "luasnip"
-      luasnip.filetype_extend("javascript", { "javascriptreact" })
-    end,
-  },
-
-  {
-    "windwp/nvim-autopairs",
-    config = function(plugin, opts)
-      require "astronvim.plugins.configs.nvim-autopairs"(plugin, opts) -- include the default astronvim config that calls the setup call
-      -- add more custom autopairs configuration such as custom rules
-      local npairs = require "nvim-autopairs"
-      local Rule = require "nvim-autopairs.rule"
-      local cond = require "nvim-autopairs.conds"
-      npairs.add_rules(
-        {
-          Rule("$", "$", { "tex", "latex" })
-            -- don't add a pair if the next character is %
-            :with_pair(cond.not_after_regex "%%")
-            -- don't add a pair if  the previous character is xxx
-            :with_pair(
-              cond.not_before_regex("xxx", 3)
-            )
-            -- don't move right when repeat character
-            :with_move(cond.none())
-            -- don't delete if the next character is xx
-            :with_del(cond.not_after_regex "xx")
-            -- disable adding a newline when you press <cr>
-            :with_cr(cond.none()),
-        },
-        -- disable for .vim files, but it work for another filetypes
-        Rule("a", "a", "-vim")
-      )
-    end,
-  },
 }

flake.lock

@@ -9,11 +9,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1780372639,
+        "lastModified": 1789138122,
-        "narHash": "sha256-VFzXYHlIGwO4h4ovtnpZj9sX/Qu6+dlI00sXjHdwi2w=",
+        "narHash": "sha256-mh+ZiGCtHAo0xIi1yaNjHsftfnlWz9JiYwHCyT16yIE=",
         "owner": "ezKEa",
         "repo": "aagl-gtk-on-nix",
-        "rev": "1ee1e8864a1fcfcc21a5fb5af4bd328b3c829f42",
+        "rev": "d82d6d6f66caf4b63fb154e62fad83c627874127",
         "type": "github"
       },
       "original": {
@@ -22,6 +22,29 @@
         "type": "github"
       }
     },
+    "caitsith": {
+      "inputs": {
+        "flake-schemas": "flake-schemas",
+        "nixpkgs": [
+          "nur",
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay_2"
+      },
+      "locked": {
+        "lastModified": 1791702392,
+        "narHash": "sha256-8uWZP3UiJBtYzBzazI18WvlshKYHxPb+8aqm02OxL5M=",
+        "ref": "refs/heads/master",
+        "rev": "ee2a27ad749d6d774e26c2be5de5f3a5ecd4a93f",
+        "revCount": 28,
+        "type": "git",
+        "url": "https://scm.wyattjmiller.com/wymiller/caitsith.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://scm.wyattjmiller.com/wymiller/caitsith.git"
+      }
+    },
     "darwin": {
       "inputs": {
         "nixpkgs": [
@@ -29,11 +52,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781190061,
+        "lastModified": 1783744694,
-        "narHash": "sha256-QRMpLbsmlciMGv4yx75FUoIl54K02JbIX1tgdPHPw1s=",
+        "narHash": "sha256-2cp6N3rrwnGYLTx9l6N+NI+kwrCWxvJUbj5WJhvB29A=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "f2b3fdb347f91dfd344ad196666a0b0fe8aad05c",
+        "rev": "c3e90c89649b07d1a96e4b9dd6cd0d6e44b91a74",
         "type": "github"
       },
       "original": {
@@ -51,11 +74,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779036909,
+        "lastModified": 1786845137,
-        "narHash": "sha256-zXcwYQGCT6pzinK+1dBB2ekTVtfxGZAapb3Evdcu4fY=",
+        "narHash": "sha256-oQFip+v0luP8NIxJzmiW4Wu8bILsbFWom5l0zonl8hQ=",
         "owner": "LnL7",
         "repo": "nix-darwin",
-        "rev": "56c666e108467d87d13508936aade6d567f2a501",
+        "rev": "4cff07de74b50e64bdd68cd4e722ab5b6b35ee48",
         "type": "github"
       },
       "original": {
@@ -96,6 +119,66 @@
         "type": "github"
       }
     },
+    "flake-compat_3": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_4": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1777699697,
+        "narHash": "sha256-Eg9b/rq/ECYwNwEXs5i9wHyhxNI0JrYx2srdI2uZMaQ=",
+        "ref": "refs/heads/main",
+        "rev": "382052b74656a369c5408822af3f2501e9b1af81",
+        "revCount": 94,
+        "type": "git",
+        "url": "https://git.lix.systems/lix-project/flake-compat.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.lix.systems/lix-project/flake-compat.git"
+      }
+    },
+    "flake-schemas": {
+      "locked": {
+        "lastModified": 1780327564,
+        "narHash": "sha256-HiRPtA0spK+Dkgbhz/1zW9glXxNVB+L4Rj2VYmdawb8=",
+        "rev": "6cc9bd98891b1fc6bb2b8cb3277df8bc72799ca6",
+        "revCount": 149,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/flake-schemas/0.5.0/019e83cf-9af3-78b1-ac5b-70e68ad1efe1/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/DeterminateSystems/flake-schemas/%2A"
+      }
+    },
+    "flake-schemas_2": {
+      "locked": {
+        "lastModified": 1780327564,
+        "narHash": "sha256-HiRPtA0spK+Dkgbhz/1zW9glXxNVB+L4Rj2VYmdawb8=",
+        "rev": "6cc9bd98891b1fc6bb2b8cb3277df8bc72799ca6",
+        "revCount": 149,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/flake-schemas/0.5.0/019e83cf-9af3-78b1-ac5b-70e68ad1efe1/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/DeterminateSystems/flake-schemas/%2A"
+      }
+    },
     "flake-utils": {
       "inputs": {
         "systems": "systems"
@@ -135,18 +218,17 @@
     "git-hooks": {
       "inputs": {
         "flake-compat": "flake-compat_2",
-        "gitignore": "gitignore",
         "nixpkgs": [
           "go-overlay",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1778507602,
+        "lastModified": 1788267358,
