update backups

flake.lock

@@ -9,11 +9,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1781627888,
+        "lastModified": 1785518313,
-        "narHash": "sha256-5yHuAh9k7rT7rtf3uRaXkiUyYvQE9oaCgzhprLm2mr8=",
+        "narHash": "sha256-anlq3YQDCsNrkNlu3HTg4dEIpRugwnyAVUxoPcBmA/U=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "6d3087eedff75a715b40c0e124ba15d2dd7bec28",
+        "rev": "b974715a27b49fadbf3bf6d85e26bcb3109daa6d",
         "type": "github"
       },
       "original": {
@@ -79,11 +79,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783740085,
+        "lastModified": 1785119570,
-        "narHash": "sha256-qajyHfZY29G2oEQk+uHxmsJcRoBUBXP9maTpFlwP/dI=",
+        "narHash": "sha256-Rgs2xKnGLFWQscxUaXX07oyZeuMDOHEbqDOsgliLFGM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3cd22efe6471dc7365c822bd9ad73a21e55f38fb",
+        "rev": "d4fd24667c8cbef124bb70a20380cab75ec8474d",
         "type": "github"
       },
       "original": {
@@ -111,11 +111,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1783703440,
+        "lastModified": 1785599192,
-        "narHash": "sha256-O3/YajjWo001VUIgD8BwaRdSNLUFe7nZ1qV5TwhRBcw=",
+        "narHash": "sha256-dg4RTtDxnXY13UkJNdhmgTUTl0n/IJBlCigfO7nutZw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8f0500b9660505dc3cb647775fe9a978a74b5283",
+        "rev": "6d65bfc1bcef2ef39a239d38e577e92a89fb0f07",
         "type": "github"
       },
       "original": {
@@ -125,6 +125,22 @@
         "type": "github"
       }
     },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1782175435,
+        "narHash": "sha256-EMzXKmnOtBQ2MnvpiNOm7E+kOMvdPrIKaeg52Tip2Uk=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "89570f24e97e614aa34aa9ab1c927b6578a43775",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "deploy-rs": "deploy-rs",
@@ -137,9 +153,7 @@
     },
     "sops-nix": {
       "inputs": {
-        "nixpkgs": [
+        "nixpkgs": "nixpkgs_3"
-          "nixpkgs"
-        ]
       },
       "locked": {
         "lastModified": 1783174389,
@@ -150,9 +164,8 @@
         "type": "github"
       },
       "original": {
-        "owner": "Mic92",
+        "id": "sops-nix",
-        "repo": "sops-nix",
+        "type": "indirect"
-        "type": "github"
       }
     },
     "systems": {

flake.nix

@@ -8,9 +8,6 @@
     home-manager.url = "github:nix-community/home-manager/release-26.05";
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
 
-    sops-nix.url = "github:Mic92/sops-nix";
-    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
-
     grasswren.url = "git+https://code.grasswren.net/Lilac/Grasswren.git?ref=main";
     grasswren.flake = false;
   };
@@ -23,8 +20,6 @@
         specialArgs = { inherit inputs; };
         modules = [
           home-manager.nixosModules.home-manager
-          sops-nix.nixosModules.sops
-
           ./hosts/desktop/default.nix
         ];
       };
@@ -34,9 +29,16 @@
         specialArgs = { inherit inputs; };
         modules = [
           home-manager.nixosModules.home-manager
-
           ./hosts/vps/default.nix
         ];
+     };
+       backup = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        specialArgs = { inherit inputs; };
+        modules = [
+          home-manager.nixosModules.home-manager
+          ./hosts/backup/default.nix
+        ];
       };
     };
 
@@ -71,7 +73,17 @@
           path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.desktop;
         };
       };
-    };
+       backup = {
+        hostname = "10.0.0.4";
+        sshUser = "root";
+        magicRollbackTimeout = 120;
+        profiles.system = {
+          user = "root";
+          remoteBuild = false;
+          path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.backup;
+        };
+      };
+	};
     checks = {
       x86_64-linux = deploy-rs.lib.x86_64-linux.deployChecks self.deploy;
     };

home/lilac.nix

@@ -1,48 +1,46 @@
-{ config, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
 {
-  home.username = "olive";
+  home.username = "lilac";
-  home.homeDirectory = "/olive";
+  home.homeDirectory = "/home/lilac";
 
   home.packages = with pkgs; [
-    tor-browser
-
     git
-    kitty
     zsh
     helix
   ];
 
