Merge pull request 'feature/mattermost' (#212) from feature/mattermost into main

Reviewed-on: #212

.continue/agents/ollama.yaml

@@ -0,0 +1,32 @@
+# This is an example configuration file
+# To learn more, see the full config.yaml reference: https://docs.continue.dev/reference
+name: ollama
+version: 1.0.0
+schema: v1
+# Define which models can be used
+# https://docs.continue.dev/customization/models
+models:
+    - name: StarCoder2 Local
+      provider: ollama
+      model: starcoder2:7b
+      modelTimeout: "5s"
+      roles:
+        - autocomplete
+      autocompleteOptions:
+        useCache: true
+        useImports: true
+        useRecentlyEdited: true
+    - name: Nomic Embed Local
+      provider: ollama
+      model: nomic-embed-text:latest
+      roles:
+        - embed
+    - name: Autodetect
+      provider: ollama
+      model: AUTODETECT
+      defaultCompletionOptions:
+        contextLength: 64000
+# MCP Servers that Continue can access
+# https://docs.continue.dev/customization/mcp-tools
+mcpServers:
+    - uses: anthropic/memory-mcp

.github/copilot-instructions.md

@@ -0,0 +1,698 @@
+# Nix Dotfiles Repository Guide
+
+This repository contains NixOS configurations for personal infrastructure. The setup is organized around a flake-based structure with per-system configurations and user-specific settings.
+
+## Project Structure
+
+- `flake.nix` - Main flake definition with inputs and outputs
+- `systems/` - Per-system configurations (e.g., `artemision`, `palatine-hill`)
+- `users/` - Per-user configurations using home-manager
+- `modules/` - Reusable Nix modules for common services
+- `lib/` - Custom Nix library functions
+- `hydra/` - Hydra CI/CD configuration
+- `secrets/` - SOPS encrypted secrets
+
+## Key Concepts
+
+### System Configuration
+
+Each system has its own directory under `systems/` containing:
+
+- `configuration.nix` - Main system configuration
+- Component modules (audio.nix, desktop.nix, etc.)
+- Hardware-specific configurations
+
+### User Configuration
+
+User configurations are in `users/<username>/`:
+
+- `home.nix` - Home-manager configuration using `home.packages` and imports
+- `secrets.yaml` - SOPS-encrypted secrets using age encryption
+- `non-server.nix` - Desktop-specific configurations
+
+### Nix Patterns
+
+1. **Module-based approach**: Uses Nix modules for organizing configuration
+1. **Home-manager integration**: User environment managed via home-manager
+1. **SOPS secrets**: Secrets managed with SOPS and age encryption
+1. **Flake-based**: Uses flakes for reproducible builds and development environments
+1. **Multi-system support**: Supports multiple machines with different configurations
+1. **Dynamic configuration generation**: Modules in the `modules/` directory are automatically imported into all systems (can be overridden per system). New systems are automatically discovered by `genSystems()`
+
+### Modern Nix Features
+
+This repository uses modern Nix features including:
+
+- **Flakes**: Enabled via `flake` experimental feature
+- **Nix Command**: Enabled via `nix-command` experimental feature
+- **Blake3 Hashes**: Enabled via `blake3-hashes` experimental feature
+- **Git Hashing**: Enabled via `git-hashing` experimental feature
+- **Verified Fetches**: Enabled via `verified-fetches` experimental feature
+
+### Key Commands
+
+- `nh os switch` - Apply system configuration (using nix-community/nh)
+- `nh home switch` - Apply user configuration (using nix-community/nh)
+- `nh os build` - Build a specific system (using nix-community/nh)
+- `nix build .#<system>` - Build a specific system
+- `nix run .#<system>` - Run a specific system
+- `nix flake update` - Update flake inputs
+
+### Development Workflow
+
+1. Make changes to system or user configuration
+1. Test with `nh os switch` or `nh home switch`
+1. For CI/CD, Hydra automatically builds and tests changes
+1. Secrets are managed with SOPS and age keys
+
+### Important Files
+
+- `flake.nix` - Main entry point for the flake
+- `systems/artemision/configuration.nix` - Example system configuration
+- `users/alice/home.nix` - Example user configuration
+- `modules/base.nix` - Base module with common settings
+- `hydra/jobsets.nix` - Hydra CI configuration
+
+### External Dependencies
+
+- NixOS unstable channel
+- Nixpkgs unstable channel
+- SOPS for secrets management
+- age for encryption
+- home-manager for user environments
+- nh (nix-community/nh) for simplified Nix operations
+
+### Nix MCP Server
+
+- Use the nix MCP server for looking up package names and options
+- Specify `unstable` channel if the channel is specifiable (e.g., for `pkgs.<package-name>`)
+
+## Dynamic Configuration System (lib/systems.nix)
+
+This repository automatically generates NixOS system configurations based on the folder structure. Understanding how `constructSystem` and `genSystems` work is essential when adding new systems or global modules.
+
+### How Configuration Generation Works
+
+The process happens in three stages:
+
+**Stage 1: Discovery** (`flake.nix` → `genSystems`)
+
+- `flake.nix` calls `genSystems inputs outputs src (src + "/systems")`
+- `genSystems` scans the `systems/` directory and lists all subdirectories
+- Each subdirectory name becomes a system hostname (e.g., `artemision`, `palatine-hill`)
+
+**Stage 2: Parameter Loading** (`genSystems` reads `default.nix`)
+
+- For each discovered system, `genSystems` imports `systems/<hostname>/default.nix`
+- This file exports parameters for `constructSystem` like:
+- `users = [ "alice" ]` — which users to create
+- `home = true` — enable home-manager
+- `sops = true` — enable secret decryption
+- `server = true/false` — machine role
+- `modules = [ ... ]` — additional system-specific modules
+
+**Stage 3: Assembly** (`constructSystem` assembles the full config)
+
+- Loads essential system files: `hardware.nix`, `configuration.nix`
+- Auto-imports all `.nix` files from `modules/` directory via `lib.adev.fileList`
+- Conditionally loads home-manager, SOPS, and user configs based on parameters
+- Merges everything into a complete NixOS system configuration
+
+### Key Functions in lib/systems.nix
+
+| Function | Purpose | Called By |
+|----------|---------|-----------|
+| `genSystems` | Scans `systems/` directory and creates configs for each subdirectory | `flake.nix` |
+| `constructSystem` | Assembles a single NixOS system with all modules and configs | `genSystems` |
+| `genHome` | Imports home-manager configs for specified users | `constructSystem` |
+| `genSops` | Imports SOPS-encrypted secrets for users | `constructSystem` |
+| `genUsers` | Imports user account configs from `users/<username>/` | `constructSystem` |
+| `genHostName` | Creates hostname attribute set | `constructSystem` |
+| `genWrapper` | Conditionally applies generator functions | `constructSystem` |
+
+### Special Arguments Passed to All Configs
+
