flake.lock: Update

Flake lock file updates:

• Updated input 'disko':
    'github:nix-community/disko/3a9450b26e69dcb6f8de6e2b07b3fc1c288d85f5?narHash=sha256-y7UhnWlER8r776JsySqsbTUh2Txf7K30smfHlqdaIQw%3D' (2025-10-17)
  → 'github:nix-community/disko/af087d076d3860760b3323f6b583f4d828c1ac17?narHash=sha256-TtcPgPmp2f0FAnc%2BDMEw4ardEgv1SGNR3/WFGH0N19M%3D' (2025-11-04)
• Updated input 'nix-pre-commit-hooks':
    'github:cachix/git-hooks.nix/ca5b894d3e3e151ffc1db040b6ce4dcc75d31c37?narHash=sha256-BflA6U4AM1bzuRMR8QqzPXqh8sWVCNDzOdsxXEguJIc%3D' (2025-10-17)
  → 'github:cachix/git-hooks.nix/7275fa67fbbb75891c16d9dee7d88e58aea2d761?narHash=sha256-YG19IyrTdnVn0l3DvcUYm85u3PaqBt6tI6VvolcuHnA%3D' (2025-11-16)
• Updated input 'nixos-hardware':
    'github:nixos/nixos-hardware/d6645c340ef7d821602fd2cd199e8d1eed10afbc?narHash=sha256-2m1S4jl%2BGEDtlt2QqeHil8Ny456dcGSKJAM7q3j/BFU%3D' (2025-10-20)
  → 'github:nixos/nixos-hardware/899dc449bc6428b9ee6b3b8f771ca2b0ef945ab9?narHash=sha256-BWWnUUT01lPwCWUvS0p6Px5UOBFeXJ8jR%2BZdLX8IbrU%3D' (2025-11-11)
• Updated input 'nixpkgs':
    'github:nixos/nixpkgs/78e34d1667d32d8a0ffc3eba4591ff256e80576e?narHash=sha256-vY2OLVg5ZTobdroQKQQSipSIkHlxOTrIF1fsMzPh8w8%3D' (2025-10-26)
  → 'github:nixos/nixpkgs/4c8cdd5b1a630e8f72c9dd9bf582b1afb3127d2c?narHash=sha256-LBVOyaH6NFzQ3X/c6vfMZ9k4SV2ofhpxeL9YnhHNJQQ%3D' (2025-11-16)
• Updated input 'nixpkgsMaster':
    'github:NixOS/nixpkgs/8865b77677eb576ce1dbcb90b7a1ae95a774a6cd?narHash=sha256-rIne9pcxSoaLCxcyICguhH3SUzE9lep464L7zRGBbZk%3D' (2025-10-27)
  → 'github:NixOS/nixpkgs/15901670689a6f338ebd2a9436b947ec189463a3?narHash=sha256-NzmsN8hRIn/9rJvZH3vPirBrOJJfeSfvPr4%2BfeeK7LY%3D' (2025-11-18)
• Updated input 'nur':
    'github:nix-community/NUR/378c5c7b0b2471b59b71e42b229ea5e68050235d?narHash=sha256-0UtnyehKLys0HWhctZEjKN7zDe%2BML0HCDdqdfHk221o%3D' (2025-10-27)
  → 'github:nix-community/NUR/4c584dcedf9aa3394e9730e62693515a0e47674b?narHash=sha256-B1ua1UtkPuMwT8o4nOR7yNP5yz10usMcNnxwHpGtLck%3D' (2025-11-18)
• Updated input 'nur/nixpkgs':
    'github:nixos/nixpkgs/6a08e6bb4e46ff7fcbb53d409b253f6bad8a28ce?narHash=sha256-Q/uhWNvd7V7k1H1ZPMy/vkx3F8C13ZcdrKjO7Jv7v0c%3D' (2025-10-25)
  → 'github:nixos/nixpkgs/50a96edd8d0db6cc8db57dab6bb6d6ee1f3dc49a?narHash=sha256-Y7TDFPK4GlqrKrivOcsHG8xSGqQx3A6c%2Bi7novT85Uk%3D' (2025-11-16)
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/5a7d18b5c55642df5c432aadb757140edfeb70b3?narHash=sha256-ee2e1/AeGL5X8oy/HXsZQvZnae6XfEVdstGopKucYLY%3D' (2025-10-20)
  → 'github:Mic92/sops-nix/3f66a7fb9626a9a9c077612ef10a0ce396286c7d?narHash=sha256-n5xDOeNN%2BsmocQp3EMIc11IzBlR9wvvTIJZeL0g33Fs%3D' (2025-11-17)
• Updated input 'vesc-tool':
    'github:vedderb/vesc_tool/8a6de0dda75e62681e7252a1512f34a5f4e70640?narHash=sha256-%2Bvk8SRGknwg5Q8y/R4oHkiLxe2SDQDYGj8jK7Xaeu6c%3D' (2025-10-17)
  → 'github:vedderb/vesc_tool/6a75051ce9742d97f14addd5d175ac516effb3c6?narHash=sha256-j%2BAZQYOuZ0X33p76LsZu4/NZl1Ccu6kkwPKC5HpIn1Y%3D' (2025-11-12)

.gitattributes

@@ -1,3 +1,5 @@
 **/secrets/** filter=git-crypt diff=git-crypt
 **/secrets.yaml diff=sops
 *.wav filter=lfs diff=lfs merge=lfs -text
+
+hosts/iron/services/tvproxy.nix filter=git-crypt diff=git-crypt

.sops.yaml

@@ -1,11 +1,12 @@
 keys:
-  - &admin_jalr 66FB54F6081375106EEBF651A222365EB448F934
+  - &admin_jalr 3044E71E3DEFF49B586CF5809BF4FCCB90854DA9
   - &admin_jalr_tb FE170812543DF81393EA56BA5042B8317A10617E
   - &host_aluminium age1ne08hny30vrkejqhh7dcx4ql6dmkx6jw9dqkf3cz7mzvt53njy0qh59w44
   - &host_hafnium age1ahnfjspcpwxxk7getcxkj3fypwt37rr6p3xsmp8n2tqqqz8jtg7q2am0et
   - &host_iron age1hx7fdu4mcha7kkxe7yevtvs6xgzgaafgenm3drhvr609wlj94sgqm497je
-  - &host_magnesium age1swv42gad884z2v75kateem6k2za6ltkq6wu90ewqp6dp7gxprawslwz0w0
+  - &host_magnesium age19qkgfaq08kmyxghet48dq4gxwjuy9zpvuyxys9jkmcqa5634537qlxjcd8
   - &host_weinturm_pretix_prod age1djjxl3lcvzs85nj0met6w8ujsz8pvr6ngmmdwlxfh0k9d5lkrpdqlzzehf
+  - &host_copper age1rrut5ntrkqmvttvmpa5jcmjhr2pfpyaqgu9dmtx6v07lgjxx5ppsl7e5v3
 creation_rules:
   - path_regex: hosts/aluminium/secrets\.yaml$
     key_groups:
@@ -37,6 +38,12 @@ creation_rules:
       - *admin_jalr
       age:
       - *host_weinturm_pretix_prod
+  - path_regex: hosts/copper/secrets\.yaml$
+    key_groups:
+    - pgp:
+      - *admin_jalr
+      age:
+      - *host_copper
   - path_regex: secrets\.yaml$
     key_groups:
     - pgp:

README.md

@@ -1,18 +1,27 @@
-## home-manager
-https://github.com/nix-community/home-manager
-
-For a systematic overview of Home Manager and its available options, please see
-- the [Home Manager manual](https://nix-community.github.io/home-manager/index.html) and
-- the [Home Manager configuration options](https://nix-community.github.io/home-manager/options.html).
-
+# jalr's NixOS Configuration
 
 ## Install a new host
 
 This installs nixos on host `somehost`:
+
+### NixOS Anywhere
+
+```bash
+nix run github:nix-community/nixos-anywhere -- --flake .#<somehost> root@<somehost>
+```
+
+### The traditional way
+
 ```bash
 nix-shell -p nixUnstable --run 'nixos-install --flake https://gitlab.jalr.de/jalr/nixos-configuration#somehost --no-channel-copy'
 ```
 
+### Build a configuration
+
+```
+nix build .#nixosConfigurations.iron.config.system.build.toplevel
+```
+
 ### setting up sops
 Get the host key and convert it.
 ```bash
@@ -46,4 +55,12 @@ nix-repl> :lf .#
 ```
 gpg --card-edit
 gpg/card> fetch
+gpg --edit-key $key
+gpg> trust
+Your decision? 5
 ```
+
+## Debugging boot issues
+
+1. Add `rd.systemd.debug_shell` kernel parameter
+2. Press CTRL+ALT+F9 to switch to root shell

custom-utils/default.nix

@@ -1,33 +1,5 @@
 { lib, ... }:
 
-let
-  filterPort = pm: port: (
-    lib.attrsets.catAttrs port (
-      lib.attrsets.attrValues (
-        lib.attrsets.filterAttrs (n: v: v ? "${port}") pm
-      )
-    )
-  );
-  onlyUniqueItemsInList = (x: lib.lists.length x == lib.lists.length (lib.lists.unique x));
-  protocols = (x: lib.lists.unique (lib.flatten (map builtins.attrNames (lib.attrValues x))));
-  mkRange = (x: lib.lists.range (builtins.elemAt x 0) (builtins.elemAt x 1));
-  validateList = allowed: builtins.all (x: builtins.elem x allowed);
-in
 {
-  validatePortAttrset = portmap:
-    if ! onlyUniqueItemsInList (lib.flatten (map
-      (x:
-        if lib.isInt x then x
-        else if lib.isList x then x
-        else if lib.isAttrs x then
-          (
-            if ! validateList [ "range" ] (builtins.attrNames x) then builtins.abort "found invalid attribute name"
-            else if x ? "range" then if lib.lists.length x.range == 2 then mkRange x.range else builtins.abort "range needs a list with exactly two items"
-            else builtins.abort "found invalid attrset"
-          )
-        else builtins.abort "found invalid entry in portmap"
-      )
-      (filterPort portmap "udp"))) then builtins.abort "Found duplicate ports."
-    else if ! validateList [ "tcp" "udp" ] (protocols portmap) then builtins.abort "Found invalid protocol."
-    else portmap;
+  validatePortAttrset = import ./ports.nix { inherit lib; };
 }

custom-utils/ports.nix

@@ -4,30 +4,30 @@ let
   filterPort = pm: port: (
     lib.attrsets.catAttrs port (
       lib.attrsets.attrValues (
-        lib.attrsets.filterAttrs (n: v: v ? "${port}") pm
+        lib.attrsets.filterAttrs (_: v: v ? "${port}") pm
       )
     )
   );
-  onlyUniqueItemsInList = (x: lib.lists.length x == lib.lists.length (lib.lists.unique x));
-  protocols = (x: lib.lists.unique (lib.flatten (map builtins.attrNames (lib.attrValues x))));
-  mkRange = (x: lib.lists.range (builtins.elemAt x 0) (builtins.elemAt x 1));
-  validateList = allowed: builtins.all (x: builtins.elem x allowed);
+  onlyUniqueItemsInList = x: lib.lists.length x == lib.lists.length (lib.lists.unique x);
+  mkRange = { from, to }: (lib.lists.range from to);
 in
-{
-  validatePortAttrset = portmap:
-    if ! onlyUniqueItemsInList (lib.flatten (map
-      (x:
-        if lib.isInt x then x
-        else if lib.isList x then x
-        else if lib.isAttrs x then
-          (
-            if ! validateList [ "range" ] (builtins.attrNames x) then builtins.abort "found invalid attribute name"
-            else if x ? "range" then if lib.lists.length x.range == 2 then mkRange x.range else builtins.abort "range needs a list with exactly two items"
-            else builtins.abort "found invalid attrset"
-          )
-        else builtins.abort "found invalid entry in portmap"
-      )
-      (filterPort portmap "udp"))) then builtins.abort "Found duplicate ports."
-    else if ! validateList [ "tcp" "udp" ] (protocols portmap) then builtins.abort "Found invalid protocol."
-    else portmap;
-}
+portmap:
+if builtins.all
+  (
+    proto:
+    if onlyUniqueItemsInList
+      (
+        lib.flatten (
+          map
+            (x:
+            if lib.isInt x then x
+            else if lib.isList x then x
+            else if lib.isAttrs x then mkRange x
+            else builtins.abort "found invalid entry in portmap"
+            )
+            (filterPort portmap proto)
+        )
+      ) then true else builtins.abort "Found duplicate ${proto} ports."
+  ) [ "tcp" "udp" ]
+then portmap
+else builtins.abort "Found duplicate ports."

flake.lock

@@ -1,13 +1,91 @@
 {
   "nodes": {
+    "asterisk-sounds-de": {
+      "inputs": {
+        "flake-utils": [
+          "flake-utils"
+        ],
+        "nix-filter": [
+          "nix-filter"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1748284610,
+        "narHash": "sha256-B3/OOZC0puXbODupPEbdMA6sJP39MzbMCl4j1HvgNfU=",
+        "ref": "refs/heads/main",
+        "rev": "6b1c484318727af78a64aee3f46903493dae8259",
+        "revCount": 1,
+        "type": "git",
+        "url": "https://git.jalr.de/jalr/asterisk-sounds-de"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.jalr.de/jalr/asterisk-sounds-de"
+      }
+    },
+    "bldcSrc": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1733324381,
+        "narHash": "sha256-ui9N8QSog1G5zyK7yRrD0Xl+Y2CZhvvhBkaJuQZ2qZw=",
+        "owner": "vedderb",
+        "repo": "bldc",
+        "rev": "a0d40e2c5a42c810888d8c379307e6b0a118a125",
+        "type": "github"
+      },
+      "original": {
+        "owner": "vedderb",
+        "ref": "release_6_05",
+        "repo": "bldc",
+        "type": "github"
+      }
+    },
+    "crane": {
+      "locked": {
+        "lastModified": 1731098351,
+        "narHash": "sha256-HQkYvKvaLQqNa10KEFGgWHfMAbWBfFp+4cAgkut+NNE=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "ef80ead953c1b28316cc3f8613904edc2eb90c28",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1762276996,
+        "narHash": "sha256-TtcPgPmp2f0FAnc+DMEw4ardEgv1SGNR3/WFGH0N19M=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "af087d076d3860760b3323f6b583f4d828c1ac17",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1673956053,
-        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
         "type": "github"
       },
       "original": {
@@ -16,16 +94,74 @@
         "type": "github"
       }
     },
+    "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1747046372,
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1730504689,
+        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "nur",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1733312601,
+        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "inputs": {
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1701680307,
-        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
         "type": "github"
       },
       "original": {
@@ -34,7 +170,49 @@
         "type": "github"
       }
     },
+    "gg-chatmix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1748177977,
+        "narHash": "sha256-xC/dOrDrZoQhUfVotj/z14iTwGlE80OqSl9S5zkevdA=",
+        "owner": "nilathedragon",
+        "repo": "gg-chatmix",
+        "rev": "1dadaa51794042c20ddc52d52479e8a156bd235b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nilathedragon",
+        "repo": "gg-chatmix",
+        "type": "github"
+      }
+    },
     "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "pre-commit-hooks-nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
+    "gitignore_2": {
       "inputs": {
         "nixpkgs": [
           "nix-pre-commit-hooks",
@@ -42,11 +220,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1660459072,
-        "narHash": "sha256-8DFJjXG8zqoONA1vXtgeKXy68KdJL5UaXR8NtVMUbx8=",
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
         "owner": "hercules-ci",
         "repo": "gitignore.nix",
-        "rev": "a20de23b925fd8264fd7fad6454652e142fd7f73",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
         "type": "github"
       },
       "original": {
@@ -65,11 +243,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1701687253,
-        "narHash": "sha256-qJCMxIKWXonJODPF2oV7mCd0xu7VYVenTucrY0bizto=",
+        "lastModified": 1759991118,
+        "narHash": "sha256-pDyrtUQyeP1lVTMIYqJtftzDtsXEZaJjYy9ZQ/SGhL8=",
         "owner": "nix-community",
         "repo": "gomod2nix",
-        "rev": "001bbfa22e2adeb87c34c6015e5694e88721cabe",
+        "rev": "7f8d7438f5870eb167abaf2c39eea3d2302019d1",
         "type": "github"
       },
       "original": {
@@ -85,20 +263,35 @@
         ]
       },
       "locked": {
-        "lastModified": 1703367386,
-        "narHash": "sha256-FMbm48UGrBfOWGt8+opuS+uLBLQlRfhiYXhHNcYMS5k=",
+        "lastModified": 1758463745,
+        "narHash": "sha256-uhzsV0Q0I9j2y/rfweWeGif5AWe0MGrgZ/3TjpDYdGA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "d5824a76bc6bb93d1dce9ebbbcb09a9b6abcc224",
+        "rev": "3b955f5f0a942f9f60cdc9cacb7844335d0f21c3",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-23.11",
+        "ref": "release-25.05",
         "repo": "home-manager",
         "type": "github"
       }
     },
+    "impermanence": {
+      "locked": {
+        "lastModified": 1737831083,
+        "narHash": "sha256-LJggUHbpyeDvNagTUrdhe/pRVp4pnS6wVKALS782gRI=",
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "rev": "4b3e914cdf97a5b536a889e939fb2fd2b043a170",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "type": "github"
+      }
+    },
     "krops": {
       "inputs": {
         "flake-utils": [
@@ -122,6 +315,47 @@
         "type": "github"
       }
     },
+    "lanzaboote": {
+      "inputs": {
+        "crane": "crane",
+        "flake-compat": "flake-compat",
+        "flake-parts": "flake-parts",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pre-commit-hooks-nix": "pre-commit-hooks-nix",
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1737639419,
+        "narHash": "sha256-AEEDktApTEZ5PZXNDkry2YV2k6t0dTgLPEmAZbnigXU=",
+        "owner": "nix-community",
+        "repo": "lanzaboote",
+        "rev": "a65905a09e2c43ff63be8c0e86a93712361f871e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "v0.4.2",
+        "repo": "lanzaboote",
+        "type": "github"
+      }
+    },
+    "nix-filter": {
+      "locked": {
+        "lastModified": 1757882181,
+        "narHash": "sha256-+cCxYIh2UNalTz364p+QYmWHs0P+6wDhiWR4jDIKQIU=",
+        "owner": "numtide",
+        "repo": "nix-filter",
+        "rev": "59c44d1909c72441144b93cf0f054be7fe764de5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "nix-filter",
+        "type": "github"
+      }
+    },
     "nix-github-actions": {
       "inputs": {
         "nixpkgs": [
@@ -130,11 +364,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1698974481,
-        "narHash": "sha256-yPncV9Ohdz1zPZxYHQf47S8S0VrnhV7nNhCawY46hDA=",
+        "lastModified": 1729742964,
+        "narHash": "sha256-B4mzTcQ0FZHdpeWcpDYPERtyjJd/NIuaQ9+BV1h+MpA=",
         "owner": "nix-community",
         "repo": "nix-github-actions",
-        "rev": "4bb5e752616262457bc7ca5882192a564c0472d2",
+        "rev": "e04df33f62cdcf93d73e9a04142464753a16db67",
         "type": "github"
       },
       "original": {
@@ -145,84 +379,82 @@
     },
     "nix-pre-commit-hooks": {
       "inputs": {
-        "flake-compat": "flake-compat",
-        "flake-utils": [
-          "flake-utils"
-        ],
-        "gitignore": "gitignore",
-        "nixpkgs": "nixpkgs",
-        "nixpkgs-stable": "nixpkgs-stable"
+        "flake-compat": "flake-compat_2",
+        "gitignore": "gitignore_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1703939133,
-        "narHash": "sha256-Gxe+mfOT6bL7wLC/tuT2F+V+Sb44jNr8YsJ3cyIl4Mo=",
+        "lastModified": 1763319842,
+        "narHash": "sha256-YG19IyrTdnVn0l3DvcUYm85u3PaqBt6tI6VvolcuHnA=",
         "owner": "cachix",
-        "repo": "pre-commit-hooks.nix",
-        "rev": "9d3d7e18c6bc4473d7520200d4ddab12f8402d38",
+        "repo": "git-hooks.nix",
+        "rev": "7275fa67fbbb75891c16d9dee7d88e58aea2d761",
         "type": "github"
       },
       "original": {
         "owner": "cachix",
         "ref": "master",
-        "repo": "pre-commit-hooks.nix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "nixos-hardware": {
+      "locked": {
+        "lastModified": 1762847253,
+        "narHash": "sha256-BWWnUUT01lPwCWUvS0p6Px5UOBFeXJ8jR+ZdLX8IbrU=",
+        "owner": "nixos",
+        "repo": "nixos-hardware",
+        "rev": "899dc449bc6428b9ee6b3b8f771ca2b0ef945ab9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "master",
+        "repo": "nixos-hardware",
         "type": "github"
       }
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1689261696,
-        "narHash": "sha256-LzfUtFs9MQRvIoQ3MfgSuipBVMXslMPH/vZ+nM40LkA=",
-        "owner": "NixOS",
+        "lastModified": 1763334038,
+        "narHash": "sha256-LBVOyaH6NFzQ3X/c6vfMZ9k4SV2ofhpxeL9YnhHNJQQ=",
+        "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "df1eee2aa65052a18121ed4971081576b25d6b5c",
+        "rev": "4c8cdd5b1a630e8f72c9dd9bf582b1afb3127d2c",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
+        "owner": "nixos",
+        "ref": "nixos-25.05",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1685801374,
-        "narHash": "sha256-otaSUoFEMM+LjBI1XL/xGB5ao6IwnZOXc47qhIgJe8U=",
+        "lastModified": 1730741070,
+        "narHash": "sha256-edm8WG19kWozJ/GqyYx2VjW99EdhjKwbY3ZwdlPAAlo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c37ca420157f4abc31e26f436c1145f8951ff373",
+        "rev": "d063c1dd113c91ab27959ba540c0d9753409edf3",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-23.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-stable_2": {
-      "locked": {
-        "lastModified": 1703950681,
-        "narHash": "sha256-veU5bE4eLOmi7aOzhE7LfZXcSOONRMay0BKv01WHojo=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "0aad9113182747452dbfc68b93c86e168811fa6c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "release-23.05",
+        "ref": "nixos-24.05",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgsMaster": {
       "locked": {
-        "lastModified": 1704028587,
-        "narHash": "sha256-gvnPImYfQkcb1ZQXKHUfec7f+XRxRMCg++TWhAYp/XQ=",
+        "lastModified": 1763473525,
+        "narHash": "sha256-NzmsN8hRIn/9rJvZH3vPirBrOJJfeSfvPr4+feeK7LY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "bab500a21ac81b122bc9b573429b724eb74225e1",
+        "rev": "15901670689a6f338ebd2a9436b947ec189463a3",
         "type": "github"
       },
       "original": {
@@ -232,29 +464,65 @@
         "type": "github"
       }
     },
-    "nixpkgs_2": {
+    "nixpkgsOld": {
       "locked": {
-        "lastModified": 1703900474,
-        "narHash": "sha256-Zu+chYVYG2cQ4FCbhyo6rc5Lu0ktZCjRbSPE0fDgukI=",
+        "lastModified": 1748037224,
+        "narHash": "sha256-92vihpZr6dwEMV6g98M5kHZIttrWahb9iRPBm1atcPk=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "9dd7699928e26c3c00d5d46811f1358524081062",
+        "rev": "f09dede81861f3a83f7f06641ead34f02f37597f",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-23.11",
+        "ref": "nixos-24.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1763283776,
+        "narHash": "sha256-Y7TDFPK4GlqrKrivOcsHG8xSGqQx3A6c+i7novT85Uk=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "50a96edd8d0db6cc8db57dab6bb6d6ee1f3dc49a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1735554305,
+        "narHash": "sha256-zExSA1i/b+1NMRhGGLtNfFGXgLtgo+dcuzHzaWA6w3Q=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "0e82ab234249d8eee3e8c91437802b32c74bb3fd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixpkgs-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nur": {
+      "inputs": {
+        "flake-parts": "flake-parts_2",
+        "nixpkgs": "nixpkgs_2"
+      },
       "locked": {
-        "lastModified": 1704028639,
-        "narHash": "sha256-fDN/0YA5EUCu1ic6NyWoie5W+VzrX0aHVvFkrY0np18=",
+        "lastModified": 1763471545,
+        "narHash": "sha256-B1ua1UtkPuMwT8o4nOR7yNP5yz10usMcNnxwHpGtLck=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "c1a78c7eeacb194aef527a7f41910f3866e2f14b",
+        "rev": "4c584dcedf9aa3394e9730e62693515a0e47674b",
         "type": "github"
       },
       "original": {
@@ -276,11 +544,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1703546497,
-        "narHash": "sha256-CN/7HaEmHz+akXKejkRVhsxAm6HPGOmYBWMtgMkuROA=",
+        "lastModified": 1743690424,
+        "narHash": "sha256-cX98bUuKuihOaRp8dNV1Mq7u6/CQZWTPth2IJPATBXc=",
         "owner": "nix-community",
         "repo": "poetry2nix",
-        "rev": "528d500ea826383cc126a9be1e633fc92b19ce5d",
+        "rev": "ce2369db77f45688172384bbeb962bc6c2ea6f94",
         "type": "github"
       },
       "original": {
@@ -289,33 +557,88 @@
         "type": "github"
       }
     },
+    "pre-commit-hooks-nix": {
+      "inputs": {
+        "flake-compat": [
+          "lanzaboote",
+          "flake-compat"
+        ],
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ],
+        "nixpkgs-stable": "nixpkgs-stable"
+      },
+      "locked": {
+        "lastModified": 1731363552,
+        "narHash": "sha256-vFta1uHnD29VUY4HJOO/D6p6rxyObnf+InnSMT4jlMU=",
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "rev": "cd1af27aa85026ac759d5d3fccf650abe7e1bbf0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
+        "asterisk-sounds-de": "asterisk-sounds-de",
+        "disko": "disko",
         "flake-utils": "flake-utils",
+        "gg-chatmix": "gg-chatmix",
         "gomod2nix": "gomod2nix",
         "home-manager": "home-manager",
+        "impermanence": "impermanence",
         "krops": "krops",
+        "lanzaboote": "lanzaboote",
+        "nix-filter": "nix-filter",
         "nix-pre-commit-hooks": "nix-pre-commit-hooks",
-        "nixpkgs": "nixpkgs_2",
+        "nixos-hardware": "nixos-hardware",
+        "nixpkgs": "nixpkgs",
         "nixpkgsMaster": "nixpkgsMaster",
         "nur": "nur",
         "poetry2nix": "poetry2nix",
-        "sops-nix": "sops-nix"
+        "sops-nix": "sops-nix",
+        "vesc-tool": "vesc-tool"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1731897198,
+        "narHash": "sha256-Ou7vLETSKwmE/HRQz4cImXXJBr/k9gp4J4z/PF8LzTE=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "0be641045af6d8666c11c2c40e45ffc9667839b5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
       }
     },
     "sops-nix": {
       "inputs": {
         "nixpkgs": [
           "nixpkgs"
-        ],
-        "nixpkgs-stable": "nixpkgs-stable_2"
