automated: Update flake.lock

Auto-generated by [update.yml][1] with the help of
[create-pull-request][2].

[1]: https://nayeonie.com/ahuston-0/nix-dotfiles/src/branch/main/.github/workflows/flake-update.yml
[2]: https://forgejo.stefka.eu/jiriks74/create-pull-request

flake.lock

@@ -76,11 +76,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1766117060,
-        "narHash": "sha256-wOPdAVKLiI1vE3IzNVR5mx0eM6Mf6+WWOsMETuKEyoU=",
+        "lastModified": 1767672212,
+        "narHash": "sha256-CGQgo92QKzCnRUF2wjEPsaIoKajVU5EyK1aDaMwo1xg=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "0f011296901c43d84590b262ce64259b79dee3ac",
+        "rev": "461ec70d76363e9f76588afe59e02fbbc69da80e",
         "type": "gitlab"
       },
       "original": {
@@ -125,11 +125,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1765835352,
-        "narHash": "sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw=",
+        "lastModified": 1767609335,
+        "narHash": "sha256-feveD98mQpptwrAEggBQKJTYbvwwglSbOv53uCfH9PY=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "a34fae9c08a15ad73f295041fec82323541400a9",
+        "rev": "250481aafeb741edfe23d29195671c19b36b6dca",
         "type": "github"
       },
       "original": {
@@ -242,11 +242,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766171975,
-        "narHash": "sha256-47Ee0bTidhF/3/sHuYnWRuxcCrrm0mBNDxBkOTd3wWQ=",
+        "lastModified": 1767688629,
+        "narHash": "sha256-kX1BVq5zoowePHssEjmpc6FNT3vVZNZaCXd7mfvCsxg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "bb35f07cc95a73aacbaf1f7f46bb8a3f40f265b5",
+        "rev": "bfaba198af72338b8dbda59887859d7a30c6643c",
         "type": "github"
       },
       "original": {
@@ -417,11 +417,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1764440730,
-        "narHash": "sha256-ZlJTNLUKQRANlLDomuRWLBCH5792x+6XUJ4YdFRjtO4=",
+        "lastModified": 1767185284,
+        "narHash": "sha256-ljDBUDpD1Cg5n3mJI81Hz5qeZAwCGxon4kQW3Ho3+6Q=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "9154f4569b6cdfd3c595851a6ba51bfaa472d9f3",
+        "rev": "40b1a28dce561bea34858287fbb23052c3ee63fe",
         "type": "github"
       },
       "original": {
@@ -440,11 +440,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765760415,
-        "narHash": "sha256-IWqUDFoagKlofu68/8Q1yqkn1BHMLpgsx9fnrSZNH4s=",
+        "lastModified": 1766370075,
+        "narHash": "sha256-gbhR8+gNrhmYxKaNJpTjFivuibr3ZdlB5eU0a8yE36I=",
         "owner": "NuschtOS",
         "repo": "nixos-modules",
-        "rev": "fce41e57c75d878e77cb8e01bafc4676d1b401fe",
+        "rev": "db6f2a33500dadb81020b6e5d4281b4820d1b862",
         "type": "github"
       },
       "original": {
@@ -502,11 +502,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1765779637,
-        "narHash": "sha256-KJ2wa/BLSrTqDjbfyNx70ov/HdgNBCBBSQP3BIzKnv4=",
+        "lastModified": 1767379071,
+        "narHash": "sha256-EgE0pxsrW9jp9YFMkHL9JMXxcqi/OoumPJYwf+Okucw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "1306659b587dc277866c7b69eb97e5f07864d8c4",
+        "rev": "fb7944c166a3b630f177938e478f0378e64ce108",
         "type": "github"
       },
       "original": {
@@ -552,11 +552,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765911976,
-        "narHash": "sha256-t3T/xm8zstHRLx+pIHxVpQTiySbKqcQbK+r+01XVKc0=",
+        "lastModified": 1767281941,
+        "narHash": "sha256-6MkqajPICgugsuZ92OMoQcgSHnD6sJHwk8AxvMcIgTE=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "b68b780b69702a090c8bb1b973bab13756cc7a27",
+        "rev": "f0927703b7b1c8d97511c4116eb9b4ec6645a0fa",
         "type": "github"
       },
       "original": {
@@ -596,11 +596,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766112155,
-        "narHash": "sha256-N0KUOJSIBw2fFF2ACZhwYX2e0EGaHBVPlJh7bnxcGE4=",
+        "lastModified": 1767667566,
+        "narHash": "sha256-COy+yxZGuhQRVD1r4bWVgeFt1GB+IB1k5WRpDKbLfI8=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "2a6db3fc1c27ae77f9caa553d7609b223cb770b5",
+        "rev": "056ce5b125ab32ffe78c7d3e394d9da44733c95e",
         "type": "github"
       },
       "original": {
@@ -616,11 +616,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765836173,
-        "narHash": "sha256-hWRYfdH2ONI7HXbqZqW8Q1y9IRbnXWvtvt/ONZovSNY=",
+        "lastModified": 1767499857,
+        "narHash": "sha256-0zUU/PW09d6oBaR8x8vMHcAhg1MOvo3CwoXgHijzzNE=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "443a7f2e7e118c4fc63b7fae05ab3080dd0e5c63",
+        "rev": "ecc41505948ec2ab0325f14c9862a4329c2b4190",
         "type": "github"
       },
       "original": {
@@ -650,11 +650,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1765897595,
-        "narHash": "sha256-NgTRxiEC5y96zrhdBygnY+mSzk5FWMML39PcRGVJmxg=",
+        "lastModified": 1767652667,
+        "narHash": "sha256-zsgfockkvK0JrSvzVAb8JeUq3SDdITu6ViUf7yeIpi4=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "e6829552d4bb659ebab00f08c61d8c62754763f3",
+        "rev": "a4406d9799d002c41296c72378a1094a8fc9aa1b",
         "type": "github"
       },
       "original": {