+These are available in `configuration.nix`, `hardware.nix`, and all modules:
+
+```nix
+{ config, pkgs, lib, inputs, outputs, server, system, ... }:
+```
+
+- `config` — NixOS configuration options
+- `pkgs` — Nix packages (nixpkgs)
+- `lib` — Nix library functions (extended with `lib.adev`)
+- `inputs` — Flake inputs (nixpkgs, home-manager, sops-nix, etc.)
+- `outputs` — Flake outputs (for Hydra and other tools)
+- `server` — Boolean: true for servers, false for desktops
+- `system` — System architecture string (e.g., `"x86_64-linux"`)
+
+## Adding a New NixOS System
+
+### Step 1: Create the Directory Structure
+
+```bash
+mkdir -p systems/<new-hostname>
+cd systems/<new-hostname>
+```
+
+### Step 2: Create `default.nix` (System Parameters)
+
+This file is automatically discovered and loaded by `genSystems`. It exports the parameters passed to `constructSystem`.
+
+**Minimal example:**
+
+```nix
+{ inputs }:
+{
+  # Required: List of users to create (must have entries in users/ directory)
+  users = [ "alice" ];
+
+  # Optional: Enable home-manager (default: true)
+  home = true;
+
+  # Optional: Enable SOPS secrets (default: true)
+  sops = true;
+
+  # Optional: Is this a server? Used to conditionally enable server features
+  server = false;
+
+  # Optional: System architecture (default: "x86_64-linux")
+  system = "x86_64-linux";
+
+  # Optional: System-specific modules (in addition to global modules/)
+  modules = [
+    # ./custom-service.nix
+  ];
+}
+```
+
+**See `systems/palatine-hill/default.nix` for a complex example with all options.**
+
+### Step 3: Create `hardware.nix` (Hardware Configuration)
+
+Generate this via:
+
+```bash
+sudo nixos-generate-config --show-hardware-config > systems/<new-hostname>/hardware.nix
+```
+
+This file typically includes:
+
+- Boot configuration and bootloader
+- Filesystem mounts and ZFS/LVM settings
+- Hardware support (CPU, GPU, network drivers)
+- Device-specific kernel modules
+
+### Step 4: Create `configuration.nix` (System Configuration)
+
+This is the main NixOS configuration file. Structure:
+
+```nix
+{ config, pkgs, lib, inputs, server, system, ... }:
+{
+  # System hostname (usually matches directory name)
+  networking.hostName = "new-hostname";
+
+  # Desktop/desktop specific config
+  services.xserver.enable = !server;
+
+  # System packages
+  environment.systemPackages = with pkgs; [
+    # ...
+  ];
+
+  # Services to enable
+  services.openssh.enable = server;
+
+  # System-specific settings override global defaults
+  boot.kernelParams = [ "nomodeset" ];
+}
+```
+
+### Step 5: Add Optional Secrets
+
+If the system has sensitive data:
+
+```bash
+# Create and encrypt secrets file
+sops systems/<new-hostname>/secrets.yaml
+
+# This will be automatically loaded by genSops if sops = true
+```
+
+### Step 6: Add Optional System-Specific Modules
+
+For system-specific functionality that shouldn't be global, create separate `.nix` files in the system directory:
+
+```text
+systems/<new-hostname>/
+├── configuration.nix       # Main config
+├── default.nix
+├── hardware.nix
+├── secrets.yaml            # (optional)
+├── custom-service.nix      # (optional) System-specific modules
+├── networking.nix          # (optional)
+└── graphics.nix            # (optional)
+```
+
+Reference these in `default.nix`:
+
+```nix
+{ inputs }:
+{
+  users = [ "alice" ];
+  modules = [
+    ./custom-service.nix
+    ./networking.nix
+    ./graphics.nix
+  ];
+}
+```
+
+### Step 7: Deploy the New System
+
+The system is now automatically registered! Deploy with:
+
+```bash
+# Build the new system
+nix build .#<new-hostname>
+
+# Or if you want to switch immediately
+nh os switch
+```
+
+## Adding a Global Module to modules/
+
+Global modules are automatically imported into all systems. No registration needed.
+
+### Create a Module File
+
+Add a new `.nix` file to the `modules/` directory. Example: `modules/my-service.nix`
+
+### Module Structure
+
+```nix
+{ config, pkgs, lib, inputs, server, ... }:
+{
+  # Define configuration options for this module
+  options.myService = {
+    enable = lib.mkEnableOption "my service";
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 3000;
+      description = "Port for the service";
+    };
+  };
+
+  # Actual configuration (conditional on enable option)
+  config = lib.mkIf config.myService.enable {
+    environment.systemPackages = [ pkgs.my-service ];
+
+    systemd.services.my-service = {
+      description = "My Service";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart = "${pkgs.my-service}/bin/my-service";
+        Restart = "always";
+      };
+    };
+  };
+}
+```
+
+### Using mkIf, mkDefault, and mkForce
+
+- **`mkIf`** — Conditionally apply config based on a boolean
+
+  ```nix
+  config = lib.mkIf config.myService.enable { ... };
+  ```
+
+- **`mkDefault`** — Provide a default value that can be overridden
+
+  ```nix
+  boot.kernelParams = lib.mkDefault [ "quiet" ];
+  ```
+
+- **`mkForce`** — Force a value, preventing other modules from overriding
+
+  ```nix
+  services.openssh.enable = lib.mkForce true;
+  ```
+
+- **`mkEnableOption`** — Define an `enable` option with standard description
+
+  ```nix
+  options.myService.enable = lib.mkEnableOption "my service";
+  ```
+
+### Disable a Global Module for a Specific System
+
+To disable a module for one system, override it in that system's `configuration.nix`:
+
+```nix
+{ config, lib, ... }:
+{
+  # Disable the module entirely
+  myService.enable = false;
+
+  # Or override specific options
+  services.openssh.port = 2222;
+}
+```
+
+### Module Loading Order in constructSystem
+
+Modules are applied in this order (later modules override earlier ones):
+
+1. `inputs.nixos-modules.nixosModule` (SuperSandro2000's convenience functions)
+1. `inputs.nix-index-database.nixosModules.nix-index`
+1. Hostname attribute from `genHostName`
+1. `hardware.nix` (hardware-specific config)
+1. `configuration.nix` (main system config)
+1. **System-specific modules** from `modules` parameter in `default.nix` (e.g., custom-service.nix)
+1. **All `.nix` files from global `modules/` directory** (features enabled across all systems)
+1. SOPS module (if `sops = true`)
+1. Home-manager module (if `home = true`)
+1. User configurations (if `users = [...]` and `home = true`)
+
+Important: Global modules (step 7) are applied after system-specific configs, so they can't override those values unless using `mkForce`. System-specific modules take precedence over global ones.
+
+## Common Tasks
+
+### Enable a Feature Across All Systems
+
+1. Create `modules/my-feature.nix` with `options.myFeature.enable`
+1. Set the feature enabled in `configuration.nix` of systems that need it:
+
+   ```nix
+   myFeature.enable = true;
+   ```
+
+1. Or enable globally and disable selectively:
+
+   ```nix
+   # In modules/my-feature.nix
+   config = lib.mkIf config.myFeature.enable {
+     # ...enabled by default
+   };
+