+        ]
       },
       "locked": {
-        "lastModified": 1703991717,
-        "narHash": "sha256-XfBg2dmDJXPQEB8EdNBnzybvnhswaiAkUeeDj7fa/hQ=",
+        "lastModified": 1763417348,
+        "narHash": "sha256-n5xDOeNN+smocQp3EMIc11IzBlR9wvvTIJZeL0g33Fs=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "cfdbaf68d00bc2f9e071f17ae77be4b27ff72fa6",
+        "rev": "3f66a7fb9626a9a9c077612ef10a0ce396286c7d",
         "type": "github"
       },
       "original": {
@@ -349,8 +672,9 @@
         "type": "github"
       },
       "original": {
-        "id": "systems",
-        "type": "indirect"
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
       }
     },
     "treefmt-nix": {
@@ -361,11 +685,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1699786194,
-        "narHash": "sha256-3h3EH1FXQkIeAuzaWB+nK0XK54uSD46pp+dMD3gAcB4=",
+        "lastModified": 1730120726,
+        "narHash": "sha256-LqHYIxMrl/1p3/kvm2ir925tZ8DkI0KA10djk8wecSk=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "e82f32aa7f06bbbd56d7b12186d555223dc399d1",
+        "rev": "9ef337e492a5555d8e17a51c911ff1f02635be15",
         "type": "github"
       },
       "original": {
@@ -373,6 +697,51 @@
         "repo": "treefmt-nix",
         "type": "github"
       }
+    },
+    "treefmt-nix_2": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_3"
+      },
+      "locked": {
+        "lastModified": 1744961264,
+        "narHash": "sha256-aRmUh0AMwcbdjJHnytg1e5h5ECcaWtIFQa6d9gI85AI=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "8d404a69efe76146368885110f29a2ca3700bee6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
+    "vesc-tool": {
+      "inputs": {
+        "bldcSrc": "bldcSrc",
+        "flake-utils": [
+          "flake-utils"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "nixpkgsOld": "nixpkgsOld",
+        "treefmt-nix": "treefmt-nix_2"
+      },
+      "locked": {
+        "lastModified": 1762968599,
+        "narHash": "sha256-j+AZQYOuZ0X33p76LsZu4/NZl1Ccu6kkwPKC5HpIn1Y=",
+        "owner": "vedderb",
+        "repo": "vesc_tool",
+        "rev": "6a75051ce9742d97f14addd5d175ac516effb3c6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "vedderb",
+        "ref": "master",
+        "repo": "vesc_tool",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -1,19 +1,58 @@
 {
   inputs = {
-    flake-utils.url = "github:numtide/flake-utils";
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-23.11";
-    nixpkgsMaster.url = "github:NixOS/nixpkgs/master";
+    disko.inputs.nixpkgs.follows = "nixpkgs";
+    disko.url = "github:nix-community/disko";
 
-    nur.url = "github:nix-community/NUR";
+    flake-utils.url = "github:numtide/flake-utils";
+
+    nix-filter.url = "github:numtide/nix-filter";
+
+    gg-chatmix = {
+      url = "github:nilathedragon/gg-chatmix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    gomod2nix = {
+      url = "github:nix-community/gomod2nix";
+      inputs.flake-utils.follows = "flake-utils";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
     home-manager = {
-      url = "github:nix-community/home-manager/release-23.11";
+      url = "github:nix-community/home-manager/release-25.05";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    impermanence.url = "github:nix-community/impermanence";
+
+    krops = {
+      url = "github:Mic92/krops";
+      inputs.flake-utils.follows = "flake-utils";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    lanzaboote = {
+      url = "github:nix-community/lanzaboote/v0.4.2";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
     nix-pre-commit-hooks = {
-      url = "github:cachix/pre-commit-hooks.nix/master";
+      url = "github:cachix/git-hooks.nix/master";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    nixos-hardware.url = "github:nixos/nixos-hardware/master";
+
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
+
+    nixpkgsMaster.url = "github:NixOS/nixpkgs/master";
+
+    nur.url = "github:nix-community/NUR";
+
+    poetry2nix = {
+      url = "github:nix-community/poetry2nix";
       inputs.flake-utils.follows = "flake-utils";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
 
     sops-nix = {
@@ -21,40 +60,29 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    krops = {
-      url = "github:Mic92/krops";
+    asterisk-sounds-de = {
+      url = "git+https://git.jalr.de/jalr/asterisk-sounds-de";
       inputs = {
         flake-utils.follows = "flake-utils";
+        nix-filter.follows = "nix-filter";
         nixpkgs.follows = "nixpkgs";
       };
     };
 
-    gomod2nix = {
-      url = "github:nix-community/gomod2nix";
-      inputs = {
-        flake-utils.follows = "flake-utils";
-        nixpkgs.follows = "nixpkgs";
-      };
-    };
-
-    poetry2nix = {
-      url = "github:nix-community/poetry2nix";
-      inputs = {
-        flake-utils.follows = "flake-utils";
-        nixpkgs.follows = "nixpkgs";
-      };
+    vesc-tool = {
+      url = "github:vedderb/vesc_tool/master";
+      inputs.flake-utils.follows = "flake-utils";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
   };
   outputs =
     { self
     , flake-utils
-    , gomod2nix
     , home-manager
     , krops
     , nix-pre-commit-hooks
     , nixpkgs
     , nur
-    , poetry2nix
     , ...
     }@inputs: flake-utils.lib.eachSystem [
       "x86_64-linux"
@@ -70,20 +98,26 @@
             src = self;
             hooks = {
               black.enable = true;
+              deadnix.enable = true;
               nixpkgs-fmt.enable = true;
               shellcheck.enable = true;
+              statix = {
+                enable = true;
+                settings.ignore = [ ".direnv" ];
+              };
             };
+            excludes = [ ".envrc" ];
           };
         };
         devShells.default = pkgs.mkShell {
-          buildInputs = (with pkgs; [
+          buildInputs = with pkgs; [
             black
             just
             nixpkgs-fmt
             shellcheck
             sops
             ssh-to-age
-          ]);
+          ];
 
           shellHook = ''
             ${self.checks.${system}.pre-commit-check.shellHook}
@@ -91,7 +125,7 @@
         };
 
         apps = lib.mapAttrs
-          (name: program: { type = "app"; program = toString program; })
+          (_: program: { type = "app"; program = toString program; })
           (flake-utils.lib.flattenTree {
             deploy = lib.recurseIntoAttrs (lib.mapAttrs
               (hostname: machine:
@@ -115,6 +149,7 @@
                   command = targetPath: ''
                     nixos-rebuild switch --flake ${targetPath}/config -L --keep-going
                   '';
+                  force = true;
                 }
               )
               self.nixosConfigurations);
@@ -149,42 +184,67 @@
                    , extraModules ? [ ]
                    , targetHost ? hostname
                    , nixpkgs ? inputs.nixpkgs
-                   }: nixpkgs.lib.nixosSystem rec {
+                   }: nixpkgs.lib.nixosSystem {
           inherit system;
           specialArgs = { inherit self system; };
 
-          modules = [
-            (./hosts + "/${hostname}/configuration.nix")
+          modules =
+            let
+              hostDir = ./hosts + "/${hostname}";
+            in
+            [
+              (hostDir + "/configuration.nix")
 
-            ./modules
+              ./modules
 
-            {
-              _module.args = {
-                inputs = inputs;
-                custom-utils = import ./custom-utils { lib = nixpkgs.lib; };
-              };
-            }
-
-            # deployment settings
-            ({ lib, ... }: {
-              options.deployment = {
-                targetHost = lib.mkOption {
-                  type = lib.types.str;
-                  readOnly = true;
-                  internal = true;
+              {
+                _module.args = {
+                  inherit inputs;
+                  custom-utils = import ./custom-utils { inherit (nixpkgs) lib; };
                 };
-              };
-              config.deployment = {
-                inherit targetHost;
-              };
-            })
-          ] ++ [{
-            nixpkgs.overlays = [ nur.overlay ];
-          }] ++ [
-            home-manager.nixosModules.home-manager
-          ] ++ (with inputs; [
-            sops-nix.nixosModules.sops
-          ]) ++ extraModules;
+              }
+
+              # deployment settings
+              ({ lib, ... }: {
+                options.deployment = {
+                  targetHost = lib.mkOption {
+                    type = lib.types.str;
+                    readOnly = true;
+                    internal = true;
+                  };
+                };
+                config.deployment = {
+                  inherit targetHost;
+                };
+              })
+
+              # sops settings
+              ({ lib, config, pkgs, ... }:
+                {
+                  sops.defaultSopsFile = hostDir + "/secrets.yaml";
+                  sops.secrets =
+                    let
+                      secretFile = config.sops.defaultSopsFile;
+                      getSecrets = file: builtins.fromJSON (builtins.readFile (pkgs.runCommandNoCC "secretKeys" { } ''${pkgs.yq-go}/bin/yq -o json '[del .sops | .. | select(tag != "!!seq" and tag != "!!map") | path | join("/")]' ${file} > $out''));
+                      secretNames = getSecrets secretFile;
+                      secrets =
+                        if builtins.pathExists secretFile then
+                          lib.listToAttrs (builtins.map (name: lib.nameValuePair name { }) secretNames)
+                        else
+                          { };
+                    in
+                    secrets;
+                })
+            ] ++ [
+              { nixpkgs.overlays = [ nur.overlays.default inputs.vesc-tool.overlays.default ]; }
+              home-manager.nixosModules.home-manager
+              inputs.asterisk-sounds-de.nixosModules.default
+              inputs.disko.nixosModules.disko
+              inputs.impermanence.nixosModules.impermanence
+              inputs.lanzaboote.nixosModules.lanzaboote
+              inputs.sops-nix.nixosModules.sops
+              inputs.gg-chatmix.nixosModule
+            ] ++ extraModules;
         })
         (import ./hosts inputs);
     };

home-manager/README.md

@@ -1,2 +0,0 @@
-# Documentation
-[Home Manager Manual](https://rycee.gitlab.io/home-manager/)

home-manager/modules/alacritty.nix

@@ -1,174 +0,0 @@
-{ lib, pkgs, nixosConfig, ... }:
-let
-  solarized = import ./solarized.nix;
-
-  #nixosConfig.jalr.terminalEmulator.command = pkgs.writeShellScriptBin "alacritty-sway-cwd" ''
-  #  this_alacritty_pid="$(swaymsg -t get_tree | ${pkgs.jq} -e 'recurse(.nodes[]?) | select((.focused==true) and (.app_id=="Alacritty")).pid')"
-
-  #  if [ "$this_alacritty_pid" ]; then
-  #      child_pid="$(pgrep -P "$this_alacritty_pid")"
-  #      cwd="$(readlink /proc/$child_pid/cwd)"
-  #  fi
-  #  if [ -e "$cwd" ]; then
-  #      exec ${pkgs.alacritty} --working-directory "$cwd"
-  #  fi
-
-  #  exec alacritty
-  #'';
-
-  colorschemes = {
-    # https://github.com/alacritty/alacritty/wiki/Color-schemes#solarized
-    solarized-dark = {
-      # Default colors
-      primary = {
-        background = solarized.base03.hex;
-        foreground = solarized.base0.hex;
-      };
-
-      # Cursor colors
-      cursor = {
-        text = solarized.base03.hex;
-        cursor = solarized.base0.hex;
-      };
-
-      # Normal colors
-      normal = {
-        black = solarized.base02.hex;
-        red = solarized.red.hex;
-        green = solarized.green.hex;
-        yellow = solarized.yellow.hex;
-        blue = solarized.blue.hex;
-        magenta = solarized.magenta.hex;
-        cyan = solarized.cyan.hex;
-        white = solarized.base2.hex;
-      };
-
-      # Bright colors
-      bright = {
-        black = solarized.base03.hex;
-        red = solarized.orange.hex;
-        green = solarized.base01.hex;
-        yellow = solarized.base00.hex;
-        blue = solarized.base0.hex;
-        magenta = solarized.violet.hex;
-        cyan = solarized.base1.hex;
-        white = solarized.base3.hex;
-      };
-    };
-
-    solarized-light = {
-      # Default colors
-      primary = {
-        background = solarized.base3.hex;
-        foreground = solarized.base00.hex;
-      };
-
-      # Cursor colors
-      cursor = {
-        text = solarized.base3.hex;
-        cursor = solarized.base00.hex;
-      };
-
-      # Normal colors
-      normal = {
-        black = solarized.base02.hex;
-        red = solarized.red.hex;
-        green = solarized.green.hex;
-        yellow = solarized.yellow.hex;
-        blue = solarized.blue.hex;
-        magenta = solarized.magenta.hex;
-        cyan = solarized.cyan.hex;
-        white = solarized.base2.hex;
-      };
-
-      # Bright colors
-      bright = {
-        black = solarized.base03.hex;
-        red = solarized.orange.hex;
-        green = solarized.base01.hex;
-        yellow = solarized.base00.hex;
-        blue = solarized.base0.hex;
-        magenta = solarized.violet.hex;
-        cyan = solarized.base1.hex;
-        white = solarized.base3.hex;
-      };
-    };
-  };
-  commonSettings = {
-    font = {
-      normal = {
-        family = "Inconsolata for Powerline";
-        style = "Regular";
-      };
-      size = 12;
-    };
-
-    mouse.hide_when_typing = true;
-
-    key_bindings = [
-      {
-        key = "F1";
-        mods = "Control";
-        action = "DecreaseFontSize";
-      }
-      {
-        key = "F2";
-        mods = "Control";
-        action = "IncreaseFontSize";
-      }
-    ];
-
-    bell = {
-      duration = 100;
-      color = "#000000";
-    };
-
-    window.dynamic_title = true;
-
-    scrolling.history = 100000;
-
-    window.opacity = 0.95;
-  };
-  settings = {
-    dark = commonSettings // {
-      colors = colorschemes.solarized-dark;
-    };
-    light = commonSettings // {
-      colors = colorschemes.solarized-light;
-    };
-  };
-in
-{
-
-  programs.alacritty = {
-    enable = nixosConfig.jalr.gui.enable;
-  };
-
-  # The option `home-manager.users.jalr.xdg.configFile.dark.alacritty/alacritty-dark.yml' does not exist
-
-  /*
-    xdg.configFile = builtins.mapAttrs (colorScheme: cfg: {
-    "alacritty/alacritty-${colorScheme}.yml" = lib.replaceStrings [ "\\\\" ] [ "\\" ] (builtins.toJSON cfg);
-    }) settings;
-  */
-
-  xdg.configFile = lib.attrsets.mapAttrs'
-    (colorScheme: cfg: lib.attrsets.nameValuePair "alacritty/alacritty-${colorScheme}.yml" {
-      text = lib.replaceStrings [ "\\\\" ] [ "\\" ] (builtins.toJSON cfg);
-    })
-    settings;
-
-  programs.fish.functions = {
-    ssh = {
-      description = "ssh wrapper function";
-      wraps = "ssh";
-      body = ''
-        if [ "$TERM" = alacritty ]
-            TERM=xterm-256color command ssh $argv
-        else
-            command ssh $argv
-        end
-      '';
-    };
-  };
-}

home-manager/modules/cli.nix

@@ -1,23 +0,0 @@
-{ nixosConfig, lib, pkgs, ... }:
-{
-  home.packages = with pkgs; [
-    cached-nix-shell
-    eza
-    file
-    htop
-    inetutils
-    jq
-    lsof
-    ncdu
-    ripgrep
-    unzip
-  ] ++ (if ! nixosConfig.jalr.workstation.enable then [ ] else [
-    direnv
-    dnsutils
-    screen
-    speedtest-cli
-    usbutils
-    wget
-    yt-dlp
-  ]);
-}

home-manager/modules/communication/default.nix

@@ -1,10 +0,0 @@
-{ nixosConfig, ... }:
-
-{
-  imports = [
-    ./ferdium.nix
-    ./mumble.nix
-    ./qtox.nix
-    ./telegram-desktop.nix
-  ];
-}

home-manager/modules/communication/ferdium.nix

@@ -1,7 +0,0 @@
-{ nixosConfig, lib, pkgs, ... }:
-
-lib.mkIf nixosConfig.jalr.tradebyte.enable {
-  home.packages = with pkgs; [
-    master.ferdium
-  ];
-}

home-manager/modules/firefox/default.nix

@@ -1,103 +0,0 @@
-{ nixosConfig, pkgs, ... }:
-{
-  programs.firefox = {
-    enable = nixosConfig.jalr.gui.enable;
-    package = pkgs.firefox-esr;
-    profiles = {
-      default = {
-        extensions = with pkgs.nur.repos.rycee.firefox-addons; [
-          darkreader
-          tree-style-tab
-          ublock-origin
-          umatrix
-          violentmonkey
-        ];
-        settings = {
-          #"browser.startup.homepage" = "https://nixos.org";
-          #"browser.search.region" = "GB";
-          #"browser.search.isUS" = false;
-          #"distribution.searchplugins.defaultLocale" = "en-GB";
-          #"general.useragent.locale" = "en-GB";
-          #"browser.bookmarks.showMobileBookmarks" = true;
-          "app.normandy.enabled" = false;
-          "app.shield.optoutstudies.enabled" = false;
-          "app.update.auto" = false;
-          "browser.ctrlTab.sortByRecentlyUsed" = true;
-          "browser.fixup.alternate.enabled" = false;
-          "browser.formfill.enable" = false;
-          "browser.link.open_newwindow.restriction" = 0;
-          "browser.newtabpage.enabled" = false;
-          "browser.ping-centre.telemetry" = false;
-          "browser.safebrowsing.downloads.enabled" = false;
-          "browser.safebrowsing.downloads.remote.block_dangerous" = false;
-          "browser.safebrowsing.downloads.remote.block_dangerous_host" = false;
-          "browser.safebrowsing.downloads.remote.block_potentially_unwanted" = false;
-          "browser.safebrowsing.downloads.remote.block_uncommon" = false;
-          "browser.safebrowsing.downloads.remote.enabled" = false;
-          "browser.safebrowsing.downloads.remote.url" = "";
-          "browser.safebrowsing.malware.enabled" = false;
-          "browser.safebrowsing.phishing.enabled" = false;
-          "browser.safebrowsing.provider.google.advisoryURL" = "";
-          "browser.safebrowsing.provider.google.gethashURL" = "";
-          "browser.safebrowsing.provider.google.lists" = "";
-          "browser.safebrowsing.provider.google.reportMalwareMistakeURL" = "";
-          "browser.safebrowsing.provider.google.reportPhishMistakeURL" = "";
-          "browser.safebrowsing.provider.google.reportURL" = "";
-          "browser.safebrowsing.provider.google.updateURL" = "";
-          "browser.safebrowsing.provider.google4.advisoryURL" = "";
-          "browser.safebrowsing.provider.google4.dataSharingURL" = "";
-          "browser.safebrowsing.provider.google4.gethashURL" = "";
-          "browser.safebrowsing.provider.google4.lists" = "";
-          "browser.safebrowsing.provider.google4.reportMalwareMistakeURL" = "";
-          "browser.safebrowsing.provider.google4.reportPhishMistakeURL" = "";
-          "browser.safebrowsing.provider.google4.reportURL" = "";
-          "browser.safebrowsing.provider.google4.updateURL" = "";
-          "browser.safebrowsing.provider.mozilla.gethashURL" = "";
-          "browser.safebrowsing.provider.mozilla.lists" = "";
-          "browser.safebrowsing.provider.mozilla.updateURL" = "";
-          "browser.search.suggest.enabled" = false;
-          "browser.search.widget.inNavBar" = true;
-          "browser.startup.page" = 0;
-          "extensions.pocket.enabled" = false;
-          "extensions.update.enabled" = false;
-          "identity.fxaccounts.enabled" = false;
-          "keyword.enabled" = false;
-          "network.captive-portal-service.enabled" = false;
-          "network.predictor.enabled" = false;
-          "privacy.donottrackheader.enabled" = true;
-          "startup.homepage_welcome_url" = about:blank;
-          "toolkit.legacyUserProfileCustomizations.stylesheets" = true;
-          "toolkit.telemetry.archive.enabled" = false;
-          "toolkit.telemetry.bhrPing.enabled" = false;
-          "toolkit.telemetry.firstShutdownPing.enabled" = false;
-          "toolkit.telemetry.newProfilePing.enabled" = false;
-          "toolkit.telemetry.server" = http://127.0.0.1:4711;
-          "toolkit.telemetry.server_owner" = "";
-          "toolkit.telemetry.shutdownPingSender.enabled" = false;
-          "toolkit.telemetry.updatePing.enabled" = false;
-          "urlclassifier.downloadAllowTable" = "";
-          "urlclassifier.downloadBlockTable" = "";
-          "urlclassifier.malwareTable" = "";
-          "urlclassifier.phishTable" = "";
-          "datareporting.healthreport.uploadEnabled" = "";
-          "app.normandy.api_url" = "";
-          "breakpad.reportURL" = "";
-          "browser.region.network.url" = "";
-          "browser.search.geoSpecificDefaults.url" = "";
-          "browser.shell.checkDefaultBrowser" = false;
-
-          "privacy.userContext.enabled" = true;
-          "privacy.userContext.ui.enabled" = true;
-          "network.dnsCacheExpiration" = 0;
-
-          # disable disk cache to reduce ssd writes
-          "browser.cache.disk.enable" = false;
-          "browser.cache.memory.enable" = true;
-          "browser.cache.memory.capacity" = -1;
-        };
-        userChrome = builtins.readFile ./userChrome.css;
-
-      };
-    };
-  };
-}

home-manager/modules/fish.nix

@@ -1,201 +0,0 @@
-{ config, pkgs, ... }:
-{
-  home.packages = with pkgs; [
-    fzf
-  ];
-  programs.fish = {
-    enable = true;
-    plugins = [
-      {
-        name = "theme-agnoster";
-        src = pkgs.fetchFromGitHub {
-          owner = "oh-my-fish";
-          repo = "theme-agnoster";
-          rev = "c142e802983bd1b34b4d91efac2126fc5913126d";
-          sha256 = "0PLx626BWoBp/L6wgkB4o+53q8PymiEE/rTu2mfzHhg=";
-          fetchSubmodules = true;
-        };
-      }
-      {
-        name = "fzf";
-        src = pkgs.fetchFromGitHub {
-          owner = "jethrokuan";
-          repo = "fzf";
-          rev = "479fa67d7439b23095e01b64987ae79a91a4e283";
-          sha256 = "0k6l21j192hrhy95092dm8029p52aakvzis7jiw48wnbckyidi6v";
-          fetchSubmodules = true;
-        };
-      }
-    ];
-    shellAliases = {
-      ls = "ls --color=auto";
-      crontab = "crontab -i";
-    };
-
-    shellAbbrs = {
-      lessr = "less -R";
-      jqc = "jq -C";
-    };
-
-    #interactiveShellInit = ''
-    #  echo "programs.fish.interactiveShellInit"
-    #'';
-    shellInit = ''
-      # key bindings
-      bind \cr '__fzf_reverse_isearch'
-
-      # PATH
-      set -U fish_user_paths $HOME/.local/bin $HOME/.local/bin/pio
-
-      # pass
-      #set -x PASSWORD_STORE_ENABLE_EXTENSIONS true
-      set -x AWS_VAULT_BACKEND pass
-      set -x AWS_VAULT_PASS_PREFIX aws
-      complete -c pw --no-files -a '(__fish_pass_print_entries)'
-
-      # colors
-      set -x GCC_COLORS 'error=01;31:warning=01;35:note=01;36:caret=01;32:locus=01:quote=01'
-
-      abbr --add v vim
-
-      #alias cal='ncal -b -M'
-      alias myip='dig +short myip.opendns.com @resolver1.opendns.com'
-
-      function hm -d 'merge history and delete failed commands'
-          history --merge
-
-          if test -z "$fish_private_mode" && test -e "$__fish_user_data_dir/successful_commands" && test -e "$__fish_user_data_dir/failed_commands"
-              while read line;
-                  if ! grep -qFx $line "$__fish_user_data_dir/successful_commands"
-                      set hist_command (echo $line | base64 -d)
-                      echo "deleting command: $hist_command"
-                      echo "."
