Merge pull request 'add garage' (#223 ) from feature/garage into main

Reviewed-on: #223
add garage
2026-05-02 12:14:12 -04:00 · 2026-05-02 12:11:02 -04:00 · 2026-05-02 11:38:12 -04:00 · 2026-05-02 11:38:12 -04:00 · 2026-05-01 10:57:38 -04:00 · 2026-05-01 10:54:03 -04:00
16 changed files with 473 additions and 42 deletions
--- a/.github/workflows/update-claurst.yml
+++ b/.github/workflows/update-claurst.yml
@@ -0,0 +1,169 @@
+name: "Update claurst"
+on:
+    repository_dispatch:
+    workflow_dispatch:
+    schedule:
+        - cron: "00 14 * * 1" # Every Monday at 14:00 UTC
+concurrency:
+    group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+    cancel-in-progress: true
+jobs:
+    update_claurst:
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@v4
+            - name: Install nix
+              uses: https://github.com/DeterminateSystems/nix-installer-action@main
+            - name: Setup Attic cache
+              uses: ryanccn/attic-action@v0
+              with:
+                endpoint: ${{ secrets.ATTIC_ENDPOINT }}
+                cache: ${{ secrets.ATTIC_CACHE }}
+                token: ${{ secrets.ATTIC_TOKEN }}
+                skip-push: "true"
+            - name: Get current claurst version
+              id: current
+              run: |
+                VERSION=$(grep 'version = ' pkgs/claurst/default.nix | head -1 | sed 's/.*version = "\(.*\)".*/\1/')
+                echo "version=$VERSION" >> $GITHUB_OUTPUT
+                echo "Current version: $VERSION"
+            - name: Get latest claurst release
+              id: latest
+              uses: actions/github-script@v7
+              with:
+                github-token: ${{ secrets.GITHUB_TOKEN }}
+                script: |
+                    const release = await github.rest.repos.getLatestRelease({
+                      owner: 'Kuberwastaken',
+                      repo: 'claurst',
+                    });
+                    const tag = release.data.tag_name.replace(/^v/, '');
+                    core.setOutput('version', tag);
+                    core.info(`Latest release: ${tag}`);
+            - name: Check if update needed
+              id: check_update
+              run: |
+                CURRENT="${{ steps.current.outputs.version }}"
+                LATEST="${{ steps.latest.outputs.version }}"
+                if [ "$CURRENT" = "$LATEST" ]; then
+                  echo "No update needed (current: $CURRENT, latest: $LATEST)"
+                  echo "update_needed=false" >> $GITHUB_OUTPUT
+                else
+                  echo "Update needed (current: $CURRENT, latest: $LATEST)"
+                  echo "update_needed=true" >> $GITHUB_OUTPUT
+                fi
+            - name: Update claurst if new version available
+              if: steps.check_update.outputs.update_needed == 'true'
+              id: update
+              run: |
+                NEW_VERSION="${{ steps.latest.outputs.version }}"
+
+                # Backup original file
+                cp pkgs/claurst/default.nix pkgs/claurst/default.nix.bak
+
+                # Update version placeholder with empty hash to compute it
+                sed -i "s/version = \"[^\"]*\"/version = \"$NEW_VERSION\"/" pkgs/claurst/default.nix
+
+                # Try to fetch the new src hash
+                echo "Computing src hash for v$NEW_VERSION..."
+                SRC_HASH=$(nix-prefetch-url --unpack "https://github.com/Kuberwastaken/claurst/archive/refs/tags/v$NEW_VERSION.tar.gz" 2>/dev/null | tail -1 || echo "")
+
+                if [ -z "$SRC_HASH" ]; then
+                  echo "Failed to compute src hash, reverting"
+                  mv pkgs/claurst/default.nix.bak pkgs/claurst/default.nix
+                  exit 1
+                fi
+
+                SRC_HASH="sha256-$SRC_HASH"
+                echo "New src hash: $SRC_HASH"
+
+                # Update src hash
+                sed -i "s|hash = \"sha256-[^\"]*\"|hash = \"$SRC_HASH\"|" pkgs/claurst/default.nix
+
+                # Compute cargoHash - this requires building
+                echo "Computing cargo hash..."
+                CARGO_HASH=$(nix build \
+                  --no-eval-cache \
+                  --expr "(import ./pkgs/default.nix { nixpkgs = import <nixpkgs> { }; }).mkPkgs \"x86_64-linux\" | .claurst" \
+                  2>&1 | grep -oP 'got:\s*\K[^"]+' | head -1 || echo "")
+
+                if [ -z "$CARGO_HASH" ]; then
+                  echo "Failed to compute cargo hash, trying with attribute substitution..."