hydra/jobsets.nix

@@ -18,7 +18,7 @@ let
     };
 
   prs = readJSONFile pulls;
-  refs = readJSONFile branches;
+  #refs = readJSONFile branches;
 
   # template for creating a job
   makeJob =
@@ -47,19 +47,19 @@ let
   giteaHost = "ssh://gitea@nayeonie.com:2222";
   repo = "ahuston-0/nix-dotfiles";
   # # Create a hydra job for a branch
-  jobOfRef =
-    name:
-    { ref, ... }:
-    if ((builtins.match "^refs/heads/(.*)$" ref) == null) then
-      null
-    else
-      {
-        name = builtins.replaceStrings [ "/" ] [ "-" ] "branch-${name}";
-        value = makeJob {
-          description = "Branch ${name}";
-          flake = "git+${giteaHost}/${repo}?ref=${ref}";
-        };
-      };
+  #jobOfRef =
+  #  name:
+  #  { ref, ... }:
+  #  if ((builtins.match "^refs/heads/(.*)$" ref) == null) then
+  #    null
+  #  else
+  #    {
+  #      name = builtins.replaceStrings [ "/" ] [ "-" ] "branch-${name}";
+  #      value = makeJob {
+  #        description = "Branch ${name}";
+  #        flake = "git+${giteaHost}/${repo}?ref=${ref}";
+  #      };
+  #    };
 
   # Create a hydra job for a PR
   jobOfPR = id: info: {
@@ -77,12 +77,12 @@ let
   # wrapper function for reading json from file
   readJSONFile = f: builtins.fromJSON (builtins.readFile f);
   # remove null values from a set, in-case of branches that don't exist
-  mapFilter = f: l: builtins.filter (x: (x != null)) (map f l);
+  #mapFilter = f: l: builtins.filter (x: (x != null)) (map f l);
 