-                      history delete --exact --case-sensitive $hist_command
-                  end
-              end < "$__fish_user_data_dir/failed_commands"
-              echo -n > "$__fish_user_data_dir/successful_commands"
-              echo -n > "$__fish_user_data_dir/failed_commands"
-          end
-      end
-      hm
-
-      # fancy tools
-      if which eza > /dev/null 2>&1
-          alias l=eza
-          alias ll='eza -l --time-style=long-iso --git'
-          alias la='eza -la --time-style=long-iso --git'
-          alias tree='eza --tree'
-          alias llt='eza -s modified -l'
-      else
-          alias l=ls
-          alias ll='ls -l'
-          alias la='ls -la'
-          alias llt='ls -trl'
-      end
-
-      if which rg > /dev/null 2>&1
-          alias g=rg
-          complete -c g -w rg
-      else if which ag > /dev/null 2>&1
-          alias g=ag
-          complete -c g -w ag
-      else
-          alias g='grep --color=auto'
-          complete -c g -w grep
-      end
-
-      function jqless -d 'jq -C [args] | less -R'
-          jq -C $argv | less -R
-      end
-
-      # NixOS direnv
-      if which direnv > /dev/null
-          eval (direnv hook fish)
-      end
-
-      function __cut_commandline -d 'cut commandline and paste it later'
-          set -g commandline_buffer (commandline)
-          commandline ""
-      end
-
-
-
-      function __postexec --on-event fish_postexec
-          if test $status -ne 0
-              if test -z "$hist_cmd"
-                  if test -z "$fish_private_mode"
-                      echo $argv[1] | base64 >> "$__fish_user_data_dir/failed_commands"
-                  end
-              end
-          else
-              if test -z "$fish_private_mode"
-                  echo $argv[1] | base64 >> "$__fish_user_data_dir/successful_commands"
-              end
-              commandline $commandline_buffer
-              set -e commandline_buffer
-          end
-      end
-
-      function dirh-nocolor --description "Print the current directory history (the prev and next lists)"
-          set -l options h/help
-          argparse -n dirh --max-args=0 $options -- $argv
-          or return
-
-          if set -q _flag_help
-              __fish_print_help dirh
-              return 0
-          end
-
-          set -l dirc (count $dirprev)
-          if test $dirc -gt 0
-              set -l dirprev_rev $dirprev[-1..1]
-              # This can't be (seq $dirc -1 1) because of BSD.
-              set -l dirnum (seq 1 $dirc)
-              for i in $dirnum[-1..1]
-                  printf '%s\n' $dirprev_rev[$i]
-              end
-          end
-
-          echo $PWD
-
-          set -l dirc (count $dirnext)
-          if test $dirc -gt 0
-              set -l dirnext_rev $dirnext[-1..1]
-              for i in (seq $dirc)
-                  printf '%s\n' $dirnext_rev[$i]
-              end
-          end
-      end
-
-      function dirh-fzf -d 'directory history fuzzy finder'
-          builtin cd (dirh-nocolor | uniq | fzf)
-      end
-
-      bind \ed 'dirh-fzf'
-    '';
-  };
-
-  xdg.configFile."fish/completions/mycli.fish".text = ''
-    complete -e -c mycli
-    complete -c mycli -f -s h -l host     -d "Host address of the database."
-    complete -c mycli -f -s P -l port     -d "Port number to use for connection."
-    complete -c mycli -f -s u -l user     -d "User name to connect to the database."
-    complete -c mycli -f -s S -l socket   -d "The socket file to use for connection."
-    complete -c mycli -f -s p -l pass \
-                              -l password -d "Password to connect to the database."
-    complete -c mycli -f -s V -l version  -d "Output mycli's version."
-    complete -c mycli -f -s v -l verbose  -d "Verbose output."
-    complete -c mycli -f -s d -l dsn      -d "Use DSN configured into the [alias_dsn] section of myclirc file."
-    complete -c mycli -f      -l list-dsn -d "list of DSN configured into the [alias_dsn] section of myclirc file."
-
-    complete -c mycli -f -s t -l table    -d "Display batch output in table format."
-    complete -c mycli -f      -l csv      -d "Display batch output in CSV format."
-    complete -c mycli -f      -l warn \
-                              -l no-warn  -d "Warn before running a destructive query."
-    complete -c mycli -f -s e -l execute  -d "Execute command and quit."
-
-
-    complete -c mycli -f -s h -l host -r -a '(__fish_print_hostnames)'
-    complete -c mycli -f -s d -l dsn -r -a '(mycli --list-dsn)'
-  '';
-}

home-manager/modules/gui.nix

@@ -1,15 +0,0 @@
-{ nixosConfig, lib, pkgs, ... }:
-lib.mkIf nixosConfig.jalr.gui.enable {
-  home.packages = with pkgs; [
-    evince
-    gcr # required for pinentry-gnome
-    geeqie
-    mpv
-    networkmanagerapplet
-    pinentry-gnome
-    streamlink
-    supersonic-wayland
-    vlc
-    xdg_utils
-  ];
-}

home-manager/modules/neovim.nix

@@ -1,174 +0,0 @@
-{ lib, nixosConfig, config, pkgs, ... }:
-{
-  home.sessionVariables = {
-    EDITOR = "nvim";
-  };
-  programs.neovim = {
-    enable = true;
-    vimAlias = true;
-    extraConfig = ''
-      " use space as leader
-      let mapleader = " "
-
-      colorscheme NeoSolarized
-
-      """""""""""""""""
-      " Swap and undo "
-      set noswapfile
-      set nobackup
-      if has('persistent_undo')
-          " yay persistent undo
-          :silent !mkdir -p ~/.local/vim-undo
-          set undofile
-          set undodir=~/.local/vim-undo
-      endif
-
-      cabbr <expr> %% expand('%:p:h')
-
-      set listchars=trail:·,precedes:«,extends:»,eol:↲,tab:▸\
-      nmap <silent> <leader>c :set list!<CR>
-
-      set smartcase
-      set hlsearch
-      nnoremap <silent> <CR> :nohlsearch<CR>:set nolist<CR><CR>
-
-      " highlight whitespace
-      highlight ExtraWhitespace ctermbg=red guibg=red
-      highlight WrongIndent ctermbg=2 guibg=blue
-      match ExtraWhitespace /\s\+$/
-      augroup highlight_extra_whitespace
-          autocmd BufWinEnter * match ExtraWhitespace /\s\+$/
-          autocmd InsertEnter * match ExtraWhitespace /\s\+\%#\@<!$/
-          autocmd InsertLeave * match ExtraWhitespace /\s\+$/
-          autocmd BufWinLeave * call clearmatches()
-      augroup END
-
-      let g:deoplete#enable_at_startup = 1
-
-      sign define LspDiagnosticsSignError text=🟥
-      sign define LspDiagnosticsSignWarning text=🟠
-      sign define LspDiagnosticsSignInformation text=🟣
-      sign define LspDiagnosticsSignHint text=🟢
-
-      nnoremap <silent> gd    <cmd>lua vim.lsp.buf.definition()<CR>
-      nnoremap <silent> gi    <cmd>lua vim.lsp.buf.implementation()<CR>
-      nnoremap <silent> gr    <cmd>lua vim.lsp.buf.references()<CR>
-      nnoremap <silent> gD    <cmd>lua vim.lsp.buf.declaration()<CR>
-      nnoremap <silent> ge    <cmd>lua vim.lsp.diagnostic.set_loclist()<CR>
-      nnoremap <silent> K     <cmd>lua vim.lsp.buf.hover()<CR>
-      nnoremap <silent> <leader>f    <cmd>lua vim.lsp.buf.formatting()<CR>
-      nnoremap <silent> <leader>rn    <cmd>lua vim.lsp.buf.rename()<CR>
-
-      nnoremap <silent> <leader>a <cmd>lua vim.lsp.buf.code_action()<CR>
-      xmap <silent> <leader>a <cmd>lua vim.lsp.buf.range_code_action()<CR>
-
-      lua require('init')
-    '';
-
-    # nix-env -f '<nixpkgs>' -qaP -A vimPlugins
-    plugins = with pkgs.vimPlugins; [
-      #Valloric/MatchTagAlways
-      #frankier/neovim-colors-solarized-truecolor-only
-      #nvie/vim-rst-tables
-      NeoSolarized
-      deoplete-nvim
-      editorconfig-vim
-      nvim-lspconfig
-      vim-gitgutter
-      vim-indent-guides
-      vim-nix
-      vim-puppet
-      vim-terraform
-    ];
-  };
-
-  xdg.configFile."nvim/lua/init.lua".text = builtins.concatStringsSep "\n" (
-    [
-      ''
-        -- init.lua
-        -- this configuration applies to servers and workstations
-      ''
-    ] ++ lib.optional nixosConfig.jalr.workstation.enable (
-      ''
-        -- this configuration applies to workstations only
-        -- https://github.com/neovim/nvim-lspconfig/blob/master/doc/server_configurations.md
-        local lsp = require('lspconfig')
-      '' +
-      builtins.concatStringsSep "\n" (
-        lib.mapAttrsToList
-          (
-            lang: cfg: "lsp.${lang}.setup\n" + lib.generators.toLua { } cfg
-          )
-          {
-            # C and C++
-            ccls = {
-              cmd = [ "${pkgs.ccls}/bin/ccls" ];
-            };
-
-            # Nix
-            rnix = {
-              cmd = [ "${pkgs.rnix-lsp}/bin/rnix-lsp" ];
-            };
-
-            # Python
-            pylsp = {
-              cmd = [ "${pkgs.python3Packages.python-lsp-server}/bin/pylsp" ];
-              settings = {
-                # https://github.com/python-lsp/python-lsp-server/blob/develop/CONFIGURATION.md
-                pylsp = {
-                  plugins = {
-                    flake8 = {
-                      enabled = true;
-                      executable = "${pkgs.python3Packages.flake8}/bin/flake8";
-                    };
-                    jedi_completion = { enabled = true; };
-                    jedi_definition = { enabled = true; };
-                    jedi_hover = { enabled = true; };
-                    jedi_references = { enabled = true; };
-                    jedi_signature_help = { enabled = true; };
-                    jedi_symbols = { enabled = true; };
-                    mccabe = { enabled = true; };
-                    preload = { enabled = true; };
-                    pycodestyle = { enabled = true; };
-                    pyflakes = { enabled = true; };
-                    rope_completion = { enabled = true; };
-                    yapf = { enabled = true; };
-                  };
-                };
-              };
-            };
-
-            # Ruby
-            solargraph = {
-              cmd = [ "${pkgs.solargraph}/bin/solargraph" "stdio" ];
-            };
-
-            # Rust
-            rust_analyzer = {
-              cmd = [ "${pkgs.rust-analyzer}/bin/rust-analyzer" ];
-            };
-
-            # Bash
-            bashls = {
-              cmd = [ "${pkgs.nodePackages.bash-language-server}/bin/bash-language-server" "start" ];
-            };
-
-            # Terraform
-            terraform_lsp = {
-              cmd = [ "${pkgs.terraform-lsp}/bin/terraform-lsp" "serve" ];
-            };
-
-            # YAML
-            yamlls = {
-              cmd = [ "${pkgs.nodePackages.yaml-language-server}/bin/yaml-language-server" "--stdio" ];
-              settings = {
-                yaml = {
-                  keyOrdering = false;
-                };
-              };
-            };
-          }
-      )
-    )
-  );
-}

home-manager/modules/pass.nix

@@ -1,29 +0,0 @@
-{ nixosConfig, config, pkgs, ... }:
-
-let
-  pw = pkgs.writeScriptBin "pw" ''
-    p="$(${pkgs.pass}/bin/pass show "$1")"
-
-    copy_line() {
-      echo -n "$p" | ${pkgs.gnused}/bin/sed -n "$1"p | ${pkgs.wl-clipboard}/bin/wl-copy -o -f
-    }
-
-    echo "username"
-    copy_line 2
-    echo "password"
-    copy_line 1
-  '';
-in
-{
-  home.packages = [
-    pw
-  ] ++
-  (
-    if nixosConfig.jalr.gui.enable
-    then with pkgs; [
-      qtpass
-      pass-wayland
-    ]
-    else [ ]
-  );
-}

home-manager/modules/solarized.nix

@@ -1,23 +0,0 @@
-builtins.mapAttrs
-  (name: hex: {
-    inherit hex;
-    rgb = builtins.concatStringsSep "," (map (f: toString (builtins.fromTOML "i = 0x${f hex}").i) (map (pos: builtins.substring pos 2) [ 1 3 5 ]));
-  })
-{
-  base00 = "#657b83";
-  base01 = "#586e75";
-  base02 = "#073642";
-  base03 = "#002b36";
-  base0 = "#839496";
-  base1 = "#93a1a1";
-  base2 = "#eee8d5";
-  base3 = "#fdf6e3";
-  blue = "#268bd2";
-  cyan = "#2aa198";
-  green = "#859900";
-  magenta = "#d33682";
-  orange = "#cb4b16";
-  red = "#dc322f";
-  violet = "#6c71c4";
-  yellow = "#b58900";
-}

home-manager/modules/sway/waybar.nix

@@ -1,499 +0,0 @@
-{ config, lib, nixosConfig, pkgs, ... }:
-let
-  watchUserUnitState = unit: started: stopped: pkgs.writeShellScript "watch-user-unit-${unit}-state" ''
-    ${pkgs.systemd}/bin/journalctl --user -u ${unit} -t systemd -o cat -f \
-        | ${pkgs.gnugrep}/bin/grep --line-buffered -Eo '^(Started|Stopped)' \
-        | ${pkgs.jq}/bin/jq --unbuffered -Rc 'if . == "Started" then ${builtins.toJSON started} else ${builtins.toJSON stopped} end'
-  '';
-
-  toggleUserUnitState = unit: pkgs.writeShellScript "toggle-user-unit-${unit}-state" ''
-    if ${pkgs.systemd}/bin/systemctl --user show ${unit} | ${pkgs.gnugrep}/bin/grep -q ActiveState=active; then
-        ${pkgs.systemd}/bin/systemctl --user stop ${unit}
-    else
-        ${pkgs.systemd}/bin/systemctl --user start ${unit}
-    fi
-  '';
-
-  # for fine-grained control over spacing
-  thinsp = " ";
-
-  solarized = import ../solarized.nix;
-  solarizedColors = (as: lib.strings.concatLines (lib.attrsets.mapAttrsToList (name: value: let color = solarized."${value}".hex; in "@define-color ${name} ${color};") as));
-in
-{
-  # home-manager’s waybar module performs additional checks that are overly strict
-  xdg.configFile."waybar/config".text = lib.generators.toJSON { } {
-    layer = "top";
-    position = "top";
-    height = 24;
-
-    modules-center = [ ];
-    modules-left = [
-      "sway/workspaces"
-      "sway/mode"
-    ];
-    modules-right = [
-      "tray"
-      "custom/screencast"
-      "custom/redshift"
-      "idle_inhibitor"
-      "backlight"
-      "mpd"
-      "pulseaudio"
-      "network"
-      "custom/vpn"
-      "memory"
-      "cpu"
-      "temperature"
-      "battery"
-      "clock"
-      "custom/calendar"
-    ];
-
-    "sway/workspaces" = {
-      disable-scroll = true;
-    };
-    "sway/mode" = {
-      format = "{}";
-    };
-
-    tray = {
-      spacing = 5;
-    };
-    "custom/redshift" = {
-      exec = watchUserUnitState
-        "gammastep"
-        { class = "active"; }
-        { class = "inactive"; };
-      on-click = toggleUserUnitState "gammastep";
-      return-type = "json";
-      format = "󰌵";
-      tooltip = false;
-    };
-    idle_inhibitor = {
-      format = "{icon}";
-      format-icons = {
-        activated = "󰈈 ";
-        deactivated = "󰈉 ";
-      };
-    };
-    "custom/screencast" = {
-      exec = pkgs.writeScript "screencast-monitor" /* python */ ''
-        #!${pkgs.python3}/bin/python3
-        import subprocess
-        import sys
-
-        active_outputs = 0
-
-        with subprocess.Popen(
-            ["${pkgs.coreutils}/bin/stdbuf", "-o0", "${nixosConfig.services.pipewire.package}/bin/pw-link", "-m", "-o", "xdg-desktop-portal-wlr"],
-            stdout=subprocess.PIPE,
-            text=True,
-        ) as proc:
-            for line in proc.stdout:
-                action = line.split(" ")[0]
-                if action == "=" or action == "+":
-                    active_outputs += 1
-                elif action == "-":
-                    active_outputs -= 1
-                else:
-                    print(f"Invalid action {action} (in line {line})", file=sys.stderr)
-
-                if active_outputs > 0:
-                    print("󱒃")
-                else:
-                    print()
-
-                sys.stdout.flush()
-      '';
-      format = "{}";
-      tooltip = false;
-    };
-    backlight = {
-      format = "{percent}% {icon}";
-      format-icons = [ "󰛩" "󱩎" "󱩏" "󱩐" "󱩑" "󱩒" "󱩓" "󱩔" "󱩕" "󱩖" "󰛨" ];
-      on-scroll-up = "${pkgs.brightnessctl}/bin/brightnessctl -q set +5%";
-      on-scroll-down = "${pkgs.brightnessctl}/bin/brightnessctl -q set 5%-";
-    };
-    mpd = {
-      server = config.services.mpd.network.listenAddress;
-      format = "{stateIcon} {consumeIcon}{randomIcon}{repeatIcon}{singleIcon}{artist} – {title} ({elapsedTime:%M:%S}/{totalTime:%M:%S}) 󰎈";
-      format-disconnected = "Disconnected 󰎈";
-      format-stopped = "{consumeIcon}{randomIcon}{repeatIcon}{singleIcon}Stopped 󰎈";
-      unknown-tag = "N/A";
-      interval = 2;
-      tooltip-format = "MPD (connected)";
-      tooltip-format-disconnected = "MPD (disconnected)";
-      on-scroll-up = "${pkgs.mpc_cli}/bin/mpc -q -h ${config.services.mpd.network.listenAddress} volume +2";
-      on-scroll-down = "${pkgs.mpc_cli}/bin/mpc -q -h ${config.services.mpd.network.listenAddress} volume -2";
-      title-len = 48;
-      artist-len = 24;
-      consume-icons = {
-        on = "󰩫  ";
-      };
-      random-icons = {
-        off = "󰒞 ";
-        on = "󰒝 ";
-      };
-      repeat-icons = {
-        on = "󰑖 ";
-      };
-      single-icons = {
-        on = "󰑘 ";
-      };
-      state-icons = {
-        paused = "󰏤 ";
-        playing = "󰐊 ";
-      };
-    };
-    pulseaudio = {
-      format = "{volume}% {icon} {format_source}";
-      format-bluetooth = "{volume}% {icon}󰗾{format_source}";
-      format-bluetooth-muted = "{icon}󰗿{format_source}";
-      format-muted = "󰝟 {format_source}";
-      format-source = "{volume}% ${thinsp}";
-      format-source-muted = "${thinsp}";
-      format-icons = {
-        car = "󰄋 ";
-        default = [ "󰕿" "󰖀" "󰕾" ];
-        hands-free = "󰋎";
-        headphone = "󰋋";
-        headset = "󰋎";
-        phone = "󰏲";
-        portable = "󰏲";
-      };
-      on-click-right = "${pkgs.pavucontrol}/bin/pavucontrol";
-    };
-    network = {
-      format-wifi = "{essid} ({signalStrength}%) 󰖩 ";
-      format-ethernet = "{ipaddr}/{cidr} 󰈀 ";
-      format-linked = "{ifname} (No IP) 󰈀 ";
-      format-disconnected = "Disconnected ⚠ ";
-      format-alt = "{ifname}: {ipaddr}/{cidr}";
-      tooltip = false;
-      on-click-right = "${config.programs.alacritty.package}/bin/alacritty -e ${pkgs.networkmanager}/bin/nmtui";
-    };
-    "custom/vpn" = {