+   # In a system's configuration.nix
+   myFeature.enable = false;  # Disable just for this system
+   ```
+
+### Add a New User to the System
+
+1. Create user config: `users/<username>/default.nix` and `users/<username>/home.nix`
+1. Update system's `default.nix`:
+
+   ```nix
+   users = [ "alice" "newuser" ];
+   ```
+
+1. Create secrets: `sops users/<username>/secrets.yaml`
+1. Redeploy: `nh os switch`
+
+### Override a Module's Default Behavior
+
+In any system's `configuration.nix`:
+
+```nix
+{
+  # Disable a service that's enabled by default in a module
+  services.openssh.enable = false;
+
+  # Override module options
+  boot.kernelParams = [ "nomodeset" ];
+
+  # Add to existing lists
+  environment.systemPackages = [ pkgs.custom-tool ];
+}
+```
+
+### Check Which Modules Are Loaded
+
+```bash
+# List all module paths being loaded
+nix eval .#nixosConfigurations.<hostname>.options --json | jq keys | head -20
+
+# Evaluate a specific config value
+nix eval .#nixosConfigurations.<hostname>.config.services.openssh.enable
+```
+
+### Validate Configuration Before Deploying
+
+```bash
+# Check syntax and evaluate
+nix flake check
+
+# Build without switching
+nix build .#<hostname>
+
+# Preview what would change
+nix build .#<hostname> && nix-diff /run/current-system ./result
+```
+
+## Secrets Management
+
+SOPS (Secrets Operations) manages sensitive data like passwords and API keys. This repository uses age encryption with SOPS to encrypt secrets per system and per user.
+
+### Directory Structure
+
+Secrets are stored alongside their respective configs:
+
+```text
+systems/<hostname>/secrets.yaml         # System-wide secrets
+users/<username>/secrets.yaml           # User-specific secrets
+```
+
+### Creating and Editing Secrets
+
+**Create or edit a secrets file:**
+
+```bash
+# For a system
+sops systems/<hostname>/secrets.yaml
+
+# For a user
+sops users/<username>/secrets.yaml
+```
+
+SOPS will open your `$EDITOR` with decrypted content. When you save and exit, it automatically re-encrypts the file.
+
+**Example secrets structure for a system:**
+
+```yaml
+# systems/palatine-hill/secrets.yaml
+acme:
+  email: user@example.com
+  api_token: "secret-token-here"
+postgresql:
+  password: "db-password"
+```
+
+**Example secrets for a user:**
+
+```yaml
+# users/alice/secrets.yaml
+# The user password is required
+user-password: "hashed-password-here"
+```
+
+### Accessing Secrets in Configuration
+
+Secrets are made available via `config.sops.secrets` in modules and configurations:
+
+```nix
+# In a module or configuration.nix
+{ config, lib, ... }:
+{
+  # Reference a secret
+  services.postgresql.initialScript = ''
+    CREATE USER app WITH PASSWORD '${config.sops.secrets."postgresql/password".path}';
+  '';
+
+  # Or use the secret directly if it supports content
+  systemd.services.my-app.serviceConfig = {
+    EnvironmentFiles = [ config.sops.secrets."api-token".path ];
+  };
+}
+```
+
+### Merging Secrets Files
+
+When multiple systems or users modify secrets, use the sops-mergetool to resolve conflicts:
+
+```bash
+# Set up mergetool
+git config merge.sopsmergetool.command "sops-mergetool-wrapper $BASE $CURRENT $OTHER $MERGED"
+
+# Then during a merge conflict
+git merge branch-name
+
+# Git will use sops-mergetool to intelligently merge encrypted files
+```
+
+The repository includes helper scripts: `utils/sops-mergetool.sh` and `utils/sops-mergetool-new.sh`
+
+### Adding a New Machine's Age Key
+
+When adding a new system (`systems/<new-hostname>/`), you need to register its age encryption key:
+
+1. Generate the key on the target machine (if using existing deployment) or during initial setup
+1. Add the public key to `.sops.yaml`:
+
+   ```yaml
+   keys:
+     - &artemision <age-key-for-artemision>
+     - &palatine-hill <age-key-for-palatine-hill>
+     - &new-hostname <age-key-for-new-hostname>
+
+   creation_rules:
+     - path_regex: 'systems/new-hostname/.*'
+       key_groups:
+         - age: *new-hostname
+   ```
+
+1. Re-encrypt existing secrets with the new key:
+
+   ```bash
+   sops updatekeys systems/new-hostname/secrets.yaml
+   ```
+
+## Real-World Examples
+
+### Example 1: Adding a Feature to All Desktop Machines
+
+Using `artemision` (desktop) as an example:
+
+**Create `modules/gpu-optimization.nix`:**
+
+```nix
+{ config, lib, server, ... }:
+{
+  options.gpu.enable = lib.mkEnableOption "GPU optimization";
+
+  config = lib.mkIf (config.gpu.enable && !server) {
+    # Desktop-only GPU settings
+    hardware.nvidia.open = true;
+    services.xserver.videoDrivers = [ "nvidia" ];
+  };
+}
+```
+
+**Enable in `systems/artemision/configuration.nix`:**
+
+```nix
+{
+  gpu.enable = true;
+}
+```
+
+**Deploy:**
+
+```bash
+nix build .#artemision
+nh os switch
+```
+
+### Example 2: Adding a Server Service to One System
+
+Using `palatine-hill` (server) as an example:
+
+**Create `systems/palatine-hill/postgresql-backup.nix`:**
+
+```nix
+{ config, pkgs, lib, ... }:
+{
+  systemd.timers.postgres-backup = {
+    description = "PostgreSQL daily backup";
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnCalendar = "03:00";
+      Persistent = true;
+    };
+  };
+
+  systemd.services.postgres-backup = {
+    description = "Backup PostgreSQL database";
+    script = ''
+      ${pkgs.postgresql}/bin/pg_dumpall | gzip > /backups/postgres-$(date +%Y%m%d).sql.gz
+    '';
+  };
+}
+```
+
+**Reference in `systems/palatine-hill/default.nix`:**
+
+```nix
+{ inputs }:
+{
+  users = [ "alice" ];
+  server = true;
+  modules = [
+    ./postgresql-backup.nix
+  ];
+}
+```
+
+**Deploy:**
+
+```bash
+nix build .#palatine-hill
+```
+
+### Example 3: Disabling a Global Module for a Specific System
+
+To disable `modules/steam.nix` on a server (`palatine-hill`) while it stays enabled on desktops:
+
+**In `systems/palatine-hill/configuration.nix`:**
+
+```nix
+{
+  steam.enable = false;  # Override the module option
+}
+```
+
+The module in `modules/steam.nix` should use:
+
+```nix
+config = lib.mkIf config.steam.enable {
+  # steam configuration only if enabled
+};
+```
+
+## Debugging & Validation
+
+### Check Module Evaluation
+
+```bash
+# See which modules are loaded for a system
+nix eval .#nixosConfigurations.artemision.config.environment.systemPackages --no-allocator
+
+# Validate module option exists
+nix eval .#nixosConfigurations.artemision.options.myService.enable
+```
+
+### Debug SOPS Secrets
+
+```bash
+# View encrypted secrets (you must have the age key)
+sops systems/palatine-hill/secrets.yaml
+
+# Check if SOPS integration is working
+nix eval .#nixosConfigurations.palatine-hill.config.sops.secrets --json
+```
+
+### Test Configuration Without Deploying
+
+```bash
+# Evaluate the entire configuration
+nix eval .#nixosConfigurations.artemision --no-allocator
+
+# Build (but don't activate)
+nix build .#artemision
+
+# Check for errors in the derivation
+nix path-info ./result
+```

