upgrade artemision

2025-12-19 03:20:47 -05:00
22 changed files with 278 additions and 506 deletions
--- a/flake.lock
+++ b/flake.lock
@@ -21,17 +21,17 @@
    "base16-fish": {
      "flake": false,
      "locked": {
-        "lastModified": 1765809053,
-        "narHash": "sha256-XCUQLoLfBJ8saWms2HCIj4NEN+xNsWBlU1NrEPcQG4s=",
+        "lastModified": 1754405784,
+        "narHash": "sha256-l9xHIy+85FN+bEo6yquq2IjD1rSg9fjfjpyGP1W8YXo=",
        "owner": "tomyun",
        "repo": "base16-fish",
-        "rev": "86cbea4dca62e08fb7fd83a70e96472f92574782",
+        "rev": "23ae20a0093dca0d7b39d76ba2401af0ccf9c561",
        "type": "github"
      },
      "original": {
        "owner": "tomyun",
        "repo": "base16-fish",
-        "rev": "86cbea4dca62e08fb7fd83a70e96472f92574782",
+        "rev": "23ae20a0093dca0d7b39d76ba2401af0ccf9c561",
        "type": "github"
      }
    },
@@ -76,11 +76,11 @@
      },
      "locked": {
        "dir": "pkgs/firefox-addons",
-        "lastModified": 1768622624,
-        "narHash": "sha256-Em6PP667PeXbEjidbV2LnNwmUYohbrSFvVPLYLUDHms=",
+        "lastModified": 1765080359,
+        "narHash": "sha256-BvAgmqgswcokD2eWoyO3uB1k1VTdpxDHGSx0RYRFjDg=",
        "owner": "rycee",
        "repo": "nur-expressions",
-        "rev": "8061c6d9199dc6cc0727d4241959eea28f2fa0a6",
+        "rev": "35f8ab2ecd954b3a348aa0e253878211c48a0aa7",
        "type": "gitlab"
      },
      "original": {
@@ -93,11 +93,11 @@
    "firefox-gnome-theme": {
      "flake": false,
      "locked": {
-        "lastModified": 1764873433,
-        "narHash": "sha256-1XPewtGMi+9wN9Ispoluxunw/RwozuTRVuuQOmxzt+A=",
+        "lastModified": 1764724327,
+        "narHash": "sha256-OkFLrD3pFR952TrjQi1+Vdj604KLcMnkpa7lkW7XskI=",
        "owner": "rafaelmardojai",
        "repo": "firefox-gnome-theme",
-        "rev": "f7ffd917ac0d253dbd6a3bf3da06888f57c69f92",
+        "rev": "66b7c635763d8e6eb86bd766de5a1e1fbfcc1047",
        "type": "github"
      },
      "original": {
@@ -125,11 +125,11 @@
        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1768135262,
-        "narHash": "sha256-PVvu7OqHBGWN16zSi6tEmPwwHQ4rLPU9Plvs8/1TUBY=",
+        "lastModified": 1763759067,
+        "narHash": "sha256-LlLt2Jo/gMNYAwOgdRQBrsRoOz7BPRkzvNaI/fzXi2Q=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "80daad04eddbbf5a4d883996a73f3f542fa437ac",
+        "rev": "2cccadc7357c0ba201788ae99c4dfa90728ef5e0",
        "type": "github"
      },
      "original": {
@@ -146,11 +146,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1767609335,
-        "narHash": "sha256-feveD98mQpptwrAEggBQKJTYbvwwglSbOv53uCfH9PY=",
+        "lastModified": 1763759067,
+        "narHash": "sha256-LlLt2Jo/gMNYAwOgdRQBrsRoOz7BPRkzvNaI/fzXi2Q=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "250481aafeb741edfe23d29195671c19b36b6dca",
+        "rev": "2cccadc7357c0ba201788ae99c4dfa90728ef5e0",
        "type": "github"
      },
      "original": {
@@ -220,11 +220,11 @@
      "flake": false,
      "locked": {
        "host": "gitlab.gnome.org",
-        "lastModified": 1767737596,
-        "narHash": "sha256-eFujfIUQDgWnSJBablOuG+32hCai192yRdrNHTv0a+s=",
+        "lastModified": 1764524476,
+        "narHash": "sha256-bTmNn3Q4tMQ0J/P0O5BfTQwqEnCiQIzOGef9/aqAZvk=",
        "owner": "GNOME",
        "repo": "gnome-shell",
-        "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
+        "rev": "c0e1ad9f0f703fd0519033b8f46c3267aab51a22",
        "type": "gitlab"
      },
      "original": {
@@ -242,11 +242,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1768598210,
-        "narHash": "sha256-kkgA32s/f4jaa4UG+2f8C225Qvclxnqs76mf8zvTVPg=",
+        "lastModified": 1764998300,
+        "narHash": "sha256-fZatn/KLfHLDXnF0wy7JxXqGaZmGDTVufT4o/AOlj44=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "c47b2cc64a629f8e075de52e4742de688f930dc6",
+        "rev": "27a6182347ccae90a88231ae0dc5dfa7d15815bb",
        "type": "github"
      },
      "original": {
@@ -283,11 +283,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1768426687,
-        "narHash": "sha256-CopNx3j//gZ2mE0ggEK9dZ474UcbDhpTw+KMor8mSxI=",
+        "lastModified": 1765113580,
+        "narHash": "sha256-b8YOwGDFprkQJjXsKGuSNS1pWe8w4cUW36YxlUelNpU=",
        "owner": "hyprwm",
        "repo": "contrib",
-        "rev": "541628cebe42792ddf5063c4abd6402c2f1bd68f",
+        "rev": "db18f83bebbc2cf43a21dbb26cd99aabe672d923",
        "type": "github"
      },
      "original": {
@@ -337,11 +337,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1765267181,
-        "narHash": "sha256-d3NBA9zEtBu2JFMnTBqWj7Tmi7R5OikoU2ycrdhQEws=",
+        "lastModified": 1765080594,
+        "narHash": "sha256-5t3d655GqLblE+p5xN5ntkeRfZBesN7vehOWcRcU88M=",
        "owner": "Mic92",
        "repo": "nix-index-database",
-        "rev": "82befcf7dc77c909b0f2a09f5da910ec95c5b78f",
+        "rev": "4194c582d0a3f440382ee00b729ea5cc5ef59754",
        "type": "github"
      },
      "original": {
@@ -417,11 +417,11 @@
    },
    "nixos-hardware": {
      "locked": {
-        "lastModified": 1768584846,
-        "narHash": "sha256-IRPmIOV2tPwxbhP/I9M5AmwhTC0lMPtoPStC+8T6xl0=",
+        "lastModified": 1764440730,
+        "narHash": "sha256-ZlJTNLUKQRANlLDomuRWLBCH5792x+6XUJ4YdFRjtO4=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "cce68f4a54fa4e3d633358364477f5cc1d782440",
+        "rev": "9154f4569b6cdfd3c595851a6ba51bfaa472d9f3",
        "type": "github"
      },
      "original": {
@@ -440,11 +440,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1768443651,
-        "narHash": "sha256-hmIo/e6mo40Y2v1DaH2yTtvB3lZ/zcf6gVNmgYhBgYc=",
+        "lastModified": 1764726320,
+        "narHash": "sha256-0AD/V/uCDG15xZSkQayaKjn/4Rlvoilwa+PsoSaubco=",
        "owner": "NuschtOS",
        "repo": "nixos-modules",
-        "rev": "31108e0d75bd47ddfc217b58df598e78fe3bcd42",
+        "rev": "1e03233c1b662f91c5ff8c7dba1a0a693a930e51",
        "type": "github"
      },
      "original": {
@@ -455,11 +455,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1764020296,
-        "narHash": "sha256-6zddwDs2n+n01l+1TG6PlyokDdXzu/oBmEejcH5L5+A=",
+        "lastModified": 1765053261,
+        "narHash": "sha256-CBVtkpfM7pMgXuXvByXn53p5lSm7fiDZK4EGOMnhaoo=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "a320ce8e6e2cc6b4397eef214d202a50a4583829",
+        "rev": "60a511057b110094129bdfb99f343548b59f0aba",
        "type": "github"
      },
      "original": {
@@ -471,11 +471,11 @@
    },
    "nixpkgs-lib": {
      "locked": {
-        "lastModified": 1765674936,
-        "narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=",
+        "lastModified": 1761765539,
+        "narHash": "sha256-b0yj6kfvO8ApcSE+QmA6mUfu8IYG6/uU28OFn4PaC8M=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "2075416fcb47225d9b68ac469a5c4801a9c4dd85",
+        "rev": "719359f4562934ae99f5443f20aa06c2ffff91fc",
        "type": "github"
      },
      "original": {
@@ -502,11 +502,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1768564909,
-        "narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=",
+        "lastModified": 1764950072,
+        "narHash": "sha256-BmPWzogsG2GsXZtlT+MTcAWeDK5hkbGRZTeZNW42fwA=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "e4bae1bd10c9c57b2cf517953ab70060a828ee6f",
+        "rev": "f61125a668a320878494449750330ca58b78c557",
        "type": "github"
      },
      "original": {
@@ -528,11 +528,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1767810917,
-        "narHash": "sha256-ZKqhk772+v/bujjhla9VABwcvz+hB2IaRyeLT6CFnT0=",
+        "lastModified": 1764773531,
+        "narHash": "sha256-mCBl7MD1WZ7yCG6bR9MmpPO2VydpNkWFgnslJRIT1YU=",
        "owner": "nix-community",
        "repo": "NUR",
-        "rev": "dead29c804adc928d3a69dfe7f9f12d0eec1f1a4",
+        "rev": "1d9616689e98beded059ad0384b9951e967a17fa",
        "type": "github"
      },
      "original": {
@@ -552,11 +552,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1767281941,
-        "narHash": "sha256-6MkqajPICgugsuZ92OMoQcgSHnD6sJHwk8AxvMcIgTE=",
+        "lastModified": 1765016596,
+        "narHash": "sha256-rhSqPNxDVow7OQKi4qS5H8Au0P4S3AYbawBSmJNUtBQ=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "f0927703b7b1c8d97511c4116eb9b4ec6645a0fa",
+        "rev": "548fc44fca28a5e81c5d6b846e555e6b9c2a5a3c",
        "type": "github"
      },
      "original": {
@@ -596,11 +596,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1768617670,
-        "narHash": "sha256-Z3+6dxoWZn+QFwjxAt5ZGXkiuCvCLgQP6pTS5eSWXqk=",
+        "lastModified": 1765075567,
+        "narHash": "sha256-KFDCdQcHJ0hE3Nt5Gm5enRIhmtEifAjpxgUQ3mzSJpA=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "56d0fbdd732f3686e8414b857cf885038fc17d57",
+        "rev": "769156779b41e8787a46ca3d7d76443aaf68be6f",
        "type": "github"
      },
      "original": {
@@ -616,11 +616,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1768481291,
-        "narHash": "sha256-NjKtkJraCZEnLHAJxLTI+BfdU//9coAz9p5TqveZwPU=",
+        "lastModified": 1765079830,
+        "narHash": "sha256-i9GMbBLkeZ7MVvy7+aAuErXkBkdRylHofrAjtpUPKt8=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "e085e303dfcce21adcb5fec535d65aacb066f101",
+        "rev": "aeb517262102f13683d7a191c7e496b34df8d24c",
        "type": "github"
      },
      "original": {
@@ -650,11 +650,11 @@
        "tinted-zed": "tinted-zed"
      },
      "locked": {
-        "lastModified": 1768603455,
-        "narHash": "sha256-ih6dYNhX1oSg0emfSAvf3iRcgsJtMmS6RUaoCX8kNoU=",
+        "lastModified": 1765047449,
+        "narHash": "sha256-VQcqjJ2g0kT9TW4ENwA2HBQJzfbCUd5s1Wm3K+R2QZY=",
        "owner": "danth",
        "repo": "stylix",
-        "rev": "590e5c68c4d5e8c766420473c0185d75113f653b",
+        "rev": "bd00e01aab676aee88e6cc5c9238b4a5a7d6639a",
        "type": "github"
      },
      "original": {
@@ -729,11 +729,11 @@
    "tinted-schemes": {
      "flake": false,
      "locked": {
-        "lastModified": 1767710407,
-        "narHash": "sha256-+W1EB79Jl0/gm4JqmO0Nuc5C7hRdp4vfsV/VdzI+des=",
+        "lastModified": 1763914658,
+        "narHash": "sha256-Hju0WtMf3iForxtOwXqGp3Ynipo0EYx1AqMKLPp9BJw=",
        "owner": "tinted-theming",
        "repo": "schemes",
-        "rev": "2800e2b8ac90f678d7e4acebe4fa253f602e05b2",
+        "rev": "0f6be815d258e435c9b137befe5ef4ff24bea32c",
        "type": "github"
      },
      "original": {
@@ -745,11 +745,11 @@
    "tinted-tmux": {
      "flake": false,
      "locked": {
-        "lastModified": 1767489635,
-        "narHash": "sha256-e6nnFnWXKBCJjCv4QG4bbcouJ6y3yeT70V9MofL32lU=",
+        "lastModified": 1764465359,
+        "narHash": "sha256-lbSVPqLEk2SqMrnpvWuKYGCaAlfWFMA6MVmcOFJjdjE=",
        "owner": "tinted-theming",
        "repo": "tinted-tmux",
-        "rev": "3c32729ccae99be44fe8a125d20be06f8d7d8184",
+        "rev": "edf89a780e239263cc691a987721f786ddc4f6aa",
        "type": "github"
      },
      "original": {
@@ -761,11 +761,11 @@
    "tinted-zed": {
      "flake": false,
      "locked": {
-        "lastModified": 1767488740,
-        "narHash": "sha256-wVOj0qyil8m+ouSsVZcNjl5ZR+1GdOOAooAatQXHbuU=",
+        "lastModified": 1764464512,
+        "narHash": "sha256-rCD/pAhkMdCx6blsFwxIyvBJbPZZ1oL2sVFrH07lmqg=",
        "owner": "tinted-theming",
        "repo": "base16-zed",
-        "rev": "11abb0b282ad3786a2aae088d3a01c60916f2e40",
+        "rev": "907dbba5fb8cf69ebfd90b00813418a412d0a29a",
        "type": "github"
      },
      "original": {
@@ -787,11 +787,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1765936672,
-        "narHash": "sha256-wxkeSF0/3FI0HSBKhZ2mlAAmFviNrZzdhjHqTfWP6h0=",
+        "lastModified": 1759739742,
+        "narHash": "sha256-nTNmgO71tD3jJGpr9yIS1atOBJp8K1pwZOxnEdS+aAk=",
        "owner": "Toqozz",
        "repo": "wired-notify",
-        "rev": "491197a6a5ef9c65a85c3eb1531786f32ffff5b3",
+        "rev": "6a96aa2066d8ad945f2323b63dc217081ef51168",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -171,7 +171,7 @@
      inherit lib; # for allowing use of custom functions in nix repl