   # Create job set from PRs and branches
   jobs = makeSpec (
     builtins.listToAttrs (map ({ name, value }: jobOfPR name value) (attrsToList prs))
-    // builtins.listToAttrs (mapFilter ({ name, value }: jobOfRef name value) (attrsToList refs))
+    #// builtins.listToAttrs (mapFilter ({ name, value }: jobOfRef name value) (attrsToList refs))
   );
 in
 {

systems/artemision/secrets.yaml

@@ -10,7 +10,7 @@ example_booleans:
     - ENC[AES256_GCM,data:6SJ0JKI=,iv:J0qSvWoOcDwSXCKyau+a0YcCGuH5WABHVh6Kdigac20=,tag:WQdNfjcubbzoHnQW4gua8g==,type:bool]
 apps:
     spotify: ENC[AES256_GCM,data:tIABPphA7Vr6VNvJpWTS9kDmidU=,iv:ciQzr8jyIcHYi797NKypPs7FhDgK5ToVZ0eZHHF8UtE=,tag:wUTL/x1p24cXyPUAL1dPfg==,type:str]
-wifi-env: ENC[AES256_GCM,data:2BM4wQq+RfASkg9lcH+fW7eD0VaPJMXABp3z0sYXqZbVzv9R9eAxSokxzcifT/1JK8PBwvZkWtEFrKAT3phXIZzoEySnGKGYazz8fqWWWhMJotLNNo5VkX70hLppgE9vYxf9vQSq0PLWYCN0jUO0H9mHjOT6mDzKUHegcC53jzkNY3WTfLkyzDWJVMP9IbVQ22N5QlJbzZNqrNTaOtcRm06PBz7pNuEKOy4jj5ipZOh6ceR81Xy6BXM7MzFN27lYbzfVvcDmlwqPORAmr7/00QBy2cp38rTswJEzYf1x2Q==,iv:DSTVPw9qtmo02/usZZDpHsYlX3sSW+2XrnawtBkRNmQ=,tag:3p3eW+3BEQrOmHlBNUEOaA==,type:str]
+wifi-env: ENC[AES256_GCM,data:mxPCyunx8yOahcuVhZCzuqAt/G89lMBnZme+qwcxO4LsCftx7h2FotA+wnlj1++vmPW5zL72q2kzxh0KcVlYqK9fpOrMY/FJeJXWYNMZIHesmWKlaaeA1wM/q1dSllwuVuULp9WQzipiQHwcCCLseo3bmCsYpbs8PUibrDgbDqXreTSjJBNTVzwOGpz1bZCSpEynS+dQQViRSNcVeYTOLxrOTxx5lyEOIhgIc3167ObhK+7bJVG2ZcP209Gllip4XkCj/FKnEwg2vVF5Dpofz7T2Op5ef/oNzahhKmCa+k7OPqITWwPYZg7pqAf6jdMy4eBP/A==,iv:Q6IMqePFwd1b1pSuh+TIwcag2bbJXyIYUmJWY6UaaqI=,tag:UZ5ak6nmHkNG0uBMTl1CwQ==,type:str]
 #ENC[AES256_GCM,data:G9ggYJ3YA+E=,iv:nZ5NgeyNKFXFIpquoY68Z2Jz9QROqvf5tv7/s1wSgKk=,tag:QAX555IsAMaWAlz9ywSzjQ==,type:comment]
 sops:
     age:
@@ -23,8 +23,8 @@ sops:
             d09aSXN0ZUh3VC9XeTZ4UWoxVDNVN0UKF1eU/IQJgJ8Fg+MrfqQuEZZ775hvtUJR
             D/ZS4vj+sDLWq6gy2lIBhRSIAHWrz5gHxvOOGmRnpvkqh9TS6XjLIA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-05-15T15:37:51Z"
-    mac: ENC[AES256_GCM,data:qJ8NdnzVrgQb0rGwjZFHrS+eJrUjQEk4M4uo5bnk4eY7aKaHejARcYOIhp0H/DMdlix+Dm3DAAeeRWn8AKCatXaSzYD/VHHbjfp0lKBCsC8CZFeCELQ5GGEHnVot3WGb4J+QdfupwdduExSSMd6XeZGFVbSGhLzRbiiWA+i8I3o=,iv:oxWiDCH60apKT0/fJbWp1cIZ9cvd6mJKlP3xAjMBXIo=,tag:0We6eCJnsncujCt+CwK9UQ==,type:str]
+    lastmodified: "2026-01-03T19:32:16Z"
+    mac: ENC[AES256_GCM,data:q5NppTtZZA9Oo15zI0pAZ/YN2qu0TneDPMJY9rXtWlYfG7Pq5taRyc9MpV7CyEt+qWMkN//O3/sA4jmQTtpT8JuYIEa+/x5cfSZ5w0ErjKdV4/IyDs1LPDKNLXIWlmPMo61VvsKW9DZRBRml9qtR1ypeHBuz0pjECBwAQPEcw9k=,iv:X7wUOxn4BsvqCPmNZvH75hyAzUeD7Qtp+4e4SLpPWlI=,tag:Dp6Bu3zEkRaRPdOwWil13g==,type:str]
     pgp:
         - created_at: "2024-11-28T18:57:09Z"
           enc: |-
@@ -39,4 +39,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: 5EFFB75F7C9B74EAA5C4637547940175096C1330
     unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.11.0