+                  CARGO_HASH=$(nix eval \
+                    --impure \
+                    --expr "
+                      let
+                        pkgs = import <nixpkgs> { config.allowUnsupportedSystem = true; };
+                        claurst = import pkgs/claurst { inherit pkgs; };
+                      in claurst.cargoHash
+                    " 2>&1 | tail -1)
+                fi
+
+                if [ ! -z "$CARGO_HASH" ]; then
+                  echo "New cargo hash: $CARGO_HASH"
+                  sed -i "s|cargoHash = \"[^\"]*\"|cargoHash = \"$CARGO_HASH\"|" pkgs/claurst/default.nix
+                fi
+
+                rm -f pkgs/claurst/default.nix.bak
+                echo "version=$NEW_VERSION" >> $GITHUB_OUTPUT
+            - name: Validate nix flake
+              if: steps.check_update.outputs.update_needed == 'true'
+              run: |
+                echo "Running nix flake check..."
+                nix flake check --show-trace || true
+            - name: Build claurst to verify changes
+              if: steps.check_update.outputs.update_needed == 'true'
+              run: |
+                echo "Building updated claurst package..."
+                nix build ".#artemision.config.environment.systemPackages" --no-eval-cache 2>&1 | tail -20 || true
+            - name: Generate PR body
+              if: steps.check_update.outputs.update_needed == 'true'
+              id: pr_body
+              run: |
+                cat > pr_body.md << 'EOF'
+                # Claurst Update
+
+                Automated claurst package update.
+
+                **Changes:**
+                - Version: `${{ steps.current.outputs.version }}` → `${{ steps.update.outputs.version }}`
+                - Source hash updated
+                - Cargo hash updated
+
+                Auto-generated by [update-claurst.yml][1].
+
+                [1]: https://nayeonie.com/ahuston-0/nix-dotfiles/src/branch/main/.github/workflows/update-claurst.yml
+                EOF
+                cat pr_body.md
+            - name: Create Pull Request
+              if: steps.check_update.outputs.update_needed == 'true'
+              uses: https://nayeonie.com/ahuston-0/create-pull-request@main
+              with:
+                token: ${{ secrets.GH_TOKEN_FOR_UPDATES }}
+                add-paths: pkgs/claurst/default.nix
+                body-path: pr_body.md
+                author: '"github-actions[bot]" <github-actions[bot]@users.noreply.github.com>'
+                title: "automated: Update claurst to ${{ steps.update.outputs.version }}"
+                commit-message: |
+                    automated: Update claurst to ${{ steps.update.outputs.version }}
+
+                    - Bumped version from ${{ steps.current.outputs.version }} to ${{ steps.update.outputs.version }}
+                    - Updated src and cargo hashes
+
+                    Auto-generated by [update-claurst.yml][1].
+
+                    [1]: https://nayeonie.com/ahuston-0/nix-dotfiles/src/branch/main/.github/workflows/update-claurst.yml
+                branch: update-claurst
+                delete-branch: true
+                pr-labels: |
+                    dependencies
+                    automated
+            - name: Print PR result
+              if: steps.check_update.outputs.update_needed == 'true'
+              run: |
+                echo "Pull request created successfully"
+                echo "Version updated: ${{ steps.current.outputs.version }} → ${{ steps.update.outputs.version }}"
+permissions:
+    pull-requests: write
+    contents: write
--- a/.vscode/extensions.json
+++ b/.vscode/extensions.json
@@ -1,5 +1,5 @@
 {
-    "recommendations": [
-        "davidanson.vscode-markdownlint"
-    ]
-}
+  "recommendations": [
+    "davidanson.vscode-markdownlint"
+  ]
+}
--- a/.vscode/mcp.json
+++ b/.vscode/mcp.json
@@ -1 +1 @@
-{}
+{}
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -0,0 +1,105 @@
+> Note: This document was AI-generated and reviewed by a maintainer.
+
+# AGENTS Guide for nix-dotfiles
+
+This file is the quick-start map for coding agents working in this repository.
+Use this first, then follow the linked source files for full detail.
+
+## Purpose and Scope
+
+- Repository type: flake-based NixOS + Home Manager dotfiles/infrastructure.
+- Primary goals: safe system/user config edits, reproducible builds, and clean secrets handling.
+- Default assumption: preserve existing module patterns and avoid broad refactors unless requested.
+
+## Source of Truth
+
+Read these files before substantial changes:
+
+- `.github/copilot-instructions.md`: Full repository guide for structure, workflows, dynamic system generation, module patterns, and SOPS handling.