.github/workflows/flake-health-checks.yml

@@ -13,15 +13,15 @@ jobs:
         name: "Perform Nix flake checks"
         runs-on: ubuntu-latest
         steps:
-            - name: Get Latest Determinate Nix Installer binary
-              id: latest-installer
-              uses: sigyl-actions/gitea-action-get-latest-release@main
-              with:
-                repository: ahuston-0/determinate-nix-mirror
+            #- name: Get Latest Determinate Nix Installer binary
+            #  id: latest-installer
+            #  uses: sigyl-actions/gitea-action-get-latest-release@main
+            #  with:
+            #    repository: ahuston-0/determinate-nix-mirror
             - name: Install nix
               uses: https://github.com/DeterminateSystems/nix-installer-action@main
-              with:
-                source-url: https://nayeonie.com/ahuston-0/determinate-nix-mirror/releases/download/${{ steps.latest-installer.outputs.release }}/nix-installer-x86_64-linux
+            #  with:
+            #    source-url: https://nayeonie.com/ahuston-0/determinate-nix-mirror/releases/download/${{ steps.latest-installer.outputs.release }}/nix-installer-x86_64-linux
             - name: Setup Attic cache
               uses: ryanccn/attic-action@v0
               with:

.github/workflows/flake-update.yml

@@ -14,15 +14,15 @@ jobs:
         steps:
             - name: Checkout repository
               uses: actions/checkout@v4
-            - name: Get Latest Determinate Nix Installer binary
-              id: latest-installer
-              uses: sigyl-actions/gitea-action-get-latest-release@main
-              with:
-                repository: ahuston-0/determinate-nix-mirror
+            #- name: Get Latest Determinate Nix Installer binary
+            #  id: latest-installer
+            #  uses: sigyl-actions/gitea-action-get-latest-release@main
+            #  with:
+            #    repository: ahuston-0/determinate-nix-mirror
             - name: Install nix
               uses: https://github.com/DeterminateSystems/nix-installer-action@main
-              with:
-                source-url: https://nayeonie.com/ahuston-0/determinate-nix-mirror/releases/download/${{ steps.latest-installer.outputs.release }}/nix-installer-x86_64-linux
+              #with:
+              #  source-url: https://nayeonie.com/ahuston-0/determinate-nix-mirror/releases/download/${{ steps.latest-installer.outputs.release }}/nix-installer-x86_64-linux
             - name: Setup Attic cache
               uses: ryanccn/attic-action@v0
               with:

.vscode/extensions.json

@@ -0,0 +1,5 @@
+{
+    "recommendations": [
+        "davidanson.vscode-markdownlint"
+    ]
+}

.vscode/mcp.json

@@ -0,0 +1,10 @@
+{
+    "servers": {
+        "nixos": {
+            "command": "uvx",
+            "args": [
+                "mcp-nixos"
+            ]
+        }
+    }
+}

checks.nix

@@ -56,7 +56,7 @@ forEachSystem (
               #!/usr/bin/env ruby
 
               all
-              rule 'MD013', :tables => false
+              rule 'MD013', :tables => false, :line_length => 220
             '').outPath;
         };
 