-        "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=",
+        "narHash": "sha256-nt+lUqYVpc9Y6JeMd2WmXzCDojasdadKo0mWcluvY2Y=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a",
+        "rev": "27555e2624241fb116b49095df4caaee85a25691",
         "type": "github"
       },
       "original": {
@@ -155,25 +237,26 @@
         "type": "github"
       }
     },
-    "gitignore": {
+    "git-hooks_2": {
       "inputs": {
+        "flake-compat": "flake-compat_3",
         "nixpkgs": [
+          "nur",
           "go-overlay",
-          "git-hooks",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1709087332,
+        "lastModified": 1788267358,
-        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "narHash": "sha256-nt+lUqYVpc9Y6JeMd2WmXzCDojasdadKo0mWcluvY2Y=",
-        "owner": "hercules-ci",
+        "owner": "cachix",
-        "repo": "gitignore.nix",
+        "repo": "git-hooks.nix",
-        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "rev": "27555e2624241fb116b49095df4caaee85a25691",
         "type": "github"
       },
       "original": {
-        "owner": "hercules-ci",
+        "owner": "cachix",
-        "repo": "gitignore.nix",
+        "repo": "git-hooks.nix",
         "type": "github"
       }
     },
@@ -184,11 +267,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1781239934,
+        "lastModified": 1792166485,
-        "narHash": "sha256-bK84gDc7MgPdoQfr4k1oSIsdA9pSXVjEc3QPpVFGRPs=",
+        "narHash": "sha256-TL2RJ56FbBQNi6vsCXAn7QhZECh5DPbvzfiX6v+4r1A=",
         "owner": "purpleclay",
         "repo": "go-overlay",
-        "rev": "efc8ba6788ff0736cc2098d7c588d58819a927e7",
+        "rev": "5971ffb6c5de960d37f3b85c53cb5a30387cd05a",
         "type": "github"
       },
       "original": {
@@ -197,6 +280,52 @@
         "type": "github"
       }
     },
+    "go-overlay_2": {
+      "inputs": {
+        "flake-utils": "flake-utils_2",
+        "git-hooks": "git-hooks_2",
+        "nixpkgs": [
+          "nur",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1792166485,
+        "narHash": "sha256-TL2RJ56FbBQNi6vsCXAn7QhZECh5DPbvzfiX6v+4r1A=",
+        "owner": "purpleclay",
+        "repo": "go-overlay",
+        "rev": "5971ffb6c5de960d37f3b85c53cb5a30387cd05a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "purpleclay",
+        "repo": "go-overlay",
+        "type": "github"
+      }
+    },
+    "hildibrand": {
+      "inputs": {
+        "flake-schemas": "flake-schemas_2",
+        "nixpkgs": [
+          "nur",
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay_3"
+      },
+      "locked": {
+        "lastModified": 1791702441,
+        "narHash": "sha256-qHf8tVIYu6OE1PKcthmpBgblg27u3bU7v4TVqy0B3jg=",
+        "ref": "refs/heads/master",
+        "rev": "2c2e99f6347e9be744a72f7df6043015989d6cd7",
+        "revCount": 17,
+        "type": "git",
+        "url": "https://scm.wyattjmiller.com/wymiller/hildibrand.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://scm.wyattjmiller.com/wymiller/hildibrand.git"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -204,11 +333,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781184346,
+        "lastModified": 1792274446,
-        "narHash": "sha256-cZRlW47U6A2nWvAmnZeeO6Xvq23gxYbVLel4KxqOrcQ=",
+        "narHash": "sha256-AM1HmBeDnB2B3dSiXuCYeu7Me+lHNpz/P39lVxGJBuQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "ea6d221d7aa85652d014b6f719dddf036037515b",
+        "rev": "ab3823b4b24c0c3ca984c1f3ee577fd6d667424c",
         "type": "github"
       },
       "original": {
@@ -220,14 +349,17 @@
     },
     "home-manager_2": {
       "inputs": {
-        "nixpkgs": "nixpkgs_3"
+        "nixpkgs": [
+          "nur",
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1779507042,
+        "lastModified": 1792098797,
-        "narHash": "sha256-7wOwi8B6D0BYsieZCnHZZj2sNUzgJhLoIVSfkwB7lxQ=",
+        "narHash": "sha256-u4DIIZgznEGzByxXrxWCXK19VcMtTBmi/M9gZ7Jk9bM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "509ed3c603349a9d43de9e2ae6613baea6bd5b34",
+        "rev": "640725978b99076e18e069f6e7d2959124584f8f",
         "type": "github"
       },
       "original": {
@@ -236,6 +368,21 @@
         "type": "github"
       }
     },
+    "mnw": {
+      "locked": {
+        "lastModified": 1784154424,
+        "narHash": "sha256-HRn4O1X2ShYtbq5Egji72/aemyc2cIQicjRZD9hBqM8=",
+        "owner": "Gerg-L",
+        "repo": "mnw",
+        "rev": "0151d9fa87992cbeb67c86616fb9170dcec830b6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Gerg-L",
+        "repo": "mnw",
+        "type": "github"
+      }
+    },
     "nix-flatpak": {
       "locked": {
         "lastModified": 1739444422,
@@ -254,11 +401,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1778869304,
+        "lastModified": 1789286504,
-        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
+        "narHash": "sha256-eiEK7cKZORNEvX0GeF3RtNEF/JXhgf2RqSp3230q13E=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
+        "rev": "ef34387ddd751e1ab8857adf4676492d32eb24ec",
         "type": "github"
       },
       "original": {
@@ -270,11 +417,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1780902259,
+        "lastModified": 1792030654,
-        "narHash": "sha256-q8yYEC5f1mFlQO9RGna4LTc9QrcvWunX6FYp83munkQ=",
+        "narHash": "sha256-OaQwAtPMTjQiY2sT/2/62UbSPhzP/0aDnWzMm/NCiUw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "bd0ff2d3eac24699c3664d5966b9ef36f388e2ca",