systems/artemision/wifi.nix

@@ -11,7 +11,7 @@ in
   networking.wireless = {
     enable = true;
     secretsFile = config.sops.secrets."wifi-env".path;
-    userControlled.enable = true;
+    userControlled = true;
     networks = {
       "taetaethegae-2.0" = {
         pskRaw = "ext:PASS_taetaethegae_20";
@@ -29,6 +29,7 @@ in
       "Verizon_ZLHQ3H".pskRaw = "ext:PASS_angie";
       "Fios-Qn3RB".pskRaw = "ext:PASS_parkridge";
       "Mojo Dojo Casa House".pskRaw = "ext:PASS_Carly";
+      "bwe_guest".pskRaw = "ext:PASS_BWE_NE";
 
       # Public wifi connections
       # set public_wifi on line 5 to true if connecting to one of these
@@ -45,7 +46,7 @@ in
     defaultSopsFile = ./secrets.yaml;
     secrets = {
       "wifi-env" = {
-        owner = "root";
+        owner = "wpa_supplicant";
         restartUnits = [ "wpa_supplicant.service" ];
       };
     };

systems/palatine-hill/docker/arr.nix

@@ -11,9 +11,7 @@ let
       ctype = lib.strings.toUpper container_type;
     in
     {
-      "${ctype}__POSTGRES__HOST" = "host.docker.internal";
-      "${ctype}__POSTGRES__USER" = "SOPS_ONLY";
-      "${ctype}__POSTGRES__PASSWORD" = "SOPS_ONLY";
+      "${ctype}__POSTGRES__HOST" = "/var/run/postgresql";
       "${ctype}__POSTGRES__PORT" = toString config.services.postgresql.settings.port;
     };
 in
@@ -49,129 +47,178 @@ in
   virtualisation.oci-containers.containers = {
     bazarr = {
       image = "ghcr.io/linuxserver/bazarr:latest";
+      pull = "always";
       ports = [ "6767:6767" ];
+      hostname = "bazarr";
       environment = {
         PUID = "600";
         PGID = "100";
         TZ = "America/New_York";
-        POSTGRES_HOST = "host.docker.internal";
-        POSTGRES_USER = "SOPS_ONLY";
-        POSTGRES_PASSWORD = "SOPS_ONLY";
+        POSTGRES_HOST = "/var/run/postgresql";
         POSTGRES_PORT = toString config.services.postgresql.settings.port;
       };
+      environmentFiles = [
+        config.sops.secrets."docker/bazarr".path
+      ];
       volumes = [
         "${vars.primary_docker}/bazarr:/config"
         "${vars.primary_plex_storage}/data:/data"
+        "/var/run/postgresql:/var/run/postgresql"
       ];
       extraOptions = [
         "--network=arrnet"
-        "--add-host=host.docker.internal:host-gateway"
       ];
       autoStart = true;
     };
     prowlarr = {
       image = "ghcr.io/linuxserver/prowlarr:latest";
+      pull = "always";
       ports = [ "9696:9696" ];
+      hostname = "prowlarr";
       environment = {
         PUID = "600";
         PGID = "100";
         TZ = "America/New_York";
       }
       // arr_postgres_config "prowlarr";
-      extraOptions = [ "--network=arrnet" ];
-      volumes = [ "${vars.primary_docker}/prowlarr:/config" ];
+      environmentFiles = [
+        config.sops.secrets."docker/prowlarr".path
+      ];
+      extraOptions = [
+        "--network=arrnet"
+      ];
+      volumes = [
+        "${vars.primary_docker}/prowlarr:/config"
+
+        "/var/run/postgresql:/var/run/postgresql"
+      ];
       autoStart = true;
     };
     radarr = {
       image = "ghcr.io/linuxserver/radarr:latest";
+      pull = "always";
       ports = [ "7878:7878" ];
+      hostname = "radarr";
       environment = {
         PUID = "600";
         PGID = "100";
         TZ = "America/New_York";
       }
       // arr_postgres_config "radarr";
+      environmentFiles = [
+        config.sops.secrets."docker/radarr".path
+      ];
       volumes = [
         "${vars.primary_docker}/radarr:/config"
         "${vars.primary_plex_storage}/data:/data"
+        "/var/run/postgresql:/var/run/postgresql"