flake.lock

@@ -76,11 +76,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1770437015,
-        "narHash": "sha256-+FHN9EthS+kHxnMoSDZEiGLoxwiIuij6ltK3aTmlLMA=",
+        "lastModified": 1775534587,
+        "narHash": "sha256-OLAoGTTwPVTH13C1e2Vcdff4WigTsk6hO5Y3sEcwl/s=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "65d59f814068d04e532cad2773d281e4951acd95",
+        "rev": "9f1e4b7f5443c50cb4ccc2a376ba1058231e64b4",
         "type": "gitlab"
       },
       "original": {
@@ -93,11 +93,11 @@
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
-        "lastModified": 1764873433,
-        "narHash": "sha256-1XPewtGMi+9wN9Ispoluxunw/RwozuTRVuuQOmxzt+A=",
+        "lastModified": 1775176642,
+        "narHash": "sha256-2veEED0Fg7Fsh81tvVDNYR6SzjqQxa7hbi18Jv4LWpM=",
         "owner": "rafaelmardojai",
         "repo": "firefox-gnome-theme",
-        "rev": "f7ffd917ac0d253dbd6a3bf3da06888f57c69f92",
+        "rev": "179704030c5286c729b5b0522037d1d51341022c",
         "type": "github"
       },
       "original": {
@@ -125,11 +125,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1769996383,
-        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
+        "lastModified": 1775087534,
+        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
+        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
         "type": "github"
       },
       "original": {
@@ -146,11 +146,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1767609335,
-        "narHash": "sha256-feveD98mQpptwrAEggBQKJTYbvwwglSbOv53uCfH9PY=",
+        "lastModified": 1775087534,
+        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "250481aafeb741edfe23d29195671c19b36b6dca",
+        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
         "type": "github"
       },
       "original": {
@@ -219,20 +219,18 @@
     "gnome-shell": {
       "flake": false,
       "locked": {
-        "host": "gitlab.gnome.org",
         "lastModified": 1767737596,
         "narHash": "sha256-eFujfIUQDgWnSJBablOuG+32hCai192yRdrNHTv0a+s=",
         "owner": "GNOME",
         "repo": "gnome-shell",
         "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
-        "type": "gitlab"
+        "type": "github"
       },
       "original": {
-        "host": "gitlab.gnome.org",
         "owner": "GNOME",
-        "ref": "gnome-49",
         "repo": "gnome-shell",
-        "type": "gitlab"
+        "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
+        "type": "github"
       }
     },
     "home-manager": {
@@ -242,11 +240,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770491427,
-        "narHash": "sha256-8b+0vixdqGnIIcgsPhjdX7EGPdzcVQqYxF+ujjex654=",
+        "lastModified": 1775556024,
+        "narHash": "sha256-j1u/859OVS54rGlsvFqJdwKPEnFYCI+4pyfTiSfv1Xc=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "cbd8a72e5fe6af19d40e2741dc440d9227836860",
+        "rev": "4bdfeff1d9b7473e6e58f73f5809576e8a69e406",
         "type": "github"
       },
       "original": {
@@ -283,11 +281,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768426687,
-        "narHash": "sha256-CopNx3j//gZ2mE0ggEK9dZ474UcbDhpTw+KMor8mSxI=",
+        "lastModified": 1774778246,
+        "narHash": "sha256-OX9Oba3/cHq1jMS1/ItCdxNuRBH3291Lg727nHOzYnc=",
         "owner": "hyprwm",
         "repo": "contrib",
-        "rev": "541628cebe42792ddf5063c4abd6402c2f1bd68f",
+        "rev": "ca3c381df6018e6c400ceac994066427c98fe323",
         "type": "github"
       },
       "original": {
@@ -337,11 +335,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770315571,
-        "narHash": "sha256-hy0gcAgAcxrnSWKGuNO+Ob0x6jQ2xkR6hoaR0qJBHYs=",
+        "lastModified": 1775365369,
+        "narHash": "sha256-DgH5mveLoau20CuTnaU5RXZWgFQWn56onQ4Du2CqYoI=",
         "owner": "Mic92",
         "repo": "nix-index-database",
-        "rev": "2684bb8080a6f2ca5f9d494de5ef875bc1c4ecdb",
+        "rev": "cef5cf82671e749ac87d69aadecbb75967e6f6c3",
         "type": "github"
       },
       "original": {
@@ -417,11 +415,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1769302137,
-        "narHash": "sha256-QEDtctEkOsbx8nlFh4yqPEOtr4tif6KTqWwJ37IM2ds=",
+        "lastModified": 1775490113,
+        "narHash": "sha256-2ZBhDNZZwYkRmefK5XLOusCJHnoeKkoN95hoSGgMxWM=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "a351494b0e35fd7c0b7a1aae82f0afddf4907aa8",
+        "rev": "c775c2772ba56e906cbeb4e0b2db19079ef11ff7",
         "type": "github"
       },
       "original": {
@@ -440,11 +438,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769643685,
-        "narHash": "sha256-F0Ey/SpMah0BRsz9hWNb89NMS4kvF9Q1Ex2EciWJzzM=",
+        "lastModified": 1775331627,
+        "narHash": "sha256-przIxCbTrNgLzcBlNPGZRfZbiPLzUkLUtNS05Ekcogk=",
         "owner": "NuschtOS",
         "repo": "nixos-modules",
-        "rev": "4a2307f709f3abab9935dc8c455212fdcbe13795",
+        "rev": "b4cc33254b872b286b9fe481e60e3fc2abc78072",
         "type": "github"
       },
       "original": {
@@ -471,11 +469,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1769909678,
-        "narHash": "sha256-cBEymOf4/o3FD5AZnzC3J9hLbiZ+QDT/KDuyHXVJOpM=",
+        "lastModified": 1774748309,
+        "narHash": "sha256-+U7gF3qxzwD5TZuANzZPeJTZRHS29OFQgkQ2kiTJBIQ=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "72716169fe93074c333e8d0173151350670b824c",
+        "rev": "333c4e0545a6da976206c74db8773a1645b5870a",
         "type": "github"
       },
       "original": {
@@ -502,11 +500,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1770197578,
-        "narHash": "sha256-AYqlWrX09+HvGs8zM6ebZ1pwUqjkfpnv8mewYwAo+iM=",
+        "lastModified": 1775423009,
+        "narHash": "sha256-vPKLpjhIVWdDrfiUM8atW6YkIggCEKdSAlJPzzhkQlw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "00c21e4c93d963c50d4c0c89bfa84ed6e0694df2",
+        "rev": "68d8aa3d661f0e6bd5862291b5bb263b2a6595c9",
         "type": "github"
       },
       "original": {
@@ -528,11 +526,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1767810917,
-        "narHash": "sha256-ZKqhk772+v/bujjhla9VABwcvz+hB2IaRyeLT6CFnT0=",
+        "lastModified": 1775228139,
+        "narHash": "sha256-ebbeHmg+V7w8050bwQOuhmQHoLOEOfqKzM1KgCTexK4=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "dead29c804adc928d3a69dfe7f9f12d0eec1f1a4",
+        "rev": "601971b9c89e0304561977f2c28fa25e73aa7132",
         "type": "github"
       },
       "original": {
@@ -552,11 +550,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769939035,
-        "narHash": "sha256-Fok2AmefgVA0+eprw2NDwqKkPGEI5wvR+twiZagBvrg=",
+        "lastModified": 1775036584,
+        "narHash": "sha256-zW0lyy7ZNNT/x8JhzFHBsP2IPx7ATZIPai4FJj12BgU=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "a8ca480175326551d6c4121498316261cbb5b260",
+        "rev": "4e0eb042b67d863b1b34b3f64d52ceb9cd926735",
         "type": "github"
       },
       "original": {
@@ -596,11 +594,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770520253,
-        "narHash": "sha256-6rWuHgSENXKnC6HGGAdRolQrnp/8IzscDn7FQEo1uEQ=",
+        "lastModified": 1775531562,
+        "narHash": "sha256-G83GDxQo6lqO5aeTSD5RFLhnh2g6DzJpSvSju2EjjrQ=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "ebb8a141f60bb0ec33836333e0ca7928a072217f",
+        "rev": "d8b1b209203665924c81eabf750492530754f27e",
         "type": "github"
       },
       "original": {
@@ -616,11 +614,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770526836,
-        "narHash": "sha256-xbvX5Ik+0inJcLJtJ/AajAt7xCk6FOCrm5ogpwwvVDg=",
+        "lastModified": 1775365543,
+        "narHash": "sha256-f50qrK0WwZ9z5EdaMGWOTtALgSF7yb7XwuE7LjCuDmw=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "d6e0e666048a5395d6ea4283143b7c9ac704720d",
+        "rev": "a4ee2de76efb759fe8d4868c33dec9937897916f",
         "type": "github"
       },
       "original": {
@@ -643,18 +641,17 @@
         ],
         "nur": "nur",
         "systems": "systems",
-        "tinted-foot": "tinted-foot",
         "tinted-kitty": "tinted-kitty",
         "tinted-schemes": "tinted-schemes",
         "tinted-tmux": "tinted-tmux",
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1770504996,
-        "narHash": "sha256-CjgGVXmYuEqx9rT4o1EKZVhacp6TuwZRicmaekkSvfE=",
+        "lastModified": 1775429060,
+        "narHash": "sha256-wbFF5cRxQOCzL/wHOKYm21t5AHPH2Lfp0mVPCOAvEoc=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "044ac0cc6d914f1dac22a728013bc3797f77cfab",
+        "rev": "d27951a6539951d87f75cf0a7cda8a3a24016019",
         "type": "github"
       },
       "original": {
@@ -693,23 +690,6 @@
         "type": "github"
       }
     },
-    "tinted-foot": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1726913040,
-        "narHash": "sha256-+eDZPkw7efMNUf3/Pv0EmsidqdwNJ1TaOum6k7lngDQ=",
-        "owner": "tinted-theming",
-        "repo": "tinted-foot",
-        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tinted-theming",
-        "repo": "tinted-foot",
-        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
-        "type": "github"
-      }
-    },
     "tinted-kitty": {
       "flake": false,
       "locked": {
@@ -729,11 +709,11 @@
     "tinted-schemes": {
       "flake": false,
       "locked": {
-        "lastModified": 1767710407,
-        "narHash": "sha256-+W1EB79Jl0/gm4JqmO0Nuc5C7hRdp4vfsV/VdzI+des=",
+        "lastModified": 1772661346,
+        "narHash": "sha256-4eu3LqB9tPqe0Vaqxd4wkZiBbthLbpb7llcoE/p5HT0=",
         "owner": "tinted-theming",
         "repo": "schemes",
-        "rev": "2800e2b8ac90f678d7e4acebe4fa253f602e05b2",
+        "rev": "13b5b0c299982bb361039601e2d72587d6846294",
         "type": "github"
       },
       "original": {
@@ -745,11 +725,11 @@
     "tinted-tmux": {
       "flake": false,
       "locked": {
-        "lastModified": 1767489635,
-        "narHash": "sha256-e6nnFnWXKBCJjCv4QG4bbcouJ6y3yeT70V9MofL32lU=",
+        "lastModified": 1772934010,
+        "narHash": "sha256-x+6+4UvaG+RBRQ6UaX+o6DjEg28u4eqhVRM9kpgJGjQ=",
         "owner": "tinted-theming",
         "repo": "tinted-tmux",
-        "rev": "3c32729ccae99be44fe8a125d20be06f8d7d8184",
+        "rev": "c3529673a5ab6e1b6830f618c45d9ce1bcdd829d",
         "type": "github"
       },
       "original": {
@@ -761,11 +741,11 @@
     "tinted-zed": {
       "flake": false,
       "locked": {
-        "lastModified": 1767488740,
-        "narHash": "sha256-wVOj0qyil8m+ouSsVZcNjl5ZR+1GdOOAooAatQXHbuU=",
+        "lastModified": 1772909925,
+        "narHash": "sha256-jx/5+pgYR0noHa3hk2esin18VMbnPSvWPL5bBjfTIAU=",
         "owner": "tinted-theming",
         "repo": "base16-zed",
-        "rev": "11abb0b282ad3786a2aae088d3a01c60916f2e40",
+        "rev": "b4d3a1b3bcbd090937ef609a0a3b37237af974df",
         "type": "github"
       },
       "original": {
@@ -787,11 +767,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765936672,
-        "narHash": "sha256-wxkeSF0/3FI0HSBKhZ2mlAAmFviNrZzdhjHqTfWP6h0=",
+        "lastModified": 1775531246,
+        "narHash": "sha256-sbVYa4TS2Q1pkSjs8CvHsPGYFM5w4d9od4ltzIGV/bA=",
         "owner": "Toqozz",
         "repo": "wired-notify",
-        "rev": "491197a6a5ef9c65a85c3eb1531786f32ffff5b3",
+        "rev": "4fd4283803f198302af1a6a75b2225568004b343",
         "type": "github"
       },
       "original": {

modules/fwupd.nix

@@ -0,0 +1,5 @@
+{ lib, ... }:
+
+{
+  services.fwupd.enable = lib.mkDefault true;
+}