+  imports = [
+    ../modules/ripping.nix
+  ];
+
   programs.git = {
     enable = true;
     settings = {
-      user = {
+      user.name = "Lilac";
-        name = "Lilac";
+      user.email = "lilac@grasswren.net";
-        email = "lilac@grasswren.net";
+      core.editor = "hx";
-      };
+      init.defaultBranch = "main";
-      core = {
-        editor = "hx";
-      };
-      init = {
-        defaultBranch = "main";
-      };
     };
   };
 
   programs.zsh = {
-	enable = true;
+    enable = true;
+    enableCompletion = true;
+    autosuggestion.enable = true;
+    syntaxHighlighting.enable = true;
 
-	enableCompletion = true;
+    shellAliases = {
-	autosuggestion.enable = true;
+      ls = "ls -A";
-	syntaxHighlighting.enable = true;
+    };
+  };
 
-	shellAliases = {
+  programs.helix = {
-		ls = "ls -A";
+    enable = true;
-	};
   };
 
   home.sessionVariables = {
-  	EDITOR = "hx";
+    EDITOR = "hx";
   };
 
   programs.home-manager.enable = true;

home/root.nix

@@ -1,13 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  home.username = "root";
-  home.homeDirectory = "/root";
-
-  imports = [
-    ./tools.nix
-  ];
-
-  programs.home-manager.enable = true;
-  home.stateVersion = "26.05";
-}

home/tools.nix

@@ -1,38 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  home.packages = with pkgs; [
-    git
-    zsh
-    helix
-  ];
-
-  programs.git = {
-    enable = true;
-    settings = {
-      user.name = "Lilac";
-      user.email = "lilac@grasswren.net";
-      core.editor = "hx";
-      init.defaultBranch = "main";
-    };
-  };
-
-  programs.zsh = {
-    enable = true;
-    enableCompletion = true;
-    autosuggestion.enable = true;
-    syntaxHighlighting.enable = true;
-
-    shellAliases = {
-      ls = "ls -A";
-    };
-  };
-
-  programs.helix = {
-    enable = true;
-  };
-
-  home.sessionVariables = {
-    EDITOR = "hx";
-  };
-}

hosts/backup/default.nix

@@ -0,0 +1,109 @@
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [ ./hardware-configuration.nix ../../modules/ssh.nix ];
+
+  networking.hostName = "backup";
+
+  users.users.lilac = {
+    isNormalUser = true;
+	group = "lilac";
+	extraGroups = [ "wheel" ];
+  };
+  users.groups.lilac = {};
+  home-manager = {
+    useGlobalPkgs = true;
+	useUserPackages = true;
+
+	users.lilac = import ../../home/lilac.nix;
+	};
+  programs.zsh.enable = true;
+  users.users.lilac.shell = pkgs.zsh;
+  security.sudo.wheelNeedsPassword = false;
+
+  time.timeZone = "America/Winnipeg";
+
+  systemd.sleep.settings.Sleep = {
+    AllowSuspend = "no";
+    AllowHibernation = "no";
+    AllowHybridSleep = "no";
+    AllowSuspendThenHibernate = "no";
+  };
+
+  i18n.defaultLocale = "en_US.UTF-8";
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "en_US.UTF-8";
+    LC_IDENTIFICATION = "en_US.UTF-8";
+    LC_MEASUREMENT = "en_US.UTF-8";
+    LC_MONETARY = "en_US.UTF-8";
+    LC_NAME = "en_US.UTF-8";
+    LC_NUMERIC = "en_US.UTF-8";
+    LC_PAPER = "en_US.UTF-8";
+    LC_TELEPHONE = "en_US.UTF-8";
+    LC_TIME = "en_US.UTF-8";
+  };
+
+  services.xserver.enable = true;
+  services.displayManager.sddm.enable = true;
+  services.desktopManager.plasma6.enable = true;
+  services.xserver.xkb = {
+    layout = "us";
+    variant = "";
+  };
+
+  services.pulseaudio.enable = false;
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+  };
+
+  environment.systemPackages = with pkgs; [
+    whipper
+	flac
+	tor-browser
+  ];
+
+  networking.wireless.enable = true;
+  networking.networkmanager.enable = true;
+
+  services.timesyncd.enable = true;    # optional
+
+networking = {
+    firewall = {
+	  enable = true;
+	  allowedUDPPorts = [ 51820 ];
+	  trustedInterfaces = [ "wg0" ];
+	};
+
+	wireguard.interfaces."wg0" = {
+      ips = [ "10.0.0.4/24" ];
+	  generatePrivateKeyFile = true;
+	  privateKeyFile = "/var/lib/wireguard/wg0.key";
+	  peers = [{
+        publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k=";
+		allowedIPs = [ "10.0.0.0/24" ];
+		endpoint = "216.128.177.13:51820";
+		persistentKeepalive = 25;
+	  }];
+	};
+  };
+
+  nixpkgs.config.allowUnfree = true;
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  system.stateVersion = "26.05";
+
+
+
+  services.restic.server = {
+    enable = true;
+	listenAddress = "10.0.0.4:8000";
+	dataDir = "/var/lib/restic";
+	appendOnly = true;
+	extraFlags = [ "--no-auth" ];
+  };
+
+  networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8000 ];
+}