+        "rev": "26f4107e47e3ad0ffd0db220469ba83b6f6d96e8",
         "type": "github"
       },
       "original": {
@@ -286,27 +433,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1778443072,
+        "lastModified": 1792030654,
-        "narHash": "sha256-zi7/fsqM/kFdNuED//4WOCUtezGtKKqRNORjMvfwjnA=",
+        "narHash": "sha256-OaQwAtPMTjQiY2sT/2/62UbSPhzP/0aDnWzMm/NCiUw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "da5ad661ba4e5ef59ba743f0d112cbc30e474f32",
+        "rev": "26f4107e47e3ad0ffd0db220469ba83b6f6d96e8",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_4": {
-      "locked": {
-        "lastModified": 1780902259,
-        "narHash": "sha256-q8yYEC5f1mFlQO9RGna4LTc9QrcvWunX6FYp83munkQ=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "bd0ff2d3eac24699c3664d5966b9ef36f388e2ca",
         "type": "github"
       },
       "original": {
@@ -316,6 +447,19 @@
         "type": "github"
       }
     },
+    "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1790046670,
+        "narHash": "sha256-OJe62m8gZx4xEAQnMcqH1u31/uu4Xf0q2ykAEHZfgrg=",
+        "rev": "6774f7bc253789b113a4f39285dc0fa100abeacc",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1077996.6774f7bc2537/nixexprs.tar.xz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
+      }
+    },
     "nixpkgs_5": {
       "locked": {
         "lastModified": 1744536153,
@@ -334,17 +478,20 @@
     },
     "nur": {
       "inputs": {
+        "caitsith": "caitsith",
         "darwin": "darwin_2",
-        "flake-utils": "flake-utils_2",
+        "go-overlay": "go-overlay_2",
+        "hildibrand": "hildibrand",
         "home-manager": "home-manager_2",
-        "nixpkgs": "nixpkgs_4"
+        "nixpkgs": "nixpkgs_3",
+        "rust-overlay": "rust-overlay_4"
       },
       "locked": {
-        "lastModified": 1781241353,
+        "lastModified": 1792344577,
-        "narHash": "sha256-lY3e7d5bA48qnTWGBSH6SK5jfINRlCQEv+zx1eGl1zU=",
+        "narHash": "sha256-Sbd2veIdg9iDiwwDeEKIiuk8FYMtjBXWvDlrrM0FjVA=",
         "ref": "refs/heads/master",
-        "rev": "90afe7c81a068fb1f160d68acd0ad06fa1bf7553",
+        "rev": "2debafc63297a24d2ca5c749b0d3f6bdbf6324cb",
-        "revCount": 30,
+        "revCount": 113,
         "type": "git",
         "url": "https://scm.wyattjmiller.com/wymiller/nur.git"
       },
@@ -353,6 +500,26 @@
         "url": "https://scm.wyattjmiller.com/wymiller/nur.git"
       }
     },
+    "nvf": {
+      "inputs": {
+        "flake-compat": "flake-compat_4",
+        "mnw": "mnw",
+        "nixpkgs": "nixpkgs_4"
+      },
+      "locked": {
+        "lastModified": 1792175215,
+        "narHash": "sha256-XD64JVLV8iE4lR+W5gkTweEaT+SBwOrSy0+le2WgITI=",
+        "owner": "notashelf",
+        "repo": "nvf",
+        "rev": "a736b60b1e2019931168979951c94dc46e342957",
+        "type": "github"
+      },
+      "original": {
+        "owner": "notashelf",
+        "repo": "nvf",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "aagl": "aagl",
@@ -362,7 +529,8 @@
         "nix-flatpak": "nix-flatpak",
         "nixpkgs": "nixpkgs_2",
         "nur": "nur",
-        "rust-overlay": "rust-overlay_2"
+        "nvf": "nvf",
+        "rust-overlay": "rust-overlay_5"
       }
     },
     "rust-overlay": {
@@ -373,11 +541,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780197589,
+        "lastModified": 1785476452,
-        "narHash": "sha256-FVCr2Ij/jKf59a4LW481eeOF6rJRreOBrVgW/aUBTrw=",
+        "narHash": "sha256-/CXwCFPS41rb/JI2VitKCgVK6V5E6/sfw5ke3B9zyVQ=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "21632e942d89bf1cce4e5a63d7e58a215a0cbfcc",
+        "rev": "6ef009bf4c4873cdc1a621826722bdea7c03e62c",
         "type": "github"
       },
       "original": {
@@ -387,15 +555,80 @@
       }
     },
     "rust-overlay_2": {
+      "inputs": {
+        "nixpkgs": [
+          "nur",
+          "caitsith",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1791620365,
+        "narHash": "sha256-CVZXIDNw7HEwyD8X6q9Ln370Sc0ZqRlTzDRwOZ1hJMY=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "e90fafa71b440fabcd52dd7fb017ab2da81c781a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "rust-overlay_3": {
+      "inputs": {
+        "nixpkgs": [
+          "nur",
+          "hildibrand",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1791620365,
+        "narHash": "sha256-CVZXIDNw7HEwyD8X6q9Ln370Sc0ZqRlTzDRwOZ1hJMY=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "e90fafa71b440fabcd52dd7fb017ab2da81c781a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "rust-overlay_4": {
+      "inputs": {
+        "nixpkgs": [
+          "nur",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1792219666,
+        "narHash": "sha256-RMO08tKD+hFIL5ryWi85VY4aHE5oIpdV1h4kVFctOkw=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "a110337465cfb76e3806b81b9db3094c3e6e770a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "rust-overlay_5": {
       "inputs": {
         "nixpkgs": "nixpkgs_5"
       },
       "locked": {
-        "lastModified": 1781234414,
+        "lastModified": 1792307278,
-        "narHash": "sha256-HdA+P4fKRGOomkewnI/Tww5Wz4xK1O7+hDO90YAsPB4=",
+        "narHash": "sha256-wJgFFtw/vlzsjWrQFmTn40TTkSkqHM4XXN0nh4q4uMk=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "1d18bfe3de6244c641ca4e8011186d0981b81d76",
+        "rev": "42076d1c6a0fb405ed04f9a674e4a8f69de62ba3",
         "type": "github"
       },
       "original": {