      hydraJobs = import ./hydra/jobs.nix { inherit inputs outputs systems; };
-      formatter = forEachSystem (system: nixpkgs.legacyPackages.${system}.nixfmt);
+      formatter = forEachSystem (system: nixpkgs.legacyPackages.${system}.nixfmt-rfc-style);

      nixosConfigurations = genSystems inputs outputs src (src + "/systems");
      homeConfigurations = {
--- a/hydra/jobs.nix
+++ b/hydra/jobs.nix
@@ -8,7 +8,10 @@ let
  pkgs = inputs.nixpkgs.legacyPackages.x86_64-linux;

  getCfg = _: cfg: cfg.config.system.build.toplevel;
+  hostToAgg = _: cfg: cfg;
+
  getHome = _: cfg: cfg.config.home.activationPackage;
+  homeToAgg = _: cfg: cfg;

  # get per-system check derivation (with optional postfix)
  mapSystems =
@@ -24,6 +27,15 @@ rec {
  host = lib.mapAttrs getCfg outputs.nixosConfigurations;
  home = lib.mapAttrs getHome outputs.homeConfigurations; # homeConfigurations.alice.config.home.activationPackage

+  hosts = pkgs.releaseTools.aggregate {
+    name = "hosts";
+    constituents = lib.mapAttrsToList hostToAgg host;
+  };
+  homes = pkgs.releaseTools.aggregate {
+    name = "homes";
+    constituents = lib.mapAttrsToList homeToAgg home;
+  };
+
  devChecks = pkgs.releaseTools.aggregate {
    name = "devChecks";
    constituents = lib.flatten [
--- a/hydra/jobsets.nix
+++ b/hydra/jobsets.nix
@@ -18,7 +18,7 @@ let
    };

  prs = readJSONFile pulls;
-  #refs = readJSONFile branches;
+  refs = readJSONFile branches;