+      ];
+      extraOptions = [
+        "--network=arrnet"
       ];
-      extraOptions = [ "--network=arrnet" ];
       autoStart = true;
     };
     sonarr = {
       image = "ghcr.io/linuxserver/sonarr:latest";
+      pull = "always";
       ports = [ "8989:8989" ];
+      hostname = "sonarr";
       environment = {
         PUID = "600";
         PGID = "100";
         TZ = "America/New_York";
       }
       // arr_postgres_config "sonarr";
+      environmentFiles = [
+        config.sops.secrets."docker/sonarr".path
+      ];
       volumes = [
         "${vars.primary_docker}/sonarr:/config"
         "${vars.primary_plex_storage}/data:/data"
+        "/var/run/postgresql:/var/run/postgresql"
+      ];
+      extraOptions = [
+        "--network=arrnet"
       ];
-      extraOptions = [ "--network=arrnet" ];
       autoStart = true;
     };
     lidarr = {
       image = "ghcr.io/linuxserver/lidarr:latest";
+      pull = "always";
       ports = [ "8686:8686" ];
+      hostname = "lidarr";
       environment = {
         PUID = "600";
         PGID = "100";
         TZ = "America/New_York";
       }
       // arr_postgres_config "lidarr";
+      environmentFiles = [
+        config.sops.secrets."docker/lidarr".path
+      ];
       volumes = [
         "${vars.primary_docker}/lidarr:/config"
         "${vars.primary_plex_storage}/data:/data"
+        "/var/run/postgresql:/var/run/postgresql"
+      ];
+      extraOptions = [
+        "--network=arrnet"
       ];
-      extraOptions = [ "--network=arrnet" ];
       autoStart = true;
     };
     unpackerr = {
       image = "golift/unpackerr:latest";
+      pull = "always";
       user = "600:100";
+      hostname = "unpackerr";
       environment = {
         TZ = "America/New_York";
       };
       volumes = [
         "${vars.primary_docker}/unpackerr:/config"
         "${vars.primary_plex_storage}:/data"
+        "/var/run/postgresql:/var/run/postgresql"
       ];
       extraOptions = [ "--network=arrnet" ];
       autoStart = true;
     };
     notifiarr = {
       image = "golift/notifiarr:latest";
+      pull = "always";
       ports = [ "5454:5454" ];
       user = "600:100";
+      hostname = "notifiarr";
       environment = {
         TZ = "America/New_York";
-      }
-      // arr_postgres_config "notifiarr";
+      };
       environmentFiles = [ config.sops.secrets."docker/notifiarr".path ];
       volumes = [
         "${vars.primary_docker}/notifiarr:/config"
         "${vars.primary_plex_storage}:/data"
+        "/var/run/postgresql:/var/run/postgresql"
       ];
       extraOptions = [ "--network=arrnet" ];
       autoStart = true;
     };
     jellyseerr = {
       image = "fallenbagel/jellyseerr:latest";
+      pull = "always";
+      hostname = "jellyseerr";
       environment = {
         PUID = "600";
         PGID = "100";
         TZ = "America/New_York";
         DB_TYPE = "postgres";
-        DB_HOST = "host.docker.internal";
+        DB_HOST = "/var/run/postgresql";
         DB_PORT = toString config.services.postgresql.settings.port;
-        DB_USER = "SOPS_ONLY";
-        DB_PASS = "SOPS_ONLY";
       };
-      volumes = [ "${vars.primary_docker}/overseerr:/config" ];
+      environmentFiles = [
+        config.sops.secrets."docker/jellyseerr".path
+      ];
+      volumes = [
+        "${vars.primary_docker}/overseerr:/config"
+        "/var/run/postgresql:/var/run/postgresql"
+      ];
       # TODO: remove ports later since this is going through web
       extraOptions = [
         "--network=arrnet"
@@ -193,7 +240,34 @@ in
 