-      interval = 10;
-      exec = pkgs.writeShellScript "vpn-state" ''
-        ${pkgs.iproute}/bin/ip -j link \
-          | ${pkgs.jq}/bin/jq --unbuffered --compact-output '
-            [[.[].ifname | select(. | startswith("mullvad"))][] | split("-")[1] + " 󰌾${thinsp}"] as $conns
-            | { text: ($conns[0] // ""), class: (if $conns | length > 0 then "connected" else "disconnected" end) }'
-      '';
-      return-type = "json";
-      format = "{}";
-      tooltip = false;
-    };
-    memory = {
-      interval = 2;
-      format = "{:2}% 󰍛 ";
-    };
-    cpu = {
-      interval = 2;
-      format = "{usage:2}%  ";
-      tooltip = false;
-    };
-    temperature = {
-      critical-threshold = 80;
-      format = "{temperatureC}°C {icon}";
-      format-icons = [ "" "" "" "" "" ];
-    } // (lib.optionalAttrs (nixosConfig.networking.hostName == "mayushii") {
-      hwmon-path = "/sys/class/hwmon/hwmon3/temp1_input";
-    });
-    battery = {
-      interval = 5;
-      format = "{capacity}% {icon}";
-      format-charging = "{capacity}% ";
-      format-plugged = "{capacity}% x";
-      format-alt = "{time} {icon}";
-      format-icons = [ "󰂎" "󰁺" "󰁻" "󰁼" "󰁽" "󰁾" "󰁿" "󰂀" "󰂁" "󰂂" "󰁹" ];
-      states = {
-        critical = 15;
-        good = 95;
-        warning = 30;
-      };
-    };
-    clock = {
-      format = "{:%H:%M %Z}";
-      format-alt = "{:%Y-%m-%d (%a)}";
-      tooltip-format = "<big>{:%Y %B}</big>\n<tt><small>{calendar}</small></tt>";
-    };
-    "custom/calendar" = {
-      interval = 300;
-      exec = pkgs.writeScript "calendar" /* python */ ''
-        #!${pkgs.python3}/bin/python3
-        import json
-        import subprocess
-
-
-        def khal(args):
-            completed = subprocess.run(["${pkgs.khal}/bin/khal"] + args, capture_output=True)
-            assert completed.returncode == 0
-            return completed.stdout.decode("utf-8")
-
-
-        events_today = khal(["list", "today", "today", "-df", "", "-f", "{title}"]).rstrip().split("\n")
-        events_2d = khal(["list", "today", "tomorrow", "-df", "<b>{name}, {date}</b>"]).rstrip()
-
-        if len(events_today) == 1 and events_today[0] == "No events":
-            events_today = []
-
-        if len(events_today) == 0:
-            text = "󰃮 "
-        else:
-            text = f"{len(events_today)} 󰃶 "
-
-        print(
-            json.dumps(
-                {
-                    "class": "active" if len(events_today) > 0 else "",
-                    "text": text,
-                    "tooltip": events_2d,
-                }
-            )
-        )
-      '';
-      return-type = "json";
-      format = "{}";
-    };
-  };
-
-  xdg.configFile."waybar/theme-light.css".text = solarizedColors {
-    base00 = "base3";
-    base01 = "base2";
-    base02 = "base1";
-    base03 = "base0";
-    base04 = "base00";
-    base05 = "base01";
-    base06 = "base02";
-    base07 = "base03";
-    base08 = "red";
-    base09 = "orange";
-    base0A = "yellow";
-    base0B = "green";
-    base0C = "cyan";
-    base0D = "blue";
-    base0E = "violet";
-    base0F = "magenta";
-  };
-  xdg.configFile."waybar/theme-dark.css".text = solarizedColors {
-    base00 = "base03";
-    base01 = "base02";
-    base02 = "base01";
-    base03 = "base00";
-    base04 = "base0";
-    base05 = "base1";
-    base06 = "base2";
-    base07 = "base3";
-    base08 = "red";
-    base09 = "orange";
-    base0A = "yellow";
-    base0B = "green";
-    base0C = "cyan";
-    base0D = "blue";
-    base0E = "violet";
-    base0F = "magenta";
-  };
-  xdg.configFile."waybar/style.css".text = ''
-    @import "theme.css";
-
-    * {
-      border-radius: 0;
-      border: none;
-      font-family: "Iosevka Nerd Font";
-      font-size: 14px;
-      min-height: 0;
-      transition-property: none;
-    }
-
-    window#waybar {
-      background-color: @base00;
-      color: @base04;
-    }
-
-    #workspaces button {
-      padding: 0 5px;
-      background-color: @base00;
-      color: inherit;
-      border-bottom: 2px solid transparent;
-    }
-
-    #workspaces button:hover {
-      background: @base01;
-      box-shadow: inherit;
-      text-shadow: inherit;
-    }
-
-    #workspaces button.focused {
-      border-bottom: 2px solid @base0B;
-    }
-
-    #workspaces button.urgent {
-      background-color: @base08;
-    }
-
-    #mode {
-      background-color: @base01;
-      font-style: italic;
-    }
-
-    /* all modules on the right */
-    #waybar > box > box:nth-child(3) > widget > label {
-      padding: 0 10px;
-    }
-
-    #battery.charging {
-      color: @base01;
-      background-color: @base0B;
-    }
-
-    @keyframes blink {
-      to {
-        background-color: @base07;
-        color: @base03;
-      }
-    }
-
-    #battery.critical:not(.charging),
-    #temperature.critical {
-      background-color: @base08;
-      animation-name: blink;
-      animation-duration: 0.5s;
-      /* FIXME use nearest neighbor interpolation if possible */
-      animation-timing-function: cubic-bezier(1, 0, 0, 1);
-      animation-iteration-count: infinite;
-      animation-direction: alternate;
-    }
-
-    #cpu {
-      background-color: @base0C;
-      color: @base01
-    }
-
-    #memory {
-      background-color: @base0A;
-      color: @base01
-    }
-
-    #backlight {
-      background-color: @base07;
-      color: @base03;
-    }
-
-    #network {
-      background-color: @base0E;
-      color: @base01
-    }
-
-    #custom-vpn {
-      background-color: @base0D;
-      color: @base01
-    }
-
-    #network.disconnected {
-      background-color: @base08;
-    }
-
-    #pulseaudio {
-      background-color: @base07;
-      color: @base03;
-    }
-
-    #pulseaudio.muted {
-      background-color: @base00;
-      color: @base04;
-    }
-
-    #temperature {
-      background-color: @base0F;
-      color: @base01;
-    }
-
-    #idle_inhibitor.activated {
-      background-color: @base07;
-      color: @base00;
-    }
-
-    #mpd {
-      background-color: @base0B;
-      color: @base01;
-    }
-
-    #mpd.disconnected {
-      background-color: @base08;
-    }
-
-    #mpd.stopped {
-      background-color: @base09;
-    }
-
-    #mpd.paused {
-      background-color: @base0A;
-    }
-
-    #custom-redshift {
-      color: @base01;
-    }
-
-    #custom-redshift.active {
-      background-color: @base08;
-    }
-
-    #custom-redshift.inactive {
-      background-color: @base0D;
-    }
-
-    #tray {
-      padding: 0 5px;
-    }
-
-    #custom-notification_inhibitor.active {
-      background-color: @base07;
-      color: @base00;
-    }
-
-    #custom-screencast {
-      background-color: @base08;
-      color: @base00;
-      animation-name: blink;
-      animation-duration: 0.5s;
-      animation-timing-function: cubic-bezier(1, 0, 0, 1);
-      animation-iteration-count: infinite;
-      animation-direction: alternate;
-    }
-
-    #custom-calendar.active {
-      background-color: @base07;
-      color: @base03;
-    }
-  '';
-
-  systemd.user.services.waybar = {
-    Unit = {
-      Description = "Highly customizable Wayland bar for Sway and Wlroots based compositors.";
-      Documentation = "https://github.com/Alexays/Waybar/wiki/";
-      PartOf = [ "sway-session.target" ];
-    };
-
-    Install.WantedBy = [ "sway-session.target" ];
-
-    Service = {
-      # ensure sway is already started, otherwise workspaces will not work
-      ExecStartPre = "${config.wayland.windowManager.sway.package}/bin/swaymsg";
-      ExecStart = "${pkgs.waybar}/bin/waybar";
-      ExecReload = "${pkgs.utillinux}/bin/kill -SIGUSR2 $MAINPID";
-      Restart = "on-failure";
-      RestartSec = "1s";
-    };
-  };
-
-  # TODO: remove when https://github.com/nix-community/home-manager/issues/2064
-  # is resolved
-  systemd.user.targets.tray = {
-    Unit = {
-      Description = "Home Manager System Tray";
-      Requires = [ "graphical-session-pre.target" ];
-    };
-  };
-}

home-manager/modules/sway/wofi.nix

@@ -1,89 +0,0 @@
-{ nixosConfig, config, lib, pkgs, ... }:
-
-let
-  solarized = import ../solarized.nix;
-in
-{
-  xdg.configFile."wofi/color-light".text = lib.strings.concatLines (map (c: solarized."${c}".hex) [
-    "base3"
-    "base2"
-    "base1"
-    "base0"
-    "base00"
-    "base01"
-    "base02"
-    "base03"
-    "red"
-    "orange"
-    "yellow"
-    "green"
-    "cyan"
-    "blue"
-    "violet"
-    "magenta"
-  ]);
-  xdg.configFile."wofi/color-dark".text = lib.strings.concatLines (map (c: solarized."${c}".hex) [
-    "base03"
-    "base02"
-    "base01"
-    "base00"
-    "base0"
-    "base1"
-    "base2"
-    "base3"
-    "red"
-    "orange"
-    "yellow"
-    "green"
-    "cyan"
-    "blue"
-    "violet"
-    "magenta"
-  ]);
-  xdg.configFile."wofi/style.css".text = ''
-    window {
-      margin: 0px;
-      border: 3px solid --wofi-color1;
-      border-radius: 8px;
-      background-color: rgba(--wofi-rgb-color0,0.8);
-    }
-
-    #input {
-      margin: 5px;
-      border: none;
-      color: --wofi-color4;
-      background-color: rgba(--wofi-rgb-color1,0.8);
-    }
-
-    #inner-box {
-      margin: 5px;
-      border: none;
-      background: none;
-    }
-
-    #outer-box {
-      margin: 5px;
-      border: none;
-      background: none;
-    }
-
-    #scroll {
-      margin: 0px;
-      border: none;
-    }
-
-    #text {
-      margin: 5px;
-      border: none;
-      color: --wofi-color4;
-    }
-
-    #entry:selected {
-      background-color: rgba(--wofi-rgb-color1,0.8);
-    }
-
-    #entry:selected #text{
-      color: --wofi-color11;
-    }
-  '';
-}

home-manager/modules/thunderbird.nix

@@ -1,7 +0,0 @@
-{ nixosConfig, pkgs, ... }:
-{
-  programs.thunderbird = {
-    enable = nixosConfig.jalr.gui.enable;
-    profiles."default".isDefault = true;
-  };
-}

home-manager/users/default.nix

@@ -1,28 +0,0 @@
-{ lib, ... }:
-
-{
-  options.jalr = {
-    git = {
-      user = {
-        name = lib.mkOption {
-          type = lib.types.str;
-          description = "name to use for git commits";
-        };
-        email = lib.mkOption {
-          type = lib.types.str;
-          description = "email to use for git commits";
-        };
-      };
-      signByDefault = lib.mkEnableOption "GPG sign commits per default";
-    };
-    gpg.defaultKey = lib.mkOption {
-      type = lib.types.str;
-      description = "default gpg key id";
-    };
-    terminalEmulator = lib.mkOption {
-      type = lib.types.str;
-      description = "default Terminal emulator name";
-      default = "alacritty";
-    };
-  };
-}

home-manager/users/jal.nix

@@ -1,224 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  userName = "jal";
-  vpn_routes = [
-    "10.18.0.0/16" # OEE VPC
-    "10.64.0.0/16" # CPS
-    "10.158.128.0/23" # approval
-    "10.158.224.0/20" # core production
-    "10.158.240.0/20" # core development
-    #"10.96.0.0/24" # CCS infrastructure
-    #"10.96.8.0/24" # Boomi
-    #"10.96.10.0/24" # Boomi (new)
-    "10.96.0.0/16"
-    "10.170.254.30/32" # first core DNS resolver
-    "10.170.254.40/32" # second core DNS resolver
-  ];
-  vpnc-script = pkgs.writeShellScript "vpnc-script-tb" ''
-    cisco_split_inc="$CISCO_SPLIT_INC"
-    export CISCO_SPLIT_INC=0
-
-    echo "DNS server sent by vpn: $INTERNAL_IP4_DNS"
-    unset INTERNAL_IP4_DNS
-
-    route_in_whitelist() {
-        for route in ${builtins.toString vpn_routes}; do
-            [ "$1" = "$route" ] && return 0
-        done
-        return 1
-    }
-
-    routes() {
-      for i in $(seq 0 $((cisco_split_inc-1))); do
-          addr_var="CISCO_SPLIT_INC_''${i}_ADDR"
-          mask_var="CISCO_SPLIT_INC_''${i}_MASK"
-          masklen_var="CISCO_SPLIT_INC_''${i}_MASKLEN"
-          addr="''${!addr_var}"
-          mask="''${!mask_var}"
-          masklen="''${!masklen_var}"
-          if route_in_whitelist "$addr/$masklen"; then
-              case "$1" in
-                  add)
-                      if [ -n "$NETGW" ]; then
-                          ip route add "$addr/$masklen" metric 100 dev "$TUNDEV" via "$NETGW"
-                      else
-                          ip route add "$addr/$masklen" metric 100 dev "$TUNDEV"
-                      fi
-                  ;;
-                  remove)
-                      ip route del "$addr/$masklen" dev "$TUNDEV"
-                  ;;
-              esac
-              echo "allowing route '$addr/$masklen'"
-          else
-              echo "ignoring route '$addr/$masklen'"
-          fi
-      done
-    }
-
-    case "$reason" in
-        pre-init|reconnect|attempt-reconnect)
-            "${pkgs.vpnc-scripts}/bin/vpnc-script" "$@"
-        ;;
-        connect)
-            "${pkgs.vpnc-scripts}/bin/vpnc-script" "$@"
-            routes add
-        ;;
-        disconnect)
-            routes remove
-            "${pkgs.vpnc-scripts}/bin/vpnc-script" "$@"
-        ;;
-        *)
-            echo "reason '$reason' is not implemented" >&2
-            exit 1
-        ;;
-    esac
-  '';
-  tradebyte-vpn = pkgs.writeShellScriptBin "tradebyte-vpn" ''
-    [ $UID -ne 0 ] && exec sudo -- "$0" "$@"
-    /run/wrappers/bin/sudo -u "$SUDO_USER" ${pkgs.pass}/bin/pass show zalando | openconnect \
-      --protocol=pulse \
-      -u jlechner \
-      --passwd-on-stdin \
-      -i pulse \
-      --pfs \
-      --disable-ipv6 \
-      --script=${vpnc-script} \
-      https://remote.tradebyte.org | grep -v '^> '
-  '';
-  aws_defaults = {
-    sso = {
-      start_url = "https://d-9967250383.awsapps.com/start";
-      region = "eu-central-1";
-      role_name = "AdministratorAccess";
-    };
-    region = "eu-central-1";
-  };
-in
-{
-  imports = [
-    ./default.nix
-  ];
-
-  jalr = {
-    git = {
-      user = {
-        name = "Jakob Lechner";
-        email = "jal@tradebyte.biz";
-      };
-      signByDefault = false;
-    };
-    gpg.defaultKey = "FE170812543DF81393EA56BA5042B8317A10617E";
-    aws = {
-      enable = true;
-      accounts = {
-        ops_testing = {
-          sso_account_id = 134848648016;
-          sso_start_url = aws_defaults.sso.start_url;
-          sso_region = aws_defaults.sso.region;
-          sso_role_name = aws_defaults.sso.role_name;
-          region = aws_defaults.region;
-        };
-        core-production = {
-          sso_account_id = 455520445575;
-          sso_start_url = aws_defaults.sso.start_url;
-          sso_region = aws_defaults.sso.region;
-          sso_role_name = aws_defaults.sso.role_name;
-          region = aws_defaults.region;
-        };
-        tbmeta-production = {
-          sso_account_id = 696695470425;
-          sso_start_url = aws_defaults.sso.start_url;
-          sso_region = aws_defaults.sso.region;
-          sso_role_name = aws_defaults.sso.role_name;
-          region = aws_defaults.region;
-        };
-        abnahme = {
-          sso_account_id = 837645089494;
-          sso_start_url = aws_defaults.sso.start_url;
-          sso_region = aws_defaults.sso.region;
-          sso_role_name = aws_defaults.sso.role_name;
-          region = aws_defaults.region;
-        };
-        core-develop = {
-          sso_account_id = 934000686307;
-          sso_start_url = aws_defaults.sso.start_url;
-          sso_region = aws_defaults.sso.region;
-          sso_role_name = aws_defaults.sso.role_name;
-          region = aws_defaults.region;
-        };
-        infrastructure = {
-          sso_account_id = 994756397773;
-          sso_start_url = aws_defaults.sso.start_url;
-          sso_region = aws_defaults.sso.region;
-          sso_role_name = aws_defaults.sso.role_name;
-          region = aws_defaults.region;
-        };
-        tbmeta-development = {
-          sso_account_id = 730951147261;
-          sso_start_url = aws_defaults.sso.start_url;
-          sso_region = aws_defaults.sso.region;
-          sso_role_name = aws_defaults.sso.role_name;
-          region = aws_defaults.region;
-        };
-      };
-    };
-  };
-
-  users.users.${userName} = {
-    isNormalUser = true;
-    extraGroups = [
-      "dialout"
-      "podman"
-      "libvirtd"
-      "lp"
-      "networkmanager"
-      "scanner"
-      "video"
-      "wheel"
-      "wireshark"
-    ]; # Enable ‘sudo’ for the user.
-    shell = pkgs.fish;
-  };
-
-  home-manager = {
-    useUserPackages = true;
-    useGlobalPkgs = true;
-    users.${userName} = { lib, pkgs, ... }: {
-      imports = [ ../modules ];
-      config = {
-        home.stateVersion = config.system.stateVersion;
-
-        home.packages = with pkgs; [
-          mycli
-          timetrap
-          tradebyte-vpn
-
-          # common
-          asciinema
-          bat
-          docker-compose
-          envsubst
-          gnupg
-          nmap
-          psutils
-          pwgen
-          tig
-          vlc
-          xdg_utils
-        ];
-      };
-    };
-  };
-
-  security.sudo.extraRules = [{
-    users = [ userName ];
-    commands = [
-      {
-        command = "${tradebyte-vpn}/bin/tradebyte-vpn";
-        options = [ "NOPASSWD" ];
-      }
-    ];
-  }];
-}

home-manager/users/jalr.nix

@@ -1,97 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  imports = [
-    ./default.nix
-  ];
-
-  jalr = {
-    git = {
-      user = {
-        name = "Jakob Lechner";
-        email = "mail@jalr.de";
-      };
-      signByDefault = true;
-    };
-    gpg.defaultKey = "66FB54F6081375106EEBF651A222365EB448F934";
-  };
-
-  users.users.jalr = {
-    isNormalUser = true;
-    extraGroups = [
-      "adbusers"
-      "audio"
-      "dialout"
-      "docker"
-      "libvirtd"
-      "lp"
-      "networkmanager"
-      "scanner"
-      "video"
-      "wheel"
-      "wireshark"
-    ]; # Enable ‘sudo’ for the user.