flake.nix

@@ -17,6 +17,7 @@
       url = "github:ezKEa/aagl-gtk-on-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    nvf.url = "github:notashelf/nvf";
     nur.url = "git+https://scm.wyattjmiller.com/wymiller/nur.git";
   };
 
@@ -30,12 +31,13 @@
     go-overlay,
     aagl,
     nur,
+    nvf,
     ...
   }: let
     userName = "wyatt";
     userEmail = "wyatt@wyattjmiller.com";
     extraSpecialArgs = {
-      inherit userName userEmail nur;
+      inherit userName userEmail nur nvf;
     };
 
     myOverlays = { ... }: {
@@ -48,6 +50,10 @@
     };
   in {
     meta = import ./meta;
+    formatter = nixpkgs.lib.genAttrs [
+      "x86_64-linux"
+      "aarch64-darwin"
+    ] (system: nixpkgs.legacyPackages.${system}.nixfmt);
 
     common = {
       overlays = import ./modules/common/overlays.nix;
@@ -122,7 +128,7 @@
         {
           home-manager.useGlobalPkgs = true;
           home-manager.useUserPackages = true;
-          home-manager.extraSpecialArgs = extraSpecialArgs;
+          home-manager.extraSpecialArgs = extraSpecialArgs // { isNixOS = true; role = "workstation"; };
           home-manager.backupFileExtension = "bak";
           home-manager.users.${userName}.imports = [
             ./home
@@ -187,11 +193,37 @@
       ];
     };
 
+    # Vintage story server - for a friend
+    nixosConfigurations."raubahn" = nixpkgs.lib.nixosSystem {
+      system = "x86_64-linux";
+      specialArgs = {
+        inherit userName userEmail nur;
+        hostname = "raubahn";
+        role = "server";
+      };
+      modules = [
+        myOverlays
+        ./modules/common
+        ./modules/machine/raubahn
+
+        home-manager.nixosModules.home-manager
+        {
+          home-manager.useGlobalPkgs = true;
+          home-manager.useUserPackages = true;
+          home-manager.extraSpecialArgs = extraSpecialArgs // { isNixOS = true; role = "server"; };
+          home-manager.backupFileExtension = "bak";
+          home-manager.users.${userName}.imports = [
+            ./home
+          ];
+        }
+      ];
+    };
+
     # Matrix and Mastodon server
     nixosConfigurations."yshtola" = nixpkgs.lib.nixosSystem {
       system = "x86_64-linux";
       specialArgs = {
-        inherit userName userEmail;
+        inherit userName userEmail nur;
         hostname = "yshtola";
         role = "server";
       };
@@ -213,6 +245,32 @@
       ];
     };
 
+    # Discord bot server
+    nixosConfigurations."estinien" = nixpkgs.lib.nixosSystem {
+      system = "x86_64-linux";
+      specialArgs = {
+        inherit userName userEmail nur;
+        hostname = "estinien";
+        role = "server";
+      };
+      modules = [
+        myOverlays
+        ./modules/common
+        ./modules/machine/estinien
+
+        home-manager.nixosModules.home-manager
+        {
+          home-manager.useGlobalPkgs = true;
+          home-manager.useUserPackages = true;
+          home-manager.extraSpecialArgs = extraSpecialArgs // { isNixOS = true; role = "server"; };
+          home-manager.backupFileExtension = "bak";
+          home-manager.users.${userName}.imports = [
+            ./home
+          ];
+        }
+      ];
+    };
+
     # generic non-NixOS Linux machine
     homeConfigurations."generic" = let
       hostname = builtins.getEnv "HOSTNAME";
@@ -221,7 +279,7 @@
       pkgs = nixpkgs.legacyPackages.${system};
       
       extraSpecialArgs = {
-        inherit userName userEmail hostname;
+        inherit userName userEmail hostname nvf;
         isNixOS = false;
         role = "workstation";
       };

home/neovim.nix

@@ -1,18 +1,112 @@
-{...}: let
+{ nvf, ... }: {
-  dirs = {
+  imports = [
-    defaults = ../defaults;
+    nvf.homeManagerModules.default
-  };
+  ];
-in {
-  programs.neovim = {
-    enable = true;
-    defaultEditor = true;
-    vimAlias = true;
-  };
 
