automated: Update flake.lock

Auto-generated by [update.yml][1] with the help of
[create-pull-request][2].

[1]: https://nayeonie.com/ahuston-0/nix-dotfiles/src/branch/main/.github/workflows/flake-update.yml
[2]: https://forgejo.stefka.eu/jiriks74/create-pull-request

flake.lock

@@ -21,17 +21,17 @@
     "base16-fish": {
       "flake": false,
       "locked": {
-        "lastModified": 1754405784,
-        "narHash": "sha256-l9xHIy+85FN+bEo6yquq2IjD1rSg9fjfjpyGP1W8YXo=",
+        "lastModified": 1765809053,
+        "narHash": "sha256-XCUQLoLfBJ8saWms2HCIj4NEN+xNsWBlU1NrEPcQG4s=",
         "owner": "tomyun",
         "repo": "base16-fish",
-        "rev": "23ae20a0093dca0d7b39d76ba2401af0ccf9c561",
+        "rev": "86cbea4dca62e08fb7fd83a70e96472f92574782",
         "type": "github"
       },
       "original": {
         "owner": "tomyun",
         "repo": "base16-fish",
-        "rev": "23ae20a0093dca0d7b39d76ba2401af0ccf9c561",
+        "rev": "86cbea4dca62e08fb7fd83a70e96472f92574782",
         "type": "github"
       }
     },
@@ -76,11 +76,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1765080359,
-        "narHash": "sha256-BvAgmqgswcokD2eWoyO3uB1k1VTdpxDHGSx0RYRFjDg=",
+        "lastModified": 1766635416,
+        "narHash": "sha256-Nfjtg55eTeSk99YF4zykkmyWjMR0LJ75aXOSCptMZOM=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "35f8ab2ecd954b3a348aa0e253878211c48a0aa7",
+        "rev": "981ca9cae3898b79f085e5aa739b911bc330782f",
         "type": "gitlab"
       },
       "original": {
@@ -125,11 +125,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1763759067,
-        "narHash": "sha256-LlLt2Jo/gMNYAwOgdRQBrsRoOz7BPRkzvNaI/fzXi2Q=",
+        "lastModified": 1765835352,
+        "narHash": "sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "2cccadc7357c0ba201788ae99c4dfa90728ef5e0",
+        "rev": "a34fae9c08a15ad73f295041fec82323541400a9",
         "type": "github"
       },
       "original": {
@@ -242,11 +242,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764998300,
-        "narHash": "sha256-fZatn/KLfHLDXnF0wy7JxXqGaZmGDTVufT4o/AOlj44=",
+        "lastModified": 1766682973,
+        "narHash": "sha256-GKO35onS711ThCxwWcfuvbIBKXwriahGqs+WZuJ3v9E=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "27a6182347ccae90a88231ae0dc5dfa7d15815bb",
+        "rev": "91cdb0e2d574c64fae80d221f4bf09d5592e9ec2",
         "type": "github"
       },
       "original": {
@@ -283,11 +283,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765113580,
-        "narHash": "sha256-b8YOwGDFprkQJjXsKGuSNS1pWe8w4cUW36YxlUelNpU=",
+        "lastModified": 1766066098,
+        "narHash": "sha256-d3HmUbmfTDIt9mXEHszqyo2byqQMoyJtUJCZ9U1IqHQ=",
         "owner": "hyprwm",
         "repo": "contrib",
-        "rev": "db18f83bebbc2cf43a21dbb26cd99aabe672d923",
+        "rev": "41dbcac8183bb1b3a4ade0d8276b2f2df6ae4690",
         "type": "github"
       },
       "original": {
@@ -337,11 +337,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765080594,
-        "narHash": "sha256-5t3d655GqLblE+p5xN5ntkeRfZBesN7vehOWcRcU88M=",
+        "lastModified": 1765267181,
+        "narHash": "sha256-d3NBA9zEtBu2JFMnTBqWj7Tmi7R5OikoU2ycrdhQEws=",
         "owner": "Mic92",
         "repo": "nix-index-database",
-        "rev": "4194c582d0a3f440382ee00b729ea5cc5ef59754",
+        "rev": "82befcf7dc77c909b0f2a09f5da910ec95c5b78f",
         "type": "github"
       },
       "original": {
@@ -417,11 +417,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1764440730,
-        "narHash": "sha256-ZlJTNLUKQRANlLDomuRWLBCH5792x+6XUJ4YdFRjtO4=",
+        "lastModified": 1766568855,
+        "narHash": "sha256-UXVtN77D7pzKmzOotFTStgZBqpOcf8cO95FcupWp4Zo=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "9154f4569b6cdfd3c595851a6ba51bfaa472d9f3",
+        "rev": "c5db9569ac9cc70929c268ac461f4003e3e5ca80",
         "type": "github"
       },
       "original": {
@@ -440,11 +440,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764726320,
-        "narHash": "sha256-0AD/V/uCDG15xZSkQayaKjn/4Rlvoilwa+PsoSaubco=",
+        "lastModified": 1766370075,