+- `.github/instructions/ai-doc-attribution.instructions.md`: Markdown rule for top-of-document attribution when docs are fully AI-generated.
+- `flake.nix`: Flake inputs/outputs entrypoint; system generation begins here.
+- `lib/systems.nix`: Core dynamic config assembly (`genSystems`, `constructSystem`, and wrapper generators).
+- `systems/<hostname>/default.nix`: Per-host parameters (users, home, sops, server role, extra modules).
+- `systems/<hostname>/configuration.nix`: Main host config.
+- `modules/*.nix`: Global modules automatically imported into all systems.
+- `users/<username>/home.nix` and `users/<username>/default.nix`: Home Manager and user account configuration.
+- `hydra/jobs.nix` and `hydra/jobsets.nix`: CI/build orchestration details.
+
+## Repo Mental Model
+
+- `systems/` contains host-specific configs.
+- `modules/` contains global modules applied across hosts.
+- `users/` contains user and home-manager configs.
+- `lib/systems.nix` auto-discovers hosts and composes final configs.
+- SOPS secrets are colocated with hosts/users via `secrets.yaml` files.
+
+## Dynamic Configuration Rules
+
+- Hosts are auto-discovered from subdirectories in `systems/`.
+- Each host's `default.nix` feeds `constructSystem` parameters.
+- Effective module merge order matters. High-level order is: 1) base external
+  modules, 2) host essentials (`hardware.nix`, `configuration.nix`), 3)
+  host-specific modules from `systems/<host>/default.nix`, 4) global
+  `modules/*.nix`, 5) optional SOPS and Home Manager/user layers.
+- Global modules load after host config, so explicit overrides may require `lib.mkForce` depending on target option.
+
+## Editing Conventions
+
+- Keep changes minimal and scoped to the requested behavior.
+- Preserve existing Nix style and option naming patterns.
+- Prefer module options + `lib.mkIf` toggles over hard-coded behavior.
+- Use `lib.mkDefault` for soft defaults and `lib.mkForce` only when necessary.
+- Do not commit plaintext secrets.
+- Update docs when behavior/workflow changes.
+
+## Validation and Workflow
+
+Typical local sequence:
+
+1. Make targeted edits.
+2. Evaluate and build with `nix flake check` and `nix build .#<hostname>`.
+3. Optionally deploy/apply with `nh os switch` or `nh home switch`.
+4. For secrets-related changes, edit with `sops .../secrets.yaml` and validate expected `config.sops.secrets` evaluation paths.
+
+## Secrets and Safety
+
+- Secrets live in `systems/<hostname>/secrets.yaml` and `users/<username>/secrets.yaml`.
+- Use SOPS for create/edit/rekey operations.
+- During merge conflicts in encrypted files, prefer repository SOPS merge tooling (`utils/sops-mergetool.sh`, `utils/sops-mergetool-new.sh`).
+
+## Agent and Tool Routing
+
+When a specialized agent is available, route work by intent:
+
+- `Explore`: Fast read-only repository exploration and Q&A.
+- `dependency-auditor`: Flake/module dependency security and CVE-oriented audits.
+- `security-researcher`: Read-only server security configuration audits.
+- `server-architect`: Server integration/review planning for `palatine-hill` style infra changes.
+
+Use Nix lookup tooling for package/options discovery; prefer `unstable` channel when channel selection is available.
+
+## Where To Look Next (By Task)
+
+- Add a new host: see `.github/copilot-instructions.md` sections on "Adding a New NixOS System", plus `systems/<new-host>/default.nix`, `hardware.nix`, and `configuration.nix`.
+- Add/modify a global capability: see `modules/*.nix` and the `.github/copilot-instructions.md` section "Adding a Global Module to modules/".
+- Change user/home-manager behavior: see `users/<username>/home.nix` and `users/<username>/default.nix`.
+- Modify build/release automation: see `hydra/jobs.nix` and `hydra/jobsets.nix`.
+- Work with secrets: see `.sops.yaml`, `systems/*/secrets.yaml`, `users/*/secrets.yaml`, and the `.github/copilot-instructions.md` section "Secrets Management".
+- Validate module composition/debug evaluation: see `lib/systems.nix` and `nix eval .#nixosConfigurations.<host>...`.
+
+## Documentation Attribution Rule
+
+For Markdown docs (`**/*.md`):
+
+- If a document is fully AI-generated, include explicit attribution near the top.
+- Accepted label includes "AI-generated documentation" wording.
+- Do not imply fully human authorship for fully AI-authored content.