  # template for creating a job
  makeJob =
@@ -47,19 +47,19 @@ let
  giteaHost = "ssh://gitea@nayeonie.com:2222";
  repo = "ahuston-0/nix-dotfiles";
  # # Create a hydra job for a branch
-  #jobOfRef =
-  #  name:
-  #  { ref, ... }:
-  #  if ((builtins.match "^refs/heads/(.*)$" ref) == null) then
-  #    null
-  #  else
-  #    {
-  #      name = builtins.replaceStrings [ "/" ] [ "-" ] "branch-${name}";
-  #      value = makeJob {
-  #        description = "Branch ${name}";
-  #        flake = "git+${giteaHost}/${repo}?ref=${ref}";
-  #      };
-  #    };
+  jobOfRef =
+    name:
+    { ref, ... }:
+    if ((builtins.match "^refs/heads/(.*)$" ref) == null) then
+      null
+    else
+      {
+        name = builtins.replaceStrings [ "/" ] [ "-" ] "branch-${name}";
+        value = makeJob {
+          description = "Branch ${name}";
+          flake = "git+${giteaHost}/${repo}?ref=${ref}";
+        };
+      };

  # Create a hydra job for a PR
  jobOfPR = id: info: {
@@ -77,12 +77,12 @@ let
  # wrapper function for reading json from file
  readJSONFile = f: builtins.fromJSON (builtins.readFile f);
  # remove null values from a set, in-case of branches that don't exist
-  #mapFilter = f: l: builtins.filter (x: (x != null)) (map f l);
+  mapFilter = f: l: builtins.filter (x: (x != null)) (map f l);

  # Create job set from PRs and branches
  jobs = makeSpec (
    builtins.listToAttrs (map ({ name, value }: jobOfPR name value) (attrsToList prs))
-    #// builtins.listToAttrs (mapFilter ({ name, value }: jobOfRef name value) (attrsToList refs))
+    // builtins.listToAttrs (mapFilter ({ name, value }: jobOfRef name value) (attrsToList refs))
  );
 in
 {
--- a/shell.nix
+++ b/shell.nix
@@ -44,7 +44,7 @@ forEachSystem (
        pre-commit
        treefmt
        statix
-        nixfmt
+        nixfmt-rfc-style
        jsonfmt
        mdformat
        shfmt
--- a/systems/artemision/configuration.nix
+++ b/systems/artemision/configuration.nix
@@ -82,6 +82,8 @@

  system.stateVersion = "24.05";

+  programs.adb.enable = true;
+
  environment.variables = {
    "KWIN_DRM_NO_DIRECT_SCANOUT" = "1";
  };
--- a/systems/artemision/programs.nix
+++ b/systems/artemision/programs.nix
@@ -5,7 +5,6 @@
    alacritty
    attic-client
    amdgpu_top
-    android-tools
    bat
    bitwarden-cli
    bfg-repo-cleaner
@@ -37,9 +36,6 @@
    ipmiview
    iperf3
    # ipscan
-    javaPackages.compiler.temurin-bin.jdk-25
-    javaPackages.compiler.temurin-bin.jdk-21
-    javaPackages.compiler.temurin-bin.jdk-17
    jp2a
    jq
    kdePackages.kdenlive
--- a/systems/artemision/secrets.yaml
+++ b/systems/artemision/secrets.yaml
@@ -10,7 +10,7 @@ example_booleans:
    - ENC[AES256_GCM,data:6SJ0JKI=,iv:J0qSvWoOcDwSXCKyau+a0YcCGuH5WABHVh6Kdigac20=,tag:WQdNfjcubbzoHnQW4gua8g==,type:bool]
 apps:
    spotify: ENC[AES256_GCM,data:tIABPphA7Vr6VNvJpWTS9kDmidU=,iv:ciQzr8jyIcHYi797NKypPs7FhDgK5ToVZ0eZHHF8UtE=,tag:wUTL/x1p24cXyPUAL1dPfg==,type:str]
-wifi-env: ENC[AES256_GCM,data:mxPCyunx8yOahcuVhZCzuqAt/G89lMBnZme+qwcxO4LsCftx7h2FotA+wnlj1++vmPW5zL72q2kzxh0KcVlYqK9fpOrMY/FJeJXWYNMZIHesmWKlaaeA1wM/q1dSllwuVuULp9WQzipiQHwcCCLseo3bmCsYpbs8PUibrDgbDqXreTSjJBNTVzwOGpz1bZCSpEynS+dQQViRSNcVeYTOLxrOTxx5lyEOIhgIc3167ObhK+7bJVG2ZcP209Gllip4XkCj/FKnEwg2vVF5Dpofz7T2Op5ef/oNzahhKmCa+k7OPqITWwPYZg7pqAf6jdMy4eBP/A==,iv:Q6IMqePFwd1b1pSuh+TIwcag2bbJXyIYUmJWY6UaaqI=,tag:UZ5ak6nmHkNG0uBMTl1CwQ==,type:str]
+wifi-env: ENC[AES256_GCM,data:2BM4wQq+RfASkg9lcH+fW7eD0VaPJMXABp3z0sYXqZbVzv9R9eAxSokxzcifT/1JK8PBwvZkWtEFrKAT3phXIZzoEySnGKGYazz8fqWWWhMJotLNNo5VkX70hLppgE9vYxf9vQSq0PLWYCN0jUO0H9mHjOT6mDzKUHegcC53jzkNY3WTfLkyzDWJVMP9IbVQ22N5QlJbzZNqrNTaOtcRm06PBz7pNuEKOy4jj5ipZOh6ceR81Xy6BXM7MzFN27lYbzfVvcDmlwqPORAmr7/00QBy2cp38rTswJEzYf1x2Q==,iv:DSTVPw9qtmo02/usZZDpHsYlX3sSW+2XrnawtBkRNmQ=,tag:3p3eW+3BEQrOmHlBNUEOaA==,type:str]
 #ENC[AES256_GCM,data:G9ggYJ3YA+E=,iv:nZ5NgeyNKFXFIpquoY68Z2Jz9QROqvf5tv7/s1wSgKk=,tag:QAX555IsAMaWAlz9ywSzjQ==,type:comment]
 sops:
    age:
@@ -23,8 +23,8 @@ sops:
            d09aSXN0ZUh3VC9XeTZ4UWoxVDNVN0UKF1eU/IQJgJ8Fg+MrfqQuEZZ775hvtUJR
            D/ZS4vj+sDLWq6gy2lIBhRSIAHWrz5gHxvOOGmRnpvkqh9TS6XjLIA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-01-03T19:32:16Z"
-    mac: ENC[AES256_GCM,data:q5NppTtZZA9Oo15zI0pAZ/YN2qu0TneDPMJY9rXtWlYfG7Pq5taRyc9MpV7CyEt+qWMkN//O3/sA4jmQTtpT8JuYIEa+/x5cfSZ5w0ErjKdV4/IyDs1LPDKNLXIWlmPMo61VvsKW9DZRBRml9qtR1ypeHBuz0pjECBwAQPEcw9k=,iv:X7wUOxn4BsvqCPmNZvH75hyAzUeD7Qtp+4e4SLpPWlI=,tag:Dp6Bu3zEkRaRPdOwWil13g==,type:str]
+    lastmodified: "2025-05-15T15:37:51Z"
+    mac: ENC[AES256_GCM,data:qJ8NdnzVrgQb0rGwjZFHrS+eJrUjQEk4M4uo5bnk4eY7aKaHejARcYOIhp0H/DMdlix+Dm3DAAeeRWn8AKCatXaSzYD/VHHbjfp0lKBCsC8CZFeCELQ5GGEHnVot3WGb4J+QdfupwdduExSSMd6XeZGFVbSGhLzRbiiWA+i8I3o=,iv:oxWiDCH60apKT0/fJbWp1cIZ9cvd6mJKlP3xAjMBXIo=,tag:0We6eCJnsncujCt+CwK9UQ==,type:str]
    pgp:
        - created_at: "2024-11-28T18:57:09Z"
          enc: |-
@@ -39,4 +39,4 @@ sops:
            -----END PGP MESSAGE-----
          fp: 5EFFB75F7C9B74EAA5C4637547940175096C1330
    unencrypted_suffix: _unencrypted
-    version: 3.11.0
+    version: 3.10.2
--- a/systems/artemision/wifi.nix
+++ b/systems/artemision/wifi.nix
@@ -11,7 +11,7 @@ in
  networking.wireless = {
    enable = true;
    secretsFile = config.sops.secrets."wifi-env".path;
-    userControlled = true;
+    userControlled.enable = true;
    networks = {
      "taetaethegae-2.0" = {
        pskRaw = "ext:PASS_taetaethegae_20";
@@ -29,7 +29,6 @@ in
      "Verizon_ZLHQ3H".pskRaw = "ext:PASS_angie";
      "Fios-Qn3RB".pskRaw = "ext:PASS_parkridge";
      "Mojo Dojo Casa House".pskRaw = "ext:PASS_Carly";
-      "bwe_guest".pskRaw = "ext:PASS_BWE_NE";