hosts/backup/hardware-configuration.nix

@@ -0,0 +1,32 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "sdhci_pci" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/61b493e0-8c91-b7d1-4e336da06ff0";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/E157-E223";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/desktop/default.nix

@@ -4,24 +4,33 @@
   imports = [
     ./hardware-configuration.nix
 
-	../../modules/network.nix
+    ../../modules/site/blog.nix
+    ../../modules/site/code.nix
+    ../../modules/site/mail.nix
+    ../../modules/site/music.nix
+    ../../modules/site/photo.nix
+	../../modules/site/vault.nix
+
 	../../modules/ssh.nix
-	../../modules/wireguard.nix
-	../../modules/site.nix
-	../../modules/gitea.nix
   ];
 
-  network.node = "desktop";
   networking.hostName = "desktop";
 
+  users.users.lilac = {
+    isNormalUser = true;
+	group = "lilac";
+	extraGroups = [ "wheel" "render" "video" "input" "uinput" ];
+  };
+  users.groups.lilac = {};
   home-manager = {
     useGlobalPkgs = true;
     useUserPackages = true;
 
-    users.root = import ../../home/root.nix;
+    users.lilac = import ../../home/lilac.nix;
   };
   programs.zsh.enable = true;
-  users.users.root.shell = pkgs.zsh;
+  users.users.lilac.shell = pkgs.zsh;
+  security.sudo.wheelNeedsPassword = false;
 
   time.timeZone = "America/Toronto";
 
@@ -55,7 +64,81 @@
     pulse.enable = true;
   };
 