-    shell = pkgs.fish;
-  };
-
-  home-manager = {
-    useUserPackages = true;
-    useGlobalPkgs = true;
-    users.jalr = { lib, pkgs, ... }: {
-      imports = [ ../modules ];
-      config = {
-        home.stateVersion = if config.system.stateVersion == "22.11" then "22.05" else config.system.stateVersion;
-
-        home.packages = with pkgs; [
-          cutecom
-          ghostscript
-          newsboat
-          pdftk
-          platformio
-          ptouch-print
-          qrencode
-          sshfs
-          tmate
-
-          # common
-          asciinema
-          bat
-          docker-compose
-          envsubst
-          gnupg
-          nmap
-          psutils
-          pwgen
-          tig
-        ];
-
-        accounts.email.accounts."jalr" = {
-          primary = true;
-          userName = "jalr@jalr.de";
-          address = "jalr@jalr.de";
-          realName = "Jakob Lechner";
-          imap = {
-            host = "hha.jalr.de";
-            port = 143;
-            tls = {
-              enable = true;
-              useStartTls = true;
-            };
-          };
-          smtp = {
-            host = "hha.jalr.de";
-            port = 587;
-            tls = {
-              enable = true;
-              useStartTls = true;
-            };
-          };
-          thunderbird = {
-            enable = true;
-            profiles = [ "default" ];
-          };
-        };
-      };
-    };
-  };
-}

hosts/aluminium/configuration.nix

@@ -1,21 +1,18 @@
-{ config, lib, pkgs, ... }:
+{ config, ... }:
 
-let
-  iptablesAppendIfMissing = rule: "iptables -C " + rule + " || iptables -A " + rule;
-  iptablesInsertIfMissing = rule: "iptables -C " + rule + " || iptables -I " + rule;
-in
 {
   imports = [
     ./hardware-configuration.nix
-    ../../home-manager/users/jalr.nix
+    ../../users/jalr
     ./services
+    ./ports.nix
   ];
 
-  networking.hostName = "aluminium";
   services.openssh.enable = true;
   security.sudo.wheelNeedsPassword = false;
 
   networking = {
+    hostName = "aluminium";
     useDHCP = false;
     vlans = {
       lechner = {
@@ -26,6 +23,10 @@ in
         id = 2;
         interface = "enp1s0";
       };
+      iot = {
+        id = 3;
+        interface = "enp1s0";
+      };
       pv = {
         id = 10;
         interface = "enp1s0";
@@ -48,6 +49,10 @@ in
         address = "192.168.1.1";
         prefixLength = 24;
       }];
+      iot.ipv4.addresses = [{
+        address = "192.168.2.1";
+        prefixLength = 24;
+      }];
       pv.ipv4.addresses = [{
         address = "192.168.10.1";
         prefixLength = 30;
@@ -70,19 +75,22 @@ in
         "voice"
       ];
     };
-    firewall = {
-      extraCommands = lib.concatStringsSep "\n" [
-        (iptablesAppendIfMissing "FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu")
-        (iptablesInsertIfMissing "INPUT -i voice -p udp -m udp --dport 5060 -j ACCEPT")
-        (iptablesInsertIfMissing "INPUT -s 217.10.68.150 -p udp --dport 5060 -j ACCEPT")
-      ];
+    firewall.extraInputRules = ''
+      iifname "voice" udp dport 5059 accept
+      ip saddr 217.10.68.150 udp dport 5060 accept
+    '';
+    nftables.tables.pppoe = {
+      family = "ip";
+      content = ''
+        chain clamp {
+          type filter hook forward priority mangle;
+          oifname "ppp0" tcp flags syn tcp option maxseg size set rt mtu comment "clamp MSS to Path MTU"
+        }
+      '';
     };
   };
 
 
-  sops.secrets.pap-secrets = {
-    sopsFile = ./secrets.yaml;
-  };
   environment.etc."ppp/pap-secrets".source = config.sops.secrets.pap-secrets.path;
   services.pppd = {
     enable = true;

hosts/aluminium/hardware-configuration.nix

@@ -1,7 +1,7 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{ config, lib, modulesPath, ... }:
 
 {
   imports =

hosts/aluminium/ports.nix

@@ -1,9 +1,16 @@
-{ lib, custom-utils, ... }:
+{ custom-utils, ... }:
 
-custom-utils.validatePortAttrset {
-  asterisk-rtp = { udp.range = [ 10000 10200 ]; };
-  unifi.tcp = 8443;
-  doorbell-audiosocket.tcp = 9092;
-  doorbell-webrtc.tcp = 8889;
-  doorbell-webrtc-ice.tcp = 8189;
+{
+  config.networking.ports = custom-utils.validatePortAttrset {
+    asterisk-rtp.udp = { from = 10000; to = 10200; };
+    doorbell-audiosocket.tcp = 9092;
+    doorbell-webrtc-ice.tcp = 8189;
+    doorbell-webrtc.tcp = 8889;
+    esphome.tcp = 6052;
+    home-assistant.tcp = 8123;
+    nginx-http.tcp = 80;
+    nginx-https.tcp = 443;
+    unifi-inform.tcp = 8080;
+    unifi-ui.tcp = 8443;
+  };
 }

hosts/aluminium/secrets.yaml

@@ -4,6 +4,7 @@ myintercom-doorbell-password: ENC[AES256_GCM,data:waUUvHQ9BZFePQ==,iv:ev21SNOwzd
 asterisk-pjsip: ENC[AES256_GCM,data:PMgHCdo7K1a9/OitWdUonJ66gr70uwYgylCCWAO9cYOeXdPTIFuFLHlgBIUUxfln3UqhquTzoTluZJW9vaSuzZGe1kLIYrb1hRyrM0HLCCQc8m46jN898le/9ZrEivxonWkxf4FTfpENIf7iEr5KHh4vfd4tr4IbORTFdpcbsy8pd5eyvS8G2z9dynIWS19zqrzfGrW6yZICzAJz28IQCiiHgpN16bqSwlcPm1UdX+qi0+ZJ3TAr16Px1F9VFOXtEsu4EZvJSomecJDuhjo3QzBFffXDL971of8KX05BJgtpP6SzIZXKfSWaOxaguctdFr2tScvze0o3FXpDoOn0cvinOdYQt1P2TzjFnBZ4I3N1turpD4be9xJ92coV/j1hBsZHj2mWE/iCdsrzj2uP/74b4Mo1BJZ6l1gXFg3OgyDXaVoMxAOnutelCEG0lf78hsJXF56aQ1LVSUly6ugZP4rMiPFg5oa7WfrIsVVURUt7WRFrDLCYIQVynpfeUxHshPSB+/jVvYLqie5XeNt8B8mgTJYFo5hFB28sa1beqYEA27QMT3gRvWivqDnuf8soVi/r3WREfnSCBujhzXQF/uJZEwqVEn0OQo9ICfJ8hqtvDiAw6Hb4Wn+0maoYQeKjbPHeL3kr1SUE/kU913FNig4Yn66QKYevLLIkd3uQ0GqTLcgn4Ttwu3qArlXXxrI4US8yA7XGQUutVadN7ayyZBbYnw+vUTlPfhSO+ridK3huGKnQfcPAbD31L11EeQBe2820Nba9Bb4d5QAkiGsNj5y9tZ4Vl6l2JErO63fVPKQ9fPxD3yYyZpP8Hm1e7Wl1eRsNtoWqkTRtno7hIpAYFoMYTUk2x5U/qZOgtRX0JHufi6+GXvPPlBaQNfiGzNlJjdmtTT6MGLPRQjsASGi00pSjKd4psAj9Uf8rttsHhJHvIRDRsiNSjae+JGbVlyyauU1JL44Qf+U+MaJDjkLagNqUZ9xgNFmXzr7st6bRFYCJHkmQC8bgJsdpwRMz3HjNzrKZRvRhHIiwT3d+oyrd9hoSQl3JkxcrD7AfEThrBQL9BpGCDcfr5RzfNv8Fb08tR7rlIzyb6Rw3eKlY1obfZRRNTF+iYlBDz8LLI+BwWqJiefbHB2F9nOC0of5Eqm5gjn+MXSKuSIP5ltDsjfO+m6q7c+t7udKwnJVnePtOnuf4uQpKfxjpld4e8Y1N9hyuKSjqEy83UB4yXJb1OoUAOXENvdPhGFDghmSC+ZVcCZRBG2k6d6MdXY6AkdjUAteDQLsDNMwpW8a8RwOXlDoAtxu7yEYP51BrHu2spagNfXMWHThnkcuR/TvqAPmcPlzVjcX+tnuU0k+JK5e4eWc+diTcvo8fpeaKi7A4uyGWRaZsoaauxsK1dEwIgmAAYyWc0Hl+Z49/dLW8kgr/Qh9N5SRRk/SLk4GvS0uyYYClN7G/7LdMDUwWifr32oqXEINDh0NEyehEJ9dEQsIIH5gR3OdlEAuL1C7/Js3/ZCdBREXRYt4y5y4TAO/kMmGgv7Y/Z2XVD0klXVBMvVnil4LJ0H5KF+RZC4j/C6acRBdrPaI0nlE3bfAbmizQN9D7jOj5BkkRzBaYlMaBuFKRKUA6CUanhUWhIn3ZlF3Z+o4PGB2c7EFXZN+PzOSgkQYUD7KtVW/QV94mxkcqN9mKe6mAbj87neN1IHhEkNOj7KJQP60pqDjx6N+WYFpD3sYvDcJDg2WFumR8F2v+jHx09v5AB1r6AzhPJ3TCwnHN4e1+Nexxlb91iPcoSmLRF3Fimn7307260CtaA70hngWHSRaBcKTXi3WL1v9kKOou2kKs1GMy5bjREtqheBxZ1i4x56VtANF9lo9UT+97qxuAqk08Rc4z9j5M8cJK/d1syRT0z/uAuTWlRgxdE/Fj/OlDNr/SnZw9CLkQ0SVJAuJFFg9EY0ru3PC9PDNt9CJiVy0GoeK0mv7ZkTv2o456kdzMpJPBwpKLIO9tpZBbNZrMn1HpLJrfXIvmuVDFmm3EH6FVhGoI+4yB11Eo/2aEMzUOEtn55KNeESkoVel6GgYiwrg1ZlQS7XhdCTGyCOMbFTOLHgUe4vaUfPBNOyLaLWE3ZiyGCxVb+nBltcPSDHrNtbc2fuPqVom3Z1wfmako1BGcwRzbLdaUPwuu6eRa/KxppPh/PoYTttPxOArql25BWAVTI6BIhlvGgZgqDRwihHBGt1uyXjwv4ufES5zgxhMB8mNqVnCSkcLXXyvpmCiB5kEv5+V4nCJIXSNbmym+V9tEzGh+cx8up24IHrg6gG28fHfMcV7Z+JzN86jogr+sgH9wigrcYcDqTE9lHJhaZlmNraTl8viAwEXkPC/dnQuPSTX5V1qeRtKo1oFkf9xnPhdVLq51GoVU+MhQqZsbnqymgKnPWTQq3Kyiux5go/Li0BqfiV+Wwpn+f3WXJ21aMpU2FfIR26z2DULlJUYDKoewmklq8vzk5iZ/tywPFGR1G0z8IM5jwr+qz0uEccAtulCWsQjtvw0kGLnTsoB2WNL4x0Kti/cE14purKaE65wMrBoG/mxd6R7ZHE7u/Uo1MDAsgqsS8MomCqyxC/1yH9BdhpXc6VZJpborqWQjW/kK8/OBxWFjfQgwvDGeQkgv2ShV0c8U6DgnS545Im9aAxQGvu1sXMhnVNQZdZ2Ta3Gz7bTHqkxB4/X7KGHdGSmw5s/RQfo0BkBBBLLTc49pcmJTxG5LPkRebCM8ANX57qj3u/D9wYumFKclTglNdrjaxSdh3zTb1kEQ0rn/D4z7lVNUsw7srUUZeEadg3xTZSmSustbziXvp51juiJeyPjVY2AlmbVVxU0O245kbyWA8lHcEluo+dfk0Rr9hDNHz35NxQRCslPHiSKswxfuPcqyzlSiBMLsMWrJ5/RyQJgaO/XJ/x3R2o4h+MiHtUKj91epxAIpYD8JqQ4eaUkP6GJRNDSNLK3VNP69Qecc7b6AvV5udzt2up0lp7OuzEZeT88Vg8YcZvOv1UTxmkI6dem1xi4imJs+V4OZrcSt9ZTlc34rc6/lvVxVQZs/1vADB0ZVk3jp24KWuRWFGacJqUIxW8TbI8N1DtmZcf7sqoQU1QPRzkOa/UYmzWablAP4B5M5WOjyr3YSJGOzHxN+GSSs4K4jHUon+LbpKxHL5KJUSsD+kZFTfsDauFhAzpFDhR2wW/XYLr0iTvKQ6+26dIpW65P8Egv+n/CXQE0wuJ1R5z0M4FucpUo+FTUIcww8cfqfHqMlMeKEFeu8/QNdZ0uj06Q8/j6E/OUjpxTIVRQBs4qaLWxMZv3zulCUe9Czr6c28NhewIJlLUxOnCVDo5pT1OmzZPghurNyhTBFP8PfJrRXN1h2uvXfGP46dgt9jgeqqQqP9xlq+fzo9cyEZ/n4nQvY+CBuOW9Cqo41zNB0PQ3tC9SU477gQkDrg0M6/bAk+xsqVg1DpZOSuRUQnOfbTdZ1CXhESy+dcri9BeKKcTCZ6aenvW4W4J6OV8en3L4jPFsgqEWJUk1qr9ggM5NXc7RIrR0eCsiR9V1gi4HWMF1roTZ3wK9NvdATj3HWTGssfdpXht/vjedIp+InNWBWjnBfIf7XWuPgiB/ZW9uew8g8vDLULGVtww==,iv:bFKc8e+3rLAHje8UWwY2elof5xqceTTWX1f7nkE91nM=,tag:NWMiljj8urTDoka5bkF0jg==,type:str]
 asterisk-ari: ENC[AES256_GCM,data:HnY7d3BdScb0bmsBVlsTHAMv2k8tyyA/,iv:q+NsCHcGGOCe6gdAHbFfjKvO4dyWoW/xI5jtngJmdds=,tag:e8kuEsEokf5lAAgO/coxTQ==,type:str]
 asterisk-voicemail: ENC[AES256_GCM,data:uyXeBP+9WkfVot4Ot3vwv3OEZfoVDK2I+lvaPpGJTZp16YNtP+uxNiW2ynewQlORCTY59bP1jW3bQdT/ASGsErOrhInYSytTyfdZ51BF9+jz0TH6oWxsSuuawTrkC8jvJOpejt6XuGoYbbqlM/VL1xzgDkq3ztTxaHTfdTonQij2Q4cYddMRHWIEuBCK7FU2TlHAJeIFZvtE0MiyNNT3rEWSs1xcljTGfMjkoMd+FI1uZSQT4r0kAaPPkvCWcAGH6R+F0Ue++i9TuLhu+sDV+X6u3N/garDW74H0bOcLJysImtuPXh1aXuBkHQuC1Liss/IF4NDjtDDhpfc0eePR5MWv/Kj0q+VFJiUPY6XnWh6fG9I2yY22+I7eAAg/xWVZBXPWbFHRz8jm1owp4ln6/hcrJOw6Fzw8tZ6Jd9nciOeOmR1KtjEzklPP5kP1YQPtGio/LnOaAAhTHy16MbWf/Ey4S30+eHB+joD8OM93+YxxrdKNE6XXEcAhkdpHYecrvz4Co1fhY7ZoOnNvA8Juup/7PMyNEU/Fy4Pta34aT/j1s7de2vTpRNBeecWvgFA9Qd7Re/2XPqOAkpduxDniwsUdb52oL39MBoOCY8brmXn2J/mMDeOmoqvjRHsPZsajPTAqF/nqRB8VpwoZAKAx59DYBGgmHz7/7JRX9NXOAus1yLbMfVqDftk6+KTFQ9wCqei3jaI/K5AJrSEwlZG0BLoDefIGXT5f8bNNgSn865j2RP+FLa6W3/u5t+k=,iv:/phktIxMdDO5Nrum7hf3oLDmQO04lrkvFuHNw77aRks=,tag:7OUg0BG9X7nBHWiQNaSOEQ==,type:str]
+esphome: ENC[AES256_GCM,data:2pFVokO8YTyKa1F7EePo6wIS3y6prL8SSkxypWZkHl3Ye6Qg0eqZ4du/iwLIXQpJoc6R3uU7D6eIQEVOGbwqYp6+F0CW17F89k9c/VLHQHRpWbA20GgLr7X4fZ8xdbp7HCLpVxRsdzDz8aoARfV8Cn6T7Uo80ah1rMDnTj10WI+Yu6xVqVwPNWrSk9NUGKMK32M2slk=,iv:Xla0c4d9rxn06upy7GTbWBQ8pzl+gLnIw+Rf6hqQlhk=,tag:S+clc2ctuOA6lsInSFm93Q==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -13,25 +14,25 @@ sops:
         - recipient: age1ne08hny30vrkejqhh7dcx4ql6dmkx6jw9dqkf3cz7mzvt53njy0qh59w44
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBodUx5V25ETmJLTi9EZlRU
-            ZnYweXliTDl4ZUlvcmliTjhQRkpzU0pkNXlZCjFtYU5ySWFxOGlNL29SR2RJZHNu
-            UHJ4YWE4UWJVeEJBUXJwaHJBd292REkKLS0tIDV2WlppeUxIOWFPTHlRYTBaMzA0
-            MU41eU8zeTRRUlZyUXV0U1N6U0NRNnMKZK3vfyRRr7Iu6HfpdpmDTKzUbEnCnW9l
-            rGjFmY9VX2q9w3j/4E5uUToQfeGMqqBTOFUB3hNgU8K5ZT7wMbOXAg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEZmNOcVlKNmZCdWN5NVBy
+            U3VRbXl3OUljWCtITXZCQTdrVkIxOEtDZHg4CktBNjVKRmVucjRpYXo3WXFWd1VV
+            MFpGdWIvTmNHRlJ4akxUQkZzWUtXVUkKLS0tIGs3NlNXREVkT1Nta2prSXk4QkV0
+            NEtzRXY1Q1Njelc1YXNWVE9Jd2NnOFEKjOWHaxO5fF5l+c1Hv6QLBQajrvu1VimZ
+            Hqk0GYrFpfpFtbhBRyrYgmNuX/qIRMHemdXcNKDYcj0WXgsdVqH7Qw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-11-06T23:32:51Z"
-    mac: ENC[AES256_GCM,data:7lW6i4ULus4348NwnV/ovcWebspBcEBzYqLtl+8xFOfe3erIFnC3iRo0ibZJ8yishZpIUxoVu08yxQoa1qEriC57WETMaR+iGUPaY75tHraBJGY26Etk7Hy2QhQ7D+srBY+CogHhHAD8HUwT4/ZiPqKe1eQAvNg/6HWnjbQkG/Q=,iv:r43odkYgQsyK5uJJ5V98kTx7enP7TRuFoTnYfHmD/8o=,tag:hR+1zCniHs1l3qSkhQhtFw==,type:str]
+    lastmodified: "2024-03-17T20:41:27Z"
+    mac: ENC[AES256_GCM,data:f7RdcXpu9CGSZpIF8rwuIkn97EWRxJXxoC7KKbkZg4yxSxZJR/S5UXzEC56eY73IdBHap4op3l+cO7pT7p1rkspHQPH/5D225ihVQ8PQ29u2nlyyrrebB5tM1Mt+rJRlizBPxDDKySJYgdqZCWUwB8f5hQudpb0CGra7NfQreRg=,iv:vwpVqib7fyuV83FiyMT4BOeuqyrcspFyieQGWyZZzcU=,tag:zuJVSA2WqzSvM4MBWrdRlQ==,type:str]
     pgp:
-        - created_at: "2022-11-02T22:14:19Z"
+        - created_at: "2024-01-31T01:19:14Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wV4D3ylLYNOsO+0SAQdASri/Ozm8ibaE1PN8ItRanuAGU4jRQL1g4U8GbsiXWzcw
-            u7trrk6foY98pfVAP4Z78X4Dp79UagorlDCT6F6yWtfFODFdTVJdbzJsD5QtZ1vK
-            0lEBMmTyLDw4lzTpedDhvgkWpNd33TC3WgAfRb/2LCSPmoVp83O7ja6BfuBQDkWY
-            gP7g815fKYigaihDH8HlNzvRoOOcGC9+6lyQkHTJyRjKsrg=
-            =WfhH
+            hF4DY/xpNY5WhB0SAQdAkeQx8NatnRtZUJa/G0zaw+NL5twonTayNH8mmNBXOWgw
+            EWaC9Yq6yWntxxfkVaJHN5BEzxVVumrKmpKSIkvCkJqFZ5SuYH/DyE9oZZSr7iC/
+            0l4BTKZ8SdxQL8usQPSQVbs9skr7KsYfhtjTeTi823RwZLD1+wZKwqe43AJTE0Hl
+            b2jIihfXa7wKTfi9jXI/mpxLRpGH8kZnPoQuldkz1zWIU14YKoTKq55My8qwR4uW
+            =RazZ
             -----END PGP MESSAGE-----
-          fp: 66FB54F6081375106EEBF651A222365EB448F934
+          fp: 3044E71E3DEFF49B586CF5809BF4FCCB90854DA9
     unencrypted_suffix: _unencrypted
-    version: 3.7.3
+    version: 3.8.1

hosts/aluminium/services/asterisk/default.nix

@@ -1,34 +1,15 @@
-args@{ config, lib, pkgs, custom-utils, ... }:
+{ config, lib, pkgs, ... }:
 
 let
-  ports = import ../../ports.nix args;
+  inherit (config.networking) ports;
   secretConfigFiles = [
     "ari"
     "pjsip"
     "voicemail"
   ];
-  rtp = {
-    start = builtins.elemAt ports.asterisk-rtp.udp.range 0;
-    end = builtins.elemAt ports.asterisk-rtp.udp.range 1;
-  };
   voicemail-sounds = pkgs.callPackage ./voicemail-sounds { };
 in
 {
-  systemd.services.asterisk-voicemail-sounds = {
-    wantedBy = [ "asterisk.service" ];
-    after = [ "asterisk.service" ];
-    script = ''
-      ln -sfn \
-        ${voicemail-sounds}/unavail.wav \
-        /var/spool/asterisk/voicemail/lechner/876/unavail.wav
-    '';
-    restartTriggers = [ voicemail-sounds ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-    };
-  };
-
   services.asterisk = {
     enable = true;
     confFiles = {
@@ -157,8 +138,8 @@ in
       '';
       "rtp.conf" = ''
         [general]
-        rtpstart=${toString rtp.start}
-        rtpend=${toString rtp.end}
+        rtpstart=${toString ports.asterisk-rtp.udp.from}
+        rtpend=${toString ports.asterisk-rtp.udp.to}
       '';
       "dnsmgr.conf" = ''
         [general]
@@ -169,12 +150,11 @@ in
     useTheseDefaultConfFiles = [ ];
   };
 
-  sops.secrets = (lib.listToAttrs (map
+  sops.secrets = lib.listToAttrs (map
     (name: lib.nameValuePair "asterisk-${name}" {
-      sopsFile = ../../secrets.yaml;
       owner = config.users.users.asterisk.name;
     })
-    secretConfigFiles));
+    secretConfigFiles);
   environment.etc = lib.mapAttrs'
     (name: _: lib.nameValuePair
       "asterisk/${name}.conf"
@@ -182,92 +162,106 @@ in
     (lib.listToAttrs (map (name: lib.nameValuePair name { }) secretConfigFiles));
 
   networking.firewall = {
-    allowedUDPPortRanges = [
-      {
-        from = rtp.start;
-        to = rtp.end;
-      }
-    ];
-  };
-
-  systemd.services."asterisk-reload-endpoint@" = {
-    description = "Check if asterisk endpoint is identified and reload it when it is not.";
-    serviceConfig = {
-      Type = "oneshot";
-    };
-    environment = {
-      ENDPOINT = "%I";
-    };
-    script = ''
-      export PATH=${pkgs.lib.makeBinPath [pkgs.asterisk pkgs.gnused pkgs.gnugrep]}
-      if ! asterisk -r -x "pjsip show endpoint $ENDPOINT" | sed -n '/^===/,/^\s*ParameterName/{//!p}' | grep -q 'Identify:'; then
-          asterisk -r -x "module reload res_pjsip_endpoint_identifier_ip.so"
-      fi
-    '';
-  };
-
-  systemd.timers.asterisk-reload-endpoint = {
-    description = "Check if asterisk endpoint is identified and reload it when it is not.";
-    after = [ "asterisk.service" ];
-    wantedBy = [ "timers.target" ];
-    timerConfig = {
-      Persistent = true;
-      OnCalendar = "*-*-* *:*:00";
-      Unit = "asterisk-reload-endpoint@sipgate.service";
+    allowedUDPPortRanges = lib.singleton ports.asterisk-rtp.udp;
+    interfaces.voice = {
+      allowedTCPPorts = [ 5060 ];
+      allowedUDPPorts = [ 5060 ];
     };
   };
 
-  systemd.services."asterisk-voicemail-call@" = {
-    description = "Check if voicemail exists and place a call to the voicemail application.";
-    serviceConfig = {
-      Type = "oneshot";
+  systemd.services = {
+    "asterisk-reload-endpoint@" = {
+      description = "Check if asterisk endpoint is identified and reload it when it is not.";
+      serviceConfig = {
+        Type = "oneshot";
+      };
+      environment = {
+        ENDPOINT = "%I";
+      };
+      script = ''
+        export PATH=${pkgs.lib.makeBinPath [pkgs.asterisk pkgs.gnused pkgs.gnugrep]}
+        if ! asterisk -r -x "pjsip show endpoint $ENDPOINT" | sed -n '/^===/,/^\s*ParameterName/{//!p}' | grep -q 'Identify:'; then
+            asterisk -r -x "module reload res_pjsip_endpoint_identifier_ip.so"
+        fi
+      '';
     };
-    scriptArgs = "%I";
-    script = ''
-      export PATH=${pkgs.lib.makeBinPath [pkgs.asterisk pkgs.coreutils pkgs.findutils]}
-      number="$(echo "$1" | cut -d ':' -f 1)"
-      user="$(echo "$1" | cut -d ':' -f 2)"
-      channel="PJSIP/$(echo "$1" | cut -d ':' -f 3)"
-
-      if ! find "/var/spool/asterisk/voicemail/$user/$number/INBOX/" -mindepth 1 -maxdepth 1 | read; then
-          exit
-      fi
-
-      callfile="$(mktemp -p /tmp XXXXXXXXXX.call)"
-      chmod 644 "$callfile"
-
-      cat > "$callfile" << EOF
-      Channel: $channel
-      WaitTime: 15
-      Application: VoiceMailMain
-      Data: $number@$user
-      CallerID: Voicemail
-      EOF
-
-      mv "$callfile" /var/spool/asterisk/outgoing/
-    '';
-  };
-
-  systemd.timers.asterisk-voicemail-call-10 = {
-    description = "Check if voicemail exists and place a call to the voicemail application.";
-    after = [ "asterisk.service" ];
-    wantedBy = [ "timers.target" ];
-    timerConfig = {
-      Persistent = true;
-      OnCalendar = "*-*-* 07..22:00,20,40:00";
-      Unit = "asterisk-voicemail-call@876:lechner:10.service";
+    asterisk-voicemail-sounds = {
+      wantedBy = [ "asterisk.service" ];
+      after = [ "asterisk.service" ];
+      script = ''
+        ln -sfn \
+          ${voicemail-sounds}/unavail.wav \
+          /var/spool/asterisk/voicemail/lechner/876/unavail.wav
+      '';
+      restartTriggers = [ voicemail-sounds ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
     };
-  };
-  systemd.timers.asterisk-voicemail-call-11 = {
-    description = "Check if voicemail exists and place a call to the voicemail application.";
-    after = [ "asterisk.service" ];
-    wantedBy = [ "timers.target" ];
-    timerConfig = {
-      Persistent = true;
-      OnCalendar = "*-*-* 07..22:00,10,30:50";
-      Unit = "asterisk-voicemail-call@876:lechner:11.service";
+    "asterisk-voicemail-call@" = {
+      description = "Check if voicemail exists and place a call to the voicemail application.";
+      serviceConfig = {
+        Type = "oneshot";
+      };
+      scriptArgs = "%I";
+      script = ''
+        export PATH=${pkgs.lib.makeBinPath [pkgs.asterisk pkgs.coreutils pkgs.findutils]}
+        number="$(echo "$1" | cut -d ':' -f 1)"
+        user="$(echo "$1" | cut -d ':' -f 2)"
+        channel="PJSIP/$(echo "$1" | cut -d ':' -f 3)"
+
+        if ! find "/var/spool/asterisk/voicemail/$user/$number/INBOX/" -mindepth 1 -maxdepth 1 | read; then
+            exit
+        fi
+
+        callfile="$(mktemp -p /tmp XXXXXXXXXX.call)"
+        chmod 644 "$callfile"
+
+        cat > "$callfile" << EOF
+        Channel: $channel
+        WaitTime: 15
+        Application: VoiceMailMain
+        Data: $number@$user
+        CallerID: Voicemail
+        EOF
+
+        mv "$callfile" /var/spool/asterisk/outgoing/
+      '';
     };
   };
 
-  #voicemailCallScript
+  systemd.timers = {
+    asterisk-reload-endpoint = {
+      description = "Check if asterisk endpoint is identified and reload it when it is not.";
+      after = [ "asterisk.service" ];
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        Persistent = true;
+        OnCalendar = "*-*-* *:*:00";
+        Unit = "asterisk-reload-endpoint@sipgate.service";
+      };
+    };
+
+    asterisk-voicemail-call-10 = {
+      description = "Check if voicemail exists and place a call to the voicemail application.";
+      after = [ "asterisk.service" ];
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        Persistent = true;
+        OnCalendar = "*-*-* 07..22:00,20,40:00";
+        Unit = "asterisk-voicemail-call@876:lechner:10.service";
+      };
+    };
+    asterisk-voicemail-call-11 = {
+      description = "Check if voicemail exists and place a call to the voicemail application.";
+      after = [ "asterisk.service" ];
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        Persistent = true;
+        OnCalendar = "*-*-* 07..22:00,10,30:50";
+        Unit = "asterisk-voicemail-call@876:lechner:11.service";
+      };
+    };
+  };
 }

hosts/aluminium/services/asterisk/voicemail-sounds/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenvNoCC }:
+{ stdenvNoCC }:
 
 stdenvNoCC.mkDerivation {
   name = "voicemail-sounds";

hosts/aluminium/services/default.nix

@@ -4,6 +4,10 @@
     ./dnsmasq.nix
     ./doorbell.nix
     ./dyndns.nix
+    ./esphome
+    ./home-assistant.nix
+    ./nginx.nix
+    ./ntp.nix
     ./unifi-controller.nix
   ];
 }

hosts/aluminium/services/dnsmasq.nix

@@ -1,8 +1,5 @@
-{ pkgs, ... }:
+{ lib, pkgs, ... }:
 
-let
-  stateDir = "/var/lib/dnsmasq";
-in
 {
   services.dnsmasq = {
     enable = true;
@@ -10,14 +7,19 @@ in
       listen-address = [
         "192.168.0.1"
         "192.168.1.1"
+        "192.168.2.1"
         "192.168.10.9"
       ];
       interface = "lo";
       expand-hosts = true;
-      domain = "lan.kbh.jalr.de";
+      domain = [
+        "lan.kbh.jalr.de"
+        "iot.kbh.jalr.de,192.168.2.0/24"
+      ];
       dhcp-range = [
         "192.168.0.20,192.168.0.254,4h"
         "192.168.1.20,192.168.1.254,4h"
+        "192.168.2.20,192.168.2.254,4h"
         "192.168.10.8,static,24h"
       ];
       dhcp-host = [
@@ -34,11 +36,24 @@ in
         "2001:470:20::2" # ordns.he.net
         "74.82.42.42" # ordns.he.net
       ];
+      dhcp-option = [
+        "option:ntp-server,192.168.0.1"
+      ];
     };
   };
 
-  networking.firewall = {
-    allowedUDPPorts = [ 53 67 ];
-    allowedTCPPorts = [ 53 ];
-  };
+  networking.firewall.interfaces = lib.attrsets.genAttrs [
+    "heizung"
+    "iot"
+    "lechner"
+    "pv"
+    "sprechanlage"
+    "voice"
+  ]
+    (
+      _: {
+        allowedUDPPorts = [ 53 67 ];
+        allowedTCPPorts = [ 53 ];
+      }
+    );
 }

hosts/aluminium/services/doorbell.nix

@@ -1,13 +1,10 @@
-args@{ config, lib, pkgs, custom-utils, ... }:
+{ config, ... }:
 
 let
-  ports = import ../ports.nix args;
+  inherit (config.networking) ports;
 in
 {
-  sops.secrets.myintercom-doorbell-password = {
-    sopsFile = ../secrets.yaml;
-    owner = "asterisk";
-  };
+  sops.secrets.myintercom-doorbell-password.owner = "asterisk";
   services.myintercom-doorbell = {
     enable = true;
     host = "sprechanlage.lan.kbh.jalr.de";

hosts/aluminium/services/dyndns.nix

@@ -1,16 +1,42 @@
-{ config, ... }:
+{ config, lib, pkgs, ... }:
+let
+  mkService = config:
+    lib.mapAttrs'
+      (name: cfg: lib.nameValuePair "godns-${name}" (
+        let
+          config = cfg.settings // {
+            login_token_file = "$CREDENTIALS_DIRECTORY/login_token";
+          };
+          configFile = (pkgs.formats.yaml { }).generate "config.yaml" config;
+        in
+        {
+          description = "GoDNS service";
+          wantedBy = [ "multi-user.target" ];
+          after = [ "network.target" ];
+          serviceConfig = {
+            DynamicUser = true;
+            ExecStart = "${lib.getExe pkgs.godns} -c ${configFile}";
+            LoadCredential = "login_token:${cfg.tokenPath}";
+            Restart = "always";
+            RestartSec = "2s";
+          };
+        }
+      ))
+      config;
+in
 {
-  sops.secrets.duckdns-secret = {
-    sopsFile = ../secrets.yaml;
-  };
-  services.ddclient = {
-    enable = true;
-    interval = "1min";
-    protocol = "duckdns";
-    server = "www.duckdns.org";
-    username = "nouser";
-    passwordFile = config.sops.secrets.duckdns-secret.path;
-    domains = [ "jalr-k" ];
-    use = "if, if=ppp0";
+  systemd.services = mkService {
+    ip4 = {
+      tokenPath = config.sops.secrets.duckdns-secret.path;
+      settings = {
+        provider = "DuckDNS";
+        domains = [{ domain_name = "www.duckdns.org"; sub_domains = [ "jalr-k" ]; }];
+        resolver = "8.8.8.8";
+        ip_interface = "ppp0";
+        ip_urls = [ "" ];
+        ip_type = "IPv4";
+        interval = 60;
+      };
+    };
   };
 }

hosts/aluminium/services/esphome/default.nix

@@ -0,0 +1,25 @@
+{ pkgs
+, config
+, ...