      # Public wifi connections
      # set public_wifi on line 5 to true if connecting to one of these
@@ -46,7 +45,7 @@ in
    defaultSopsFile = ./secrets.yaml;
    secrets = {
      "wifi-env" = {
-        owner = "wpa_supplicant";
+        owner = "root";
        restartUnits = [ "wpa_supplicant.service" ];
      };
    };
--- a/systems/palatine-hill/docker/arr.nix
+++ b/systems/palatine-hill/docker/arr.nix
@@ -1,193 +1,96 @@
 {
  config,
  lib,
+  pkgs,
  ...
 }:
 let
  vars = import ../vars.nix;
-  arr_postgres_config =
-    container_type:
-    let
-      ctype = lib.strings.toUpper container_type;
-    in
-    {
-      "${ctype}__POSTGRES__HOST" = "/var/run/postgresql";
-      "${ctype}__POSTGRES__PORT" = toString config.services.postgresql.settings.port;
-    };
 in
 {
-  # Notes:
-  # Jellyplex-watched - sync watch status between plex and jellyfin as long as users and library is the same
-  # Tdarr - for distributed transcoding?
-  #
-  # list of containers supporting postgres:
-  #   bazarr:
-  #     POSTGRES_ENABED: true
-  #     POSTGRES_HOST:
-  #     POSTGRES_PORT:
-  #     POSTGRES_DATABASE: bazarr
-  #     POSTGRES_USERNAME: arr
-  #     POSTGRES_PASSWORD: sops
-  #   prowlarr:
-  #     see ctype
-  #   radarr:
-  #     see ctype
-  #   sonarr:
-  #     see ctype
-  #   lidarr:
-  #     see ctype
-  #   jellyseerr:
-  #     DB_TYPE: postgres
-  #     DB_HOST:
-  #     DB_PORT:
-  #     DB_USER: arr
-  #     DB_PASS: sops
-  #     DB_NAME: jellyseerr
-  #
  virtualisation.oci-containers.containers = {
    bazarr = {
      image = "ghcr.io/linuxserver/bazarr:latest";
-      pull = "always";
      ports = [ "6767:6767" ];
-      hostname = "bazarr";
      environment = {
        PUID = "600";
        PGID = "100";
        TZ = "America/New_York";
-        POSTGRES_HOST = "/var/run/postgresql";
-        POSTGRES_PORT = toString config.services.postgresql.settings.port;
      };
-      environmentFiles = [
-        config.sops.secrets."docker/bazarr".path
-      ];
      volumes = [
        "${vars.primary_docker}/bazarr:/config"
        "${vars.primary_plex_storage}/data:/data"
-        "/var/run/postgresql:/var/run/postgresql"
-      ];
-      extraOptions = [
-        "--network=arrnet"
      ];
      autoStart = true;
    };
    prowlarr = {
      image = "ghcr.io/linuxserver/prowlarr:latest";
-      pull = "always";
      ports = [ "9696:9696" ];
-      hostname = "prowlarr";
      environment = {
        PUID = "600";
        PGID = "100";
        TZ = "America/New_York";
-      }
-      // arr_postgres_config "prowlarr";
-      environmentFiles = [
-        config.sops.secrets."docker/prowlarr".path
-      ];
-      extraOptions = [
-        "--network=arrnet"
-      ];
-      volumes = [
-        "${vars.primary_docker}/prowlarr:/config"
-
-        "/var/run/postgresql:/var/run/postgresql"
-      ];
+      };
+      volumes = [ "${vars.primary_docker}/prowlarr:/config" ];
      autoStart = true;
    };
    radarr = {
      image = "ghcr.io/linuxserver/radarr:latest";
-      pull = "always";
      ports = [ "7878:7878" ];
-      hostname = "radarr";
      environment = {
        PUID = "600";
        PGID = "100";
        TZ = "America/New_York";
-      }
-      // arr_postgres_config "radarr";
-      environmentFiles = [
-        config.sops.secrets."docker/radarr".path
-      ];
+      };
      volumes = [
        "${vars.primary_docker}/radarr:/config"
        "${vars.primary_plex_storage}/data:/data"
-        "/var/run/postgresql:/var/run/postgresql"
-      ];
-      extraOptions = [
-        "--network=arrnet"
      ];
      autoStart = true;
    };
    sonarr = {
      image = "ghcr.io/linuxserver/sonarr:latest";
-      pull = "always";
      ports = [ "8989:8989" ];
-      hostname = "sonarr";
      environment = {
        PUID = "600";
        PGID = "100";
        TZ = "America/New_York";
-      }
-      // arr_postgres_config "sonarr";
-      environmentFiles = [
-        config.sops.secrets."docker/sonarr".path
-      ];
+      };
      volumes = [
        "${vars.primary_docker}/sonarr:/config"
        "${vars.primary_plex_storage}/data:/data"
-        "/var/run/postgresql:/var/run/postgresql"
-      ];
-      extraOptions = [
-        "--network=arrnet"
      ];
      autoStart = true;
    };
    lidarr = {
      image = "ghcr.io/linuxserver/lidarr:latest";
-      pull = "always";
      ports = [ "8686:8686" ];
-      hostname = "lidarr";
      environment = {
        PUID = "600";
        PGID = "100";
        TZ = "America/New_York";
-      }
-      // arr_postgres_config "lidarr";
-      environmentFiles = [
-        config.sops.secrets."docker/lidarr".path
-      ];
+      };
      volumes = [
        "${vars.primary_docker}/lidarr:/config"
        "${vars.primary_plex_storage}/data:/data"
-        "/var/run/postgresql:/var/run/postgresql"
-      ];
-      extraOptions = [
-        "--network=arrnet"
      ];
      autoStart = true;
    };
    unpackerr = {
      image = "golift/unpackerr:latest";
-      pull = "always";
      user = "600:100";
-      hostname = "unpackerr";
      environment = {
        TZ = "America/New_York";
      };
      volumes = [
        "${vars.primary_docker}/unpackerr:/config"
        "${vars.primary_plex_storage}:/data"
-        "/var/run/postgresql:/var/run/postgresql"
      ];
-      extraOptions = [ "--network=arrnet" ];
      autoStart = true;
    };
    notifiarr = {
      image = "golift/notifiarr:latest";
-      pull = "always";
-      ports = [ "5454:5454" ];
      user = "600:100";
-      hostname = "notifiarr";
      environment = {
        TZ = "America/New_York";
      };
@@ -195,79 +98,31 @@ in
      volumes = [
        "${vars.primary_docker}/notifiarr:/config"
        "${vars.primary_plex_storage}:/data"
-        "/var/run/postgresql:/var/run/postgresql"
      ];
-      extraOptions = [ "--network=arrnet" ];
      autoStart = true;
    };
-    jellyseerr = {
-      image = "fallenbagel/jellyseerr:latest";
-      pull = "always";
-      hostname = "jellyseerr";
+    overseerr = {
+      image = "fallenbagel/jellyseerr:preview-seerr";
      environment = {
        PUID = "600";
        PGID = "100";
        TZ = "America/New_York";
-        DB_TYPE = "postgres";
-        DB_HOST = "/var/run/postgresql";
-        DB_PORT = toString config.services.postgresql.settings.port;
      };
-      environmentFiles = [
-        config.sops.secrets."docker/jellyseerr".path
-      ];
-      volumes = [
-        "${vars.primary_docker}/overseerr:/config"
-        "/var/run/postgresql:/var/run/postgresql"
-      ];
+      volumes = [ "${vars.primary_docker}/overseerr:/config" ];
      # TODO: remove ports later since this is going through web
-      extraOptions = [
-        "--network=arrnet"
-        "--network=haproxy-net"
-        # "--health-cmd \"wget --no-verbose --tries 1 --spider http://localhost:5055/api/v1/status || exit 1\""
-        # "--health-start-period 20s"
-        # "--health-timeout 3s"
-        # "--health-interval 15s"
-        # "--health-retries 3"
-      ];
      ports = [ "5055:5055" ]; # Web UI port
      dependsOn = [
        "radarr"
        "sonarr"
      ];
+      extraOptions = [ "--network=haproxy-net" ];
      autoStart = true;
    };
  };