+        "narHash": "sha256-gbhR8+gNrhmYxKaNJpTjFivuibr3ZdlB5eU0a8yE36I=",
         "owner": "NuschtOS",
         "repo": "nixos-modules",
-        "rev": "1e03233c1b662f91c5ff8c7dba1a0a693a930e51",
+        "rev": "db6f2a33500dadb81020b6e5d4281b4820d1b862",
         "type": "github"
       },
       "original": {
@@ -455,11 +455,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1765053261,
-        "narHash": "sha256-CBVtkpfM7pMgXuXvByXn53p5lSm7fiDZK4EGOMnhaoo=",
+        "lastModified": 1764020296,
+        "narHash": "sha256-6zddwDs2n+n01l+1TG6PlyokDdXzu/oBmEejcH5L5+A=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "60a511057b110094129bdfb99f343548b59f0aba",
+        "rev": "a320ce8e6e2cc6b4397eef214d202a50a4583829",
         "type": "github"
       },
       "original": {
@@ -471,11 +471,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1761765539,
-        "narHash": "sha256-b0yj6kfvO8ApcSE+QmA6mUfu8IYG6/uU28OFn4PaC8M=",
+        "lastModified": 1765674936,
+        "narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "719359f4562934ae99f5443f20aa06c2ffff91fc",
+        "rev": "2075416fcb47225d9b68ac469a5c4801a9c4dd85",
         "type": "github"
       },
       "original": {
@@ -502,11 +502,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1764950072,
-        "narHash": "sha256-BmPWzogsG2GsXZtlT+MTcAWeDK5hkbGRZTeZNW42fwA=",
+        "lastModified": 1766651565,
+        "narHash": "sha256-QEhk0eXgyIqTpJ/ehZKg9IKS7EtlWxF3N7DXy42zPfU=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "f61125a668a320878494449750330ca58b78c557",
+        "rev": "3e2499d5539c16d0d173ba53552a4ff8547f4539",
         "type": "github"
       },
       "original": {
@@ -552,11 +552,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765016596,
-        "narHash": "sha256-rhSqPNxDVow7OQKi4qS5H8Au0P4S3AYbawBSmJNUtBQ=",
+        "lastModified": 1765911976,
+        "narHash": "sha256-t3T/xm8zstHRLx+pIHxVpQTiySbKqcQbK+r+01XVKc0=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "548fc44fca28a5e81c5d6b846e555e6b9c2a5a3c",
+        "rev": "b68b780b69702a090c8bb1b973bab13756cc7a27",
         "type": "github"
       },
       "original": {
@@ -596,11 +596,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765075567,
-        "narHash": "sha256-KFDCdQcHJ0hE3Nt5Gm5enRIhmtEifAjpxgUQ3mzSJpA=",
+        "lastModified": 1766717007,
+        "narHash": "sha256-ZjLiHCHgoH2maP5ZAKn0anrHymbjGOS5/PZqfJUK8Ik=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "769156779b41e8787a46ca3d7d76443aaf68be6f",
+        "rev": "a18efe8a9112175e43397cf870fb6bc1ca480548",
         "type": "github"
       },
       "original": {
@@ -616,11 +616,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765079830,
-        "narHash": "sha256-i9GMbBLkeZ7MVvy7+aAuErXkBkdRylHofrAjtpUPKt8=",
+        "lastModified": 1766289575,
+        "narHash": "sha256-BOKCwOQQIP4p9z8DasT5r+qjri3x7sPCOq+FTjY8Z+o=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "aeb517262102f13683d7a191c7e496b34df8d24c",
+        "rev": "9836912e37aef546029e48c8749834735a6b9dad",
         "type": "github"
       },
       "original": {
@@ -650,11 +650,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1765047449,
-        "narHash": "sha256-VQcqjJ2g0kT9TW4ENwA2HBQJzfbCUd5s1Wm3K+R2QZY=",
+        "lastModified": 1766603026,
+        "narHash": "sha256-J2DDdRqSU4w9NNgkMfmMeaLIof5PXtS9RG7y6ckDvQE=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "bd00e01aab676aee88e6cc5c9238b4a5a7d6639a",
+        "rev": "551df12ee3ebac52c5712058bd97fd9faa4c3430",
         "type": "github"
       },
       "original": {
@@ -787,11 +787,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759739742,
-        "narHash": "sha256-nTNmgO71tD3jJGpr9yIS1atOBJp8K1pwZOxnEdS+aAk=",
+        "lastModified": 1765936672,
+        "narHash": "sha256-wxkeSF0/3FI0HSBKhZ2mlAAmFviNrZzdhjHqTfWP6h0=",
         "owner": "Toqozz",
         "repo": "wired-notify",
-        "rev": "6a96aa2066d8ad945f2323b63dc217081ef51168",
+        "rev": "491197a6a5ef9c65a85c3eb1531786f32ffff5b3",
         "type": "github"
       },
       "original": {

