headscale works

flake.nix

@@ -33,8 +33,6 @@
         system = "x86_64-linux";
         specialArgs = { inherit inputs; };
         modules = [
-          home-manager.nixosModules.home-manager
-
           ./hosts/vps/default.nix
         ];
       };
@@ -51,7 +49,7 @@
     # nix run github:serokell/deploy-rs
     deploy.nodes = {
       vps = {
-        hostname = "10.0.0.3";
+        hostname = "vps.vpn";
         sshUser = "root";
         magicRollbackTimeout = 120;
         profiles.system = {
@@ -62,7 +60,7 @@
       };
 
       desktop = {
-        hostname = "10.0.0.2";
+        hostname = "desktop.vpn";
         sshUser = "root";
         magicRollbackTimeout = 120;
         profiles.system = {

home/lilac.nix

@@ -1,48 +1,46 @@
-{ config, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
 {
-  home.username = "olive";
+  home.username = "lilac";
-  home.homeDirectory = "/olive";
+  home.homeDirectory = "/home/lilac";
 
   home.packages = with pkgs; [
-    tor-browser
-
     git
-    kitty
     zsh
     helix
   ];
 
+  imports = [
+    ../modules/ripping.nix
+  ];
+
   programs.git = {
     enable = true;
     settings = {
-      user = {
+      user.name = "Lilac";
-        name = "Lilac";
+      user.email = "lilac@grasswren.net";
-        email = "lilac@grasswren.net";
+      core.editor = "hx";
-      };
+      init.defaultBranch = "main";
-      core = {
-        editor = "hx";
-      };
-      init = {
-        defaultBranch = "main";
-      };
     };
   };
 
   programs.zsh = {
-	enable = true;
+    enable = true;
+    enableCompletion = true;
+    autosuggestion.enable = true;
+    syntaxHighlighting.enable = true;
 
-	enableCompletion = true;
+    shellAliases = {
-	autosuggestion.enable = true;
+      ls = "ls -A";
-	syntaxHighlighting.enable = true;
+    };
+  };
 
-	shellAliases = {
+  programs.helix = {
-		ls = "ls -A";
+    enable = true;
-	};
   };
 
   home.sessionVariables = {
-  	EDITOR = "hx";
+    EDITOR = "hx";
   };
 
   programs.home-manager.enable = true;

home/root.nix

@@ -1,13 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  home.username = "root";
-  home.homeDirectory = "/root";
-
-  imports = [
-    ./tools.nix
-  ];
-
-  programs.home-manager.enable = true;
-  home.stateVersion = "26.05";
-}

home/tools.nix

@@ -1,38 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  home.packages = with pkgs; [
-    git
-    zsh
-    helix
-  ];
-
-  programs.git = {
-    enable = true;
-    settings = {
-      user.name = "Lilac";
-      user.email = "lilac@grasswren.net";
-      core.editor = "hx";
-      init.defaultBranch = "main";
-    };
-  };
-
-  programs.zsh = {
-    enable = true;
-    enableCompletion = true;
-    autosuggestion.enable = true;
-    syntaxHighlighting.enable = true;
-
-    shellAliases = {
-      ls = "ls -A";
-    };
-  };
-
-  programs.helix = {
-    enable = true;
-  };
-
-  home.sessionVariables = {
-    EDITOR = "hx";
-  };
-}

hosts/desktop/default.nix

@@ -7,21 +7,33 @@
 	../../modules/network.nix
 	../../modules/ssh.nix
 	../../modules/wireguard.nix
+	../../modules/headscale.nix
+	../../modules/tailscale.nix
+
 	../../modules/site.nix
 	../../modules/gitea.nix
+	../../modules/navidrome.nix
+	../../modules/immich.nix
   ];
 
   network.node = "desktop";
   networking.hostName = "desktop";
 
+  users.users.lilac = {
+    isNormalUser = true;
+	group = "lilac";
+	extraGroups = [ "wheel" "render" "video" "input" "uinput" ];
+  };
+  users.groups.lilac = {};
   home-manager = {
     useGlobalPkgs = true;
     useUserPackages = true;
 
-    users.root = import ../../home/root.nix;
+    users.lilac = import ../../home/lilac.nix;
   };
   programs.zsh.enable = true;
-  users.users.root.shell = pkgs.zsh;
+  users.users.lilac.shell = pkgs.zsh;
+  security.sudo.wheelNeedsPassword = false;
 
   time.timeZone = "America/Toronto";
 
@@ -55,6 +67,47 @@
     pulse.enable = true;
   };
 