  sops = {
    secrets = {
-      "docker/notifiarr" = {
-        owner = "docker-service";
-        restartUnits = [ "docker-notifiarr.service" ];
-      };
-      "docker/bazarr" = {
-        owner = "docker-service";
-        restartUnits = [ "docker-bazarr.service" ];
-      };
-      "docker/prowlarr" = {
-        owner = "docker-service";
-        restartUnits = [ "docker-prowlarr.service" ];
-      };
-      "docker/radarr" = {
-        owner = "docker-service";
-        restartUnits = [ "docker-radarr.service" ];
-      };
-      "docker/sonarr" = {
-        owner = "docker-service";
-        restartUnits = [ "docker-sonarr.service" ];
-      };
-      "docker/lidarr" = {
-        owner = "docker-service";
-        restartUnits = [ "docker-lidarr.service" ];
-      };
-      "docker/jellyseerr" = {
-        owner = "docker-service";
-        restartUnits = [ "docker-jellyseerr.service" ];
-      };
+      "docker/notifiarr".owner = "docker-service";
    };
  };
 }
--- a/systems/palatine-hill/docker/minecraft.nix
+++ b/systems/palatine-hill/docker/minecraft.nix
@@ -11,38 +11,30 @@ let
    arcanum-institute = "arcanum.alicehuston.xyz";
    meits = "meits.alicehuston.xyz";
    # bcg-plus = "bcg.alicehuston.xyz";
-    pii = "pii.alicehuston.xyz";
  };

  defaultServer = "rlcraft";

-  defaultEnv = {
-    EULA = "true";
-    TYPE = "AUTO_CURSEFORGE";
-    STOP_SERVER_ANNOUNCE_DELAY = "120";
-    STOP_DURATION = "600";
-    SYNC_CHUNK_WRITES = "false";
-    USE_AIKAR_FLAGS = "true";
-    MEMORY = "12G";
-    ALLOW_FLIGHT = "true";
-    MAX_TICK_TIME = "-1";
-    ENABLE_RCON = "true";
-    TZ = "America/New_York";
-    REGION_FILE_COMPRESSION = "none";
-    OPS = ''
-      magpiecat
-      chesiregirl1105
-    '';
-  };
+  # defaultEnv = {
+  #   EULA = "true";
+  #   TYPE = "AUTO_CURSEFORGE";
+  #   STOP_SERVER_ANNOUNCE_DELAY = "120";
+  #   STOP_DURATION = "600";
+  #   SYNC_CHUNK_WRITES = "false";
+  #   USE_AIKAR_FLAGS = "true";
+  #   MEMORY = "8GB";
+  #   ALLOW_FLIGHT = "true";
+  #   MAX_TICK_TIME = "-1";
+  # };

-  defaultOptions = [
-    "--stop-signal=SIGTERM"
-    "--stop-timeout=1800"
-    "--network=minecraft-net"
-  ];
+  # defaultOptions = [
+  #   "--stop-signal=SIGTERM"
+  #   "--stop-timeout=1800"
+  #   "--network=minecraft-net"
+  # ];

-  vars = import ../vars.nix;
-  minecraft_path = "${vars.primary_games}/minecraft";
+  # vars = import ../vars.nix;
+  # minecraft_path = "${vars.primary_games}/minecraft";
 in
 {
  virtualisation.oci-containers.containers = {
@@ -60,49 +52,23 @@ in
        )
      ];
    };
-    #rlcraft = {
-    #  image = "itzg/minecraft-server:java8";
-    #  volumes = [
-    #    "${minecraft_path}/rlcraft/modpacks:/modpacks:ro"
-    #    "${minecraft_path}/rlcraft/data:/data"
-    #  ];
-    #  hostname = "rlcraft";
-    #  environment = defaultEnv // {
-    #    VERSION = "1.12.2";
-    #    CF_SLUG = "rlcraft";
-    #    DIFFICULTY = "hard";
-    #    ENABLE_COMMAND_BLOCK = "true";
-    #  };
-    #  extraOptions = defaultOptions;
-    #  log-driver = "local";
-    #  environmentFiles = [ config.sops.secrets."docker/minecraft".path ];
-    #};
-    prominence-ii = {
-      image = "itzg/minecraft-server:java25-graalvm";
-      volumes = [
-        "${minecraft_path}/prominence-ii/modpacks:/modpacks:ro"
-        "${minecraft_path}/prominence-ii/data:/data"
-      ];
-      hostname = "pii";
-      environment = defaultEnv // {
-        VERSION = "1.20.1";
-        CF_SLUG = "prominence-2-hasturian-era";
-        CF_FILENAME_MATCHER = "3.9.14hf";
-        USE_AIKAR_FLAGS = "false";
-        USE_MEOWICE_FLAGS = "true";
-        USE_MEOWICE_GRAALVM_FLAGS = "true";
-        DIFFICULTY = "hard";
-        ENABLE_COMMAND_BLOCK = "true";
-        CF_FORCE_INCLUDE_FILES = ''
-          emi
-        '';
-      };
-      extraOptions = defaultOptions;
-      log-driver = "local";
-      environmentFiles = [ config.sops.secrets."docker/minecraft".path ];
-    };
-    #stop_signal: SIGTERM
-    #stop_grace_period: 5m
+    # rlcraft = {
+    #   image = "itzg/minecraft-server:java8";
+    #   volumes = [
+    #     "${minecraft_path}/rlcraft/modpacks:/modpacks:ro"
+    #     "${minecraft_path}/rlcraft/data:/data"
+    #   ];
+    #   hostname = "rlcraft";
+    #   environment = defaultEnv // {
+    #     VERSION = "1.12.2";
+    #     CF_SLUG = "rlcraft";
+    #     DIFFICULTY = "hard";
+    #     ENABLE_COMMAND_BLOCK = "true";
+    #   };
+    #   extraOptions = defaultOptions;
+    #   log-driver = "local";
+    #   environmentFiles = [ config.sops.secrets."docker/minecraft".path ];
+    # };
    # bcg-plus = {
    #   image = "itzg/minecraft-server:java17";
    #   volumes = [
--- a/systems/palatine-hill/docker/nextcloud.nix
+++ b/systems/palatine-hill/docker/nextcloud.nix
@@ -8,13 +8,13 @@ let
  # nextcloud-image = import ./nextcloud-image { inherit pkgs; };
  nextcloud-base = {
    # image comes from running docker compose build in nextcloud-docker/.examples/full/apache
-    image = "docker.io/library/nextcloud-nextcloud";
+    image = "nextcloud-nextcloud";
    # pull = "always";
    # do NOT enable pull here, this image is generated based on a custom docker image
    hostname = "nextcloud";
    volumes = [
      "${nextcloud_path}/nc_data:/var/www/html:z"
-      #"${nextcloud_path}/nc_php:/usr/local/etc/php"
+      "${nextcloud_path}/nc_php:/usr/local/etc/php"
      "${nextcloud_path}/nc_prehooks:/docker-entrypoint-hooks.d/before-starting"
      #"${nextcloud_path}/remoteip.conf:/etc/apache2/conf-enabled/remoteip.conf:ro"
    ];
--- a/systems/palatine-hill/docker/torr.nix
+++ b/systems/palatine-hill/docker/torr.nix
@@ -1,143 +1,130 @@
 { config, pkgs, ... }:

 let
-  qbitBase = {
-    image = "ghcr.io/linuxserver/qbittorrent:latest";
+  delugeBase = {
    pull = "always";
    environment = {
      PUID = "600";
      PGID = "100";
      TZ = "America/New_York";
+      UMASK = "000";
+      DEBUG = "true";
+      DELUGE_DAEMON_LOG_LEVEL = "debug";
+      DELUGE_WEB_LOG_LEVEL = "debug";
    };
  };