-  xdg.configFile = {
+  programs.nvf = {
-    nvim = {
+    enable = true;
-      onChange = "nvim --headless -c 'if exists(\":LuaCacheClear\") | :LuaCacheClear' +quitall";
+    settings = {
-      source = dirs.defaults + /nvim;
+      vim = {
+        viAlias = true;
+        vimAlias = true;
+        lsp.enable = true;
+        treesitter.enable = true;
+        autocomplete.nvim-cmp.enable = true;
+        autopairs.nvim-autopairs.enable = true;
+
+        languages = {
+          nix.enable = true;
+          rust.enable = true;
+          go.enable = true;
+          python.enable = true;
+          markdown.enable = true;
+          css.enable = true;
+          scss.enable = true;
+          tsx.enable = true;
+          typescript = {
+            enable = true;
+            lsp.servers = [ "typescript-language-server" "deno" ];
+          };
+          csharp.enable = true;
+        };
+
+        utility.surround.enable = true;
+        telescope.enable = true;
+        mini.icons.enable = true;
+        notes.obsidian = {
+          enable = true;
+          setupOpts.workspaces = [
+            {
+              name = "personal";
+              path = "~/Documents/Obsidian/notes";
+            }
+          ];
+        };
+
+        terminal.toggleterm = {
+          enable = true;
+          lazygit = {
+            enable = true;
+            mappings.open = "<leader>gg";
+          };
+        };
+        filetree.neo-tree.enable = true;
+        binds.whichKey.enable = true;
+
+        clipboard = {
+          enable = true;
+          registers = "unnamedplus";
+          providers = {
+            wl-copy.enable = true;
+            xclip.enable = true;
+          };
+        };
+
+        lsp.null-ls = {
+          enable = true;
+          setupOpts = {};
+        };
+        lsp.trouble.enable = true;
+
+        theme = {
+          enable = true;
+          name = "catppuccin";
+          style = "mocha";
+          transparent = false;
+        };
+
+        dashboard.alpha.enable = true;
+
+        statusline.lualine.enable = true;
+        tabline.nvimBufferline.enable = true;
+
+        keymaps = [
+          {
+            key = "<C-s>";
+            mode = "n";
+            action = "<cmd>w<CR>";
+            silent = true;
+            noremap = true;
+          }
+          { key = "<leader>o"; mode = "n"; action = "<cmd>Neotree toggle<CR>"; silent = true; noremap = true; }
+          { key = "<leader>tf"; mode = "n"; action = "<cmd>ToggleTerm direction=float<CR>"; silent = true; noremap = true; }
+          { key = "<leader>th"; mode = "n"; action = "<cmd>ToggleTerm direction=horizontal<CR>"; silent = true; noremap = true; }
+          { key = "<leader>tv"; mode = "n"; action = "<cmd>ToggleTerm direction=vertical<CR>"; silent = true; noremap = true; }
+          { key = "<leader>n"; mode = "n"; action = "<nop>"; desc = "Notes"; silent = true; noremap = true; }
+          { key = "<leader>nd"; mode = "n"; action = "<cmd>Obsidian today<CR>"; desc = "Obsidian daily note"; silent = true; noremap = true; }
+          { key = "<leader>nf"; mode = "n"; action = "<cmd>Obsidian quick_switch<CR>"; desc = "Obsidian find note"; silent = true; noremap = true; }
+          { key = "<leader>ns"; mode = "n"; action = "<cmd>Obsidian search<CR>"; desc = "Obsidian search notes"; silent = true; noremap = true; }
+          { key = "<leader>nn"; mode = "n"; action = "<cmd>Obsidian new<CR>"; desc = "Obsidian new note"; silent = true; noremap = true; }
+          { key = "<leader>ff"; mode = "n"; action = "<cmd>Telescope find_files<CR>"; silent = true; noremap = true; }
+          { key = "<leader>fD"; mode = "n"; action = "<cmd>lua require('telescope.builtin').find_files({ cwd = vim.fn.input('Dir: ', vim.loop.cwd() .. '/', 'dir') })<CR>"; silent = true; noremap = true; }
+          { key = "<leader>fg"; mode = "n"; action = "<cmd>Telescope live_grep<CR>"; silent = true; noremap = true; }
+          { key = "<leader>/";  mode = "n"; action = "<cmd>Telescope current_buffer_fuzzy_find<CR>"; silent = true; noremap = true; }
+          { key = "<leader>gb"; mode = "n"; action = "<cmd>Telescope git_branches<CR>"; silent = true; noremap = true; }
+          { key = "<leader>gc"; mode = "n"; action = "<cmd>Telescope git_commits<CR>"; silent = true; noremap = true; }
+          { key = "<leader>gl"; mode = "n"; action = "<cmd>Telescope git_bcommits<CR>"; silent = true; noremap = true; }
+          { key = "<leader>gr"; mode = "n"; action = "<cmd>Telescope git_status<CR>"; silent = true; noremap = true; }
+        ];
+      };
     };
   };
 }

home/packages/linux.nix

@@ -5,7 +5,12 @@ lib.mkIf pkgs.stdenv.isLinux {
     xdg-utils
   ] ++ lib.optionals isNixOS [
     vesktop
-    xfce.thunar
+    thunar
+    thunar-volman
+    thunar-shares-plugin
+    thunar-vcs-plugin
+    thunar-archive-plugin
+    thunar-media-tags-plugin
     pavucontrol
     zathura
     gpu-screen-recorder

home/shell.nix

@@ -66,8 +66,14 @@
             "The gods themselves will be my meal. Your dear companions my dessert. Upon this world I'll feast, and death shall follow in my wake. All your hate, all your rage, you will render unto me." \
             "Boring, boring, boring" \
             "Would you be 'happier' had I a 'good reason'?" \
-            "A test of your reflexes!"
+            "A test of your reflexes!" \ 
-
+            "Yer a wizard, Wyatt" \
+            "Yer a lizard, Wyatt" \ 
+            "Po-Tay-To boil em mash em stick em in a stew" \ 
+            "Oh look it's the cutie patootie potato!" 
+            "What a charming young man" \ 
+            "Wyatt, you are smart, kind, and resilient. I believe in you no matter what life throws at you! Kick this project's butt!! - Nico" \
+            "Ganbatte!"
 
           set choose_meme (random)"%"(count $memes)
           set choose_meme $memes[(math $choose_meme"+1")]

modules/apps/gaming.nix

@@ -76,6 +76,16 @@ in {
       enable = lib.mkEnableOption "OpenGL/Vulkan overlay tool shown in games presenting FPS, CPU/GPU/memory utilization, load, etc.";
     };
 
+    proton = {
+      enable = lib.mkEnableOption "Proton compatibility tool management";
+
+      manager = lib.mkOption {
+        type = lib.types.enum ["protonplus" "protonup-qt"];
+        default = "protonup-qt";
+        description = "Graphical Proton compatibility tool manager to install";
+      };
+    };
+
     lutris = {
       enable = lib.mkEnableOption "Lutris game manager and launcher";
       package = lib.mkOption {
@@ -93,14 +103,7 @@ in {
         };
       };
 
-      # Compatibility layers for Lutris
       compatibility = {
-        protonSupport = lib.mkOption {
-          type = lib.types.bool;
-          default = true;
-          description = "Enable Proton-like compatibility layers for Lutris";
-        };
-
         extraTools = lib.mkOption {
           type = lib.types.listOf lib.types.package;
           default = [];
@@ -149,13 +152,31 @@ in {
     vintage-story = {
       enable = lib.mkEnableOption "Vintage Story client and server";
     };
+
+    archon = {
+      enable = lib.mkEnableOption "Archon from NUR";
+    };
+
+    opengoal = {
+      enable = lib.mkEnableOption "OpenGOAL, a game engine used in a certain PlayStation 2 franchise";
+    };
   };
 