+  services.sunshine = {
+    enable = true;
+    autoStart = true;
+    capSysAdmin = true;
+    openFirewall = true;
+  };
+  networking.firewall.interfaces.wg0.allowedTCPPorts = [ 47984 47989 47990 48010 ];
+  networking.firewall.interfaces.wg0.allowedUDPPorts = [ 47998 47999 48000 48002 48010 ];
+  services.displayManager.autoLogin.enable = true;
+  services.displayManager.autoLogin.user = "lilac";
+
+  systemd.sleep.settings.Sleep = {
+    AllowSuspend = "no";
+    AllowHibernation = "no";
+    AllowHybridSleep = "no";
+    AllowSuspendThenHibernate = "no";
+  };
+
+  systemd.services.amdgpu-performance = {
+    description = "Force AMD GPU performance level to high";
+    wantedBy = [ "multi-user.target" ];
+  
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = ''
+        ${pkgs.bash}/bin/bash -c '
+          for gpu in /sys/class/drm/card*/device; do
+            if [ -f "$gpu/vendor" ] && [ "$(cat "$gpu/vendor")" = "0x1002" ]; then
+              echo high > "$gpu/power_dpm_force_performance_level"
+            fi
+          done
+        '
+      '';
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    whipper
+	flac
+	tor-browser
+	restic
+  ];
+
+  programs.steam.enable = true;
+
+  networking = {
+    firewall = {
+	  enable = true;
+	  allowedUDPPorts = [ 51820 ];
+	  trustedInterfaces = [ "wg0" ];
+	};
+
+	wireguard.interfaces."wg0" = {
+      ips = [ "10.0.0.2/24" ];
+	  generatePrivateKeyFile = true;
+	  privateKeyFile = "/var/lib/wireguard/wg0.key";
+	  peers = [{
+        publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k=";
+		allowedIPs = [ "10.0.0.0/24" ];
+		endpoint = "216.128.177.13:51820";
+		persistentKeepalive = 25;
+	  }];
+	};
+  };
+
   nixpkgs.config.allowUnfree = true;
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   system.stateVersion = "26.05";
+
+  services.restic.backups.backup = {
+    repository = "rest:http://10.0.0.4:8000/backup";
+	initialize = true;
+	passwordFile = "/home/lilac/test-password";
+	paths = [ "/var/lib/immich" "/var/lib/music" "/var/lib/gitea" "/var/lib/vault-backup" ];
+	timerConfig.OnCalendar = "03:30";
+	pruneOpts = [ "--keep-daily 7" "--keep-weekly 4" "--keep-monthly 12" ];
+  };
 }

hosts/desktop/hardware-configuration.nix

@@ -16,6 +16,10 @@
   boot.loader.efi.canTouchEfiVariables = true;
   boot.kernelPackages = pkgs.linuxPackages_latest;
 
+  boot.kernelParams = [
+    "amdgpu.runpm=0"
+  ];
+
   fileSystems."/" =
     { device = "/dev/disk/by-uuid/d7450680-7d53-4842-83c5-7fc32526dff1";
       fsType = "ext4";

hosts/vps/default.nix

@@ -4,23 +4,74 @@
   imports = [
     ./hardware-configuration.nix
 
-    ../../modules/network.nix
     ../../modules/ssh.nix
-    ../../modules/wireguard.nix
-    ../../modules/http-forwarding.nix
   ];
 
-  network.node = "vps";
   networking.hostName = "vps";
 
+  users.users.lilac = {
+    isNormalUser = true;
+	group = "lilac";
+	extraGroups = [ "wheel" ];
+  };
+  users.groups.lilac = {};
   home-manager = {
     useGlobalPkgs = true;
     useUserPackages = true;
-
+    users.lilac = import ../../home/lilac.nix;
-    users.root = import ../../home/root.nix;
   };
   programs.zsh.enable = true;
-  users.users.root.shell = pkgs.zsh;
+  users.users.lilac.shell = pkgs.zsh;
+  security.sudo.wheelNeedsPassword = false;
+
+  # forwarding inbound network traffic over wireguard
+  networking = {
+    firewall = {
+	  enable = true;
+	  allowedTCPPorts = [ 80 443 ];
+	  allowedUDPPorts = [ 51820 ];
+	  trustedInterfaces = [ "wg0" ];
+	};
+	wireguard.interfaces."wg0" = {
+      ips = [ "10.0.0.3/24" ];
+	  listenPort = 51820;
+	  generatePrivateKeyFile = true;
+	  privateKeyFile = "/var/lib/wireguard/wg0.key";
+	  peers = [
+	    {
+		  allowedIPs = [ "10.0.0.1/32" ];
+          publicKey = "n+9eh8VUP9NCnjPL0Z/KPc0TQCQloXE2Ipc5+CBtJjU=";
+		}
+		{
+          allowedIPs = [ "10.0.0.2/32" ];
+		  publicKey = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
+		}
+		{
+		  allowedIPs = [ "10.0.0.4/32" ];
+		  publicKey = "XjuV3wzkP03UUjYSJfY3OG3WWLRtoQBN7GokDEWhdhQ=";
+		}
+      ];
+	};
+	nftables = {
+	  enable = true;
+	  tables.nat = {
+	    family = "ip";
+		content = ''
+          chain prerouting {
+            type nat hook prerouting priority dstnat; policy accept;
+            iifname "enp1s0" tcp dport { 80, 443 } dnat to 10.0.0.2
+          }
+	      chain postrouting {
+            type nat hook postrouting priority srcnat; policy accept;
+            oifname "wg0" masquerade
+          }
+        '';
+      };
+	};
+  };
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
+  };
 