  vars = import ../vars.nix;
  #docker_path = vars.primary_docker;
  torr_path = vars.primary_torr;
-  qbit_path = "${torr_path}/qbit";
-  qbitvpn_path = "${torr_path}/qbitvpn";
-  qbitperm_path = "${torr_path}/qbitperm";
+  deluge_path = "${torr_path}/deluge";
+  delugevpn_path = "${torr_path}/delugevpn";
+
+  #genSopsConfWg = file: {
+  #  "${file}" = {
+  #    format = "binary";
+  #    sopsFile = ./wg/${file};
+  #    path = "${delugevpn_path}/config/wireguard/configs/${file}";
+  #    owner = "docker-service";
+  #    group = "users";
+  #    restartUnits = [ "docker-delugeVPN.service" ];
+  #  };
+  #};
+
+  genSopsConfOvpn = file: {
+    "${file}" = {
+      format = "binary";
+      sopsFile = ./openvpn/${file};
+      path = "${delugevpn_path}/config/openvpn/configs/${file}";
+      owner = "docker-service";
+      group = "users";
+      restartUnits = [ "docker-delugeVPN.service" ];
+    };
+
+  };
 in
 {

  virtualisation.oci-containers.containers = {
-    qbit = qbitBase // {
-      # webui port is 8082, torr port is 29432
-      environment = qbitBase.environment // {
-        WEBUI_PORT = "8082";
-        TORRENTING_PORT = "29432";
-      };
+    deluge = delugeBase // {
+      image = "binhex/arch-deluge";
      volumes = [
-        "${qbit_path}/config:/config" # move from docker/qbit to qbit_path
-        "${torr_path}/data/:/data"
+        "${deluge_path}/config:/config"
+        "${deluge_path}/data/:/data"
        "/etc/localtime:/etc/localtime:ro"
      ];
-      networks = [ "host" ];
      ports = [
-        "8082:8082"
-        "29432:29432"
-        "29432:29432/udp"
-      ];
-      extraOptions = [
-        "--dns=9.9.9.9"
+        "8084:8112"
+        "29433:29433"
      ];
    };
-
-    # temp instance
-    qbitVPN = qbitBase // {
-      # webui port is 8081, torr port is 39274
-      networks = [
-        "container:gluetun-qbit"
-      ];
-      environment = qbitBase.environment // {
-        WEBUI_PORT = "8081";
-      };
-      dependsOn = [ "gluetun-qbit" ];
-      volumes = [
-        "${qbitvpn_path}/config:/config"
-        "${torr_path}/data:/data"
-        "/etc/localtime:/etc/localtime:ro"
-      ];
-    };
-    gluetun-qbit = {
-      image = "qmcgaw/gluetun:v3";
+    delugeVPN = delugeBase // {
+      image = "binhex/arch-delugevpn:latest";
      capabilities = {
        NET_ADMIN = true;
      };
-      devices = [
-        "/dev/net/tun:/dev/net/tun"
-      ];
-      ports = [
-        "8081:8081"
-        "8083:8083"
-      ];
-      environment = {
-        TZ = "America/New_York";
-        # SOPS prep
+      autoRemoveOnStop = false;
+      environment = delugeBase.environment // {
+        VPN_ENABLED = "yes";
+        VPN_CLIENT = "openvpn";
+        VPN_PROV = "protonvpn";
+        ENABLE_PRIVOXY = "yes";
+        LAN_NETWORK = "192.168.0.0/16";
+        ENABLE_STARTUP_SCRIPTS = "yes";
+        #NAME_SERVERS = "194.242.2.9";
+        #NAME_SERVERS = "9.9.9.9";
+        # note, delete /config/perms.txt to force a bulk permissions update
      };
-      environmentFiles = [
-        config.sops.secrets."docker/gluetun".path
-        config.sops.secrets."docker/gluetun-qbitvpn".path
-      ];
-    };
-
-    # permanent instance
-    qbitPerm = qbitBase // {
-      # webui port is 8083, torr port is 29434
-      networks = [
-        "container:gluetun-qbit"
-      ];
-      environment = qbitBase.environment // {
-        WEBUI_PORT = "8083";
-      };
-      dependsOn = [ "gluetun-qbit" ];
+      environmentFiles = [ config.sops.secrets."docker/delugevpn".path ];
      volumes = [
-        "${qbitperm_path}/config:/config"
-        "${torr_path}/data:/data"
+        "${delugevpn_path}/config:/config"
+        "${deluge_path}/data:/data" # use common torrent path yuck
        "/etc/localtime:/etc/localtime:ro"
      ];
-    };
-    gluetun-qbitperm = {
-      image = "qmcgaw/gluetun:v3";
-      capabilities = {
-        NET_ADMIN = true;
-      };
-      devices = [
-        "/dev/net/tun:/dev/net/tun"
-      ];
      ports = [
-        "8083:8083"
-      ];
-      environment = {
-        TZ = "America/New_York";
-        # SOPS prep
-      };
-      environmentFiles = [
-        config.sops.secrets."docker/gluetun".path
-        config.sops.secrets."docker/gluetun-qbitperm".path
+        "8085:8112"
+        "8119:8118"
+        "39275:39275"
+        "39275:39275/udp"
+        "48346:48346"
+        "48346:48346/udp"
+
      ];
    };
  };

-  sops.secrets = {
-    "docker/gluetun" = {
-      owner = "docker-service";
-      restartUnits = [
-        "docker-gluetun-qbit.service"
-        "docker-gluetun-qbitperm.service"
+  systemd.services.docker-delugeVPN = {
+    serviceConfig = {
+      ExecStartPre = [
+        (
+          "${pkgs.bash}/bin/bash -c \"${pkgs.findutils}/bin/find ${delugevpn_path}/config/openvpn/configs "
+          + "-type l -not -name network.ovpn "
+          + "| ${pkgs.coreutils}/bin/shuf -n 1 "
+          + "| ${pkgs.findutils}/bin/xargs -I {} cp -L {} ${delugevpn_path}/config/openvpn/network.ovpn &&"
+          + "${pkgs.coreutils}/bin/chown docker-service:users ${delugevpn_path}/config/openvpn/network.ovpn &&"
+          + "${pkgs.coreutils}/bin/chmod 440 ${delugevpn_path}/config/openvpn/network.ovpn\""
+        )
+        (
+          "${pkgs.bash}/bin/bash -c \"${pkgs.findutils}/bin/find ${delugevpn_path}/config/scripts/links "
+          + "-type l "
+          + "| ${pkgs.findutils}/bin/xargs -I {} cp -L {} ${delugevpn_path}/config/scripts/ \""
+        )
      ];
+      ExecStopPost = [ "${pkgs.coreutils}/bin/rm ${delugevpn_path}/config/scripts/*sh" ];
    };
-    "docker/gluetun-qbitvpn" = {
+  };
+
+  sops.secrets = (genSopsConfOvpn "se.protonvpn.udp.ovpn") // {
+    "docker/delugevpn" = {
      owner = "docker-service";
-      restartUnits = [
-        "docker-gluetun-qbit.service"
-      ];
+      group = "users";
+      restartUnits = [ "docker-delugeVPN.service" ];
    };
-    "docker/gluetun-qbitperm" = {
+    "docker/protonvpn-start-script" = {
+      path = "${delugevpn_path}/config/scripts/links/protonvpn-start-script.sh";
      owner = "docker-service";
-      restartUnits = [
-        "docker-gluetun-qbitperm.service"
-      ];
+      group = "users";
+      restartUnits = [ "docker-delugeVPN.service" ];
    };
  };
 }
--- a/systems/palatine-hill/firewall.nix
+++ b/systems/palatine-hill/firewall.nix
@@ -1,59 +1,38 @@
 { ... }:

 {
-  networking.firewall = {
+  networking.firewall.allowedTCPPorts = [
+    # qbit
+    8081
+    8082
+    8443

-    extraCommands = "
-      iptables -I nixos-fw 1 -i br+ -j ACCEPT
-    ";
+    # hydra
+    3000

-    extraStopCommands = "
-      iptables -D nixos-fw -i br+ -j ACCEPT
-    ";
+    # minio
+    8500
+    8501

-    trustedInterfaces = [ "br+" ];
+    # gitea
+    2222
+    2223
+    8088

-    allowedTCPPorts = [
-      # qbit
-      8081
-      8082
-      8443
+    # attic
+    8183

-      # hydra
-      3000
+    # collabora
+    9980

-      # minio
-      8500
-      8501
+    # arr
+    6767
+    9696
+    7878
+    8989
+    8686
+    8787
+    5055
+  ];