hydra/jobsets.nix

@@ -18,7 +18,7 @@ let
     };
 
   prs = readJSONFile pulls;
-  refs = readJSONFile branches;
+  #refs = readJSONFile branches;
 
   # template for creating a job
   makeJob =
@@ -47,19 +47,19 @@ let
   giteaHost = "ssh://gitea@nayeonie.com:2222";
   repo = "ahuston-0/nix-dotfiles";
   # # Create a hydra job for a branch
-  jobOfRef =
-    name:
-    { ref, ... }:
-    if ((builtins.match "^refs/heads/(.*)$" ref) == null) then
-      null
-    else
-      {
-        name = builtins.replaceStrings [ "/" ] [ "-" ] "branch-${name}";
-        value = makeJob {
-          description = "Branch ${name}";
-          flake = "git+${giteaHost}/${repo}?ref=${ref}";
-        };
-      };
+  #jobOfRef =
+  #  name:
+  #  { ref, ... }:
+  #  if ((builtins.match "^refs/heads/(.*)$" ref) == null) then
+  #    null
+  #  else
+  #    {
+  #      name = builtins.replaceStrings [ "/" ] [ "-" ] "branch-${name}";
+  #      value = makeJob {
+  #        description = "Branch ${name}";
+  #        flake = "git+${giteaHost}/${repo}?ref=${ref}";
+  #      };
+  #    };
 
   # Create a hydra job for a PR
   jobOfPR = id: info: {
@@ -77,12 +77,12 @@ let
   # wrapper function for reading json from file
   readJSONFile = f: builtins.fromJSON (builtins.readFile f);
   # remove null values from a set, in-case of branches that don't exist
-  mapFilter = f: l: builtins.filter (x: (x != null)) (map f l);
+  #mapFilter = f: l: builtins.filter (x: (x != null)) (map f l);
 
   # Create job set from PRs and branches
   jobs = makeSpec (
     builtins.listToAttrs (map ({ name, value }: jobOfPR name value) (attrsToList prs))
-    // builtins.listToAttrs (mapFilter ({ name, value }: jobOfRef name value) (attrsToList refs))
+    #// builtins.listToAttrs (mapFilter ({ name, value }: jobOfRef name value) (attrsToList refs))
   );
 in
 {

systems/artemision/configuration.nix

@@ -52,7 +52,7 @@
       };
     };
     calibre-server = {
-      enable = true;
+      enable = false;
       user = "calibre-web";
       group = "calibre-web";
 

systems/artemision/default.nix

@@ -7,7 +7,7 @@
   server = false;
   users = [ "alice" ];
   modules = [
-    inputs.nixos-hardware.nixosModules.framework-16-7040-amd
+    inputs.nixos-hardware.nixosModules.framework-16-amd-ai-300-series
     inputs.stylix.nixosModules.stylix
     {
       environment.systemPackages = [

systems/artemision/hardware.nix

@@ -100,7 +100,7 @@
   # (the default) this is the recommended approach. When using systemd-networkd it's
   # still possible to use this option, but it's recommended to use it in conjunction
   # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.interfaces.wlp4s0.useDHCP = lib.mkDefault true;
+  networking.interfaces.wlp191s0.useDHCP = lib.mkDefault true;
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;

systems/artemision/private-wifi.nix

@@ -3,17 +3,17 @@
   networking.nameservers = [
     "9.9.9.9"
     "1.1.1.1"
-    "192.168.76.1"
+    #"192.168.76.1"
   ];
 