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   system.stateVersion = "26.05";

hosts/vps/hardware-configuration.nix

@@ -7,11 +7,11 @@
 	extraModulePackages = [ ];
   	loader.systemd-boot.enable = true;
   	loader.efi.canTouchEfiVariables = true;
-  	loader.efi.efiSysMountPoint = "/boot";
+  	loader.efi.efiSysMountPoint = "/boot/efi";
   };
 
   fileSystems."/" = { device = "/dev/vda2"; fsType = "ext4"; };
-  fileSystems."/boot" = { device = "/dev/vda1"; fsType = "vfat"; };
+  fileSystems."/boot/efi" = { device = "/dev/vda1"; fsType = "vfat"; };
   swapDevices = [ ];
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";

modules/http-forwarding.nix

@@ -1,28 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  networking.firewall.enable = true;
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-
-  networking.nftables.enable = true;
-  networking.nftables.tables.nat = {
-    family = "ip";
-    content = ''
-      chain prerouting {
-        type nat hook prerouting priority dstnat; policy accept;
-
-        iifname "enp1s0" tcp dport 80 dnat to 10.0.0.2:80
-        iifname "enp1s0" tcp dport 443 dnat to 10.0.0.2:443
-      }
-	    chain postrouting {
-        type nat hook postrouting priority srcnat; policy accept;
-
-        oifname "wg0" masquerade
-      }
-    '';
-  };
-
-  boot.kernel.sysctl = {
-    "net.ipv4.ip_forward" = 1;
-  };
-}

modules/network.nix

@@ -1,41 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  options.network = {
-    nodes = lib.mkOption { type = lib.types.attrsOf
-	  (lib.types.submodule ({ name, config, ... }: {
-        options = {
-          id          = lib.mkOption { type = lib.types.int; };
-          ssh         = lib.mkOption { type = lib.types.str; };
-          vpn         = lib.mkOption { type = lib.types.str; };
-		  address-vpn = lib.mkOption { type = lib.types.str; };
-          address-pub = lib.mkOption { type = lib.types.nullOr lib.types.str; default = null; };
-		};
-		config = {
-          address-vpn = "10.0.0.${toString config.id}";
-		};
-	  }));
-	};
-	node = lib.mkOption { type = lib.types.str; };
-  };
-  config.network = {
-    nodes = {
-      laptop = {
-        id = 1;
-        ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhCH6YN63AWFsR1wZ6wJdZ2jlTtYBSkY5FnLrWoLKeg";
-        vpn = "n+9eh8VUP9NCnjPL0Z/KPc0TQCQloXE2Ipc5+CBtJjU=";
-      };
-      desktop = {
-        id = 2;
-        ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdOUv+mUhnS2sbahlqcqm9Ili16/rOk2WAlMSXrjnHu";
-        vpn = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
-      };
-      vps = {
-        id = 3;
-        ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGiiLFiy+UcOi0RgZ1Xvuzl4C5aiZ+bcGaOmQcI/UBXp";
-        vpn = "c5irm217aE+QVwHYmnQh4r91u2fZmQKBIWVgFVMaEwU=";
-        address-pub = "216.128.177.13";
-      };
-    };
-  };
-}

modules/ripping.nix

@@ -0,0 +1,44 @@
+{ config, lib, pkgs, ... }:
+
+{
+  home.packages = with pkgs; [
+    whipper
+	beets
+  ];
+
+  programs.beets = {
+    enable = true;
+
+    settings = {
+      directory = "/var/lib/music";
+      library = "/var/lib/music/library.db";
+
+      plugins = [
+	    "musicbrainz"
+        "fetchart"
+        "embedart"
+        "scrub"
+		"chroma"
+      ];
+
+      per_disc_numbering = true;
+
+      import = {
+        move = true;
+        copy = false;
+        write = true;
+        timid = true;
+        incremental = false;
+        resume = "ask";
+      };
+
+      paths = {
+        default = "$albumartist/$album%aunique{}/$track - $title";
+      };
+
+	  fetchart.auto = true;
+      embedart.auto = true;
+      scrub.auto = true;
+    };
+  };
+}