+  services.sunshine = {
+    enable = true;
+    autoStart = true;
+    capSysAdmin = true;
+    openFirewall = true;
+  };
+  networking.firewall.interfaces.wg0.allowedTCPPorts = [ 47984 47989 47990 48010 ];
+  networking.firewall.interfaces.wg0.allowedUDPPorts = [ 47998 47999 48000 48002 48010 ];
+  services.displayManager.autoLogin.enable = true;
+  services.displayManager.autoLogin.user = "lilac";
+
+  systemd.sleep.settings.Sleep = {
+    AllowSuspend = "no";
+    AllowHibernation = "no";
+    AllowHybridSleep = "no";
+    AllowSuspendThenHibernate = "no";
+  };
+
+  systemd.services.amdgpu-performance = {
+    description = "Force AMD GPU performance level to high";
+    wantedBy = [ "multi-user.target" ];
+  
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = ''
+        ${pkgs.bash}/bin/bash -c '
+          for gpu in /sys/class/drm/card*/device; do
+            if [ -f "$gpu/vendor" ] && [ "$(cat "$gpu/vendor")" = "0x1002" ]; then
+              echo high > "$gpu/power_dpm_force_performance_level"
+            fi
+          done
+        '
+      '';
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    whipper
+	flac
+  ];
+
   nixpkgs.config.allowUnfree = true;
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   system.stateVersion = "26.05";

hosts/desktop/hardware-configuration.nix

@@ -16,6 +16,10 @@
   boot.loader.efi.canTouchEfiVariables = true;
   boot.kernelPackages = pkgs.linuxPackages_latest;
 
+  boot.kernelParams = [
+    "amdgpu.runpm=0"
+  ];
+
   fileSystems."/" =
     { device = "/dev/disk/by-uuid/d7450680-7d53-4842-83c5-7fc32526dff1";
       fsType = "ext4";

hosts/vps/default.nix

@@ -7,21 +7,14 @@
     ../../modules/network.nix
     ../../modules/ssh.nix
     ../../modules/wireguard.nix
+	../../modules/tailscale.nix
+
     ../../modules/http-forwarding.nix
   ];
 
   network.node = "vps";
   networking.hostName = "vps";
 
-  home-manager = {
-    useGlobalPkgs = true;
-    useUserPackages = true;
-
-    users.root = import ../../home/root.nix;
-  };
-  programs.zsh.enable = true;
-  users.users.root.shell = pkgs.zsh;
-
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   system.stateVersion = "26.05";
 }

modules/email.nix

@@ -0,0 +1,5 @@
+{ config, lib, pkgs, ... }:
+
+{
+  
+}

modules/gitea.nix

@@ -1,16 +1,6 @@
 { config, lib, pkgs, ... }:
 
 {
-  sops = {
-    defaultSopsFile = ./secrets.yaml;
-    defaultSopsFormat = "yaml";
-    age.keyFile = "/var/lib/sops-nix/key.txt";
-
-    secrets.gitea_database_password = {
-      owner = "gitea";
-    };
-  };
-
   services.postgresql = {
     enable = true;
     ensureDatabases = [ "gitea" ];
@@ -25,10 +15,9 @@
     appName = "Lilac's Code";
     database = {
       type = "postgres";
-      host = "/run/postgres";
+      host = "/run/postgresql";
       name = "gitea";
       user = "gitea";
-      passwordFile = config.sops.secrets.gitea_database_password.path;
     };
   };
 
@@ -38,6 +27,4 @@
 	  reverse_proxy localhost:3000
 	'';
   };
-
-  networking.firewall.allowedTCPPorts = [ 3000 ];
 }

modules/headscale.nix

@@ -0,0 +1,37 @@
+{ config, lib, pkgs, ... }:
+
+{
+systemd.services.headscale.environment = {
+  GODEBUG = "netdns=go";
+};
+networking.enableIPv6 = false;
+  environment.etc."headscale/derp.yaml".source = ./derp.yaml;
+  services.headscale = {
+
+    enable = true;
+	settings = {
+      server_url = "https://vpn.grasswren.net";
+	  listen_addr = "0.0.0.0:8080";
+
+	  database.type = "sqlite";
+
+	  ip_prefixes = [
+        "100.64.0.0/10"
+        "fd7a:115c:a1e0::/48"
+      ];
+
+	  dns = {
+	    magic_dns = true;
+	    base_domain = "vpn";
+		nameservers.global = [ "1.1.1.1" ];
+	  };
+	};
+  };
+
+  services.caddy = {
+    enable = true;
+	virtualHosts."vpn.grasswren.net".extraConfig = ''
+	  reverse_proxy localhost:8080
+	'';
+  };
+}