modules/kubernetes.nix

@@ -0,0 +1,78 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+{
+  options = {
+    services.kubernetes = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to enable Kubernetes services";
+      };
+
+      version = lib.mkOption {
+        type = lib.types.str;
+        default = "1.28.0";
+        description = "Kubernetes version to use";
+      };
+
+      clusterName = lib.mkOption {
+        type = lib.types.str;
+        default = "palatine-hill-cluster";
+        description = "Name of the Kubernetes cluster";
+      };
+
+      controlPlaneEndpoint = lib.mkOption {
+        type = lib.types.str;
+        default = "localhost:6443";
+        description = "Control plane endpoint";
+      };
+
+      networking = lib.mkOption {
+        type = lib.types.attrs;
+        default = { };
+        description = "Kubernetes networking configuration";
+      };
+    };
+  };
+
+  config = lib.mkIf config.services.kubernetes.enable {
+    environment.systemPackages = with pkgs; [
+      kubectl
+      kubernetes
+    ];
+
+    ## Enable containerd for Kubernetes
+    #virtualisation.containerd.enable = true;
+
+    ## Enable kubelet
+    #services.kubelet = {
+    #  enable = true;
+    #  extraFlags = {
+    #    "pod-infra-container-image" = "registry.k8s.io/pause:3.9";
+    #  };
+    #};
+
+    ## Enable kubeadm for cluster initialization
+    #environment.etc."kubeadm.yaml".text = ''
+    #  apiVersion: kubeadm.k8s.io/v1beta3
+    #  kind: InitConfiguration
+    #  localAPIEndpoint:
+    #    advertiseAddress: 127.0.0.1
+    #    bindPort: 6443
+    #  ---
+    #  apiVersion: kubeadm.k8s.io/v1beta3
+    #  kind: ClusterConfiguration
+    #  clusterName: ${config.services.kubernetes.clusterName}
+    #  controlPlaneEndpoint: ${config.services.kubernetes.controlPlaneEndpoint}
+    #  networking:
+    #    serviceSubnet: 10.96.0.0/12
+    #    podSubnet: 10.244.0.0/16
+    #    dnsDomain: cluster.local
+    #'';
+  };
+}

modules/programs.nix

@@ -1,7 +0,0 @@
-{ pkgs, ... }:
-{
-  environment.systemPackages = with pkgs; [
-    git
-    python312
-  ];
-}

systems/artemision/configuration.nix

@@ -1,7 +1,7 @@
 {
-  config,
   lib,
   pkgs,
+  config,
   ...
 }:
 {
@@ -18,6 +18,7 @@
     ./stylix.nix
     ./wifi.nix
     ./zerotier.nix
+    ../palatine-hill/ollama.nix
   ];
 
   time.timeZone = "America/New_York";
@@ -40,6 +41,19 @@
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 
   services = {
+    ollama = {
+      package = lib.mkForce pkgs.ollama-rocm;
+      models = lib.mkForce "${config.services.ollama.home}/models";
+      loadModels = lib.mkForce [
+        "deepseek-r1:1.5b"
+        "lennyerik/zeta"
+        "nomic-embed-text:latest"
+        "glm-4.7-flash"
+        "magistral"
+        "devstral-small-2"
+        "starcoder2:7b"
+      ];
+    };
     flatpak.enable = true;
     calibre-web = {
       # temp disable this
@@ -78,7 +92,9 @@
     };
   };
 
-  users.users.alice.extraGroups = [ "calibre-web" ];
+  users.users = {
+    alice.extraGroups = [ "calibre-web" ];
+  };
 
   system.stateVersion = "24.05";
 
@@ -86,6 +102,10 @@
     "KWIN_DRM_NO_DIRECT_SCANOUT" = "1";
   };
 
+  #nixpkgs.config = {
+  #  rocmSupport = true;
+  #};
+
   sops = {
     defaultSopsFile = ./secrets.yaml;
     #secrets = {

systems/artemision/programs.nix

@@ -16,6 +16,7 @@
     candy-icons
     chromium
     chromedriver
+    #claude-code
     croc
     deadnix
     direnv
@@ -26,20 +27,16 @@
     fd
     file
     firefox
+
     # gestures replacement
     git
     glances
     gpu-viewer
     grim
-    helvum
     htop
     hwloc
-    ipmiview
     iperf3
     # ipscan
-    javaPackages.compiler.temurin-bin.jdk-25
-    javaPackages.compiler.temurin-bin.jdk-21
-    javaPackages.compiler.temurin-bin.jdk-17
     jp2a
     jq
     kdePackages.kdenlive
@@ -85,8 +82,6 @@
     # signal in tray?
     siji
     simple-mtpfs
-    skaffold
-    slack
     slurp
     smartmontools
     snyk

systems/palatine-hill/configuration.nix

@@ -14,6 +14,7 @@
     ./haproxy
     ./hardware-changes.nix
     ./hydra.nix
+    ./mattermost.nix
     ./minio.nix
     ./networking.nix
     ./nextcloud.nix

systems/palatine-hill/docker/default.nix

@@ -20,7 +20,7 @@
     ./nextcloud.nix
     # ./postgres.nix
     # ./restic.nix
-    ./torr.nix
+    #./torr.nix
     # ./unifi.nix
   ];
 

systems/palatine-hill/docker/minecraft.nix

@@ -12,6 +12,8 @@ let
     rlcraft = "rlcraft.alicehuston.xyz";
     arcanum-institute = "arcanum.alicehuston.xyz";
     meits = "meits.alicehuston.xyz";
+    cobblemon-overclocked = "mco.alicehuston.xyz";
+    cobblemon-plus = "mcp.alicehuston.xyz";
     # bcg-plus = "bcg.alicehuston.xyz";
     pii = "pii.alicehuston.xyz";
   };
@@ -79,69 +81,49 @@ in
     #  log-driver = "local";
     #  environmentFiles = [ config.sops.secrets."docker/minecraft".path ];
     #};
-    prominence-ii = {
-      image = "itzg/minecraft-server:java25-graalvm";
+    cobblemon-overclocked = {
+      image = "itzg/minecraft-server:java21";
       volumes = [
-        "${minecraft_path}/prominence-ii/modpacks:/modpacks:ro"
-        "${minecraft_path}/prominence-ii/data:/data"
+        "${minecraft_path}/cobblemon-overclocked/modpacks:/modpacks:ro"
+        "${minecraft_path}/cobblemon-overclocked/data:/data"
       ];
-      hostname = "pii";
+      hostname = "cobblemon-overclocked";
       environment = defaultEnv // {
-        VERSION = "1.20.1";
-        CF_SLUG = "prominence-2-hasturian-era";
-        CF_FILENAME_MATCHER = "3.9.14hf";
-        MEMORY = "8G";
+        VERSION = "1.21.1";
+        CF_SLUG = "modified-cobblemon-overclocked";
+        CF_FILENAME_MATCHER = "1.11.2";
         USE_AIKAR_FLAGS = "false";
         USE_MEOWICE_FLAGS = "true";
-        USE_MEOWICE_GRAALVM_FLAGS = "true";
-        DIFFICULTY = "hard";
+        DIFFICULTY = "normal";
         ENABLE_COMMAND_BLOCK = "true";
-        CF_FORCE_INCLUDE_FILES = ''
-          emi
-        '';
+        INIT_MEMORY = "4G";
+        MAX_MEMORY = "16G";
+        SEED = "-7146406535839057559";
       };
       extraOptions = defaultOptions;
       log-driver = "local";
       environmentFiles = [ config.sops.secrets."docker/minecraft".path ];
     };
-    stoneblock-4 = {
-      image = "itzg/minecraft-server:java25-graalvm";
+    cobblemon-plus = {
+      image = "itzg/minecraft-server:java21";
       volumes = [
-        "${minecraft_path}/stoneblock-4/modpacks:/modpacks:ro"
-        "${minecraft_path}/stoneblock-4/data:/data"
+        "${minecraft_path}/cobblemon-plus/modpacks:/modpacks:ro"
+        "${minecraft_path}/cobblemon-plus/data:/data"
       ];
-      hostname = "stoneblock-4";
+      hostname = "cobblemon-plus";
       environment = defaultEnv // {
         VERSION = "1.21.1";
-        CF_SLUG = "ftb-stoneblock-4";
-        CF_FILENAME_MATCHER = "1.6.0";
-        MEMORY = "8G";
+        CF_SLUG = "modified-cobblemon-plus";
+        CF_FILENAME_MATCHER = "1.11.2";
         USE_AIKAR_FLAGS = "false";
         USE_MEOWICE_FLAGS = "true";
-        USE_MEOWICE_GRAALVM_FLAGS = "true";
-        DIFFICULTY = "hard";
-        ENABLE_COMMAND_BLOCK = "true";
-      };
-      extraOptions = defaultOptions;
-      log-driver = "local";
-      environmentFiles = [ config.sops.secrets."docker/minecraft".path ];
-    };
-    submerged-2 = {
-      image = "itzg/minecraft-server:java25-graalvm";
-      volumes = [
-        "${minecraft_path}/submerged-2/modpacks:/modpacks:ro"
-        "${minecraft_path}/submerged-2/data:/data"
-      ];
-      hostname = "submerged-2";
-      environment = defaultEnv // {
-        VERSION = "1.21.1";
-        CF_SLUG = "submerged-2";
-        CF_FILENAME_MATCHER = "B6.1";
-        USE_AIKAR_FLAGS = "false";
-        USE_MEOWICE_FLAGS = "true";
-        USE_MEOWICE_GRAALVM_FLAGS = "true";
-        DIFFICULTY = "hard";
+        DIFFICULTY = "peaceful";
         ENABLE_COMMAND_BLOCK = "true";
+        INIT_MEMORY = "4G";
+        MAX_MEMORY = "16G";
+        # exclude clientside mods that cause crashes when run in a headless environment
+        CF_EXCLUDE_MODS = "world-host";
+        CF_OVERRIDES_EXCLUSIONS = "mods/iris*.jar,mods/sodium*.jar,mods/world-host-*.jar";
       };
       extraOptions = defaultOptions;
       log-driver = "local";