-  services.resolved = {
-    enable = true;
-    dnssec = "false";
-    domains = [ "~." ];
-    fallbackDns = [
-      "1.1.1.1#one.one.one.one"
-      "1.0.0.1#one.one.one.one"
-    ];
-    dnsovertls = "true";
-  };
+  #services.resolved = {
+  #  enable = true;
+  #  dnssec = "false";
+  #  domains = [ "~." ];
+  #  fallbackDns = [
+  #    "1.1.1.1#one.one.one.one"
+  #    "1.0.0.1#one.one.one.one"
+  #  ];
+  #  dnsovertls = "true";
+  #};
 }

systems/palatine-hill/docker/arr.nix

@@ -1,121 +1,273 @@
 {
   config,
   lib,
-  pkgs,
   ...
 }:
 let
   vars = import ../vars.nix;
+  arr_postgres_config =
+    container_type:
+    let
+      ctype = lib.strings.toUpper container_type;
     in
     {
+      "${ctype}__POSTGRES__HOST" = "/var/run/postgresql";
+      "${ctype}__POSTGRES__PORT" = toString config.services.postgresql.settings.port;
+    };
+in
+{
+  # Notes:
+  # Jellyplex-watched - sync watch status between plex and jellyfin as long as users and library is the same
+  # Tdarr - for distributed transcoding?
+  #
+  # list of containers supporting postgres:
+  #   bazarr:
+  #     POSTGRES_ENABED: true
+  #     POSTGRES_HOST:
+  #     POSTGRES_PORT:
+  #     POSTGRES_DATABASE: bazarr
+  #     POSTGRES_USERNAME: arr
+  #     POSTGRES_PASSWORD: sops
+  #   prowlarr:
+  #     see ctype
+  #   radarr:
+  #     see ctype
+  #   sonarr:
+  #     see ctype
+  #   lidarr:
+  #     see ctype
+  #   jellyseerr:
+  #     DB_TYPE: postgres
+  #     DB_HOST:
+  #     DB_PORT:
+  #     DB_USER: arr
+  #     DB_PASS: sops
+  #     DB_NAME: jellyseerr
+  #
   virtualisation.oci-containers.containers = {
     bazarr = {
       image = "ghcr.io/linuxserver/bazarr:latest";
+      pull = "always";
       ports = [ "6767:6767" ];
+      hostname = "bazarr";
       environment = {
         PUID = "600";
         PGID = "100";
         TZ = "America/New_York";
+        POSTGRES_HOST = "/var/run/postgresql";
+        POSTGRES_PORT = toString config.services.postgresql.settings.port;
       };
+      environmentFiles = [
+        config.sops.secrets."docker/bazarr".path
+      ];
       volumes = [
         "${vars.primary_docker}/bazarr:/config"
         "${vars.primary_plex_storage}/data:/data"
+        "/var/run/postgresql:/var/run/postgresql"
+      ];
+      extraOptions = [
+        "--network=arrnet"
       ];
       autoStart = true;
     };
     prowlarr = {
       image = "ghcr.io/linuxserver/prowlarr:latest";
+      pull = "always";
       ports = [ "9696:9696" ];
+      hostname = "prowlarr";
       environment = {
         PUID = "600";
         PGID = "100";
         TZ = "America/New_York";
-      };
-      volumes = [ "${vars.primary_docker}/prowlarr:/config" ];
+      }
+      // arr_postgres_config "prowlarr";
+      environmentFiles = [
+        config.sops.secrets."docker/prowlarr".path
+      ];
+      extraOptions = [
+        "--network=arrnet"
+      ];
+      volumes = [
+        "${vars.primary_docker}/prowlarr:/config"
+
+        "/var/run/postgresql:/var/run/postgresql"
+      ];
       autoStart = true;
     };
     radarr = {
       image = "ghcr.io/linuxserver/radarr:latest";
+      pull = "always";
       ports = [ "7878:7878" ];
+      hostname = "radarr";
       environment = {
         PUID = "600";
         PGID = "100";
         TZ = "America/New_York";
-      };
+      }
+      // arr_postgres_config "radarr";
+      environmentFiles = [
+        config.sops.secrets."docker/radarr".path
+      ];
       volumes = [
         "${vars.primary_docker}/radarr:/config"
         "${vars.primary_plex_storage}/data:/data"
+        "/var/run/postgresql:/var/run/postgresql"
+      ];
+      extraOptions = [
+        "--network=arrnet"
       ];
       autoStart = true;
     };
     sonarr = {
       image = "ghcr.io/linuxserver/sonarr:latest";
+      pull = "always";
       ports = [ "8989:8989" ];
+      hostname = "sonarr";
       environment = {
         PUID = "600";
         PGID = "100";
         TZ = "America/New_York";
-      };
+      }
+      // arr_postgres_config "sonarr";
+      environmentFiles = [
+        config.sops.secrets."docker/sonarr".path
+      ];
       volumes = [
         "${vars.primary_docker}/sonarr:/config"