+
+## Quick Command Reference
+
+- `nh os build`
+- `nh os switch`
+- `nh home switch`
+- `nix build .#<hostname>`
+- `nix flake check`
+- `nix eval .#nixosConfigurations.<hostname>.config.<path>`
--- a/flake.lock
+++ b/flake.lock
@@ -76,11 +76,11 @@
      },
      "locked": {
        "dir": "pkgs/firefox-addons",
-        "lastModified": 1776398575,
-        "narHash": "sha256-WArU6WOdWxzbzGqYk4w1Mucg+bw/SCl6MoSp+/cZMio=",
+        "lastModified": 1777348977,
+        "narHash": "sha256-9aKuCI5TKHKnP073B1VzBdLRLAQJE7R9rbJWaSFXr3M=",
        "owner": "rycee",
        "repo": "nur-expressions",
-        "rev": "05815686caf4e3678f5aeb5fd36e567886ab0d30",
+        "rev": "a314975f42bfa9665bf77d1586ee0e123790ed27",
        "type": "gitlab"
      },
      "original": {
@@ -240,11 +240,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1776454077,
-        "narHash": "sha256-7zSUFWsU0+jlD7WB3YAxQ84Z/iJurA5hKPm8EfEyGJk=",
+        "lastModified": 1777349711,
+        "narHash": "sha256-PGKgo2dO6fK603QGI+DWXdKmS09pbJjjTxwRHdhkGZA=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "565e5349208fe7d0831ef959103c9bafbeac0681",
+        "rev": "c1140540536d483e2730320100f6835d62c94fdf",
        "type": "github"
      },
      "original": {
@@ -335,11 +335,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1775970782,
-        "narHash": "sha256-7jt9Vpm48Yy5yAWigYpde+HxtYEpEuyzIQJF4VYehhk=",
+        "lastModified": 1777181277,
+        "narHash": "sha256-yVJbd07ortDRAttDFmDV5p220aOLTHgVAx//0nW/xW8=",
        "owner": "Mic92",
        "repo": "nix-index-database",
-        "rev": "bedba5989b04614fc598af9633033b95a937933f",
+        "rev": "b8eb7acee0f7604fe1bf6a5b3dcf5254369180fa",
        "type": "github"
      },
      "original": {
@@ -415,11 +415,11 @@
    },
    "nixos-hardware": {
      "locked": {
-        "lastModified": 1775490113,
-        "narHash": "sha256-2ZBhDNZZwYkRmefK5XLOusCJHnoeKkoN95hoSGgMxWM=",
+        "lastModified": 1776983936,
+        "narHash": "sha256-ZOQyNqSvJ8UdrrqU1p7vaFcdL53idK+LOM8oRWEWh6o=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "c775c2772ba56e906cbeb4e0b2db19079ef11ff7",
+        "rev": "2096f3f411ce46e88a79ae4eafcfc9df8ed41c61",
        "type": "github"
      },
      "original": {
@@ -500,11 +500,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1776169885,
-        "narHash": "sha256-l/iNYDZ4bGOAFQY2q8y5OAfBBtrDAaPuRQqWaFHVRXM=",
+        "lastModified": 1776877367,
+        "narHash": "sha256-EHq1/OX139R1RvBzOJ0aMRT3xnWyqtHBRUBuO1gFzjI=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "4bd9165a9165d7b5e33ae57f3eecbcb28fb231c9",
+        "rev": "0726a0ecb6d4e08f6adced58726b95db924cef57",
        "type": "github"
      },
      "original": {
@@ -550,11 +550,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1775585728,
-        "narHash": "sha256-8Psjt+TWvE4thRKktJsXfR6PA/fWWsZ04DVaY6PUhr4=",
+        "lastModified": 1776796298,
+        "narHash": "sha256-PcRvlWayisPSjd0UcRQbhG8Oqw78AcPE6x872cPRHN8=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "580633fa3fe5fc0379905986543fd7495481913d",
+        "rev": "3cfd774b0a530725a077e17354fbdb87ea1c4aad",
        "type": "github"
      },
      "original": {
@@ -594,11 +594,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1776395632,
-        "narHash": "sha256-Mi1uF5f2FsdBIvy+v7MtsqxD3Xjhd0ARJdwoqqqPtJo=",
+        "lastModified": 1777346187,
+        "narHash": "sha256-oVxyGjpiIsrXhWTJVUOs38fZQkLjd0nZGOY9K7Kfot8=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "8087ff1f47fff983a1fba70fa88b759f2fd8ae97",