   config = let 
     agl = cfg.aagl;
+    nurPkgs = import "${nur.outPath}/pkgs" { inherit pkgs; };
+    protonManager = {
+      protonplus = pkgs.protonplus;
+      protonup-qt = pkgs.protonup-qt;
+    }.${cfg.proton.manager};
   in {
     programs.steam = lib.mkIf cfg.steam.enable {
       enable = true;
+      extraPackages = with pkgs; [
+        gamescope
+        gamemode
+      ];
+
       remotePlay.openFirewall = cfg.steam.firewall.remotePlay;
       localNetworkGameTransfers.openFirewall = cfg.steam.firewall.localNetworkGameTransfers;
     };
@@ -209,16 +230,14 @@ in {
           cfg.lutris.wine.package
           pkgs.winetricks
         ]) ++
-        (lib.optionals cfg.lutris.compatibility.protonSupport [
-          pkgs.protonup-ng
-          pkgs.protonup-qt
-        ]) ++
         cfg.lutris.compatibility.extraTools ++
         cfg.lutris.extraPackages
       )) ++
+      (lib.optionals cfg.proton.enable [protonManager]) ++
       (lib.optionals cfg.minecraft.enable [pkgs.prismlauncher]) ++
       (lib.optionals cfg.ffxiv.enable [pkgs.xivlauncher pkgs.fflogs]) ++
-      (lib.optionals cfg.vintage-story.enable [nur.packages.${pkgs.system}.vintage-story]) ++
+      (lib.optionals cfg.vintage-story.enable [nurPkgs.vintage-story]) ++
+      (lib.optionals cfg.archon.enable [nurPkgs.archon]) ++
       (lib.optionals cfg.vkbasalt.enable [pkgs.vkbasalt pkgs.vkbasalt-cli]) ++
       (lib.optionals cfg.mangohud.enable [pkgs.mangohud]) ++
       (lib.optionals (cfg.vkbasalt.enable || cfg.mangohud.enable) [pkgs.goverlay pkgs.mesa-demos pkgs.vulkan-tools]);
@@ -226,7 +245,7 @@ in {
     nix.settings = let 
       inherit agl;
     in (lib.mkIf
-      (agl.anime-game-launcher.enable || agl.honkers-railway-laucher.enable || agl.honkers-launcher.enable || agl.wavey-launcher.enable || agl.sleepy-launcher.enable)
+      (agl.anime-game-launcher.enable || agl.honkers-railway-launcher.enable || agl.honkers-launcher.enable || agl.wavey-launcher.enable || agl.sleepy-launcher.enable)
       {
         substituters = [ "https://ezkea.cachix.org" ];
         trusted-public-keys = [ "ezkea.cachix.org-1:ioBmUbJTZIKsHmWWXPe1FSFbeVe+afhfgqgTSNd34eI=" ];

modules/graphics/default.nix

@@ -43,6 +43,11 @@ in {
         vulkan-tools
         mesa-demos
       ];
+
+      hardware.graphics = {
+        enable = true;
+        enable32Bit = true;
+      };
     }
 
     (mkIf (cfg.gpuVendor == "nvidia") {
@@ -61,9 +66,6 @@ in {
 
     (mkIf (cfg.gpuVendor == "amd") {
       services.xserver.videoDrivers = ["amdgpu"];
-      # hardware.graphics.extraPackages = with pkgs; [
-      #   amdvlk
-      # ];
       environment.systemPackages = with pkgs; [
         radeontop
       ];
@@ -82,7 +84,6 @@ in {
       environment.sessionVariables = {
         MOZ_ENABLE_WAYLAND = "1";
         QT_QPA_PLATFORM = "wayland";
-        SDL_VIDEODRIVER = "wayland";
       };
     })
 

modules/machine/cloud/configuration.nix

@@ -49,8 +49,6 @@ in {
     ];
   };
 
-
-
   # Custom kernel/boot stuff
   boot = {
     kernelPackages = pkgs.linuxPackages_latest;
@@ -83,6 +81,9 @@ in {
     shared-mime-info
     wl-clipboard
     wl-clip-persist
+    ollama-rocm
+    newelle
+    vlc
   ];
 
   # Enable Polkit
@@ -109,23 +110,25 @@ in {
     gamemode.enable = true;
     gamescope.enable = true;
     mangohud.enable = true;
+    proton = {
+      enable = true;
+      manager = "protonplus";
+    };
     lutris = {
       enable = true;
       wine = {
         enable = true;
         package = pkgs.wine-staging;
       };
-      compatibility = {
-        protonSupport = true;
-      };
     };
 
     ffxiv.enable = true;
+    archon.enable = true;
     minecraft.enable = true;
-    aagl.anime-game-launcher.enable = true;
     vintage-story.enable = true;
   };
 
+  
   # Power management (see ../../pwrMgmt/default.nix)
   pwrMgmt = {
     enable = true;
@@ -148,7 +151,10 @@ in {
 
   # Core networking module (see ../../networking/core.nix)
   network = {
-    firewall.enable = true;
+    firewall = {
+      enable = true;
+      firewalld.enable = true;
+    };
     networkManager.enable = true;
   };
 
@@ -225,5 +231,8 @@ in {
     ];
   };
 
+  # Tailscale service
+  services.tailscale.enable = true;
+
   system.stateVersion = "24.11";
 }