         "${vars.primary_plex_storage}/data:/data"
+        "/var/run/postgresql:/var/run/postgresql"
+      ];
+      extraOptions = [
+        "--network=arrnet"
       ];
       autoStart = true;
     };
     lidarr = {
       image = "ghcr.io/linuxserver/lidarr:latest";
+      pull = "always";
       ports = [ "8686:8686" ];
+      hostname = "lidarr";
       environment = {
         PUID = "600";
         PGID = "100";
         TZ = "America/New_York";
-      };
+      }
+      // arr_postgres_config "lidarr";
+      environmentFiles = [
+        config.sops.secrets."docker/lidarr".path
+      ];
       volumes = [
         "${vars.primary_docker}/lidarr:/config"
         "${vars.primary_plex_storage}/data:/data"
+        "/var/run/postgresql:/var/run/postgresql"
+      ];
+      extraOptions = [
+        "--network=arrnet"
       ];
       autoStart = true;
     };
     unpackerr = {
       image = "golift/unpackerr:latest";
+      pull = "always";
       user = "600:100";
+      hostname = "unpackerr";
       environment = {
         TZ = "America/New_York";
       };
       volumes = [
         "${vars.primary_docker}/unpackerr:/config"
         "${vars.primary_plex_storage}:/data"
+        "/var/run/postgresql:/var/run/postgresql"
       ];
+      extraOptions = [ "--network=arrnet" ];
       autoStart = true;
     };
     notifiarr = {
       image = "golift/notifiarr:latest";
+      pull = "always";
+      ports = [ "5454:5454" ];
       user = "600:100";
+      hostname = "notifiarr";
       environment = {
         TZ = "America/New_York";
       };
+      environmentFiles = [ config.sops.secrets."docker/notifiarr".path ];
       volumes = [
         "${vars.primary_docker}/notifiarr:/config"
         "${vars.primary_plex_storage}:/data"
+        "/var/run/postgresql:/var/run/postgresql"
       ];
+      extraOptions = [ "--network=arrnet" ];
       autoStart = true;
     };
-    overseerr = {
-      image = "fallenbagel/jellyseerr:preview-seerr";
+    jellyseerr = {
+      image = "fallenbagel/jellyseerr:latest";
+      pull = "always";
+      hostname = "jellyseerr";
       environment = {
         PUID = "600";
         PGID = "100";
         TZ = "America/New_York";
+        DB_TYPE = "postgres";
+        DB_HOST = "/var/run/postgresql";
+        DB_PORT = toString config.services.postgresql.settings.port;
       };
-      volumes = [ "${vars.primary_docker}/overseerr:/config" ];
+      environmentFiles = [
+        config.sops.secrets."docker/jellyseerr".path
+      ];
+      volumes = [
+        "${vars.primary_docker}/overseerr:/config"
+        "/var/run/postgresql:/var/run/postgresql"
+      ];
       # TODO: remove ports later since this is going through web
+      extraOptions = [
+        "--network=arrnet"
+        "--network=haproxy-net"
+        # "--health-cmd \"wget --no-verbose --tries 1 --spider http://localhost:5055/api/v1/status || exit 1\""
+        # "--health-start-period 20s"
+        # "--health-timeout 3s"
+        # "--health-interval 15s"
+        # "--health-retries 3"
+      ];
       ports = [ "5055:5055" ]; # Web UI port
       dependsOn = [
         "radarr"
         "sonarr"
       ];
-      extraOptions = [ "--network=haproxy-net" ];
       autoStart = true;
     };
   };
+
+  sops = {
+    secrets = {
+      "docker/notifiarr" = {
+        owner = "docker-service";
+        restartUnits = [ "docker-notifiarr.service" ];
+      };
+      "docker/bazarr" = {
+        owner = "docker-service";
+        restartUnits = [ "docker-bazarr.service" ];
+      };
+      "docker/prowlarr" = {
+        owner = "docker-service";
+        restartUnits = [ "docker-prowlarr.service" ];
+      };
+      "docker/radarr" = {
+        owner = "docker-service";
+        restartUnits = [ "docker-radarr.service" ];
+      };
+      "docker/sonarr" = {
+        owner = "docker-service";
+        restartUnits = [ "docker-sonarr.service" ];
+      };
+      "docker/lidarr" = {
+        owner = "docker-service";
+        restartUnits = [ "docker-lidarr.service" ];
+      };
+      "docker/jellyseerr" = {
+        owner = "docker-service";
+        restartUnits = [ "docker-jellyseerr.service" ];
+      };
+    };
+  };
 }