+        "rev": "146e7bf7569b8288f24d41d806b9f584f7cfd5b5",
        "type": "github"
      },
      "original": {
@@ -614,11 +614,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1776119890,
-        "narHash": "sha256-Zm6bxLNnEOYuS/SzrAGsYuXSwk3cbkRQZY0fJnk8a5M=",
+        "lastModified": 1777338324,
+        "narHash": "sha256-bc+ZZCmOTNq86/svGnw0tVpH7vJaLYvGLLKFYP08Q8E=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "d4971dd58c6627bfee52a1ad4237637c0a2fb0cd",
+        "rev": "8eaee5c45428b28b8c47a83e4c09dccec5f279b5",
        "type": "github"
      },
      "original": {
@@ -647,11 +647,11 @@
        "tinted-zed": "tinted-zed"
      },
      "locked": {
-        "lastModified": 1776170745,
-        "narHash": "sha256-Tl1aZVP5EIlT+k0+iAKH018GLHJpLz3hhJ0LNQOWxCc=",
+        "lastModified": 1776893932,
+        "narHash": "sha256-AFD5cf9eNqXq1brHS63xeZy2xKZMgG9J86XJ9I2eLn8=",
        "owner": "danth",
        "repo": "stylix",
-        "rev": "e3861617645a43c9bbefde1aa6ac54dd0a44bfa9",
+        "rev": "84971726c7ef0bb3669a5443e151cc226e65c518",
        "type": "github"
      },
      "original": {
@@ -767,11 +767,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1775531246,
-        "narHash": "sha256-sbVYa4TS2Q1pkSjs8CvHsPGYFM5w4d9od4ltzIGV/bA=",
+        "lastModified": 1777064547,
+        "narHash": "sha256-hssXWvyy6bzaGi9FuZQPGxVBLzQKRPDht13O0Y+Qxmo=",
        "owner": "Toqozz",
        "repo": "wired-notify",
-        "rev": "4fd4283803f198302af1a6a75b2225568004b343",
+        "rev": "95edd8613b1636639857a3fba403155cef82eb5d",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -164,19 +164,23 @@
          lib = self;
        }
      );
+      packageSetup = import ./pkgs/default.nix { inherit nixpkgs; };
+      inherit (packageSetup) localPackagesOverlay;
      inherit (lib.adev.systems) genSystems getImages;
      inherit (self) outputs; # for hydra
    in
    rec {
      inherit lib; # for allowing use of custom functions in nix repl

+      overlays.default = localPackagesOverlay;
+
      hydraJobs = import ./hydra/jobs.nix { inherit inputs outputs systems; };
      formatter = forEachSystem (system: nixpkgs.legacyPackages.${system}.nixfmt);

      nixosConfigurations = genSystems inputs outputs src (src + "/systems");
      homeConfigurations = {
        "alice" = inputs.home-manager.lib.homeManagerConfiguration {
-          pkgs = import nixpkgs { system = "x86_64-linux"; };
+          pkgs = packageSetup.mkPkgs "x86_64-linux";
          modules = [
            inputs.stylix.homeModules.stylix
            inputs.sops-nix.homeManagerModules.sops
@@ -203,9 +207,7 @@
        qcow = getImages nixosConfigurations "qcow";
      };

-      packages.x86_64-linux.lego-latest =
-        nixpkgs.legacyPackages.x86_64-linux.callPackage ./pkgs/lego-latest/default.nix
-          { };
+      packages = forEachSystem packageSetup.mkPackages;

      checks = import ./checks.nix { inherit inputs forEachSystem formatter; };
      devShells = import ./shell.nix { inherit inputs forEachSystem checks; };
--- a/lib/systems.nix
+++ b/lib/systems.nix
@@ -172,6 +172,7 @@ rec {
      modules = [
        inputs.nixos-modules.nixosModule
        inputs.nix-index-database.nixosModules.nix-index
+        { nixpkgs.overlays = [ outputs.overlays.default ]; }
        (genHostName hostname)
        (configPath + "/hardware.nix")
        (configPath + "/configuration.nix")
--- a/pkgs/bitwarden-rofi/default.nix
+++ b/pkgs/bitwarden-rofi/default.nix
@@ -19,6 +19,7 @@
  libnotify,
 }:
 let
+  maintainers = import ../maintainers.nix;
  bins = [
    jq
    bitwarden-cli