modules/machine/estinien/configuration.nix

@@ -0,0 +1,100 @@
+{
+  pkgs,
+  userName,
+  nur,
+  ...
+}: let
+    hildibrand = nur.packages.${pkgs.stdenv.hostPlatform.system}.hildibrand;
+  in {
+  imports = [
+    ../../pwrMgmt
+    ../../networking/core.nix
+  ];
+
+  # Enable flakes for NixOS
+  nix.settings.experimental-features = ["nix-command" "flakes"];
+
+  # Custom kernel/boot stuff
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  # Set your timezone
+  time.timeZone = "America/Detroit";
+
+  # Enable OpenSSH
+  services.openssh.enable = true;
+
+  # Enable keyring
+  services.gnome.gnome-keyring.enable = true;
+
+  # Enable GnuPG
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+
+  # Enable SUID wrappers (some programs need them)
+  programs.mtr.enable = true;
+
+  # Enable Polkit
+  security.polkit.enable = true;
+
+  # Power management (see ../../pwrMgmt/default.nix)
+  pwrMgmt = {
+    enable = true;
+    cpuFreqGovernor = "performance";
+    powertop.enable = false;
+  };
+
+  network = {
+    firewall = {
+      enable = true;
+    };
+    networkManager.enable = true;
+  };
+
+  environment.systemPackages = [
+    hildibrand
+  ];
+
+  systemd.services.hildibrand = {
+    description = "Hildibrand - trivia buzzer bot";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" ];
+    serviceConfig = {
+      Type = "simple";
+      User = userName;
+      WorkingDirectory = "/home/${userName}";
+      ExecStart = "${hildibrand}/bin/hildebrand";
+      Restart = "on-failure";
+      RestartSec = "5s";
+    };
+  };
+
+  # Add username to groups "wheel" and "video" - more may be added here later
+  users = {
+    users = {
+      ${userName} = {
+        extraGroups = [ "wheel" "network" ];
+        openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFV9eSc9L+aJLoKoexq2f/jb5rpyZnhuGiyhS8YQAbaS wyatt@wyattjmiller.com"
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4WKvKnnYpTbzZHFEslOKyfiiMqWxhW3AfX6E7ACmYU wyatt@wyattjmiller.com"
+        ];
+      };
+    };
+  };
+
+  services.fail2ban = {
+    enable = true;
+    package = pkgs.fail2ban;
+    maxretry = 5;
+    bantime = "3h";
+    bantime-increment = {
+      enable = true;
+      rndtime = "10m";
+    };
+  };
+
+  system.stateVersion = "24.11";
+}

modules/machine/estinien/default.nix

@@ -0,0 +1,6 @@
+{ ... }: {
+  imports = [
+    ./configuration.nix
+    ./hardware-configuration.nix
+  ];
+}

modules/machine/estinien/hardware-configuration.nix

@@ -0,0 +1,32 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sr_mod" "virtio_blk" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/498ce176-f090-46d8-96bf-9e6141cffa19";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/09A6-B803";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/4a64a2ee-2b32-4e53-b00f-7b1f127162aa"; }
+    ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

modules/machine/raubahn/configuration.nix

@@ -0,0 +1,105 @@
+{
+  pkgs,
+  userName,
+  nur,
+  ...
+}: {
+  imports = [
+    ../../pwrMgmt
+    ../../networking/core.nix
+    ../../virtualization/podman.nix
+  ];
+
+  # Enable flakes for NixOS
+  nix.settings.experimental-features = ["nix-command" "flakes"];
+
+  # Custom kernel/boot stuff
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  # Set your timezone
+  time.timeZone = "America/Detroit";
+
+  # Enable OpenSSH
+  services.openssh.enable = true;
+
+  # Enable keyring
+  services.gnome.gnome-keyring.enable = true;
+
+  # Enable GnuPG
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+
+  # Enable SUID wrappers (some programs need them)
+  programs.mtr.enable = true;
+
+  # Enable Polkit
+  security.polkit.enable = true;
+
+  # Power management (see ../../pwrMgmt/default.nix)
+  pwrMgmt = {
+    enable = true;
+    cpuFreqGovernor = "performance";
+    powertop.enable = false;
+  };
+
+  network = {
+    firewall = {
+      enable = true;
+      tcpPorts = {
+        allowedPorts = [ 42420 ];
+      };
+      udpPorts = {
+        allowedPorts = [ 42420 ];
+      };
+    };
+    networkManager.enable = true;
+  };
+
+  environment.systemPackages = [
+    nur.packages.${pkgs.system}.vintage-story
+  ];
+
+  systemd.services.vintagestory-server = {
+    description = "Vintage Story Server";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" ];
+    serviceConfig = {
+      Type = "simple";
+      User = userName;
+      WorkingDirectory = "/home/${userName}";
+      ExecStart = "${nur.packages.${pkgs.system}.vintage-story}/bin/vintagestory-server";
+      Restart = "on-failure";
+      RestartSec = "5s";
+    };
+  };
+
+  # Add username to groups "wheel" and "video" - more may be added here later
+  users = {
+    users = {
+      ${userName} = {
+        extraGroups = [ "wheel" "network" ];
+        openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFV9eSc9L+aJLoKoexq2f/jb5rpyZnhuGiyhS8YQAbaS wyatt@wyattjmiller.com"
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4WKvKnnYpTbzZHFEslOKyfiiMqWxhW3AfX6E7ACmYU wyatt@wyattjmiller.com"
+        ];
+      };
+    };
+  };
+
+  services.fail2ban = {
+    enable = true;
+    package = pkgs.fail2ban;
+    maxretry = 5;
+    bantime = "3h";
+    bantime-increment = {
+      enable = true;
+      rndtime = "10m";
+    };
+  };
+
+  system.stateVersion = "24.11";
+}

modules/machine/raubahn/default.nix

@@ -0,0 +1,6 @@
+{ ... }: {
+  imports = [
+    ./configuration.nix
+    ./hardware-configuration.nix
+  ];
+}

modules/machine/raubahn/hardware-configuration.nix

@@ -0,0 +1,32 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sr_mod" "virtio_blk" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/ec4c43ec-efcc-40ea-a4c8-411e60ee7c4e";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/140E-FE19";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/547bbd78-85be-4d17-a519-c4a2a923bdab"; }
+    ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

modules/machine/sephiroth/apps.nix

@@ -2,6 +2,7 @@
   environment.systemPackages = with pkgs; [
     neovim
     git
+    tailscale
   ];
 
   environment.variables.EDITOR = "nvim";