+}:
+let
+  inherit (config.networking) ports;
+in
+{
+  sops.secrets.esphome.restartUnits = [ config.systemd.services.esphome.name ];
+
+  jalr.esphome = {
+    enable = true;
+    port = ports.esphome.tcp;
+    secretsFile = config.sops.secrets.esphome.path;
+    configDir = pkgs.stdenvNoCC.mkDerivation {
+      name = "esphome-config";
+      src = ./devices;
+      dontBuild = true;
+      installPhase = ''
+        mkdir $out
+        cp -r * $out
+      '';
+    };
+  };
+}

hosts/aluminium/services/esphome/devices/.env

@@ -0,0 +1,2 @@
+ESPHOME_HOST="jalr-k.duckdns.org"
+ESPHOME_SECRETS_FILE="esphome_${ESPHOME_HOST}_secrets.yaml"

hosts/aluminium/services/esphome/devices/.gitignore

@@ -0,0 +1,5 @@
+# Gitignore settings for ESPHome
+# This is an example and may include too much for your use-case.
+# You can modify this file to suit your needs.
+/.esphome/
+/secrets.yaml

hosts/aluminium/services/esphome/devices/justfile

@@ -0,0 +1 @@
+../../../../../modules/esphome/devices/justfile

hosts/aluminium/services/esphome/devices/wasserbett.yaml

@@ -0,0 +1,64 @@
+esphome:
+  name: "waterbed"
+  friendly_name: "Wasserbett"
+
+esp8266:
+  board: d1_mini
+  framework:
+    version: recommended
+
+logger:
+
+api:
+  encryption:
+    key: !secret apikey_waterbed
+
+ota:
+  - platform: esphome
+    password: !secret otapass_waterbed
+
+wifi:
+  ssid: !secret wifi_ssid_kbh
+  password: !secret wifi_password_kbh
+  domain: .iot.kbh.jalr.de
+  enable_on_boot: true
+  fast_connect: true
+
+switch:
+  - platform: gpio
+    pin:
+      number: 13
+    id: pump
+    icon: "mdi:electric-switch"
+
+dallas:
+  - pin: 12
+
+sensor:
+  - platform: dallas
+    #address: 0xb7000802397ccc10
+    index: 0
+    name: "Temperatur"
+    id: temperature_waterbed
+
+climate:
+ - platform: thermostat
+   name: "Temperatur"
+   id: temperature
+   sensor: temperature_waterbed
+   heat_deadband: 0.2
+   heat_overrun: 0.2
+   min_heating_off_time: 300s
+   min_heating_run_time: 300s
+   min_idle_time: 30s
+   heat_action:
+     - switch.turn_on: pump
+   idle_action:
+     - switch.turn_off: pump
+   default_preset: heizen
+   on_boot_restore_from: memory
+   preset:
+     - name: heizen
+       default_target_temperature_low: 28.5 °C
+     - name: abwesend
+       default_target_temperature_low: 24 °C

hosts/aluminium/services/home-assistant.nix

@@ -0,0 +1,141 @@
+{ pkgs, config, ... }:
+let
+  inherit (config.networking) ports;
+in
+{
+  services.home-assistant = {
+    enable = true;
+    lovelaceConfig = {
+      title = "Home";
+      views = [
+        {
+          path = "default_view";
+          title = "Home";
+          cards = [
+            {
+              title = "Heizung";
+              type = "entities";
+              entities = [
+                { entity = "sensor.guntamaticbiostar_betrieb"; }
+                { entity = "sensor.guntamaticbiostar_pufferladung"; }
+                { entity = "sensor.guntamaticbiostar_puffer_oben"; }
+                { entity = "sensor.guntamaticbiostar_puffer_unten"; }
+                { entity = "sensor.guntamaticbiostar_kesseltemperatur"; }
+                { entity = "sensor.guntamaticbiostar_vorlauf_ist_1"; }
+                { entity = "sensor.guntamaticbiostar_aussentemperatur"; }
+                { entity = "sensor.guntamaticbiostar_co2_gehalt"; }
+                { entity = "select.guntamaticbiostar_program"; }
+                { entity = "sensor.guntamaticbiostar_programm"; }
+                { entity = "sensor.guntamaticbiostar_programm_hk1"; }
+                { entity = "sensor.guntamaticbiostar_rucklauftemperatur"; }
+                { entity = "sensor.guntamaticbiostar_servicezeit"; }
+              ];
+            }
+            {
+              type = "grid";
+              square = false;
+              columns = 1;
+              cards = [
+                {
+                  title = "Wasserbett";
+                  type = "entities";
+                  entities = [
+                    {
+                      entity = "sensor.waterbed_temperatur";
+                      name = "Temperatur";
+                    }
+                  ];
+                }
+                {
+                  type = "thermostat";
+                  entity = "climate.waterbed_temperatur";
+                }
+              ];
+            }
+          ];
+        }
+      ];
+    };
+    extraComponents = [
+      # See https://www.home-assistant.io/integrations
+      "esphome"
+      "openweathermap"
+    ];
+    customComponents = [
+      # https://github.com/a529987659852/GuntamaticBiostar
+      pkgs.home-assistant-custom-components.guntamatic
+    ];
+    lovelaceConfigWritable = false;
+    configWritable = false;
+    config = {
+      http = {
+        server_host = [ "127.0.0.1" ];
+        server_port = ports.home-assistant.tcp;
+        use_x_forwarded_for = true;
+        trusted_proxies = [ "127.0.0.1" ];
+      };
+      homeassistant = {
+        unit_system = "metric";
+        time_zone = "Europe/Berlin";
+        temperature_unit = "C";
+        inherit (config.location) longitude;
+        inherit (config.location) latitude;
+      };
+      default_config = { };
+      "automation nix" = [
+        {
+          alias = "Nachschüren";
+          description = "Benachrichtigung auf iPad bei Wechsel auf Teillast";
+          mode = "single";
+          trigger = [
+            {
+              platform = "state";
+              entity_id = [ "sensor.guntamaticbiostar_betrieb" ];
+              from = "VOLLLAST";
+              to = "TEILLAST";
+            }
+          ];
+          condition = [
+            {
+              condition = "numeric_state";
+              entity_id = "sensor.guntamaticbiostar_pufferladung";
+              below = "80";
+            }
+          ];
+          action = [
+            {
+              device_id = "5612874405fa2ee539ad4518a1bb8e34";
+              domain = "mobile_app";
+              type = "notify";
+              message = ''
+                Kessel läuft auf Teillast und Puffer ist unter 80%. Vielleicht willst du
+                nachschüren.
+              '';
+              title = "Nachschüren?";
+            }
+          ];
+        }
+      ];
+      "automation ui" = "!include automations.yaml";
+      "scene nix" = [
+      ];
+      "scene ui" = "!include scenes.yaml";
+    };
+  };
+
+  systemd.tmpfiles.rules = [
+    "f ${config.services.home-assistant.configDir}/automations.yaml 0755 hass hass"
+    "f ${config.services.home-assistant.configDir}/scenes.yaml 0755 hass hass"
+  ];
+
+  services.nginx.virtualHosts."hass.kbh.jalr.de" = {
+    enableACME = true;
+    forceSSL = true;
+    kTLS = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:${toString ports.home-assistant.tcp}/";
+      recommendedProxySettings = true;
+      proxyWebsockets = true;
+    };
+  };
+}

hosts/aluminium/services/nginx.nix

@@ -0,0 +1,20 @@
+{ config, ... }:
+
+let
+  inherit (config.networking) ports;
+in
+{
+  services.nginx = {
+    enable = true;
+    defaultHTTPListenPort = ports.nginx-http.tcp;
+    defaultSSLListenPort = ports.nginx-https.tcp;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+  };
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
+}

hosts/aluminium/services/ntp.nix

@@ -0,0 +1,12 @@
+{
+  services.chrony = {
+    enable = true;
+    extraConfig = ''
+      allow 192.168.0.0/24
+      allow 192.168.10.0/24
+      leapsectz right/UTC
+    '';
+  };
+  networking.firewall.interfaces.lechner.allowedUDPPorts = [ 123 ];
+  networking.firewall.interfaces.heizung.allowedUDPPorts = [ 123 ];
+}

hosts/aluminium/services/unifi-controller.nix

@@ -1,13 +1,16 @@
-args@{ pkgs, custom-utils, ... }:
+{ config, pkgs, ... }:
 
 let
-  ports = import ../ports.nix args;
+  inherit (config.networking) ports;
 in
 {
   services.unifi = {
     enable = true;
-    openFirewall = true;
     unifiPackage = pkgs.unifi;
+    mongodbPackage = pkgs.mongodb-7_0;
   };
-  networking.firewall.allowedTCPPorts = [ ports.unifi.tcp ];
+  networking.firewall.interfaces.lechner.allowedTCPPorts = [
+    ports.unifi-inform.tcp
+    ports.unifi-ui.tcp
+  ];
 }

hosts/cadmium/configuration.nix

@@ -1,16 +1,13 @@
-{ config, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   imports = [
     ./hardware-configuration.nix
-    ../../home-manager/users/jalr.nix
+    ../../users/jalr
   ];
 
   networking = {
     hostName = "cadmium";
-    networkmanager = {
-      enable = true;
-    };
     useDHCP = false;
 
     firewall = {
@@ -50,9 +47,11 @@
     bootloader = "systemd-boot";
     bluetooth.enable = true;
     uefi.enable = true;
-    gui.enable = true;
+    gui = {
+      enable = true;
+      sway.enable = true;
+    };
     workstation.enable = true;
-    sdr.enable = true;
     libvirt.enable = true;
     autologin.enable = true;
     autologin.username = "jalr";

hosts/copper/configuration.nix

@@ -0,0 +1,77 @@
+{ lib, ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./disko.nix
+    ../../users/jalr
+    ./services
+    ./framework-fixes.nix
+  ];
+
+  networking = {
+    hostName = "copper";
+    extraHosts = lib.concatStringsSep "\n" (
+      lib.attrsets.mapAttrsToList
+        (addr: hosts:
+          lib.concatStringsSep " " ([ addr ] ++ hosts)
+        )
+        {
+          #"192.0.2.1" = ["example.com"];
+        }
+    );
+    firewall.interfaces.virbr0.allowedTCPPorts = [ 53 64172 ];
+    firewall.interfaces.virbr0.allowedUDPPorts = [ 53 67 69 4011 ];
+  };
+
+  zramSwap = {
+    enable = true;
+    algorithm = "zstd";
+    memoryPercent = 60;
+    priority = 1;
+  };
+
+  services = {
+    fstrim.enable = true;
+    flatpak.enable = true;
+    snapper.configs = {
+      home = {
+        SUBVOLUME = "/home";
+        ALLOW_USERS = [ "jalr" ];
+        TIMELINE_CREATE = true;
+        TIMELINE_CLEANUP = true;
+        TIMELINE_LIMIT_HOURLY = 12;
+        TIMELINE_LIMIT_DAILY = 7;
+        TIMELINE_LIMIT_WEEKLY = 4;
+        TIMELINE_LIMIT_MONTHLY = 3;
+        TIMELINE_LIMIT_YEARLY = 0;
+        BACKGROUND_COMPARISON = "yes";
+        NUMBER_CLEANUP = "no";
+        NUMBER_MIN_AGE = "1800";
+        NUMBER_LIMIT = "100";
+        NUMBER_LIMIT_IMPORTANT = "10";
+        EMPTY_PRE_POST_CLEANUP = "yes";
+        EMPTY_PRE_POST_MIN_AGE = "1800";
+      };
+    };
+  };
+
+  jalr = {
+    bootloader = "lanzaboote";
+    bluetooth.enable = true;
+    uefi.enable = true;
+    gui = {
+      enable = true;
+      sway.enable = true;
+    };
+    workstation.enable = true;
+    libvirt.enable = true;
+    autologin = {
+      enable = true;
+      username = "jalr";
+    };
+  };
+
+  system.stateVersion = "24.05";
+}
+

hosts/copper/disko.nix

@@ -0,0 +1,59 @@
+{
+  disko.devices = {
+    disk = {
+      nvme = {
+        type = "disk";
+        device = "/dev/disk/by-id/nvme-Samsung_SSD_990_PRO_2TB_S7DNNJ0X235226N";
+        content = {
+          type = "gpt";
+          partitions = {
+            esp = {
+              type = "EF00";
+              size = "1024M";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "uid=0" "gid=0" "fmask=0077" "dmask=0077" "nodev" "nosuid" "noexec" ];
+              };
+            };
+            luks = {
+              size = "100%";
+              content = {
+                type = "luks";
+                name = "copper-crypt";
+                settings = {
+                  allowDiscards = true;
+                };
+                extraFormatArgs = [ "--hash sha512 --use-random --pbkdf argon2id --iter-time 5000 --pbkdf-memory ${builtins.toString (4*1024*1024)} --pbkdf-parallel 4" ];
+                content = {
+                  type = "btrfs";
+                  extraArgs = [ "-f" ];
+                  subvolumes = {
+                    "/root" = {
+                      mountpoint = "/";
+                      mountOptions = [ "compress-force=zstd:1" "noatime" ];
+                    };
+                    "/home" = {
+                      mountpoint = "/home";
+                      mountOptions = [ "compress-force=zstd:1" "noatime" "nodev" "nosuid" ];
+                    };
+                    "/home/.snapshots" = {
+                      mountOptions = [ "compress-force=zstd:1" "noatime" "nodev" "nosuid" ];
+                    };
+                    "/nix" = {
+                      mountpoint = "/nix";
+                      mountOptions = [ "compress-force=zstd:1" "noatime" "noatime" "nodev" ];
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}
+
+

hosts/copper/framework-fixes.nix

@@ -0,0 +1,14 @@
+{ pkgs, ... }:
+
+{
+  boot.extraModprobeConfig = ''
+    options cfg80211 ieee80211_regdom="DE"
+    options mt7921_common disable_clc=1
+    options mt7921e disable_aspm=Y
+  '';
+  hardware.firmware = [ pkgs.wireless-regdb ];
+
+  services.udev.extraRules = ''
+    ACTION=="add", SUBSYSTEM=="pci", ATTR{power/wakeup}="disabled"
+  '';
+}

hosts/copper/hardware-configuration.nix

@@ -0,0 +1,18 @@
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd = {
+    availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ];
+  };
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+
+  environment.systemPackages = with pkgs; [
+    fw-ectool
+  ];
+}

hosts/copper/secrets.yaml

@@ -0,0 +1,32 @@
+ntfy_shiftphone: ENC[AES256_GCM,data:WG/LlELNgEh2BiyrOYLDvYk3AlObSvUYUH8v3Cq9oHOhN1+Iwg==,iv:MVwLBIQjY8Z31V9mXf7Ge/jGb9S7ceLFx2TffcsO+o4=,tag:skeQbBPLYH8D4CPDorJ0fQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1rrut5ntrkqmvttvmpa5jcmjhr2pfpyaqgu9dmtx6v07lgjxx5ppsl7e5v3
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzbXFqbHJFM0xxL284dWZD
+            TDkzcGVSRGorRWQvV3h3dkJ6UjNOeUxVcGdRCk5jTkZDeVFORVVWdm1vZm5XUHdk
+            S0ZBTEdEeDgramZNZm5xK3RkVkkxSDgKLS0tIFZ6dysvVm1YNlJzOVFXZXhrdXBE
+            dU0reGFSUmRxb0ZlUHgyYlpjU0FOQUEKuOMKvkZcynBGyMHmAYmz13Jy32YKyVK0
+            ztCWcXbl9qCe6KtI0yW+t8DLk/PaRrmSrB+2ICTMFqPh7HiBoX+KgQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-03-12T20:36:21Z"
+    mac: ENC[AES256_GCM,data:BpwQmtqj8NkTNO7cJHMoOeILY4HRcb7OasiCcnXsBwIFvbeDgwj+DMZOeKbitLXwzS5frWhZWg0eBHQ4BZQFjX1K0KReVacH9CblHnSZLxjMg3x6o3upB70YjdmD3KKBisOwfMCjklwk0rKwx0w5vzac3r1nJU+PGtFw1luIiBs=,iv:bYIRVFWVGjwgmaGu6JqvpCa0TIp8idP5Bc5cYV7Bri8=,tag:D2xS1PK9a9Dd1mm8+R9RRA==,type:str]
+    pgp:
+        - created_at: "2025-03-12T20:51:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4DY/xpNY5WhB0SAQdAhB2C4sQhoL04j1RiWoeNCNSbGxDkrqXP+IffdoY8DWgw
+            x8aogh0b7CpTplBG/4g/WMVB4N/86uvI+mLYxJMyRb9b0f0bDr5dPpnhk//r/MDg
+            0l4B9+hcSzmkwXlKh7L8Ds4cZr/z3RlqnR424KSfKbiaaigYttui5l4xgEEPZE1H
+            1yfIJ5lBMgG1HTj3HX5mqM9ocA4HVzIkfPPqrFRAgjZdqeDEbLBT3lItMlvsOwy4
+            =kS0b
+            -----END PGP MESSAGE-----
+          fp: 3044E71E3DEFF49B586CF5809BF4FCCB90854DA9
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

hosts/copper/services/default.nix

@@ -0,0 +1,8 @@
+{
+  imports = [
+    ./illuminanced.nix
+    ./ntfy.nix
+    ./timelog.nix
+    ./webdev.nix
+  ];
+}

hosts/copper/services/illuminanced.nix

@@ -0,0 +1,94 @@
+{ lib, pkgs, ... }:
+
+let
+  tomlFormat = pkgs.formats.toml { };
+  cfg = {
+    daemonize = {
+      log_to = "syslog";
+      pid_file = "/run/illuminanced/illuminanced.pid";
+      #log_level = "OFF", "ERROR", "WARN", "INFO", "DEBUG", "TRACE"
+      log_level = "ERROR";
+    };
+    general = {
+      check_period_in_seconds = 1;
+      light_steps = 100;
+      min_backlight = 20;
+      step_barrier = 0.1;
+      max_backlight_file = "/sys/class/backlight/amdgpu_bl1/max_brightness";
+      backlight_file = "/sys/class/backlight/amdgpu_bl1/brightness";
+      illuminance_file = "/sys/bus/iio/devices/iio:device0/in_illuminance_raw";
+      #event_device_mask = "/dev/input/event*";
+      #event_device_name = "Asus WMI hotkeys";
+      enable_max_brightness_mode = true;
+      filename_for_sensor_activation = "";
+    };
+    kalman = {
+      q = 1;
+      r = 20;
+      covariance = 10;
+    };
+    light = {
+      points_count = 6;
+
+      illuminance_0 = 0;
+      light_0 = 0;
+      illuminance_1 = 20;
+      light_1 = 35;
+      illuminance_2 = 70;
+      light_2 = 50;
+      illuminance_3 = 120;
+      light_3 = 65;
+      illuminance_4 = 200;
+      light_4 = 75;
+      illuminance_5 = 255;
+      light_5 = 99;
+    };
+  };
+  configFile = tomlFormat.generate "illuminanced.toml" cfg;
+in
+{
+  systemd.services.illuminanced = {
+    description = "Ambient Light Sensor Daemon";
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "exec";
+      Restart = "always";
+      ExecStart = "${pkgs.illuminanced}/bin/illuminanced -c ${configFile}";
+      PIDFile = cfg.daemonize.pid_file;
+      StandardOutput = "journal";
+      BindReadOnlyPaths = [
+        "/nix/store"
+        "/dev/log"
+        "/run/systemd/journal/socket"
+        "/run/systemd/journal/stdout"
+        cfg.general.max_backlight_file
+        (lib.strings.escape [ ":" ] cfg.general.illuminance_file)
+      ];
+      BindPaths = [
+        cfg.general.backlight_file
+      ];
+      CapabilityBoundingSet = null;
+      IPAddressDeny = "any";
+      LockPersonality = true;
+      PrivateDevices = true;
+      PrivateTmp = true;
+      PrivateUsers = true;
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "noaccess";
+      ProtectSystem = "strict";
+      RestrictAddressFamilies = [ ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RootDirectory = "/run/illuminanced";
+      RuntimeDirectory = "illuminanced";
+      SystemCallArchitectures = "native";
+      SystemCallFilter = "@system-service";
+    };
+  };
+}

hosts/copper/services/ntfy.nix

@@ -0,0 +1,3 @@
+{
+  sops.secrets.ntfy_shiftphone.owner = "jalr";
+}

hosts/copper/services/timelog.nix

@@ -0,0 +1,10 @@
+{
+  powerManagement = {
+    powerUpCommands = ''
+      echo "timelog: powerUp"
+    '';
+    powerDownCommands = ''
+      echo "timelog: powerDown"
+    '';
+  };
+}

hosts/copper/services/webdev.nix

@@ -0,0 +1,50 @@
+{ pkgs, lib, ... }:
+{
+  systemd.services = lib.attrsets.mapAttrs'
+    (
+      name: mapping: lib.attrsets.nameValuePair "redir-${name}" {
+        description = "Port redirection for local development web server (${name})";
+        after = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+          BindReadOnlyPaths = [ "/nix/store" ];
+          CapabilityBoundingSet = "CAP_NET_BIND_SERVICE";
+          DynamicUser = true;
+          ExecStart = "${pkgs.redir}/bin/redir -n 127.0.0.1:${toString mapping.to} 127.0.0.1:${toString mapping.from}";
+          IPAddressAllow = "localhost";
+          IPAddressDeny = "any";
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = lib.mkForce true;
+          PrivateTmp = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "noaccess";
+          ProtectSystem = "strict";
+          ReadWritePaths = "";
+          RemoveIPC = true;
+          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          RootDirectory = "/run/redir-https";
+          RuntimeDirectory = "redir-https";
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
+          Type = "exec";
+        };
+      }
+    )
+    {
+      http = { from = 8080; to = 80; };
+      https = { from = 8443; to = 443; };
+    };
+}

hosts/default.nix

@@ -1,7 +1,10 @@
-{ ... }@inputs:
+inputs:
+let
+  hardware = inputs.nixos-hardware.nixosModules;
+in
 {
   aluminium = {
-    targetHost = "192.168.0.1";
+    targetHost = "jalr-k.duckdns.org";
     system = "x86_64-linux";
   };
   jalr-t520 = {
@@ -10,20 +13,20 @@
   cadmium = {
     system = "x86_64-linux";
   };
-  hafnium = {
-    system = "x86_64-linux";
-  };
-  weinturm-pretix-prod = {
-    system = "aarch64";
-    targetHost = "142.132.185.70";
-  };
   iron = {
     system = "x86_64-linux";
     #targetHost = "192.168.42.1";
     targetHost = "jalr-bw.duckdns.org";
   };
   magnesium = {
-    system = "aarch64";
-    targetHost = "162.55.35.199";
+    system = "x86_64-linux";
+    targetHost = "magnesium.jalr.de";
+  };
+  copper = {
+    system = "x86_64-linux";
+    targetHost = "copper.lan.bw.jalr.de";
+    extraModules = [
+      hardware.framework-16-7040-amd
+    ];
   };
 }

hosts/hafnium/configuration.nix

@@ -1,147 +0,0 @@
-{ lib, config, pkgs, self, system, ... }:
-
-let
-  tradebyteDnsServers = [
-    "10.170.254.30"
-    "10.170.254.40"
-  ];
-in
-{
-  imports = [
-    ./hardware-configuration.nix
-    ../../home-manager/users/jal.nix
-  ];
-
-  networking = {
-    hostName = "hafnium";
-    networkmanager = {
-      enable = true;
-    };
-    useDHCP = false;
-    interfaces = {
-      enp2s0f0.useDHCP = false;
-      enp5s0.useDHCP = false;
-      wlp3s0.useDHCP = false;
-    };
-    firewall = {
-      allowedUDPPorts = [
-        53
-      ];
-      allowedTCPPorts = [
-        53
-      ];
-    };
-    extraHosts = ''
-      #10.10.10.10 example.com
-    '';
-  };
-
-  environment.systemPackages = with pkgs; [
-    brightnessctl
-    gnome3.adwaita-icon-theme
-    openconnect
-    redir
-    tcpdump
-  ];
-
-  environment.variables.EDITOR = "nvim";
-
-  programs.mtr.enable = true;
-
-
-  services.udisks2.enable = true;
-
-  jalr = {
-    bootloader = "systemd-boot";
-    bluetooth.enable = true;
-    uefi.enable = true;
-    gui.enable = true;
-    workstation.enable = true;
-    sdr.enable = false;
-    libvirt.enable = true;
-    autologin.enable = true;
-    autologin.username = "jal";
-    tradebyte.enable = true;
-  };
-
-
-  sops.secrets = (
-    lib.listToAttrs (map
-      (name: lib.nameValuePair "wireguard_key_${name}" {
-        sopsFile = ./secrets.yaml;
-      })
-      [
-        "tbcore"
-        "ops-testing"
-      ]
-    )
-  );
-
-  networking.wireguard.interfaces = {
-    tbcore = {
-      ips = [ "172.27.27.16/32" ];
-      privateKeyFile = config.sops.secrets.wireguard_key_tbcore.path;
-      listenPort = 51930;
-
-      peers = [{
-        publicKey = "K5vF/yTag6NnWjZsMug63DERdCFRfHoqxVkgKH55oFE=";
-        endpoint = "194.33.184.175:51930";
-        #endpoint = "ccs-emergency-vpn.core.tradebyte.com:51930";
-        persistentKeepalive = 25;
-        allowedIPs = [
-          "10.158.128.0/23"
-          "10.158.224.0/20"
-          "10.18.0.0/16"
-          "10.64.64.0/20" # CPS
-          "172.31.1.0/24"
-        ];
-      }];
-    };
-    ops-testing = {
-      ips = [ "10.254.254.2/30" ];
-      privateKeyFile = config.sops.secrets.wireguard_key_ops-testing.path;
-      peers = [{
-        publicKey = "+jZETJfwaRiM+7ys5eYjgiWEAtxP47RzZSCx0w4l2nI=";
-        endpoint = "3.68.138.217:2048";
-        persistentKeepalive = 25;
-        allowedIPs = [
-          "10.254.254.0/30"
-          "10.250.0.0/16"
-        ];
-      }];
-    };
-  };
-
-  services.dnsmasq.settings.server = lib.lists.flatten
-    (
-      map (domain: (map (srv: "/${domain}/${srv}") tradebyteDnsServers)) [
-        "vpce-0c1c169d1e33a1c2f-yugtdam1.s3.eu-central-1.vpce.amazonaws.com"
-        "ccs.tradebyte.com"
-        "instance.tradebyte.com"
-      ]) ++ [
-    "/internal.production.core.tradebyte.com/10.158.224.2"
-    "/internal.development.core.tradebyte.com/10.170.254.30"
-    "/rds.amazonaws.com/9.9.9.9"
-    "/tradebyte.com/9.9.9.9"
-    "/tradebyte.org/9.9.9.9"
-    "/develop.sys.tradebyte.com/10.0.3.1"
-    "/corp.ad.zalando.net/10.160.19.100"
-  ];
-  services.actkbd = {
-    enable = true;
-    bindings = [
-      { keys = [ 232 ]; events = [ "key" ]; command = "/run/current-system/sw/bin/brightnessctl s -5%"; }
-      { keys = [ 233 ]; events = [ "key" ]; command = "/run/current-system/sw/bin/brightnessctl s +5%"; }
-    ];
-  };
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "23.11"; # Did you read the comment?