modules/secrets.yaml

@@ -1,16 +0,0 @@
-gitea_database_password: ENC[AES256_GCM,data:bL0VpnAk8rglXmjIWwpKiFnadYQVmPkR0Jq6o+ecFIPWDLt3YCD1LdBHd2E=,iv:4sMOZ5V4XopzuLcDxtwTFDbjkeeUoqggN4wAQIQvB/o=,tag:5iqAYIt0cCBoEMF/ySrO1A==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCVCtsSnhnQWplWGNqWDNv
-            M2UycWRBZmVDZnpQNWJwOWRFeVBxQ0hsZEd3CmhXc2JxNFNMdGNhTFFYbWVVQ0E0
-            enRRQjJ2WnlPSGgyOUZZQUxNRGl4bXcKLS0tIDFMRm1TN0dOM05YaXhaNlQwVGFW
-            WStnazd3RkRNRUZ2N3VWR0dEM2h4MFUK8BmxNJC07XpjM0/ONRyhQFJqNDDeebeH
-            8TgZukSjeq++fdaSNQQfRHX33MjhIkv5ynPaNi+dJ/m4INv5kfKGEA==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1ttmws269mrs30f65qwky5rzkwuq0dcfgrhgegxr7u9x9ty2nqfxq9v8dwu
-    lastmodified: "2026-07-05T03:11:33Z"
-    mac: ENC[AES256_GCM,data:2SaYCBj/U/JFUMejMZeGLhzcQk0O5+UkZ8xOHJJj5zwS6n1N8ns8sJOPixErOR2rm/Gnd1QG/KLqkQFdbKjTEpAYDUB65LOqatKWD3uGqrO8/Yu+3bvJSMahuJIJCTAm8zG8tvYpYdijiFBzw2tCgji83tjOBXn7YnM1R09jY2o=,iv:syC6kINOgG9NA8cxWGa3WzWy9e7JawHS6U5e3uUS3uM=,tag:YRlrjHgx1gGTUrq5NTvu3w==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.1

modules/site/blog.nix

@@ -23,11 +23,5 @@ in
       root * ${website}/blog
       file_server
     '';
-
-    virtualHosts."birds.grasswren.net".extraConfig = ''
-      encode
-      root * ${website}/birds
-      file_server
-    '';
   };
 }

modules/site/code.nix

@@ -1,16 +1,6 @@
 { config, lib, pkgs, ... }:
 
 {
-  sops = {
-    defaultSopsFile = ./secrets.yaml;
-    defaultSopsFormat = "yaml";
-    age.keyFile = "/var/lib/sops-nix/key.txt";
-
-    secrets.gitea_database_password = {
-      owner = "gitea";
-    };
-  };
-
   services.postgresql = {
     enable = true;
     ensureDatabases = [ "gitea" ];
@@ -25,11 +15,12 @@
     appName = "Lilac's Code";
     database = {
       type = "postgres";
-      host = "/run/postgres";
+      host = "/run/postgresql";
       name = "gitea";
       user = "gitea";
-      passwordFile = config.sops.secrets.gitea_database_password.path;
     };
+
+	settings.service.DISABLE_REGISTRATION = true;
   };
 
   services.caddy = {
@@ -38,6 +29,4 @@
 	  reverse_proxy localhost:3000
 	'';
   };
-
-  networking.firewall.allowedTCPPorts = [ 3000 ];
 }

modules/site/mail.nix

@@ -0,0 +1,5 @@
+{ config, lib, pkgs, ... }:
+
+{
+  
+}

modules/site/music.nix

@@ -0,0 +1,15 @@
+{ config, lib, pkgs, ... }:
+
+{
+  services.navidrome = {
+    enable = true;
+	settings.MusicFolder = "/var/lib/music";
+  };
+
+  services.caddy = {
+    enable = true;
+	virtualHosts."music.grasswren.net".extraConfig = ''
+      reverse_proxy localhost:4533
+	'';
+  };
+}