systems/palatine-hill/docker/nextcloud.nix

@@ -8,13 +8,13 @@ let
   # nextcloud-image = import ./nextcloud-image { inherit pkgs; };
   nextcloud-base = {
     # image comes from running docker compose build in nextcloud-docker/.examples/full/apache
-    image = "nextcloud-nextcloud";
+    image = "docker.io/library/nextcloud-nextcloud";
     # pull = "always";
     # do NOT enable pull here, this image is generated based on a custom docker image
     hostname = "nextcloud";
     volumes = [
       "${nextcloud_path}/nc_data:/var/www/html:z"
-      "${nextcloud_path}/nc_php:/usr/local/etc/php"
+      #"${nextcloud_path}/nc_php:/usr/local/etc/php"
       "${nextcloud_path}/nc_prehooks:/docker-entrypoint-hooks.d/before-starting"
       #"${nextcloud_path}/remoteip.conf:/etc/apache2/conf-enabled/remoteip.conf:ro"
     ];

systems/palatine-hill/firewall.nix

@@ -1,7 +1,19 @@
 { ... }:
 
 {
-  networking.firewall.allowedTCPPorts = [
+  networking.firewall = {
+
+    extraCommands = "
+      iptables -I nixos-fw 1 -i br+ -j ACCEPT
+    ";
+
+    extraStopCommands = "
+      iptables -D nixos-fw -i br+ -j ACCEPT
+    ";
+
+    trustedInterfaces = [ "br+" ];
+
+    allowedTCPPorts = [
       # qbit
       8081
       8082
@@ -35,4 +47,5 @@
       5055
     ];
 
+  };
 }

systems/palatine-hill/hydra.nix

@@ -43,9 +43,9 @@ in
     hydra = {
       enable = true;
       package = inputs.hydra.packages.x86_64-linux.hydra.overrideAttrs (old: {
-        checkPhase = ''
+        preCheck = ''
           export YATH_JOB_COUNT=8
-          ${old.checkPhase or "yath test"}
+          ${old.preCheck or ""}
         '';
       });
       hydraURL = "https://hydra.alicehuston.xyz";

systems/palatine-hill/postgresql.nix

@@ -1,6 +1,5 @@
 {
   config,
-  lib,
   pkgs,
   ...
 }:
@@ -30,6 +29,12 @@ in
            # Let other names login as themselves
            superuser_map      /^(.*)$   \1
       '';
+      authentication = ''
+        local  bazarr  bazarr  scram-sha-256
+        local  /.*arr-main  /.*arr  scram-sha-256
+        local  /.*arr-log  /.*arr  scram-sha-256
+        local  jellyseerr  jellyseerr  scram-sha-256
+      '';
 