@@ -64,6 +65,7 @@ stdenv.mkDerivation {
    description = "Wrapper for Bitwarden and Rofi";
    homepage = "https://github.com/mattydebie/bitwarden-rofi";
    license = licenses.gpl3;
+    maintainers = [ maintainers.alice ];
    platforms = platforms.linux;
  };

--- a/pkgs/claurst/default.nix
+++ b/pkgs/claurst/default.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  pkg-config,
+  openssl,
+  alsa-lib,
+  dbus,
+  libxkbcommon,
+  libxcb,
+}:
+
+let
+  maintainers = import ../maintainers.nix;
+in
+rustPlatform.buildRustPackage rec {
+  pname = "claurst";
+  version = "0.0.9";
+
+  src = fetchFromGitHub {
+    owner = "Kuberwastaken";
+    repo = "claurst";
+    rev = "v${version}";
+    hash = "sha256-bTQHtZGZxhEAki0JxSC8smAC3w+otm8ubHvZ9MvwDaE=";
+  };
+
+  cargoRoot = "src-rust";
+  cargoHash = "sha256-6+B43spqmUZ983YMl5UBH5647DcUOS2ngw5ChMIPFFo=";
+  buildAndTestSubdir = "src-rust";
+  doCheck = false;
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+    alsa-lib
+    dbus
+    libxkbcommon
+    libxcb
+  ];
+
+  meta = with lib; {
+    description = "Terminal coding agent written in Rust";
+    homepage = "https://github.com/Kuberwastaken/claurst";
+    license = licenses.gpl3Only;
+    mainProgram = "claurst";
+    maintainers = [ maintainers.alice ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -0,0 +1,33 @@
+{ nixpkgs }:
+let
+  localPackagesOverlay = final: _prev: {
+    lego-latest = final.callPackage ./lego-latest/default.nix { };
+    claurst = final.callPackage ./claurst/default.nix { };
+  };
+
+  mkPkgs =
+    system:
+    import nixpkgs {
+      inherit system;
+      overlays = [ localPackagesOverlay ];
+    };
+
+  mkPackages =
+    system:
+    let
+      pkgs = mkPkgs system;
+    in
+    {
+      inherit (pkgs)
+        lego-latest
+        claurst
+        ;
+    };
+in
+{
+  inherit
+    localPackagesOverlay
+    mkPkgs
+    mkPackages
+    ;
+}
--- a/pkgs/maintainers.nix
+++ b/pkgs/maintainers.nix
@@ -0,0 +1,8 @@
+{
+  alice = {
+    name = "Alice Huston";
+    email = "aliceghuston@gmail.com";
+    github = "ahuston-0";
+    githubId = 43225907;
+  };
+}
--- a/systems/palatine-hill/configuration.nix
+++ b/systems/palatine-hill/configuration.nix
@@ -9,6 +9,7 @@
    ./acme.nix
    ./attic
    ./docker
+    ./garage.nix
    ./gitea.nix
    ./firewall.nix
    ./haproxy
--- a/systems/palatine-hill/docker/haproxy.cfg
+++ b/systems/palatine-hill/docker/haproxy.cfg
@@ -50,6 +50,7 @@ frontend ContentSwitching
  acl host_minio hdr(host) -i minio.alicehuston.xyz
  acl host_minio_console hdr(host) -i minio-console.alicehuston.xyz
  acl host_attic hdr(host) -i attic.nayeonie.com
+  acl host_s3 hdr(host) -i s3.nayeonie.com
  acl host_minio hdr(host) -i minio.nayeonie.com
  acl host_minio_console hdr(host) -i minio-console.nayeonie.com
  #acl host_nextcloud_vol hdr(host) -i nextcloud-vol.alicehuston.xyz
@@ -67,6 +68,7 @@ frontend ContentSwitching
  use_backend nextcloud_nodes if host_nextcloud
  use_backend hydra_nodes if host_hydra
  use_backend attic_nodes if host_attic
+  use_backend garage_nodes if host_s3
  #use_backend nextcloud_vol_nodes if host_nextcloud_vol
 #  use_backend collabora_nodes if host_collabora
  use_backend prometheus_nodes if host_prometheus
@@ -142,6 +144,10 @@ backend minio_console_nodes
  mode http
  server server 192.168.76.2:8501

+backend garage_nodes
+  mode http
+  server server 192.168.76.2:8502
+
 # backend foundry_nodes
 #   timeout tunnel 50s
 #   mode http
--- a/systems/palatine-hill/garage.nix
+++ b/systems/palatine-hill/garage.nix
@@ -0,0 +1,48 @@
+{
+  config,
+  pkgs,
+  ...