systems/palatine-hill/firewall.nix

@@ -48,6 +48,9 @@
 
       # torr
       29432
+
+      # mattermost
+      8065
     ];
 
     allowedUDPPorts = [

systems/palatine-hill/mattermost.nix

@@ -0,0 +1,19 @@
+{
+  config,
+  ...
+}:
+let
+  vars = import ./vars.nix;
+in
+{
+  services.mattermost = {
+    enable = true;
+    siteUrl = "https://mattermost.nayeonie.com"; # Set this to the URL you will be hosting the site on.
+    database = {
+      peerAuth = true; # This allows Mattermost to connect to the database without a password, which is more secure when both are on the same machine.
+      create = true;
+      driver = "postgres";
+    };
+    dataDir = "${vars.primary_mattermost}/mattermost";
+  };
+}

systems/palatine-hill/ollama.nix

@@ -0,0 +1,77 @@
+{
+  pkgs,
+  ...
+}:
+let
+  vars = import ./vars.nix;
+in
+{
+  services = {
+    ollama = {
+      enable = true;
+      package = pkgs.ollama;
+      syncModels = true;
+      loadModels = [
+        "deepseek-r1:1.5b"
+        "deepseek-r1:32b"
+        "deepseek-r1:70b"
+        #"qwen3"
+        #"qwen3.5:latest"
+        "qwen3-coder-next"
+        "lennyerik/zeta"
+        "nomic-embed-text:latest"
+        "lfm2:24b"
+        "glm-4.7-flash"
+        "nemotron-cascade-2:30b"
+        "magistral"
+        "devstral-small-2"
+        "starcoder2:15b"
+      ];
+      models = vars.primary_ollama;
+      environmentVariables = {
+        FLASH_ATTENTION = "1";
+        OLLAMA_KV_CACHE_TYPE = "q4_0";
+        # Ollama memory configuration
+        OLLAMA_MAX_LOADED_MODELS = "3";
+        OLLAMA_MAX_QUEUE = "512";
+        OLLAMA_NUM_PARALLEL = "1";
+
+        # ROCm memory optimization
+        #HIP_VISIBLE_DEVICES = "0";
+        #ROCR_VISIBLE_DEVICES = "0";
+
+        # context length for agents
+        OLLAMA_CONTEXT_LENGTH = "128000";
+      };
+      openFirewall = true;
+      host = "0.0.0.0"; # don't want to make this available via load-balancer yet, so making it available on the local network
+    };
+    open-webui = {
+      enable = true;
+      port = 21212;
+      openFirewall = true;
+      host = "0.0.0.0"; # don't want to make this available via load-balancer yet, so making it available on the local network
+    };
+  };
+  users.users.ollama = {
+    extraGroups = [
+      "render"
+      "video"
+    ];
+    group = "ollama";
+    isSystemUser = true;
+  };
+  users.groups.ollama = { };
+  systemd.services = {
+    ollama.serviceConfig = {
+      Nice = 19;
+      IOSchedulingPriority = 7;
+    };
+    ollama-model-loader.serviceConfig = {
+      Nice = 19;
+      CPUWeight = 50;
+      IOSchedulingClass = "idle";
+      IOSchedulingPriority = 7;
+    };
+  };
+}

systems/palatine-hill/postgresql.nix

@@ -40,6 +40,7 @@ in
       ensureDatabases = [
         "atticd"
         "alice"
+        "mattermost"
       ];
       ensureUsers = [
         {
@@ -171,6 +172,7 @@ in
           "hydra-server"
           "atticd"
           "gitea"
+          "mattermost"
         ];
       };
     };

systems/palatine-hill/vars.nix

@@ -19,4 +19,6 @@ rec {
   primary_torr = "${zfs_primary}/torr";
   primary_plex = "${zfs_primary}/plex";
   primary_plex_storage = "${zfs_primary}/plex_storage";
+  primary_ollama = "${zfs_primary}/ollama";
+  primary_mattermost = "${zfs_primary}/mattermost";
 }

systems/selinunte/programs.nix

@@ -29,10 +29,8 @@
     glances
     gpu-viewer
     grim
-    helvum
     htop
     hwloc
-    ipmiview
     iperf3
     # ipscan
     jp2a
@@ -80,8 +78,6 @@
     # signal in tray?
     siji
     simple-mtpfs
-    skaffold
-    slack
     slurp
     smartmontools
     snyk

users/alice/home.nix

@@ -66,7 +66,6 @@
       cargo-update
       diesel-cli
       tealdeer
-      helix
       ripunzip
 
       # nix specific packages
@@ -86,7 +85,7 @@
 
       # dependencies for nix-dotfiles/hydra-check-action
       nodejs_20
-      nodePackages.prettier
+      prettier
       treefmt
 
       gocryptfs
@@ -164,8 +163,9 @@
     userDirs = {
       enable = true;
       createDirectories = true;
+      setSessionVariables = true;
       extraConfig = {
-        XDG_SCREENSHOTS_DIR = "${config.xdg.userDirs.pictures}/Screenshots";
+        SCREENSHOTS = "${config.xdg.userDirs.pictures}/Screenshots";
       };
     };
   };

users/alice/home/git.nix

@@ -6,6 +6,7 @@
     lfs.enable = true;
     signing = {
       key = "5EFFB75F7C9B74EAA5C4637547940175096C1330";
+      format = "openpgp";
       signByDefault = true;
     };
     settings = {
@@ -14,6 +15,7 @@
       color.ui = true;
       init.defaultBranch = "main";
       format.signoff = true;
+      format.commitMessage = "signed-off-by";
       pack.windowMemory = "2g";
       pack.packSizeLimit = "1g";
       user.email = "aliceghuston@gmail.com";