   sops = {
     secrets = {
-      "docker/notifiarr".owner = "docker-service";
+      "docker/notifiarr" = {
+        owner = "docker-service";
+        restartUnits = [ "docker-notifiarr.service" ];
+      };
+      "docker/bazarr" = {
+        owner = "docker-service";
+        restartUnits = [ "docker-bazarr.service" ];
+      };
+      "docker/prowlarr" = {
+        owner = "docker-service";
+        restartUnits = [ "docker-prowlarr.service" ];
+      };
+      "docker/radarr" = {
+        owner = "docker-service";
+        restartUnits = [ "docker-radarr.service" ];
+      };
+      "docker/sonarr" = {
+        owner = "docker-service";
+        restartUnits = [ "docker-sonarr.service" ];
+      };
+      "docker/lidarr" = {
+        owner = "docker-service";
+        restartUnits = [ "docker-lidarr.service" ];
+      };
+      "docker/jellyseerr" = {
+        owner = "docker-service";
+        restartUnits = [ "docker-jellyseerr.service" ];
+      };
     };
   };
 }

systems/palatine-hill/firewall.nix

@@ -1,38 +1,51 @@
 { ... }:
 
 {
-  networking.firewall.allowedTCPPorts = [
-    # qbit
-    8081
-    8082
-    8443
+  networking.firewall = {
 
-    # hydra
-    3000
+    extraCommands = "
+      iptables -I nixos-fw 1 -i br+ -j ACCEPT
+    ";
 
-    # minio
-    8500
-    8501
+    extraStopCommands = "
+      iptables -D nixos-fw -i br+ -j ACCEPT
+    ";
 
-    # gitea
-    2222
-    2223
-    8088
+    trustedInterfaces = [ "br+" ];
 
-    # attic
-    8183
+    allowedTCPPorts = [
+      # qbit
+      8081
+      8082
+      8443
 
-    # collabora
-    9980
+      # hydra
+      3000
 
-    # arr
-    6767
-    9696
-    7878
-    8989
-    8686
-    8787
-    5055
-  ];
+      # minio
+      8500
+      8501
 
+      # gitea
+      2222
+      2223
+      8088
+
+      # attic
+      8183
+
+      # collabora
+      9980
+
+      # arr
+      6767
+      9696
+      7878
+      8989
+      8686
+      8787
+      5055
+    ];
+
+  };
 }

systems/palatine-hill/postgresql.nix

@@ -29,6 +29,12 @@ in
            # Let other names login as themselves
            superuser_map      /^(.*)$   \1
       '';
+      authentication = ''
+        local  bazarr  bazarr  scram-sha-256
+        local  /.*arr-main  /.*arr  scram-sha-256
+        local  /.*arr-log  /.*arr  scram-sha-256
+        local  jellyseerr  jellyseerr  scram-sha-256
+      '';
 
       # initialScript = config.sops.secrets."postgres/init".path;
       ensureDatabases = [

systems/palatine-hill/samba.nix

@@ -12,7 +12,7 @@
         #"use sendfile" = "yes";
         #"max protocol" = "smb2";
         # note: localhost is the ipv6 localhost ::1
-        "hosts allow" = "192.168.76. 127.0.0.1 localhost";
+        "hosts allow" = "192.168.76. 127.0.0.1 localhost 192.168.191.";
         "hosts deny" = "0.0.0.0/0";
         "guest account" = "nobody";
         "map to guest" = "bad user";