modules/site/photo.nix

@@ -0,0 +1,17 @@
+{ config, lib, pkgs, ... }:
+
+{
+  services.immich = {
+    enable = true;
+	host = "127.0.0.1";
+	port = 2283;
+	mediaLocation = "/var/lib/immich";
+  };
+
+  services.caddy = {
+    enable = true;
+	virtualHosts."photo.grasswren.net".extraConfig = ''
+      reverse_proxy localhost:2283
+	'';
+  };
+}

modules/site/vault.nix

@@ -0,0 +1,21 @@
+{ config, lib, pkgs, ... }:
+
+{
+  services.vaultwarden = {
+    enable = true;
+	backupDir = "/var/lib/vault-backup";
+    config = {
+      DOMAIN = "https://vault.example.com";
+      SIGNUPS_ALLOWED = false;
+      ROCKET_ADDRESS = "127.0.0.1";
+      ROCKET_PORT = 8222;
+    };
+  };
+
+  services.caddy = {
+    enable = true;
+	virtualHosts."vault.grasswren.net".extraConfig = ''
+	  reverse_proxy localhost:8222
+	'';
+  };
+}

modules/site/vpn.nix

@@ -0,0 +1,31 @@
+{ config, lib, pkgs, ... }:
+
+{
+  services.headscale = {
+    enable = true;
+	settings = {
+      server_url = "https://vpn.grasswren.net";
+	  listen_addr = "127.0.0.1:8080";
+
+	  database.type = "sqlite";
+
+	  ip_prefixes = [
+        "100.64.0.0/10"
+        "fd7a:115c:a1e0::/48"
+      ];
+
+	  dns = {
+	    magic_domain = true;
+	    base_domain = "vpn.grasswren.net";
+		nameservers.global = [ "1.1.1.1" ];
+	  };
+	};
+  };
+
+  services.caddy = {
+    enable = true;
+	virtualHosts."vpn.grasswren.net".extraConfig = ''
+	  reverse_proxy localhost:8080
+	'';
+  };
+}

modules/ssh.nix

@@ -1,8 +1,5 @@
 { config, lib, pkgs, ... }:
 
-let
-  me = config.network.nodes.${config.network.node};
-in
 {
   networking.firewall = {
     enable = true;
@@ -16,12 +13,16 @@ in
 	  KbdInteractiveAuthentication = false;
 	};
 	listenAddresses = [{
-      addr = me.address-vpn;
+      addr = "0.0.0.0";
 	  port = 22;
 	}];
   };
+
+  users.users.lilac.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhCH6YN63AWFsR1wZ6wJdZ2jlTtYBSkY5FnLrWoLKeg"
+  ];
+
   users.users.root.openssh.authorizedKeys.keys = [
-    config.network.nodes.laptop.ssh
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhCH6YN63AWFsR1wZ6wJdZ2jlTtYBSkY5FnLrWoLKeg"
-	config.network.nodes.desktop.ssh
   ];
 }

modules/wireguard.nix

@@ -1,38 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  me = config.network.nodes.${config.network.node};
-in
-{
-  networking = {
-    firewall = {
-      allowedUDPPorts = [ 51820 ];
-	    trustedInterfaces = [ "wg0" ];
-	  };
-	  wireguard.interfaces."wg0" = {
-      ips = [ "${me.address-vpn}/24" ];
-	    listenPort = 51820;
-	    generatePrivateKeyFile = true;
-	    privateKeyFile = "/var/lib/wireguard/wg0.key";
-	    peers = lib.mapAttrsToList (name: peer: {
-        publicKey = peer.vpn;
-		    allowedIPs =
-		      if config.network.node == "vps"
-			      then [ "${peer.address-vpn}/32" ]
-			      else [ "10.0.0.0/24" ];
-		    endpoint =
-		      if peer.address-pub != null
-			      then "${peer.address-pub}:51820"
-			      else null;
-		    persistentKeepalive =
-		      if peer.address-pub != null
-			      then 25
-			      else null;
-	    }) (lib.filterAttrs (name: _:
-        if config.network.node == "vps"
-		      then name != "vps"
-          else name == "vps"
-      ) config.network.nodes);
-	  };
-  };
-}