-      # gitea
-      2222
-      2223
-      8088
-
-      # attic
-      8183
-
-      # collabora
-      9980
-
-      # arr
-      6767
-      9696
-      7878
-      8989
-      8686
-      8787
-      5055
-
-      # torr
-      29432
-    ];
-
-    allowedUDPPorts = [
-      # torr
-      29432
-    ];
-
-  };
 }
--- a/systems/palatine-hill/postgresql.nix
+++ b/systems/palatine-hill/postgresql.nix
@@ -1,5 +1,6 @@
 {
  config,
+  lib,
  pkgs,
  ...
 }:
@@ -29,12 +30,6 @@ in
           # Let other names login as themselves
           superuser_map      /^(.*)$   \1
      '';
-      authentication = ''
-        local  bazarr  bazarr  scram-sha-256
-        local  /.*arr-main  /.*arr  scram-sha-256
-        local  /.*arr-log  /.*arr  scram-sha-256
-        local  jellyseerr  jellyseerr  scram-sha-256
-      '';

      # initialScript = config.sops.secrets."postgres/init".path;
      ensureDatabases = [
--- a/systems/palatine-hill/samba.nix
+++ b/systems/palatine-hill/samba.nix
@@ -12,7 +12,7 @@
        #"use sendfile" = "yes";
        #"max protocol" = "smb2";
        # note: localhost is the ipv6 localhost ::1
-        "hosts allow" = "192.168.76. 127.0.0.1 localhost 192.168.191.";
+        "hosts allow" = "192.168.76. 127.0.0.1 localhost";
        "hosts deny" = "0.0.0.0/0";
        "guest account" = "nobody";
        "map to guest" = "bad user";
--- a/systems/palatine-hill/secrets.yaml
+++ b/systems/palatine-hill/secrets.yaml
@@ -26,15 +26,6 @@ docker:
    delugevpn: ENC[AES256_GCM,data:YGkgaQUuA9oteKD77tnFzxZSHctyOQjMNlfvJr3mPWAl2P8wfcshiUoa6SNp69pagxbzRV6mfuzwzinbkQCoZN3lw7uF76y0,iv:Bro0H4tFR+3wi9DGGq9a6ge4o4uPlVXBUF7h17zyqg8=,tag:N1kVNFasqGMx8R9qTq2dJA==,type:str]
    protonvpn-start-script: ENC[AES256_GCM,data:ZnlDpCLdILHXSUCI6itWkqO4y75Lwjj7qT1DBkfueLneQOaQ0JhuE2FbOOajkmI046nP9fMrJbu3g4QZHsq1g8yqGU1wb0OOT+eS9+M92Md29B4NnUdwnVAO6/RzvRKXP2tsQ4iprx9An+BEFwZYD6WG6DQc6NjJVSgRcYvfH9rQey2VdwLysNsgFCs8eC6QgikqBpeg4eOIvDDNbdXPKkW+ZPph9xpzGkcFIMwlX5esg0n7qyUoMvWwBn4avC46U5erOw0fNajY60ri9sm5Afht6LZrFal71Hx/K9/5EXBp9dD4teLO2Ew0CQX0i94pKCuR207l9868s7Ao3udLp4wbiLnXoRKq+w==,iv:qR0kNYpb50NXEqSksvHBPAaRG51RKCsSwTq32nosxzo=,tag:+xRQyuWi4Ja/N9lcd11oJA==,type:str]
    notifiarr: ENC[AES256_GCM,data:XxVEhp4Rei6mRcdSSooRnofuVNZDalVhDYiVUmvQUr8QihrVRMKRE9Kpl5PGWUBw,iv:urMLaUf3XUjMks2vk0E7iRUU3mLHBiMAiwtQgmWQq20=,tag:dHdTOyC/ukd71UlYEI5fWw==,type:str]
-    bazarr: ENC[AES256_GCM,data:x+JdRCl3x3OM3lWmgcWikJSEnh5c5He5HmuLzCGAQ8zUXMi2Z3Kf6LzL+aoqtCBu3rabYZmQSLBoDm9CPkk=,iv:7e+3w46RUD2/OSlwrEe7BRxUqPPdt5+obIjQA8pr3xY=,tag:rHSijp/tcf/SGp5y4kJ0cw==,type:str]
-    prowlarr: ENC[AES256_GCM,data:hr3hYwRw0+/UD8anqZQjGy7rPkV2pad4Xi5FdXSf3Ftd1/jwlYfMqhqgEngFX30LLMWvJvjeu1TkTNzSEwI6ZCPdefNVYYwWavtm+XcBVxffGvFZ,iv:EXW48288IcCeGs/vP4tkAI4dxQAOh92Na43q/9cyuSc=,tag:pnYR26MDd82DjeUPdwCoUw==,type:str]
-    radarr: ENC[AES256_GCM,data:qCfoeEHb0ng5GhaY3QZiFvLVb25ZHNmgT0bRqEjBcelyP2819zCL7LxUPr08FxivEYZiAMFVleRozL8NMg6O5fh+2BatcYOfyh99zxIC,iv:HV3gTTnrjtab7x4Be+7hSe+nrD6BnPAmZBsHzi9Fujg=,tag:O6x0FDlasuJSRrGL/9SwpQ==,type:str]
-    sonarr: ENC[AES256_GCM,data:X/hM31ZyHybvy2eQzVnmq8CH1AqBgz1pxq7tKC4lZB3ryAbnEIJksffem8+35tWt/0r5cEH4aaIKD1kS7Q+Ma+8JrRLcWkt6CZq/wspz,iv:44FfdVpQCposXshzNe5DXAxExeQzjVKhkZaVbgKo8KU=,tag:WIWWUt1XBngUTwwqhCrcNw==,type:str]
-    lidarr: ENC[AES256_GCM,data:xERBECneutNUMZRrHukp8CaNrpI7SXUB16zUkauNP2+wto3eIc/K+2nMCkbwSC9AKlSjnUGSiORmAWn/jofTAuEzQljkCR1XCSkJRMmL,iv:iKf4fZtCfdjT/KuMFK5VFoLAV+Lll8uJowe9Q4cHyYw=,tag:xzmATTkrYRYm9Mw23zEO5g==,type:str]
-    jellyseerr: ENC[AES256_GCM,data:7dDfHFp8+WbJqrf7Ms/gmfroBePwegXh5CXn5FcOz8IEK7rTvr9KZfz9x/1BwdD8,iv:ZPi3OcMfH76A08piKY4P7hFbeMyouwBoeN5oL3ExzKU=,tag:oOZ37dy/y+DFqNRfAHexvQ==,type:str]
-    gluetun: ENC[AES256_GCM,data:ryhYVOYEZl5zDs+xMgbWI6q/Ei2AiNZJMxT/TcaHzTEocINgbczWk9GKeeZKno71vFXiF9/tPpYavLqvjWNL77doWDB+wiYrtBJ97PkQ70dqWntua9E8eCalYlIZpRbLsl5OA9ZHorIMPjjSB2CRYLCqq30PPi5I2TtRvs/g6LRUN4sZ/E2TTUjz7AEY7228ZEuHt1UkU+dY/jEbx6fwrm/ocP8xKvYUuAR1/Cx/z4N0mqmVl+FX/5dRSkmhpfAxO9ss898XKiJW4rewQIbG5ccYal+reZZr70TaEJQqg5KIfAnbp6dEjAsSXnRiEF801JXM0h+d14ECT4tQmdyvYBdCVnJ/Ibqw9D15cViHmeDbR68spqOCj67FSMKxgCVx4KFrxPOualsULX7RL/UbHq2cwyziSFkH4n2ljFlKohyj39F7EparJbiCOumNfhRWknDDwvXY+BjJhbAe19ccKP6QWrS68uBp0cTXqb0rVN/qlfz6Sj5EYj5M/u0rl6d5xctnKmOzfLjI2m5+E9WfDJaAUcP/Ihs+p2eD7aSQTIj+O7I66ju+UAz66D9ZoU1U3uVQ9gaPI5dOMmYdLKS3b19EVytwW2W13d0WXKIw5Vfb7MvFh9I0iPWq+ntL4jQzMYSwV5Y=,iv:Cy3h5I3vbqKORdqw91SHL4tRMeGHMLsXgQ0USJ2jtzk=,tag:0J/p1sUQfXR4ujjY7VzZuQ==,type:str]
-    gluetun-qbitvpn: ENC[AES256_GCM,data:3IdmuLvWs5YRQZuG9y1GRTMKMbR7OynUUVluezviDOV22EkABvo3Ic/+xZrWi/lzAhQRwRsCGjinlUJf7lBvPLg53HaIplbzSIyd3IPLbKzEVAK32WYB/M5cGNQW+XV8TiKK72HO8+WG588A0bsuvp/wQ86ohpRHVrnlboANLS3diCNXI3VdFIHPGpvM77TqB3/vo2AFLKjxi2es4l6KRam8cEUFAz0eH03tTUYaxy+ewA5IZCQSbMURLFKKdh0EATTG5jIz3jFp372fnk8UBgFPeH8+N9VHNM6rnV6zAsC2Vlj2E1YQRTRqOwSK0NRAAV5NBbr7zumS3VS0rVUpIbZVrW/C2BSAVbzowkHuo5o1B7UFsryb3s2FJJGF2biaDoL+ijM5a0Qi4LfNeaSLNKrzaTin0wYq8rPrQKOUBZL4t6FsRbG7KHmfwM4uYdWqV5h1syjI9WWReuePVb416YvqSH9p8HhNsDTka8IGgYkHcYAXYuuxUc6sgQONBwrsdeN5Dhq1IedhuOW+3qAV+hHl8qmVgiWZ8Ss+nmo016nsikifEp08N7J8t3f86/SFZO+YMBxQ/K9PJLsJzR2jsBcf2aTlq0cuzXDvb4cMtro=,iv:N9zdyKJDsj049j5hZOSnAkS/VTWlC3crTODJKIpYYko=,tag:uYHq3CZj0P/BAv+0Ak5ZEw==,type:str]
-    gluetun-qbitperm: ENC[AES256_GCM,data:kzSrILs78UkzNeAvxoDU3QsLKdapQNyQW9nq0it+7HhhwDQ0MJB1s2Ek8zKErTatpwzG8xiUK0HwX5hFLgNZYc+OE0CH4PUrgX1t6dykuPLD2rKQL7veElNgqhX0/39xNyopyJk2UMVFNSqoV1DCC/ja9MqX9+jBYk++7DeX7v1Gl1ntjzJ+zIscg0nOTN1eQAHtiOWtFU0COC/aA8KS+HLIsMkjrIk9UD4C/DE8AOS07s+gDxPRtl6L7324FRqjEHNyxAobWOOLeG711RZcskF7dlminVJu4aVGbBwIy/zDdHFxRwO6yaLr/AqrTlRVOa2O8Qu2Ydpv8ZNj2F6fHrVNNmVwvMEKYibV6oMVo72uT+DTz/mFaYuTUeuJfkdCy7tnQYhBnpbd5J4mKfVb8uOF9Tx02kL2fTFKyvtET3nrtakQUjv8mEqHn4F8136O2JvUBN5RmC3B3vRdFjYgdfwy8hUT9b0Cmi8w0Zzs+XGMRdvWv2g6b5fmlAn0K+a0KB1fdDLhvbIXhY+sYzR3yOH01K0lW3xVdnl1eMIFjZkUGRTi32HyCYb0SUA1EcXmtA4XmyZ6HHFEXFA5y2guVqU4xLyXXldM+lGB7yGLMcM=,iv:kuueHxYafrEdyBxGUBoU2ks7kdr/rWMnXZmE3Kx/iK4=,tag:bNIfP3H5/Kh3ofuCGGx5Hg==,type:str]
 acme:
    bunny: ENC[AES256_GCM,data:P2yROVUga9mORcq8VR/l0i4/2Vod1zvlYq+ZJLLNKow0SpblkwQX/i1ucQYAOkTTRddN+3C+t0zj1rMWkdLoaLjEUJJi3VsSxi+chV2FFiVKFQGEcg24,iv:aQvGgGLsgRGoEmwTgZHR8Jm/MYxmGtVTT/fZKaTLeMs=,tag:m3ssF4O8qs4yxvMu6yUcjw==,type:str]
    dnsimple: ENC[AES256_GCM,data:37FKyBibFtXZgI4EduJQ0z8F+shBc5Q6YlLa3YkVPh9XuJVS20eybi75bfJxiozcZ9d+YRaqcbkBQCSdFOCotDU=,iv:oq3JjqbfAm2C4jcL1lvUb2EOmnwlR07vPoO8H0BmydQ=,tag:E3NO/jMElL6Q817666gIyg==,type:str]
@@ -53,8 +44,8 @@ sops:
            cXNZWmZqd0R0SmhINExscHBKWmxvblUKEFEQvt/zQFARba4S8vHz/1SoKdKg69At
            LZ58XQGOmlGbBhPr7EzYQ2XSY4flWbnnD174cmCR8DNFm15DsNA5fw==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-01-10T05:52:21Z"
-    mac: ENC[AES256_GCM,data:DyLjQrIXJD7udT32xJ20WgCYr+4zXr7s0uuVMxOYSiC1VphhV+BQ2BgGF0bxAfx1n+JiO2BnyX8uD+z/iWh/k/9+UBGnL3MPJ5L5ffvno8hktVU9NHO72xkugYIkbSievTYrJGcSwWAsfJGTm4+1rG9GgcSoxIvRUoR6QJss22s=,iv:pHkPR0Va4bKjZVzNtvsDJ211ORNvNyZfWRf70OWI01w=,tag:/gEp09I+1nD6Cn6dPGZglA==,type:str]
+    lastmodified: "2025-12-08T03:05:16Z"
+    mac: ENC[AES256_GCM,data:gIw//fnDU/lE2rDP4890MjnQ2xp0I4fXwvSWrLC0kFjW1RMLzNCaRLlJzw5/khALH/IZgTrnRqTHF3zHZd+mlyqvC/vzkyBBVdWRRX6w5l9JhFDfe83r86tvsV9G/AOeRchDp1gGuBBNkRamSuCOj7QFc1l334e/jNdKDadhwgI=,iv:nrOQxvJBce5/NDvpowJX/AiIssQdNOStvjj/Lkutppk=,tag:MlRJxbG3laajsi5KHAxy5g==,type:str]
    pgp:
        - created_at: "2024-11-28T18:56:39Z"
          enc: |-
--- a/systems/palatine-hill/zfs.nix
+++ b/systems/palatine-hill/zfs.nix
@@ -49,7 +49,7 @@
          daily = 30;
          weekly = 0;
          monthly = 6;
-          yearly = 2;
+          yearly = 3;
          autosnap = true;
          autoprune = true;
        };
--- a/users/alice/default.nix
+++ b/users/alice/default.nix
@@ -17,7 +17,4 @@ import ../default.nix {
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILWG3cIBju6vzX6s8JlmGNJOiWY7pQ19bHvcqDADtWzv snowi@DESKTOP-EVIR8IH"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEMfC0IXl9sGx+9FjuYZT2OUfffGjciJIHWqZdEU1d3n alice@parthenon-7588"
  ];
-  groups = [
-    "adbusers"
-  ];
 }
--- a/users/alice/home/zsh.nix
+++ b/users/alice/home/zsh.nix
@@ -1,10 +1,9 @@
-{ lib, config, ... }:
+{ lib, ... }:
 {