systems/palatine-hill/secrets.yaml

@@ -26,6 +26,12 @@ docker:
     delugevpn: ENC[AES256_GCM,data:YGkgaQUuA9oteKD77tnFzxZSHctyOQjMNlfvJr3mPWAl2P8wfcshiUoa6SNp69pagxbzRV6mfuzwzinbkQCoZN3lw7uF76y0,iv:Bro0H4tFR+3wi9DGGq9a6ge4o4uPlVXBUF7h17zyqg8=,tag:N1kVNFasqGMx8R9qTq2dJA==,type:str]
     protonvpn-start-script: ENC[AES256_GCM,data:ZnlDpCLdILHXSUCI6itWkqO4y75Lwjj7qT1DBkfueLneQOaQ0JhuE2FbOOajkmI046nP9fMrJbu3g4QZHsq1g8yqGU1wb0OOT+eS9+M92Md29B4NnUdwnVAO6/RzvRKXP2tsQ4iprx9An+BEFwZYD6WG6DQc6NjJVSgRcYvfH9rQey2VdwLysNsgFCs8eC6QgikqBpeg4eOIvDDNbdXPKkW+ZPph9xpzGkcFIMwlX5esg0n7qyUoMvWwBn4avC46U5erOw0fNajY60ri9sm5Afht6LZrFal71Hx/K9/5EXBp9dD4teLO2Ew0CQX0i94pKCuR207l9868s7Ao3udLp4wbiLnXoRKq+w==,iv:qR0kNYpb50NXEqSksvHBPAaRG51RKCsSwTq32nosxzo=,tag:+xRQyuWi4Ja/N9lcd11oJA==,type:str]
     notifiarr: ENC[AES256_GCM,data:XxVEhp4Rei6mRcdSSooRnofuVNZDalVhDYiVUmvQUr8QihrVRMKRE9Kpl5PGWUBw,iv:urMLaUf3XUjMks2vk0E7iRUU3mLHBiMAiwtQgmWQq20=,tag:dHdTOyC/ukd71UlYEI5fWw==,type:str]
+    bazarr: ENC[AES256_GCM,data:x+JdRCl3x3OM3lWmgcWikJSEnh5c5He5HmuLzCGAQ8zUXMi2Z3Kf6LzL+aoqtCBu3rabYZmQSLBoDm9CPkk=,iv:7e+3w46RUD2/OSlwrEe7BRxUqPPdt5+obIjQA8pr3xY=,tag:rHSijp/tcf/SGp5y4kJ0cw==,type:str]
+    prowlarr: ENC[AES256_GCM,data:hr3hYwRw0+/UD8anqZQjGy7rPkV2pad4Xi5FdXSf3Ftd1/jwlYfMqhqgEngFX30LLMWvJvjeu1TkTNzSEwI6ZCPdefNVYYwWavtm+XcBVxffGvFZ,iv:EXW48288IcCeGs/vP4tkAI4dxQAOh92Na43q/9cyuSc=,tag:pnYR26MDd82DjeUPdwCoUw==,type:str]
+    radarr: ENC[AES256_GCM,data:qCfoeEHb0ng5GhaY3QZiFvLVb25ZHNmgT0bRqEjBcelyP2819zCL7LxUPr08FxivEYZiAMFVleRozL8NMg6O5fh+2BatcYOfyh99zxIC,iv:HV3gTTnrjtab7x4Be+7hSe+nrD6BnPAmZBsHzi9Fujg=,tag:O6x0FDlasuJSRrGL/9SwpQ==,type:str]
+    sonarr: ENC[AES256_GCM,data:X/hM31ZyHybvy2eQzVnmq8CH1AqBgz1pxq7tKC4lZB3ryAbnEIJksffem8+35tWt/0r5cEH4aaIKD1kS7Q+Ma+8JrRLcWkt6CZq/wspz,iv:44FfdVpQCposXshzNe5DXAxExeQzjVKhkZaVbgKo8KU=,tag:WIWWUt1XBngUTwwqhCrcNw==,type:str]
+    lidarr: ENC[AES256_GCM,data:xERBECneutNUMZRrHukp8CaNrpI7SXUB16zUkauNP2+wto3eIc/K+2nMCkbwSC9AKlSjnUGSiORmAWn/jofTAuEzQljkCR1XCSkJRMmL,iv:iKf4fZtCfdjT/KuMFK5VFoLAV+Lll8uJowe9Q4cHyYw=,tag:xzmATTkrYRYm9Mw23zEO5g==,type:str]
+    jellyseerr: ENC[AES256_GCM,data:7dDfHFp8+WbJqrf7Ms/gmfroBePwegXh5CXn5FcOz8IEK7rTvr9KZfz9x/1BwdD8,iv:ZPi3OcMfH76A08piKY4P7hFbeMyouwBoeN5oL3ExzKU=,tag:oOZ37dy/y+DFqNRfAHexvQ==,type:str]