modules/machine/yshtola/configuration.nix

@@ -1,8 +1,10 @@
 {
+  nur,
   pkgs,
   userName,
   ...
-}: let
+}:
+let
   # INFO: set these to your liking
   matrixFqdn = "chat.wyattjmiller.com";
   rtcFqdn = "rtc.wyattjmiller.com";
@@ -10,16 +12,50 @@
   supportEmail = "wyatt@wyattjmiller.com";
   livekitKeyFile = "/var/lib/livekit/livekit.key";
   matrixRegistrationTokenFile = "/var/lib/matrix.key";
-in {
+
+  sableWeb = nur.packages.${pkgs.stdenv.hostPlatform.system}.sable-web;
+
+  sableConfig = pkgs.writeTextDir "config.json" (
+    builtins.toJSON {
+      defaultHomeserver = 0;
+      homeserverList = [ matrixFqdn ];
+      allowCustomHomeservers = false;
+
+      disableAccountSwitcher = false;
+      hideUsernamePasswordFields = false;
+
+      hashRouter = {
+        enabled = false;
+        basename = "/";
+      };
+
+      featuredCommunities = {
+        spaces = [
+          "#seventhdawn:chat.wyattjmiller.com"
+        ];
+        rooms = [
+          "#general:chat.wyattjmiller.com"
+          "#gposeglams:chat.wyattjmiller.com"
+          "#lobby-vc:chat.wyattjmiller.com"
+          "#annoucements:chat.wyattjmiller.com"
+        ];
+      };
+    }
+  );
+in
+{
   imports = [
     ../../pwrMgmt
   ];
 
   # Enable flakes for NixOS
-  nix.settings.experimental-features = ["nix-command" "flakes"];
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
 
   nix.settings = {
-    download-buffer-size = 134217728;  # 128 MiB in bytes
+    download-buffer-size = 134217728; # 128 MiB in bytes
   };
 
   # Custom kernel/boot stuff
@@ -79,7 +115,7 @@ in {
       8448
     ];
 
-    allowedUDPPortRanges =[
+    allowedUDPPortRanges = [
       # TURN UDP relays
       {
         from = 49000;
@@ -99,7 +135,11 @@ in {
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFV9eSc9L+aJLoKoexq2f/jb5rpyZnhuGiyhS8YQAbaS wyatt@wyattjmiller.com"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4WKvKnnYpTbzZHFEslOKyfiiMqWxhW3AfX6E7ACmYU wyatt@wyattjmiller.com"
     ];
-    extraGroups = ["wheel" "video" "network"];
+    extraGroups = [
+      "wheel"
+      "video"
+      "network"
+    ];
   };
 
   # fail2ban
@@ -145,10 +185,12 @@ in {
           support_email = supportEmail;
           support_mxid = "@wymiller:${matrixFqdn}";
 
-          rtc_transports = [{
+          rtc_transports = [
-            type = "livekit";
+            {
-            livekit_service_url = "https://${rtcFqdn}";
+              type = "livekit";
-          }];
+              livekit_service_url = "https://${rtcFqdn}";
+            }
+          ];
         };
       };
     };
@@ -176,8 +218,37 @@ in {
     virtualHosts = {
       "${matrixFqdn}" = {
         extraConfig = ''
-          encode zstd gzip
+          @matrixEndpoints path \
-          reverse_proxy localhost:8008
+            /_matrix/* \
+            /_tuwunel/* \
+            /.well-known/matrix/*
+
+          handle @matrixEndpoints {
+            reverse_proxy 127.0.0.1:8008
+          }
+
+          @sableConfig path /config.json
+          handle @sableConfig {
+            root * ${sableConfig}
+            header Cache-Control "no-store"
+            file_server
+          }
+
+          handle {
+            root * ${sableWeb}
+
+            encode zstd gzip
+            try_files {path} /index.html
+
+            file_server {
+              precompressed br
+            }
+
+            header /assets/* Cache-Control "public, max-age=31536000, immutable"
+            header /sw.js Cache-Control "no-cache"
+            header /index.html Cache-Control "no-cache"
+            header Document-Policy "js-profiling"
+          }
         '';
       };
       "${matrixFqdn}:8448" = {
@@ -220,7 +291,10 @@ in {
     matrix-registration-token-gen = {
       before = [ "tuwunel.service" ];
       wantedBy = [ "multi-user.target" ];
-      path = with pkgs; [ coreutils openssl ];
+      path = with pkgs; [
+        coreutils
+        openssl
+      ];
       script = ''
         set -eu
 
@@ -242,9 +316,15 @@ in {
     };
 
     livekit-key-gen = {
-      before = [ "lk-jwt-service.service" "livekit.service" ];
+      before = [
+        "lk-jwt-service.service"
+        "livekit.service"
+      ];
       wantedBy = [ "multi-user.target" ];
-      path = with pkgs; [ coreutils openssl ];
+      path = with pkgs; [
+        coreutils
+        openssl
+      ];
       script = ''
         set -eu
 

modules/networking/core.nix

@@ -8,6 +8,12 @@ in {
   options.network = {
     firewall = {
       enable = lib.mkEnableOption "system firewall";
+      firewalld.enable = lib.mkEnableOption "firewalld with its nftables backend";
+      nftables.extraConfig = lib.mkOption {
+        type = lib.types.lines;
+        default = "";
+        description = "Rules inside a separate inet nftables table alongside firewalld";
+      };
       tcpPorts = {
         ssh.enable = lib.mkEnableOption "SSH service port (22)";
         web.enable = lib.mkEnableOption "common web service ports (80, 443)";
@@ -42,6 +48,21 @@ in {
     };
   };
   config = {
+    assertions = [
+      {
+        assertion = cfg.firewall.nftables.extraConfig == "" || cfg.firewall.firewalld.enable;
+        message = "network.firewall.nftables.extraConfig requires network.firewall.firewalld.enable";
+      }
+    ];
+    services.firewalld.enable = cfg.firewall.firewalld.enable;
+    networking.nftables = lib.mkIf cfg.firewall.firewalld.enable {
+      enable = true;
+      flushRuleset = false;
+      tables."local-extra" = lib.mkIf (cfg.firewall.nftables.extraConfig != "") {
+        family = "inet";
+        content = cfg.firewall.nftables.extraConfig;
+      };
+    };
     networking.firewall = {
       enable = cfg.firewall.enable;
       allowedTCPPorts = lib.flatten [

modules/sound/pipewire.nix

@@ -3,6 +3,11 @@
   services.pipewire = {
     enable = true;
     pulse.enable = true;
+
+    alsa = {
+      enable = true;
+      support32Bit = true;
+    };
   };
 
   environment.systemPackages = with pkgs; [