modules/immich.nix

@@ -0,0 +1,17 @@
+{ config, lib, pkgs, ... }:
+
+{
+  services.immich = {
+    enable = true;
+	host = "127.0.0.1";
+	port = 2283;
+	mediaLocation = "/var/lib/immich";
+  };
+
+  services.caddy = {
+    enable = true;
+	virtualHosts."image.grasswren.net".extraConfig = ''
+      reverse_proxy localhost:2283
+	'';
+  };
+}

modules/navidrome.nix

@@ -0,0 +1,15 @@
+{ config, lib, pkgs, ... }:
+
+{
+  services.navidrome = {
+    enable = true;
+	settings.MusicFolder = "/var/lib/music";
+  };
+
+  services.caddy = {
+    enable = true;
+	virtualHosts."music.grasswren.net".extraConfig = ''
+      reverse_proxy localhost:4533
+	'';
+  };
+}

modules/ripping.nix

@@ -0,0 +1,44 @@
+{ config, lib, pkgs, ... }:
+
+{
+  home.packages = with pkgs; [
+    whipper
+	beets
+  ];
+
+  programs.beets = {
+    enable = true;
+
+    settings = {
+      directory = "/var/lib/music";
+      library = "/var/lib/music/library.db";
+
+      plugins = [
+	    "musicbrainz"
+        "fetchart"
+        "embedart"
+        "scrub"
+		"chroma"
+      ];
+
+      per_disc_numbering = true;
+
+      import = {
+        move = true;
+        copy = false;
+        write = true;
+        timid = true;
+        incremental = false;
+        resume = "ask";
+      };
+
+      paths = {
+        default = "$albumartist/$album%aunique{}/$track - $title";
+      };
+
+	  fetchart.auto = true;
+      embedart.auto = true;
+      scrub.auto = true;
+    };
+  };
+}

modules/secrets.yaml

@@ -1,16 +0,0 @@
-gitea_database_password: ENC[AES256_GCM,data:bL0VpnAk8rglXmjIWwpKiFnadYQVmPkR0Jq6o+ecFIPWDLt3YCD1LdBHd2E=,iv:4sMOZ5V4XopzuLcDxtwTFDbjkeeUoqggN4wAQIQvB/o=,tag:5iqAYIt0cCBoEMF/ySrO1A==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCVCtsSnhnQWplWGNqWDNv
-            M2UycWRBZmVDZnpQNWJwOWRFeVBxQ0hsZEd3CmhXc2JxNFNMdGNhTFFYbWVVQ0E0
-            enRRQjJ2WnlPSGgyOUZZQUxNRGl4bXcKLS0tIDFMRm1TN0dOM05YaXhaNlQwVGFW
-            WStnazd3RkRNRUZ2N3VWR0dEM2h4MFUK8BmxNJC07XpjM0/ONRyhQFJqNDDeebeH
-            8TgZukSjeq++fdaSNQQfRHX33MjhIkv5ynPaNi+dJ/m4INv5kfKGEA==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1ttmws269mrs30f65qwky5rzkwuq0dcfgrhgegxr7u9x9ty2nqfxq9v8dwu
-    lastmodified: "2026-07-05T03:11:33Z"
-    mac: ENC[AES256_GCM,data:2SaYCBj/U/JFUMejMZeGLhzcQk0O5+UkZ8xOHJJj5zwS6n1N8ns8sJOPixErOR2rm/Gnd1QG/KLqkQFdbKjTEpAYDUB65LOqatKWD3uGqrO8/Yu+3bvJSMahuJIJCTAm8zG8tvYpYdijiFBzw2tCgji83tjOBXn7YnM1R09jY2o=,iv:syC6kINOgG9NA8cxWGa3WzWy9e7JawHS6U5e3uUS3uM=,tag:YRlrjHgx1gGTUrq5NTvu3w==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.1

modules/ssh.nix

@@ -6,7 +6,7 @@ in
 {
   networking.firewall = {
     enable = true;
-	interfaces.wg0.allowedTCPPorts = [ 22 ];
+	allowedTCPPorts = [ 22 ];
   };
   services.openssh = {
     enable = true;
@@ -16,12 +16,19 @@ in
 	  KbdInteractiveAuthentication = false;
 	};
 	listenAddresses = [{
-      addr = me.address-vpn;
+      addr = "0.0.0.0";
 	  port = 22;
 	}];
   };
+
   users.users.root.openssh.authorizedKeys.keys = [
     config.network.nodes.laptop.ssh
 	config.network.nodes.desktop.ssh
   ];
+  users.users.lilac = lib.mkIf (config.network.node != "vps") {
+    openssh.authorizedKeys.keys = [
+      config.network.nodes.laptop.ssh
+      config.network.nodes.desktop.ssh
+    ];
+  };
 }

modules/tailscale.nix

@@ -0,0 +1,5 @@
+{ config, lib, pkgs, ... }:
+
+{
+  services.tailscale.enable = true;
+}