-
-}
-

hosts/hafnium/hardware-configuration.nix

@@ -1,44 +0,0 @@
-{ modulesPath, ... }:
-
-{
-  imports = [
-    "${modulesPath}/installer/scan/not-detected.nix"
-  ];
-
-  hardware.cpu.amd.updateMicrocode = true;
-
-  boot = {
-    initrd.availableKernelModules = [
-      "nvme"
-      "ehci_pci"
-      "xhci_pci"
-      "usb_storage"
-      "sd_mod"
-      "rtsx_pci_sdmmc"
-    ];
-    kernelModules = [ "kvm-amd" ];
-  };
-
-  fileSystems = {
-    "/" = {
-      device = "/dev/disk/by-uuid/b86310f5-fe3d-4b4d-bc02-ab0d7e9297cf";
-      fsType = "btrfs";
-      options = [
-        "discard=async"
-        "noatime"
-        "subvol=/nixos"
-        "compress=zstd:6"
-      ];
-    };
-    "/boot" = {
-      device = "/dev/disk/by-uuid/564E-26B4";
-      fsType = "vfat";
-      options = [ "nodev" "nosuid" "noexec" ];
-    };
-  };
-
-  boot.initrd.luks.devices.cryptroot = {
-    device = "/dev/disk/by-uuid/d9b120c1-5e80-4893-92fe-497e5b44c25b";
-    allowDiscards = true;
-  };
-}

hosts/hafnium/secrets.yaml

@@ -1,42 +0,0 @@
-wireguard_key_tbcore: ENC[AES256_GCM,data:/VdCVC6xciihm2suOiuNabAWPhWPGSyWSKbLKRpy8EK7aXpyxZPybnANc1E=,iv:/LxrjPLzUkHdyT45RIfbfc4Xa3vsnQNiamnbiMdubpg=,tag:N5nFx1QsH9FGiK9DrMg2hQ==,type:str]
-wireguard_key_ops-testing: ENC[AES256_GCM,data:FiADGmh3GAK6LI9Y5EEErmoVCfx4So6mN3glnzUWk8zDXJbRYP1Uj1kJiss=,iv:7tEWVT6eeHpekgkO17DXtrO7meFvYo6xV4ZLpGG20PQ=,tag:Mtr2gMnCqfJP5ADyordddw==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1ahnfjspcpwxxk7getcxkj3fypwt37rr6p3xsmp8n2tqqqz8jtg7q2am0et
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtWlZBSFBKNXJ4QmpDZUpT
-            NE91ek10QkwxSU1XTE81cGxHZXZmL1JncEY0ClZFbVd5dG14L1hqQlRWTDVkZmpx
-            V1EzSG9rMC80WTNIZExXOXU1VjcrMk0KLS0tIElWdkh4MzNyeTNteDJTY3RvanQx
-            ai9YdFdleXNNY2pXQzZMem0vdDdSMjgKvngMU5Y1/Pp+G/a9SyewkN9wr22ZcGP6
-            XHHadzk6NE7BJWqquY+2B0Rh3B1Ow+rC8yJd7FhJlHw+i0Bp/d/ESw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2022-04-21T08:09:31Z"
-    mac: ENC[AES256_GCM,data:+TB7XQPMQCFAR/0jrUKTgjm2yJ7qJ6Jak3DMbFof7mnGE9LKT+xPKYzPwAM+4aDzngHv1fumD6JCXDoJ4DS95frAVfNVNM1bfB0iVmrtf0PX1y+Em189/hs3bt2YBkvvW9kYJMq0g9VBngX6gwGuaBAFHly1gi6SPMZN4vNRF6g=,iv:DK5OYG+BohxllorP0j9mvQ7MtqVNnBjJ3Nf378scJOA=,tag:lBwsHbY9PlJ2/eMtKcxZxA==,type:str]
-    pgp:
-        - created_at: "2022-04-20T21:27:25Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA6jlFWJ+id7kARAArP1hdPwQk2XyKsXYnSj6vxK81GhfZp3tkYEqsU3Jdpwn
-            OR+0SnuoNWk4dN4JE4ooS5DOhS0ZaVsglLPtiLLohGWYY4OrX33JHZN4oEa5GMBK
-            t9b0YNb9owow0MSFN679tmiCMvzXGprT0mdWO3/X/HlKvCcTYPRqul4BVeVR/LyG
-            V94MSaF3BUwFb4p/Q8jcWfsfH5gmMpiFHQsmtci4LjDHvAVCFzI3AjcbRRJUfO5v
-            ampZ+9yUNo8Y6btrQQWvMoGpOp6U7cj6rTk+eZuW16/7WbHMz6WSpolDyy01QjzQ
-            szS5RuACnUTMqG4YWQk90H3Srgq/6CFBVLSTm2h8zdO9UZcgkJRYLTFczbYbyqgN
-            2Vpjf0UwIv5MHvdo1QZJeBEl8TxjI5UZY2/UDOb9OZXktcAxW5U0Wy6pZIfUsJpk
-            GJeAb+P3pLvs62hkNSS+rGoGvLX2u0R/Xvw1btTdLLOeIOPNGF8lau32mBuErIZ9
-            2E44N1qV8uQDkDdvaKpj4ikf/0MURPW4GWXST3K/BwD1Gos2SzVD17kXGGOVdeOP
-            Q19LSo06h2Cq+zNcyKU4C0IdRPvFLKJbyEN3vDYXGnJK7lqGr/UDDcPgYPHVPn1Q
-            gTdmAk2e8lZY6O0OP5tth5cMjJZj5msvjbww9J1PA3VnBuo8+17zCJ/IYwCUlEbS
-            XgEWH0LKnwjG7Ufr8eT0DzeCJoD2U/2h+8/+Q2dc4YqokIPW7VuZhR+HZygVAX65
-            1yT/1z+1Hr6kLr9cDLzjyPRu5rNgZJHc8pxkbrQsT764oclvfbgIcmvko9Fsg4o=
-            =S5XT
-            -----END PGP MESSAGE-----
-          fp: FE170812543DF81393EA56BA5042B8317A10617E
-    unencrypted_suffix: _unencrypted
-    version: 3.7.2

hosts/iron/configuration.nix

@@ -1,25 +1,25 @@
-{ inputs, config, pkgs, lib, ... }:
+{ config, pkgs, lib, ... }:
 let
-  zfsKernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
-  disks = [
-    "ata-Samsung_SSD_870_QVO_8TB_S5SSNG0R103837K"
-    "ata-Samsung_SSD_870_QVO_8TB_S5SSNG0R103838A"
-    "ata-Samsung_SSD_870_QVO_8TB_S5SSNG0R104926N"
-    "ata-Samsung_SSD_870_QVO_8TB_S5SSNG0R104934H"
-    "ata-Samsung_SSD_870_QVO_8TB_S5SSNJ0W206517Y"
-  ];
+  interfaces = import ./interfaces.nix;
+  disks = {
+    slot1 = "ata-Samsung_SSD_870_QVO_8TB_S5SSNG0R103837K";
+    slot2 = "ata-Samsung_SSD_870_QVO_8TB_S5SSNG0R103838A";
+    slot3 = "ata-Samsung_SSD_870_QVO_8TB_S5SSNG0R104926N";
+    slot4 = "ata-Samsung_SSD_870_QVO_8TB_S5SSNG0R104934H";
+    slot5 = "ata-Samsung_SSD_870_QVO_8TB_S5SSNJ0W206517Y";
+  };
   removableEfi = true;
   devNodes = "/dev/disk/by-id/";
   datasets = {
     "bpool/nixos/root" = "/boot";
     "rpool/filebitch" = "/filebitch";
     "rpool/navidrome" = "/var/lib/private/navidrome";
-    "rpool/navidrome/music" = "/var/lib/private/navidrome/music";
+    "rpool/navidrome/music" = "/var/lib/navidrome/music";
     "rpool/nixos/home" = "/home";
     "rpool/nixos/root" = "/";
     "rpool/nixos/var/lib" = "/var/lib";
-    "rpool/nixos/var/lib/qbittorrent" = "/var/lib/qbittorrent";
-    "rpool/nixos/var/lib/qbittorrent/downloads" = "/var/lib/qbittorrent/downloads";
+    "rpool/nixos/var/lib/qBittorrent" = "/var/lib/qBittorrent";
+    "rpool/nixos/var/lib/qBittorrent/downloads" = "/var/lib/qBittorrent/downloads";
     "rpool/nixos/var/log" = "/var/log";
   };
   partitionScheme = {
@@ -28,16 +28,16 @@ let
     luksDev = "-part3";
     biosBoot = "-part4";
   };
-  efiSystemPartitions = (map (diskName: diskName + partitionScheme.efiBoot) disks);
-  iptablesAppendIfMissing = rule: "iptables -C " + rule + " || iptables -A " + rule;
+  efiSystemPartitions = map (diskName: diskName + partitionScheme.efiBoot) (lib.attrValues disks);
 in
 with lib; {
   imports = [
-    ../../home-manager/users/jalr.nix
+    ../../users/jalr
     ./services
+    ./ports.nix
   ];
   config = {
-    system.stateVersion = "23.11";
+    system.stateVersion = "25.05";
 
     security.sudo.wheelNeedsPassword = false;
 
@@ -47,14 +47,19 @@ with lib; {
       useDHCP = false;
       networkmanager.enable = false;
 
+      bridges = {
+        "${interfaces.lan}" = {
+          interfaces = [ "enp2s4" "enp3s5" ];
+        };
+      };
       vlans = {
         iot = {
           id = 20;
-          interface = "enp2s4";
+          interface = interfaces.lan;
         };
       };
       interfaces = {
-        enp2s4.ipv4.addresses = [{
+        "${interfaces.lan}".ipv4.addresses = [{
           address = "192.168.42.1";
           prefixLength = 24;
         }];
@@ -62,30 +67,36 @@ with lib; {
           address = "10.20.0.1";
           prefixLength = 20;
         }];
-        enp3s5 = {
+        "${interfaces.wan}" = {
           useDHCP = true;
         };
       };
 
       nat = {
         enable = true;
-        externalInterface = "enp3s5";
+        externalInterface = interfaces.wan;
         internalInterfaces = [
-          "enp2s4"
+          interfaces.lan
+          "virbr0"
         ];
       };
 
       firewall = {
-        extraCommands = lib.concatStringsSep "\n" [
-          (iptablesAppendIfMissing "FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu")
-        ];
+        allowedTCPPorts = [ 5201 ];
+        extraForwardRules = ''
+          tcp flags syn tcp option maxseg size set rt mtu
+        '';
+        interfaces.virbr0 = {
+          allowedTCPPorts = [ 53 ];
+          allowedUDPPorts = [ 53 67 ];
+        };
       };
     };
 
     services.radvd = {
       enable = true;
       config = ''
-        interface enp2s4 {
+        interface ${interfaces.lan} {
           AdvSendAdvert on;
           prefix ::/64 {
             AdvOnLink on;
@@ -100,47 +111,59 @@ with lib; {
       noipv6rs
       waitip 6
 
-      interface enp3s5
+      interface ${interfaces.wan}
         ipv6rs
         ia_na 1
-        ia_pd 1/::/64 enp2s4/0/64
+        ia_pd 1/::/64 ${interfaces.lan}/0/64
     '';
 
+    jalr.luksUsbUnlock = {
+      enable = true;
+      devices = builtins.mapAttrs
+        (_: _: {
+          keyPath = "iron.key";
+          usbDevice = "by-label/RAM_USB";
+          waitForDevice = 10;
+        })
+        disks;
+    };
+
     boot = {
-      kernelPackages = zfsKernelPackages;
       kernel.sysctl = {
         "net.ipv6.conf.all.forwarding" = 1;
       };
       initrd = {
-        availableKernelModules = [ "ahci" ];
+        availableKernelModules = [
+          "ahci"
+          "ehci_pci"
+          "sd_mod"
+          "sdhci_pci"
+          "usb_storage"
+          "xhci_pci"
+        ];
         systemd.enable = true;
-        luks.devices = lib.listToAttrs (
-          map
-            (dev: {
-              name = "LUKS-${dev}${partitionScheme.luksDev}";
-              value = {
-                device = "${devNodes}${dev}${partitionScheme.luksDev}";
-                allowDiscards = true;
-              };
-            })
-            disks
-        );
+        luks.devices = builtins.mapAttrs
+          (_: dev: {
+            device = "${devNodes}${dev}${partitionScheme.luksDev}";
+            allowDiscards = true;
+          })
+          disks;
       };
       supportedFilesystems = [ "zfs" ];
       zfs = {
-        devNodes = devNodes;
+        inherit devNodes;
         forceImportRoot = false;
       };
       loader = {
         efi = {
-          canTouchEfiVariables = (if removableEfi then false else true);
-          efiSysMountPoint = ("/boot/efis/" + (head disks)
-            + partitionScheme.efiBoot);
+          canTouchEfiVariables = if removableEfi then false else true;
+          efiSysMountPoint = "/boot/efis/" + (head (lib.attrValues disks))
+            + partitionScheme.efiBoot;
         };
         generationsDir.copyKernels = true;
         grub = {
           enable = true;
-          devices = (map (diskName: devNodes + diskName) disks);
+          devices = map (diskName: devNodes + diskName) (attrValues disks);
           efiInstallAsRemovable = removableEfi;
           copyKernels = true;
           efiSupport = true;
@@ -150,11 +173,11 @@ with lib; {
             terminal_input --append serial
             terminal_output --append serial
           '';
-          extraInstallCommands = (toString (map
+          extraInstallCommands = toString (map
             (diskName: ''
               ${pkgs.coreutils-full}/bin/cp -r ${config.boot.loader.efi.efiSysMountPoint}/EFI /boot/efis/${diskName}${partitionScheme.efiBoot}
             '')
-            (tail disks)));
+            (tail (attrValues disks)));
         };
       };
       kernelParams = [
@@ -195,7 +218,15 @@ with lib; {
       };
     };
 
-    hardware.enableRedistributableFirmware = true;
+    hardware = {
+      enableRedistributableFirmware = true;
+      graphics = {
+        enable = true;
+        extraPackages = [
+          pkgs.intel-vaapi-driver
+        ];
+      };
+    };
 
     virtualisation.containers.storage.settings = {
       storage = {
@@ -205,5 +236,16 @@ with lib; {
         options.zfs.fsname = "rpool/nixos/podman";
       };
     };
+
+    zramSwap = {
+      enable = true;
+      algorithm = "zstd";
+      memoryPercent = 60;
+      priority = 1;
+    };
+
+    services.zfs = {
+      trim.enable = false;
+    };
   };
 }

hosts/iron/interfaces.nix

@@ -0,0 +1,4 @@
+{
+  lan = "br0";
+  wan = "enp0s25";
+}

hosts/iron/ports.nix

@@ -1,21 +1,35 @@
-{ lib, custom-utils, ... }:
+{ custom-utils, ... }:
 
-custom-utils.validatePortAttrset {
-  esphome.tcp = 6052;
-  home-assistant.tcp = 8123;
-  jellyfin.tcp = 8096;
-  matrix-synapse.tcp = 8008;
-  mautrix-signal.tcp = 29319;
-  mautrix-whatsapp.tcp = 29318;
-  navidrome.tcp = 4533;
-  nginx-http.tcp = 80;
-  nginx-https.tcp = 443;
-  postfix-relay.tcp = 25;
-  postfix-submission.tcp = [ 465 587 ];
-  qbittorrent-torrent.tcp = 59832;
-  qbittorrent-webui.tcp = 8099;
-  radicale.tcp = 5232;
-  rmfakecloud.tcp = 3000;
-  unifi.tcp = 8443;
-  wireguard-public-ip-tunnel.udp = 51000;
+{
+  config.networking.ports = custom-utils.validatePortAttrset {
+    calibre-server.tcp = 8081;
+    calibre-web.tcp = 8082;
+    esphome.tcp = 6052;
+    grafana.tcp = 3001;