 acme:
     bunny: ENC[AES256_GCM,data:P2yROVUga9mORcq8VR/l0i4/2Vod1zvlYq+ZJLLNKow0SpblkwQX/i1ucQYAOkTTRddN+3C+t0zj1rMWkdLoaLjEUJJi3VsSxi+chV2FFiVKFQGEcg24,iv:aQvGgGLsgRGoEmwTgZHR8Jm/MYxmGtVTT/fZKaTLeMs=,tag:m3ssF4O8qs4yxvMu6yUcjw==,type:str]
     dnsimple: ENC[AES256_GCM,data:37FKyBibFtXZgI4EduJQ0z8F+shBc5Q6YlLa3YkVPh9XuJVS20eybi75bfJxiozcZ9d+YRaqcbkBQCSdFOCotDU=,iv:oq3JjqbfAm2C4jcL1lvUb2EOmnwlR07vPoO8H0BmydQ=,tag:E3NO/jMElL6Q817666gIyg==,type:str]
@@ -44,8 +50,8 @@ sops:
             cXNZWmZqd0R0SmhINExscHBKWmxvblUKEFEQvt/zQFARba4S8vHz/1SoKdKg69At
             LZ58XQGOmlGbBhPr7EzYQ2XSY4flWbnnD174cmCR8DNFm15DsNA5fw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-08T03:05:16Z"
-    mac: ENC[AES256_GCM,data:gIw//fnDU/lE2rDP4890MjnQ2xp0I4fXwvSWrLC0kFjW1RMLzNCaRLlJzw5/khALH/IZgTrnRqTHF3zHZd+mlyqvC/vzkyBBVdWRRX6w5l9JhFDfe83r86tvsV9G/AOeRchDp1gGuBBNkRamSuCOj7QFc1l334e/jNdKDadhwgI=,iv:nrOQxvJBce5/NDvpowJX/AiIssQdNOStvjj/Lkutppk=,tag:MlRJxbG3laajsi5KHAxy5g==,type:str]
+    lastmodified: "2025-12-25T17:45:31Z"
+    mac: ENC[AES256_GCM,data:lVRqQWnO1RvmoW13/xCpP2SvibccRWwmr1Gyj6EgrE+V+Iu1bfnZRkTkHiFIQqQLQgCy2qBiSHeZF/dNERe83eEwpXgRQAduarpE/qL8K1mxcwf5HMMYACjlNfsL/I1/TCJrJ7DZBxI4neRLetc5OpScVXqHj1neOodD/g8n+ls=,iv:+gZpo0I2NVYz24o42mUW/OkfONqNSjgaJeKeFdKx7dg=,tag:EJnpiotQuBKth21mdhvjZQ==,type:str]
     pgp:
         - created_at: "2024-11-28T18:56:39Z"
           enc: |-

users/alice/home/zsh.nix

@@ -1,9 +1,10 @@
-{ lib, ... }:
+{ lib, config, ... }:
 {
 
   programs.zsh = {
 
     enable = true;
+    dotDir = "${config.xdg.configHome}/zsh";
     oh-my-zsh = {
       enable = true;
       plugins = [

users/alice/non-server.nix

@@ -14,6 +14,7 @@
       customTitleBar = false;
       hardwareAcceleration = true;
     };
+    vencord.useSystem = true;
     vencord.settings = {
       autoUpdate = false;
       autoUpdateNotification = false;

users/default.nix

@@ -22,6 +22,7 @@
     (lib.mkIf config.programs.wireshark.enable "wireshark")
     (lib.mkIf config.virtualisation.docker.enable "docker")
     (lib.mkIf (with config.services.locate; (enable && package == pkgs.plocate)) "plocate")
+    (lib.mkIf config.networking.wireless.enable "wpa_supplicant")
     "libvirtd"
     "dialout"
     "plugdev"