+}:
+
+let
+  vars = import ./vars.nix;
+  basePath = "${vars.primary_minio}/garage";
+in
+{
+  services.garage = {
+    enable = true;
+    package = pkgs.garage;
+    logLevel = "info";
+    settings = {
+      metadata_dir = "${basePath}/meta";
+      data_dir = "${basePath}/data";
+      db_engine = "sqlite";
+      replication_factor = 1;
+
+      rpc_bind_addr = "127.0.0.1:8504";
+      rpc_public_addr = "127.0.0.1:8504";
+      rpc_secret_file = config.sops.secrets."garage/rpc-secret".path;
+
+      s3_api = {
+        api_bind_addr = "127.0.0.1:8502";
+        s3_region = "us-east-1";
+        root_domain = ".s3.nayeonie.com";
+      };
+
+      admin = {
+        api_bind_addr = "127.0.0.1:8503";
+        admin_token_file = config.sops.secrets."garage/admin-token".path;
+      };
+    };
+  };
+
+  systemd.tmpfiles.rules = [
+    "d ${basePath}/meta 0750 garage garage -"
+    "d ${basePath}/data 0750 garage garage -"
+  ];
+
+  sops.secrets = {
+    "garage/rpc-secret" = { };
+    "garage/admin-token" = { };
+  };
+}
--- a/systems/palatine-hill/secrets.yaml
+++ b/systems/palatine-hill/secrets.yaml
@@ -42,6 +42,9 @@ server-validation:
    webhook: ENC[AES256_GCM,data:Lwqy4UhyFutpXjai7EJPKp8MDlI+ayDna4T8jluvC6qkeJ7o1UaaDCOsgLy4Fw7LC77tXhJtkcmep9w37JaiHp2CoDOfy2iAaq8o9CCSi/a0zqMJx+HdZYZNemvmpc6E/be0K+JDrFZLbjr3unSpCidQ3whccC6XyY013R12swN3bFZIu1gtzXCgUZ4U,iv:pVbrRwH3ziu4+R5BfimPV7N71QmyerJEc9M5K4eofOc=,tag:zNrCXrIioQWPEPVz/wMDpQ==,type:str]
 typhon:
    hashedPassword: ENC[AES256_GCM,data:gMyY8gxUn3HzycQRu2cminqRFWghqWcjzZzTxAQZ5PJqn604iSwDiVdr7icHB7drJfCAfsE7L4oKRJgxaIAE32043oOkb2T7DDH8y2jxMzqmZCfbvrfMI4wdfRTHGqzxb6X/aZ5ai2rr1Q==,iv:4EsTo/lQld0o9iktDX9gobMlPUCitx1i9wn8EL16sIs=,tag:FgVDRHk2glDwpC/mprrPqQ==,type:str]
+garage:
+    rpc-secret: ENC[AES256_GCM,data:Q2ZaAXcntD3yK6DynEpxab2TITByMZ7ECVrq1pb0ZU7hXOZnhaBmjdty/Os6len8l+GBl6+WaC0An6cFkhQTlQ==,iv:E8C4bnxMLXK9fky+KC7q8sHpmrEU5un0TEAwxVUBiLk=,tag:PiSiU+9NpyilH2aMs2Qc/Q==,type:str]
+    admin-token: ENC[AES256_GCM,data:Xjm8Xq99aDseR0jN50Uj3gLpeDaq2IGXzJCS0o1H0RgKX9LGdP8w508nWWE=,iv:+L9T3TEUSbIz+jo08ykjGHVhuz5ecmzrlhzD2iv48HE=,tag:7P2rY4F8cWFdG4Lm9n/etQ==,type:str]
 sops:
    age:
        - recipient: age1qw5k8h72k3fjg5gmlxx8q8gwlc2k6n6u08d8hdzpm2pk9r0fnfxsmw33nh
@@ -53,8 +56,8 @@ sops:
            cXNZWmZqd0R0SmhINExscHBKWmxvblUKEFEQvt/zQFARba4S8vHz/1SoKdKg69At
            LZ58XQGOmlGbBhPr7EzYQ2XSY4flWbnnD174cmCR8DNFm15DsNA5fw==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-01-17T01:50:50Z"
-    mac: ENC[AES256_GCM,data:8TGSqwEcfmrW1PjuzTVNyDTNs6s3oWbT0tI+rg7u2w5Dcw1EEU+SjJ6VpNY06AZHTjSD6E0O7NzUxybtMpslHUGitOGWwQCk+sbqRJuUseFe7bWFboEVoJpEoYGN5pnn52opMT+NeHGkXumaxjhDjCxfwn1RBHR7TgD4ZHEH6pE=,iv:szBUnn3HL/osWhmTwYmHrUghobWdBR60Lc6uUD/eGMY=,tag:6vgdJeJjL4ZYKc8WjixClg==,type:str]
+    lastmodified: "2026-05-02T16:02:29Z"
+    mac: ENC[AES256_GCM,data:dDv33vEGVeEEeTSXZPcIG3BO0GjFOswBGUsOY+/6IJqAC8omHaSQ6hdcVaXKScC56kEn5w/494hfOOEEficJt1nGQBrnfE8u95tdBqcODtSmTWbonXgpfckX68jV7Y9iTSxisih6ciAwFToxovhiI36kLrWoeVlzs5DdfwJp1YU=,iv:jkThy/omE/9SyqfAr6ARrDYLGVhhACmSxm4EgM+Is1s=,tag:Key2xC4btvI8HqQglIcXkg==,type:str]
    pgp:
        - created_at: "2024-11-28T18:56:39Z"
          enc: |-
@@ -69,4 +72,4 @@ sops:
            -----END PGP MESSAGE-----
          fp: 5EFFB75F7C9B74EAA5C4637547940175096C1330
    unencrypted_suffix: _unencrypted
-    version: 3.11.0
+    version: 3.12.2
--- a/users/alice/home.nix