       # initialScript = config.sops.secrets."postgres/init".path;
       ensureDatabases = [

systems/palatine-hill/secrets.yaml

@@ -25,7 +25,13 @@ docker:
     collabora: ENC[AES256_GCM,data:LPRkzPEv5qfzeWSDbf+L+0asfmiK5Mhj8jCdfVyvVQAaD75Cbo4qLD0Nc80z,iv:/l2vAyYYJChhv6T+JkHT4I74ZpdhvbVqxlDWIM4Y4bw=,tag:/+uzn1vtd1RnO9/lGiQAKA==,type:str]
     delugevpn: ENC[AES256_GCM,data:YGkgaQUuA9oteKD77tnFzxZSHctyOQjMNlfvJr3mPWAl2P8wfcshiUoa6SNp69pagxbzRV6mfuzwzinbkQCoZN3lw7uF76y0,iv:Bro0H4tFR+3wi9DGGq9a6ge4o4uPlVXBUF7h17zyqg8=,tag:N1kVNFasqGMx8R9qTq2dJA==,type:str]
     protonvpn-start-script: ENC[AES256_GCM,data:ZnlDpCLdILHXSUCI6itWkqO4y75Lwjj7qT1DBkfueLneQOaQ0JhuE2FbOOajkmI046nP9fMrJbu3g4QZHsq1g8yqGU1wb0OOT+eS9+M92Md29B4NnUdwnVAO6/RzvRKXP2tsQ4iprx9An+BEFwZYD6WG6DQc6NjJVSgRcYvfH9rQey2VdwLysNsgFCs8eC6QgikqBpeg4eOIvDDNbdXPKkW+ZPph9xpzGkcFIMwlX5esg0n7qyUoMvWwBn4avC46U5erOw0fNajY60ri9sm5Afht6LZrFal71Hx/K9/5EXBp9dD4teLO2Ew0CQX0i94pKCuR207l9868s7Ao3udLp4wbiLnXoRKq+w==,iv:qR0kNYpb50NXEqSksvHBPAaRG51RKCsSwTq32nosxzo=,tag:+xRQyuWi4Ja/N9lcd11oJA==,type:str]
-    notifiarr: ENC[AES256_GCM,data:8p7+58u1WSjBMjgxxkyDVp0CK26RMBAOFe7Ax5ugfs85+K97loSCAgTaDzplkHwZ0W1jc7rKUyEp6H22R+VwIUL5CvlYZ4XIZbcbrTfcuAqXcVExDNP/hQQs0Kg6,iv:kXKVrHPiBKvUvaeZvf1AG8M+Zu3SaSv5UacBqeHeBWA=,tag:jiZe/6oEZ8IPybZ3rDevEg==,type:str]
+    notifiarr: ENC[AES256_GCM,data:XxVEhp4Rei6mRcdSSooRnofuVNZDalVhDYiVUmvQUr8QihrVRMKRE9Kpl5PGWUBw,iv:urMLaUf3XUjMks2vk0E7iRUU3mLHBiMAiwtQgmWQq20=,tag:dHdTOyC/ukd71UlYEI5fWw==,type:str]
+    bazarr: ENC[AES256_GCM,data:x+JdRCl3x3OM3lWmgcWikJSEnh5c5He5HmuLzCGAQ8zUXMi2Z3Kf6LzL+aoqtCBu3rabYZmQSLBoDm9CPkk=,iv:7e+3w46RUD2/OSlwrEe7BRxUqPPdt5+obIjQA8pr3xY=,tag:rHSijp/tcf/SGp5y4kJ0cw==,type:str]
+    prowlarr: ENC[AES256_GCM,data:hr3hYwRw0+/UD8anqZQjGy7rPkV2pad4Xi5FdXSf3Ftd1/jwlYfMqhqgEngFX30LLMWvJvjeu1TkTNzSEwI6ZCPdefNVYYwWavtm+XcBVxffGvFZ,iv:EXW48288IcCeGs/vP4tkAI4dxQAOh92Na43q/9cyuSc=,tag:pnYR26MDd82DjeUPdwCoUw==,type:str]
+    radarr: ENC[AES256_GCM,data:qCfoeEHb0ng5GhaY3QZiFvLVb25ZHNmgT0bRqEjBcelyP2819zCL7LxUPr08FxivEYZiAMFVleRozL8NMg6O5fh+2BatcYOfyh99zxIC,iv:HV3gTTnrjtab7x4Be+7hSe+nrD6BnPAmZBsHzi9Fujg=,tag:O6x0FDlasuJSRrGL/9SwpQ==,type:str]
+    sonarr: ENC[AES256_GCM,data:X/hM31ZyHybvy2eQzVnmq8CH1AqBgz1pxq7tKC4lZB3ryAbnEIJksffem8+35tWt/0r5cEH4aaIKD1kS7Q+Ma+8JrRLcWkt6CZq/wspz,iv:44FfdVpQCposXshzNe5DXAxExeQzjVKhkZaVbgKo8KU=,tag:WIWWUt1XBngUTwwqhCrcNw==,type:str]
+    lidarr: ENC[AES256_GCM,data:xERBECneutNUMZRrHukp8CaNrpI7SXUB16zUkauNP2+wto3eIc/K+2nMCkbwSC9AKlSjnUGSiORmAWn/jofTAuEzQljkCR1XCSkJRMmL,iv:iKf4fZtCfdjT/KuMFK5VFoLAV+Lll8uJowe9Q4cHyYw=,tag:xzmATTkrYRYm9Mw23zEO5g==,type:str]
+    jellyseerr: ENC[AES256_GCM,data:7dDfHFp8+WbJqrf7Ms/gmfroBePwegXh5CXn5FcOz8IEK7rTvr9KZfz9x/1BwdD8,iv:ZPi3OcMfH76A08piKY4P7hFbeMyouwBoeN5oL3ExzKU=,tag:oOZ37dy/y+DFqNRfAHexvQ==,type:str]
 acme:
     bunny: ENC[AES256_GCM,data:P2yROVUga9mORcq8VR/l0i4/2Vod1zvlYq+ZJLLNKow0SpblkwQX/i1ucQYAOkTTRddN+3C+t0zj1rMWkdLoaLjEUJJi3VsSxi+chV2FFiVKFQGEcg24,iv:aQvGgGLsgRGoEmwTgZHR8Jm/MYxmGtVTT/fZKaTLeMs=,tag:m3ssF4O8qs4yxvMu6yUcjw==,type:str]
     dnsimple: ENC[AES256_GCM,data:37FKyBibFtXZgI4EduJQ0z8F+shBc5Q6YlLa3YkVPh9XuJVS20eybi75bfJxiozcZ9d+YRaqcbkBQCSdFOCotDU=,iv:oq3JjqbfAm2C4jcL1lvUb2EOmnwlR07vPoO8H0BmydQ=,tag:E3NO/jMElL6Q817666gIyg==,type:str]
@@ -44,8 +50,8 @@ sops:
             cXNZWmZqd0R0SmhINExscHBKWmxvblUKEFEQvt/zQFARba4S8vHz/1SoKdKg69At
             LZ58XQGOmlGbBhPr7EzYQ2XSY4flWbnnD174cmCR8DNFm15DsNA5fw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-10-15T02:30:11Z"
-    mac: ENC[AES256_GCM,data:uG3ZnIAepcCDFXZNhE18dqd0R3pL0a4JTxTaYx8fnaoT3ooN580yIA6tfjGj+6M3JyqPCM56dmqmnMsPplkr+WToW5Wgc8EBe+L2UdSpVK6Zk1ClxvG+NMmZK0u+dNOszJHpoRWTFLl5Wffku9hKEwcgYTA0nwVcrqPc3FSZQyA=,iv:hN2Wfr/IopxM1ItekB7YcXPjR5zBIwPvq1EzW1yjS34=,tag:ao059oZR+kT7IMBF4b2aAQ==,type:str]
+    lastmodified: "2025-12-25T17:45:31Z"
+    mac: ENC[AES256_GCM,data:lVRqQWnO1RvmoW13/xCpP2SvibccRWwmr1Gyj6EgrE+V+Iu1bfnZRkTkHiFIQqQLQgCy2qBiSHeZF/dNERe83eEwpXgRQAduarpE/qL8K1mxcwf5HMMYACjlNfsL/I1/TCJrJ7DZBxI4neRLetc5OpScVXqHj1neOodD/g8n+ls=,iv:+gZpo0I2NVYz24o42mUW/OkfONqNSjgaJeKeFdKx7dg=,tag:EJnpiotQuBKth21mdhvjZQ==,type:str]
     pgp:
         - created_at: "2024-11-28T18:56:39Z"
           enc: |-