users/alice/non-server.nix

@@ -1,51 +1,214 @@
-{ pkgs, outputs, ... }:
-
-{
-  programs.emacs = {
-    enable = true;
-    package = pkgs.emacs30-pgtk;
+{ pkgs, ... }:
+let
+  tex = pkgs.texlive.combine {
+    inherit (pkgs.texlive)
+      scheme-medium
+      preprint
+      titlesec
+      enumitem
+      sourcesanspro
+      xifthen
+      ifmtarg
+      framed
+      paralist
+      fontawesome7
+      ;
   };
-  programs.vesktop = {
-    enable = true;
-    settings = {
-      appBadge = false;
-      arRPC = true;
-      checkUpdates = false;
-      customTitleBar = false;
-      hardwareAcceleration = true;
+in
+{
+  programs = {
+    emacs = {
+      enable = true;
+      package = pkgs.emacs30-pgtk;
     };
-    vencord.useSystem = true;
-    vencord.settings = {
-      autoUpdate = false;
-      autoUpdateNotification = false;
-      notifyAboutUpdates = false;
-      plugins = {
-        AnonymiseFileNames.enabled = true;
-        BetterFolders.enabled = true;
-        BetterGifAltText.enabled = true;
-        CallTimer.enabled = true;
-        ClearURLs.enabled = true;
-        CopyFileContents.enabled = true;
-        CtrlEnterSend.enabled = true;
-        CustomIdle = {
-          enabled = true;
-          remainInIdle = false;
+    vesktop = {
+      enable = true;
+      settings = {
+        appBadge = false;
+        arRPC = true;
+        checkUpdates = false;
+        customTitleBar = false;
+        hardwareAcceleration = true;
+      };
+      vencord.useSystem = true;
+      vencord.settings = {
+        autoUpdate = false;
+        autoUpdateNotification = false;
+        notifyAboutUpdates = false;
+        plugins = {
+          AnonymiseFileNames.enabled = true;
+          BetterFolders.enabled = false;
+          BetterGifAltText.enabled = true;
+          CallTimer.enabled = true;
+          ClearURLs.enabled = true;
+          CopyFileContents.enabled = true;
+          CtrlEnterSend.enabled = true;
+          CustomIdle = {
+            enabled = true;
+            remainInIdle = false;
+          };
+          FriendsSince.enabled = true;
+          GameActivityToggle.enabled = true;
+          ImplicitRelationships.enabled = true;
+          MutualGroupDMs.enabled = true;
+          QuickMention.enabled = true;
+          QuickReply.enabled = true;
+          ReplaceGoogleSearch = {
+            enabled = true;
+            customEngineName = "DuckDuckGo";
+          };
+          ReviewDB.enabled = true;
+          ShowConnections.enabled = true;
         };
-        FriendsSince.enabled = true;
-        GameActivityToggle.enabled = true;
-        ImplicitRelationships.enabled = true;
-        MutualGroupDMs.enabled = true;
-        QuickMention.enabled = true;
-        QuickReply.enabled = true;
-        ReplaceGoogleSearch = {
-          enabled = true;
-          customEngineName = "DuckDuckGo";
+      };
+    };
+    zed-editor = {
+      enable = true;
+      mutableUserSettings = false;
+      extensions = [
+        "nix"
+        "toml"
+        "rust"
+        "java"
+        "kotlin"
+        "git firefly"
+        "make"
+        "dockerfile"
+        "sql"
+        "latex"
+        "terraform"
+        "log"
+        "context7-mcp-server"
+        "github-mcp-server"
+      ];
+      userSettings = {
+        context_servers = {
+          nixos = {
+            command = "nix";
+            args = [
+              "run"
+              "github:utensils/mcp-nixos"
+              "--"
+            ];
+          };
+        };
+        language_models = {
+          ollama = {
+            api_url = "http://192.168.76.2:11434";
+            context_window = 128000;
+            # global keep alive doesnt work
+            #keep_alive = "15m";
+            available_models = [
+              {
+                name = "deepseek-r1:1.5b";
+                max_tokens = 128000;
+                keep_alive = "15m";
+              }
+              {
+                name = "deepseek-r1:32b";
+                max_tokens = 128000;
+                keep_alive = "15m";
+              }
+              {
+                name = "deepseek-r1:70b";
+                max_tokens = 128000;
+                keep_alive = "15m";
+              }
+              {
+                name = "qwen3-coder-next";
+                max_tokens = 128000;
+                keep_alive = "15m";
+              }
+              {
+                name = "lennyerik/zeta";
+                max_tokens = 128000;
+                keep_alive = "15m";
+              }
+              {
+                name = "nomic-embed-text:latest";
+                max_tokens = 128000;
+                keep_alive = "15m";
+              }
+              {
+                name = "lfm2:24b";
+                max_tokens = 128000;
+                keep_alive = "15m";
+              }
+              {
+                name = "glm-4.7-flash";
+                max_tokens = 128000;
+                keep_alive = "15m";
+              }
+              {
+                name = "nemotron-cascade-2:30b";
+                max_tokens = 128000;
+                keep_alive = "15m";
+              }
+              {
+                name = "magistral";
+                max_tokens = 128000;
+                keep_alive = "15m";
+              }
+
+            ];
+          };
+        };
+        colorize_brackets = true;
+        hard_tabs = false;
+        vim_mode = true;
+        minimap = {
+          show = "auto";
+        };
+        buffer_line_height = "comfortable";
+        auto_update = false;
+        autosave = "on_focus_change";
+        agent = {
+          default_model = {
+            provider = "ollama";
+            model = "glm-4.7-flash";
+          };
+          favorite_models = [ ];
+          model_parameters = [ ];
+        };
+        telemetry = {
+          diagnostics = false;
+          metrics = false;
+        };
+        journal = {
+          hour_format = "hour24";
+        };
+        edit_predictions = {
+          provider = "ollama";
+          ollama = {
+            #api_url = "http://192.168.76.2:11434/v1/completions";
+            api_url = "http://192.168.76.2:11434";
+            context_window = 128000;
+            model = "lennyerik/zeta";
+            prompt_format = "qwen";
+            max_requests = 64;
+            max_output_tokens = 256;
+          };
+        };
+        texlab = {
+          build = {
+            onSave = true;
+            forwardSearchAfter = true;
+          };
+          forwardSearch = {
+            executable = "zathura";
+            args = [
+              "--synctex-forward"
+              "%l:1:%f"
+              "-x"
+              "zed %%{input}:%%{line}"
+              "%p"
+            ];
+          };
         };
-        ReviewDB.enabled = true;
-        ShowConnections.enabled = true;
       };
     };
   };
+
   home.packages = with pkgs; [
     cmake
     shellcheck
@@ -70,12 +233,14 @@
     nix-init
 
     # markdown
-    nodePackages.markdownlint-cli
+    markdownlint-cli
+
+    # insert essential rust dependencies
 
     # doom emacs dependencies
     yaml-language-server
-    nodePackages.typescript-language-server
-    nodePackages.bash-language-server
+    typescript-language-server
+    bash-language-server
     pyright
     cmake-language-server
     multimarkdown
@@ -91,11 +256,12 @@
     languagetool
 
     # latex
-    texlive.combined.scheme-medium
+    tex
+    poppler-utils
 
     # dependencies for nix-dotfiles/hydra-check-action
     nodejs_20
-    nodePackages.prettier
+    prettier
     treefmt
 
     nextcloud-client
@@ -112,5 +278,9 @@
 
     # arch zed deps
     nixd
+    uv
+
+    pdf4qt
+    masterpdfeditor4
   ];
 }

users/default.nix

@@ -28,6 +28,8 @@
     "plugdev"
     "uaccess"
     "ydotool"
+    "video"
+    "render"
   ]
   ++ groups;
 }