+++ b/users/alice/home.nix
@@ -90,6 +90,7 @@

      gocryptfs
      awscli2
+      claurst
    ];
  };
Author	SHA1	Message	Date
ahuston-0	f42d031f4f	Merge pull request 'add garage' (#223 ) from feature/garage into main Some checks failed Check flake.lock / Check health of `flake.lock` (push) Successful in 9s Details Check Nix flake / Perform Nix flake checks (push) Successful in 2m19s Details Update flakes / update_lockfile (push) Failing after 19m57s Details Reviewed-on: #223	2026-05-02 12:14:12 -04:00
ahuston-0	086ca6377f	add garage All checks were successful Check flake.lock / Check health of `flake.lock` (pull_request) Successful in 9s Details Check Nix flake / Perform Nix flake checks (pull_request) Successful in 2m17s Details	2026-05-02 12:11:02 -04:00
ahuston-0	8b1d0f6972	Merge pull request 'automated: Update `flake.lock`' (#210 ) from update-flake-lock into main All checks were successful Check flake.lock / Check health of `flake.lock` (push) Successful in 15s Details Check Nix flake / Perform Nix flake checks (push) Successful in 2m22s Details Reviewed-on: #210	2026-05-02 11:38:12 -04:00
github-actions[bot]	02a61ec4dd	automated: Update `flake.lock` Auto-generated by [update.yml][1] with the help of [create-pull-request][2]. [1]: https://nayeonie.com/ahuston-0/nix-dotfiles/src/branch/main/.github/workflows/flake-update.yml [2]: https://forgejo.stefka.eu/jiriks74/create-pull-request	2026-05-02 11:38:12 -04:00
ahuston-0	aac5738dda	Merge pull request 'claurst update script' (#222 ) from feature/claurst into main Some checks failed Check flake.lock / Check health of `flake.lock` (push) Successful in 12s Details Check Nix flake / Perform Nix flake checks (push) Successful in 3m5s Details Update flakes / update_lockfile (push) Failing after 23m28s Details Reviewed-on: #222	2026-05-01 10:57:38 -04:00
ahuston-0	1851df463c	claurst update script All checks were successful Check flake.lock / Check health of `flake.lock` (pull_request) Successful in 12s Details Check Nix flake / Perform Nix flake checks (pull_request) Successful in 3m15s Details	2026-05-01 10:54:03 -04:00
ahuston-0	976e1663aa	Merge pull request 'feature/claurst' (#221 ) from feature/claurst into main Some checks failed Check flake.lock / Check health of `flake.lock` (push) Successful in 8s Details Check Nix flake / Perform Nix flake checks (push) Successful in 9m42s Details Update flakes / update_lockfile (push) Failing after 24m48s Details Reviewed-on: #221	2026-05-01 01:51:30 -04:00
ahuston-0	eb4609613e	fix overlays All checks were successful Check flake.lock / Check health of `flake.lock` (pull_request) Successful in 9s Details Check Nix flake / Perform Nix flake checks (pull_request) Successful in 11m32s Details	2026-05-01 01:39:38 -04:00
ahuston-0	41e50f98b5	add maintainer info Some checks failed Check flake.lock / Check health of `flake.lock` (pull_request) Successful in 7s Details Check Nix flake / Perform Nix flake checks (pull_request) Failing after 2m48s Details	2026-05-01 01:31:44 -04:00
ahuston-0	6ef3f87d16	add agents.md Some checks failed Check flake.lock / Check health of `flake.lock` (pull_request) Successful in 1m4s Details Check Nix flake / Perform Nix flake checks (pull_request) Failing after 6m11s Details	2026-05-01 01:23:19 -04:00
ahuston-0	f878369896	add overlay	2026-05-01 01:17:39 -04:00
ahuston-0	179ced171d	add claurst	2026-05-01 01:07:56 -04:00