systems/palatine-hill/zfs.nix

@@ -49,7 +49,7 @@
           daily = 30;
           weekly = 0;
           monthly = 6;
-          yearly = 3;
+          yearly = 2;
           autosnap = true;
           autoprune = true;
         };

users/alice/home/hypr/hyprland.conf

@@ -116,8 +116,8 @@ master {
 }
 
 gestures {
-    # See https://wiki.hyprland.org/Configuring/Variables/ for more
-    workspace_swipe = off
+    # See https://wiki.hypr.land/Configuring/Gestures/ for more
+    gesture = 3, horizontal, workspace
 }
 
 misc {
@@ -149,6 +149,7 @@ bind = $mainMod, W, killactive,
 #bind = $mainMod, W, exit, 
 bind = $mainMod, E, exec, $fileManager
 bind = $mainMod, V, togglefloating, 
+bind = $mainMod, F, fullscreen, toggle
 bind = $mainMod, SPACE, exec, $menu
 bind = $mainMod, O, pseudo, # dwindle
 bind = $mainMod, J, togglesplit, # dwindle

users/alice/non-server.nix

@@ -14,6 +14,7 @@
       customTitleBar = false;
       hardwareAcceleration = true;
     };
+    vencord.useSystem = true;
     vencord.settings = {
       autoUpdate = false;
       autoUpdateNotification = false;
@@ -108,5 +109,8 @@
 
     # media tools
     #deepin.deepin-music
+
+    # arch zed deps
+    nixd
   ];
 }