  programs.zsh = {

    enable = true;
-    dotDir = "${config.xdg.configHome}/zsh";
    oh-my-zsh = {
      enable = true;
      plugins = [
--- a/users/alice/non-server.nix
+++ b/users/alice/non-server.nix
@@ -14,7 +14,6 @@
      customTitleBar = false;
      hardwareAcceleration = true;
    };
-    vencord.useSystem = true;
    vencord.settings = {
      autoUpdate = false;
      autoUpdateNotification = false;
@@ -66,7 +65,7 @@

    # nix tools
    nil
-    nixfmt
+    nixfmt-rfc-style
    nix-init

    # markdown
@@ -109,8 +108,5 @@

    # media tools
    #deepin.deepin-music
-
-    # arch zed deps
-    nixd
  ];
 }
--- a/users/default.nix
+++ b/users/default.nix
@@ -4,7 +4,6 @@
  pkgs,
  name,
  publicKeys ? [ ],
-  groups ? [ ],
  defaultShell ? "zsh",
 }:

@@ -19,15 +18,14 @@
    "wheel"
    "media"
    (lib.mkIf config.networking.networkmanager.enable "networkmanager")
+    (lib.mkIf config.programs.adb.enable "adbusers")
    (lib.mkIf config.programs.wireshark.enable "wireshark")
    (lib.mkIf config.virtualisation.docker.enable "docker")
    (lib.mkIf (with config.services.locate; (enable && package == pkgs.plocate)) "plocate")
-    (lib.mkIf config.networking.wireless.enable "wpa_supplicant")
    "libvirtd"
    "dialout"
    "plugdev"
    "uaccess"
    "ydotool"
-  ]
-  ++ groups;
+  ];
 }