+    home-assistant.tcp = 8123;
+    jellyfin.tcp = 8096;
+    matrix-synapse.tcp = 8008;
+    mautrix-signal.tcp = 29319;
+    mautrix-whatsapp.tcp = 29318;
+    mqtt.tcp = 1883;
+    navidrome.tcp = 4533;
+    nginx-http.tcp = 80;
+    nginx-https.tcp = 443;
+    photoprism.tcp = 2342;
+    postfix-relay.tcp = 25;
+    postfix-submission.tcp = 465;
+    prometheus-vodafone-station-exporter.tcp = 9420;
+    qbittorrent-torrent.tcp = 59832;
+    qbittorrent-webui.tcp = 8099;
+    radicale.tcp = 5232;
+    rmfakecloud.tcp = 3000;
+    snapserver.tcp = 1704;
+    snapserverHttp.tcp = 1780;
+    snapserverTcp.tcp = 1705;
+    tvproxy.tcp = 64321;
+    unifi-http.tcp = 8080;
+    unifi-https.tcp = 8443;
+    wireguard-esphome.udp = 51001;
+    wireguard-public-ip-tunnel.udp = 51000;
+  };
 }

hosts/iron/secrets.yaml

@@ -1,43 +1,54 @@
 duckdns-secret: ENC[AES256_GCM,data:SAf/xZ28tgmvqcVKC2tMNRm838AVMMNCC3fpYLXBEIoTl7E7,iv:+KTEpNMj0+aVCGKB1dRFFslgjpBhSzBZFdee+VIAt4o=,tag:C/eSyoQjAgD7Qv4J4jsp4g==,type:str]
+calibre-htpasswd: ENC[AES256_GCM,data:+WW5A3/GZIk0p5CJ8RnK/gcYpJIXXsfrCpqFUWz2PzFZwf5xOlUeTGxqZdNorKq5xip4sT3/brrG4mqGDJ7iXfXJ,iv:D7CqUlbX4XGuUhjRLKytgvLa+jF4zuTZGV1NZCehf8Y=,tag:TAjSyBCIMZC4LBm0Q/2aXQ==,type:str]
+radicale-htpasswd: ENC[AES256_GCM,data:Q0WnleP9I4xozsL/H+5oV3Ag7khfalV40A6ub+DA07U8UKna3/ju533RmjWOnETzSNa6XK140nfCcfGZCiqGyF9tfuuXcKFu+j4=,iv:87PSvHyKF7QUQZmEuxM+IT0VKSGnS0MjoUmCqJ+6tzI=,tag:yrP3TgxE8aSZf0MrCF9dsQ==,type:str]
 sturzbach-htpasswd: ENC[AES256_GCM,data:qqBwu6mASnRqjy65knU4uIvBNXXgrfcmvWnbmOH4tVQ7vRbpEhe/GQDwAg==,iv:OQnDOzezjajGl35m/u5StQeMRR+1sNDD5u1my1wTngQ=,tag:7zjVRWI1IzZ5iS3sFHLubg==,type:str]
 navidrome-password-encryption-key: ENC[AES256_GCM,data:ynQsFyGDEBnlWhTlv0mF7mLiXOjijq9ixWWEa1OXsTOYAd74dU0dp3Fo532WtD4fPvIWEf8Y2dYmY7zPVLuydQ==,iv:GJqPVL5OIFPLMcCVOjWvMjyFR4iTXo3uGE8R0keTzG0=,tag:RTERQgYRxBBevlL2H1lIWA==,type:str]
 wireguard_key_hetzner-ha: ENC[AES256_GCM,data:ak/KpQIHBNRPriJ1IeKYXIp4CcnygRHSj5MzZNnuxQnVunmmtzGu0lBEajA=,iv:aNw3EooT6XE1zC+g37WSJasRCfnNUaKQrYCDBMTxRrg=,tag:KXc70tVFc7xDLlefk1Hzow==,type:str]
-hetzner-api-key: ENC[AES256_GCM,data:7eWYncujkEytQzhRdNRItPgpz1eUvcyp2PVLJtHbqd8=,iv:AxoKJUuor32kC3ZdpkDPUEUlPRosY6cKoWx0TIGK9wA=,tag:SVtXMraGxnJnx/j3zMQnQw==,type:str]
+wireguard_key:
+    esphome: ENC[AES256_GCM,data:sMA/a0YsS/9ReJDY6gpIw+nTjkMyhs3GyEy6nA3Fiw2mvBdZCyNg0q8tdy4=,iv:WPVk4BlY7eKTjLuT/Li0oRhA9N16WFBnuuGKFjHIhLQ=,tag:0x3+3+ts2zMg2Q4eqySNnA==,type:str]
 rspamd-worker-controller: ENC[AES256_GCM,data:7tS8bEr9i5F+YZoj3uPQa6Xd2SCsuC+jE531AbKEmPHNeL3qMyO0pQZ/P1ONaPHTVMOPQHYABihDJcZv0BKW,iv:pFBVi4F661fnYPcCPwuetiGL1H+RAnJiFQhTUqGNwjU=,tag:xQoHIEQpnrMOnXqsH8anxQ==,type:str]
 dkim-keys:
     jalr.de.default: ENC[AES256_GCM,data:mnApsYKXYGtUAHddccmNmU9yZQtekDkTiTXbJ0UJxC0rFxzQCtGsinQslIROJdNUxsxciR1ilNzxawzjJD7AaWJbcAq2TYObGJJOQZBif7t/XEN/rIxEmnAFmdeAyrSONmFb9DiEn59m6DpsU+/9Y+hnc/uwwbzueO34WHJnTqmmsxFVNQZfGR+cbSckHS3wZrfjZSKKzCRt+9DU/xxJ4voyowXLO77w00LHVkyU5liwONi0v2XJ+QeP/jIMmJeKjujZcH+qvUm/kukijqyWKGrZoAYPC2cBlL/UrNECuVdSLMXvr4KBDDTCRZCSMRgUPJ0TAfpQPTPitKJ/0igK7qQl9n/6hckY7VyP8KDS7J7G2Z2XVxfZrAR4X/7ya9B2kneVr2CNx3w954EdTcV1/lD7rcKRjKynyl3ddf8gxJFJ21k1ybo2RLnftGCRVq25qNwhyfjU8x5c7AEs+YTPDrcnmxZ/Ui276eLwpMj61oZzTp8QQhiBVwS/+ruRLC+78pu2gb1gBF/Oo3nuvQD1SOpCRikLVewCYDvfXj/hrjo+oCsjTOj+9tWRcRAEDVlhkXWCMuPXDYrdt3HrIWbQuP8NW1ezd1Ll0r1ujjtPJeSwdd8cVcUSBIoA5gU+eXnYjFaSx9BZ+sIfKqG//W3S+aBYDqAEK/z4N5q66sReb5mtSQYfbZuIZDmox9bwNMG3tJmQX0lJZgEIiuJ5/ef4ra0sj9JsRFldmIn9KUmjW9OlIwzQ42cNNvQSMD/6haNiYsE6TPzVylJ/B2kNu9Qh5FfpCIPtVORv2BAGoNvZlyhjyEiXBEZ4x2hx1l5cBwGOaGhoJ0p+1wqn2zDalIBaEFjbBVdIB6DPC6/lccvpqSwF7HvW2ugyYhW+u92vgic71/BsI4i0OlsJV18gU/zVg0Yj8SK69kEwm4wkJTrkM/I4+kkUIc5OiSAknRfjOFJc0etkh3nO34xpHLOkSv9DrKfXSAGmGZtCLtVL5LGdZeCd/g6EK0JJh6bd9Gu9koSJVq5vjdDJJFf+sgk39TCvHAvk8k1/FgdK5jMJ+pR8heJtP8G96ay3DFVm5hpbjuNKqfBvbf2rkyV6++ywRFnAQGPUiMn9g6Q4F5Ks7CC1D0Ubl7b3dCUk6BDi8rHjxy9QS0/25Yz9cF0bFd6XQDfblnyRLMi9aB36M9Vp38Oh5aB16MyvNUHzcxpaAak0yknE6OuuEMBPQZgFVADCITfy9eUXl2FoXrMWEnBO78GybQ+cV8nhynn5t0U+3koMy2E8ju5kiEofQxXylys3Q76iKRRUbQqFkh/ndWtJVVfGNpi1GrUr1w1YZM0hBY9FqqeBjf7ckj+9BdiwWJ0XauuR70o7odm02mydk1/T3Hfzt3OE5nHIXnVbum9KyPx8wXj9qc6JGFm558pQOcRUgGUi+EzGoGckkoLx4Onl+XeGysW5sXP9dbYgMBug0Tjmdo9xkoBti6znDnN/zh93bbzWITNvxMgVs8zSWEhlM0c7F02UeUXSekbTFue5FOaMdYObMvPeb53jAKBOYLr34GVFvucJhKajIaNzDvfiI6fGCMxcSsWk+P3co7gdbRlWYZELsKDu2scktZsHr/gRwRiDZXAWOLiWZL4jswQ1vXSFXJgdblEV//hr2DwsAtCAsyFcgO/LGq30xi3xNqHTkUZXo6cZYSb6EVaIywMCI5ySEnTLAp/xedySANHuo8yyVqyLxkDPI7CnnSS7JcnQF3K5z+NZ0KnIpc1ewGupOhS0fKj31XxUkoSsHEY/iWJPLNA8+4VsBkADnGdkYXHTvy/yAGV6w1k1qtjiWhDAGcE9/o6NOHctYm3cx8CVsLpve/WFUaCkGgjWJdC8XP92xsUQoE6PENn6ZzFaqGHs7hgQqE1kBcEj8N5WkEqkoMo82giHE33iYoVUdkjOTkV4iDGEqyjg1BoM0GedR2A832LseDkP7u4DjIAQfpIDu7PaeiDh7xWkPRwIMV0oDTakXTdPkPGdgFikzTaxkTzRlpCbQuV769eITqVT04kJDp7+0Rb6dtjeXc0Ennv68wZSiyrlmXbrJntg7g1wrebq28q9NMIZETAPugfK6wNDu/Iw1q1kZn2ELo6xaDlcIxHDcpzK7e2VAYYuP1k3sYnSLU3oeq54j3/yS2z1me5FEqWlPOCrjdnLkE3/GjbeMsYo2YTYJEUEd2ncacSCoXUaUoxpBnjRYcHLRUV+6jy7Amp0/52rAPzSeVlBzc+SdNiKLYA2UQ74WrMU596Gkhw1SD8jSM5QqSBhH9sL+oE4GjhjLhstMUPdkNgiwxXDTZLKcIyjN1cn+RSmvNA2KXMH6MoXrkqSkJ9u2s0QAhla51zR/LZwWbzwGOO0dkh3rwh2x+pcCfuzvlk3lYr/x5XOF2k1n8yvehXY5zIX8nk6djjLbvAzzSr/yalS7R0WYIc6CjzoUl3qz+PlneMfKHcaX00hkOlIub/ZFQf1RE+JzZxi0qQq4M8Nt1XRKGDeS448Z6znDpedStUH29krZcnjMtyLmPX7ETTsjr3HLpCOd7MQ2K1rfhmvh5BtJkn1KSUf94puZbkLH7X+WnWN0hsc+KbSXnYZvqwJ8G0/7ptp/Q+wGljqhjv+HhOeA3NUwANv1xWgbiymVIlxCodXtQwn8mxS+jxSvslGwOnyUkTT76IbFbv/IpW6PNvj/xqwOqey8a/4WCGcqs403Y7TKQ+xCflG6K3tL7U5UbMnMgXTeZvoK+DooS2eIepF2WB5XqTuOZJV2OQ6GHfaBMjXN9iGVNLi6XgkbpmcMLQ4TZq+dVmgleJb14IaTFD3n74OfmbcT9lmRfPRJEpFEMNeL3ghH54P2a91zJFASgE7x+Uv2cGcmKFtMbyc/rrhH1F/Ixlv/R37huFo1T2dPMEZ/1ouuPpbUQ5oz/JlOWw3NOxd0O6oG0x9Xib+9KxSFOusLWcFEgx70jrBQKj8s2Jj+W0gZYv+BJtPMPY0KAkRj1amt4Fd6ZrPOEXJ392EHSAEv5jssO5ba52OHKA+QkYvPPL04rwkxSAQiTl57scnEj2WEIP+Lz0/qsMnwF+3rWuz856doJZcXX+U9iuzBCaYQqA1P3BojAYhEHnXBPeolHOA3BmhT9E2TJsZ6P9SQ+GaqyLm0i4vRXGlArlkLwRBs9EZv/l4DT8q0YHha53O4rhRzGJZKAOO252Dpha1YN7+FubYGAZjaUT5O0R/7xSPrGyBejddtM8asW8+NClAn4Y6xvj1IgUg6VRpEy7ZIpZEQ+UyDWt0A4nsipaz2NyZKZ5Vxza2v1qZDdYODK8nm/zj7fR/JykaNVEVj7ceTSHdaQlajfeEWWTs92msIBcqPUXqlaR005hoVvXm+WCnzIMIXLGiyRKRsAPIDYh2hGCtvfXLSq5TYm3bnGAImL0KW3Yllt1qSqSbOYsvm5QfDmTrrccvtSLGRj0rOU3Z8f4WXjf+1YgxjZ9h8fKL+LKA8x1S6M8fl0JVGBIAU8Xe8c4+r2F1VcygJp7h+0v8o8GudM6in4djAdeMLWBgXid7r0q744joFucP56opwYQp3Lu0oFEo0omS6Rh9yPfOjdGBU2eUdjcCNXXuEJD9yHSyebviSAvDw/KH1AxYSWYnjMWACCfcbOlXf3ej7PuQgq5MdFwF7+QawXm0john4YusUon4/0fqd/IFLd6oHYYesxcFdm1jN6DeS4SAqRgeEPuEWDFERgXjLHBxl5Xdi5n+NOR3Vc7ziJ9j9/CA1DKdwmsFBBDcVKMnr2FibXpN5WsSdlBng0L2zhkL22wRH9xbz8Xk5shN20/EHoxHB5HJvwfOgHIC7ooWKOUUuNTZH43+gVN+wzRzlMfiF4X71Edw+lTnQRp6Lh03M2k9do6JPoX2+UU0h6mOYiAFkhHKzCmK3DY12c4Smx+qLJNbUGhoMgthu/WnXObm0Hr+myCooTYSVNTJx6vVjI3GZtMcat2o8B9k38u/Y5/FxqTYmyXhROwS4v3W5fXwTAaxBqQy6Xj5s4V37omBBh/Z9a43nc2VlT7dKR1wIvNB/gqhiYyYrVMtYMJqGLkeCbu50LUWT4qXyR8uaqbZTVjyJCQRxZd6fd3Zfe9wIeYe3N5qKIXkFD3n1U2Q/EyRfb3TpiA+eYkAtl6JGK0vpeWpN5M2LJ3/V79e3cIG7B7/p6BrRxKxHDnBZcu57KKaN8XM+v2KTz7XdF8bjgeu1V/B9WoBwnpzCM+3s5ffNceuUcb2gJgRAUpZvcSDLYy+9aluGU2Tvsm49fCzr851p3VSEJepgPpnvuq874AX/MbPvqidF8Y21Kss1RUbl5wrlq5IihKdM+xCSq6mjvtSPVHRvw==,iv:2NBiTTW9slOH9BvM+kVbMB/+8EiS/Dc/eaqrtiwn4HY=,tag:0rc2+ZWy9XZYE7RK/oSo3g==,type:str]
-radicale-htpasswd: ENC[AES256_GCM,data:Q0WnleP9I4xozsL/H+5oV3Ag7khfalV40A6ub+DA07U8UKna3/ju533RmjWOnETzSNa6XK140nfCcfGZCiqGyF9tfuuXcKFu+j4=,iv:87PSvHyKF7QUQZmEuxM+IT0VKSGnS0MjoUmCqJ+6tzI=,tag:yrP3TgxE8aSZf0MrCF9dsQ==,type:str]
 synapse-turn-shared-secret: ENC[AES256_GCM,data:Q1XRds3Zud1kYkvD6s9WUzP+kNDNsxB5SHd6oCAaLCHhHhYENSAYTZOF+rGjCPNyKFL0e/A=,iv:zScRQrz+pXHNUh/BGOaV+TVnDR3wu1Z/UO1zXarKwtA=,tag:ckpVziE+yb0FjctcT7tAkg==,type:str]
 rmfakecloud: ENC[AES256_GCM,data:ktKBKb6cRv1VF8tRvXIpxIy9hPinVPKK05mgvYzz18PEdcrCLpldm5xf7ffHtY5XzDOAMXDCiz6x4xyv7071frrF0spOEPnIzVhxwG8H2Ck=,iv:qJdHjv0RziAs4G9UGeRwGQ4GE5kaObJWpIYWpRKhr9c=,tag:PXgvU1hZK/gvWGyFJaHekg==,type:str]
-esphome: ENC[AES256_GCM,data:8mXqZnGaiWTO3pNozXCG/NmPEb9fTWBIs/2gX4xLPQwoUg8rw18pVfm0GbEQG1e/crV8ykeYcbKvvZdvVIrc4M/khoO7iuqJHURTcoQh/q/9pH1K2Tg+f7w6V24BozP3GnHXGo+zfo4gX8TgQzx7kktMIiWWnP5gyc1KOw5mQlGmOwfe/Ny6ziCWuGOCPIzd4qtMGOn2lie9HztJ5h0HR9NMJar007grRUS/DXtgw4Z6/PQ80bQJPJF3qsCuJuW9YiI1ImqherYiGaS+ptdZI/nkj9RZFrDBf1NOt1ZizROoeKKO0uJ134Rh+YeuAtWeT+NcQMnj20YdJ75aBHGd+Kx/fICOmO/yXKyuwk1ZyvIvnlauG0bgi2nMrAQJdgO7FRBflmZd6IIFv6a2kOHkS8sigBi2Movq/mZTEF13XBsFxgEZugEqh5MvEd10iaLusYNCa5pc3z5DoeAcbsOGfmcgy4RdHurtVImfLSvPyelRAsWXceOPzU+zLVyAGZ4MeqP5cO2oK1qC9sntMz3s5sjl7BsT9SieiaScK4Tdadh0ZjlzVYzh+XIDTvbgUu6EFmU3t4UeAanPywJIdnnJVMCvgN6FLHk098h9PL2DgKWfS8aiywKXctXUA78WYpYInqS531liF8Jc5HM91Azp1q+ImpzmZjfm0kgD7wLiGzZaPeKsQaB7ykMpvWpTSq+QHW4=,iv:qLn56QxmWFaYtz3MwZyCP7NEfypmWRW4HxQiZmn27fE=,tag:9bHVx5NDf3nZG0alxb4p1w==,type:str]
+esphome: ENC[AES256_GCM,data:SPZ/4GqNuz3Lk0Jor815jWaw9YYiIS/u79qmdjd9eNhPUiT4PpM7gQJHLwa/KHbjYAHBICVd5dAFdBsZ5UsYww6bTZcEjM+aDcSXvrXE7NKUdYwrKfOeGdsIX/l79AlNfaPma1+3dDULj6/5ElXZJFsuurMWaWc+KLOUTBTMNRwylW1pxShywz40wqxtTQmFBLhIbk/yYLfJMuFaPnctoJnW6cutbzw/fwSitAvYEq9Ch2ZOkujOOTP/NlDAsxxBV6tFJj7UnJtGJ9lucJ7BURU0eb3Bp3K3ef1XgiyTtp0g4m2EdN/XTzzA6fI4/Vhf6giDvrbXxSM5pPTbY4fjv5cpKROaHS58il24OA0S7zccFY8XoXkl2QjiJrNnsJvNrfxn21i+LFWKCC1CMZbfEMkg+FNjzrp6nkr/kpjOlEet7umhlkxXdEUSjUBmb7luig55ICSxCH5yzRD8TwsP4fhjQgAQ8C+5fojQ/YH3VkFboY4sS5mkamDeUJ94pLy3GcfKPB5I/qipi5kUxEo7AvvxK2PHNM/0VC3S/23StQwkrH2+mrU5mo4+ngutoxyegSaqJzMJZ6KORPbDo9ETxehwWGZTuP+kpjT8Sz3J0A1LxCZwQsbXJMpABWkg2c3URJZYS/1q1o+16PocE9mbPthiayrBETss6zsYB7xYjaRMN74C1yuEL/55xRqqlrNgfk/svW4XTNRl+zkRfyxz1awWEa4zSpbqSTZT5M97uxuSHwWW64dOb7lCxfVZtpBuEMTN2iITUYWfNnyv3Ipgv2AN3vZUoYiehS8Vlv+j0SHrTAjLqUv/opTNB02PMpE9wWKsOiktDQ6VwbPkd/k9xCPqdaT4fN/yinji+91BkgeaNgyu3KRTnaQlFOxmYzQAoPHwhZSwT+s0/rOPP4wtKIUkI2IcMjEWd8nw0PEo9J/wqzZxcFZ8VKSJofrVMmo0nQF4BK0/86KXOTk2bo/5HaXE4d2s6xc3qhyGnWdWUjm1X8CLoVNx49EsVRhrJKkqrvgFH0P26qNno4m7KWtzZGt/e/e3B4+TeaVgFS5o7IY8hcnIslsbic9DW/rSAxkXdumgvumRHHtBf0WA89K84/Qhs0Ufx4z9ijZdojqTX4rRPpIpV79jaJmjS72adUjnVWMMdQWyW7Y7e0Cp0u7dcbhl1T2S8QRMsJiIOv8syiUFEy8krC7R8Lf7/kZca1MYohEud/QeNsIWq0FfpyYN/vGMoTZ0Hn5npuXap5HVlmSoPX8Bve+tgR3ZFBpTS+/uXhJ70v93IXBt0fWe5tNl518Di8k5h6xAp/8Rl9EJdUuKjVnpto8bO8LIefOQLpeTo282ykPlqxsaEimeasExNAMyi/dzX9SKuSr9D5zKzU8/0zhUA+lhKtwkUkBuxeaeqF1mlffWyjVhL/3/il9Xd7kTT461889AOKt20BH1rzqVQcUiLgoi79r4kIDs2MJE8QU+Ne3fcaP+DCvjjfiTGQ+0icZvVmgKYRpJaD7MsQWN0LvzoqbkIlXrSJprsDt9JNX4IOp6egh5bxAMwZM2V7uCF/WRDXSlHYa6XJId6fY7PMAhDsTYuD4/glFzeD121yajoeyb71AgoKy62mvgExe6nnzh6qNEAQEX8bl+L6sVtwzdYpvc3j0PXbtbEs7zwncyhphj0EOag0N3E236Ck3fW6EWIKkqg7qTBDdXrCKgv7BKl6aYIDQiaUP2hwlqpegklTRkfOrAP0tOYps9DCKGa+Bm6fK2ekG/b8OCPQdp72PtyNv5vumzaV2L6v+nc/0+5VsjL66CdJ9tvwIR9NxUC6M7pp3gMQMyxW95rj4JxZkW8f8r6EU33rQJtNeeo45Uorp3l466s//GoEmcRNO08VcFJaEdd8rocm9dsexd+0QNN9xQVDOwF+KgJAUJi+Qygvzcy+nVibow2sRUPGai6/rbNBPrVEKjfHck+s794XjVGXPAoAMk7SsNKrjSpvEHws0dnC3Faa3PA8UKZalOzmNi6A1ngK/wn5SAQ/LfXRDY/oTJa4ND/C8vJfzywR8=,iv:3nnHepX48XKuKQzO4zHcGj0VNQR2edmQ2DqvAJi5W6M=,tag:UJHGnWXrwCUgyRMGc16Ntg==,type:str]
+home-assistant: ENC[AES256_GCM,data:wcFMxDdRCHf/shO9v2WaGgrsa9J2WP62xFs=,iv:9ckeIO62cFZUo8fPyQj445CrJVTooNlwLapM/oTsrkk=,tag:mlfxtXDPsB3T79P9BX9oJQ==,type:str]
+mqtt-users:
+    home-assistant: ENC[AES256_GCM,data:oIjCw7ZnA5iOBmQdW1jcy3QQnpjT32pY,iv:5HFRkXJBdMXQbjk2ubQs3sEy5qEteiqSe2hrNc8+H40=,tag:7B6yI4oCHanE0JE/gHaKnQ==,type:str]
+    valetudo: ENC[AES256_GCM,data:+HRz6X+A5dhmx43G99ka0u9VozuzOFWR,iv:SPw5yoiBqN7sBH5EofevacTtu45jmuTPqToKrar0aJ0=,tag:lf+usB/eNNP1yuWW/QyTqQ==,type:str]
+photoprism:
+    oidc-secret: ENC[AES256_GCM,data:XTAiUiGZJfSZHNbz6fePl3iMDdbxFSE7+SQH2ECRFqlo7w8TAhLyNXBxlEfGvu+8vttbKdkEm0r7132Q4ftOtA==,iv:WGsQXolbtRWIq4EDgODWNmkXdOZCsA9A3Fqoo4lJyec=,tag:5zJftwB5If/RZB3hI0Ly8A==,type:str]
+prometheus:
+    exporters:
+        vodafone-station: ENC[AES256_GCM,data:eaFqYEuK3UU=,iv:BauymCkvj33TmZLyii367uVEc4Iq4GGcik4nbyT9Fpk=,tag:poB+qh5tAdv/dEt3WN6yVw==,type:str]
+        unpoller: ENC[AES256_GCM,data:WI1oUKHW4ef4pBk+mGM=,iv:C1LykPf1/ypUmy3ZCQzjfSjkpxhUukDNnfJnZLp2CJg=,tag:mSnZJKl9IHcx7I7GpFherw==,type:str]
+tvproxy: ENC[AES256_GCM,data:MbXEmgerpUiwDgcUKF2y1+Cc+d43sKPfGGTEkvNoZFFS4rzDWw4Udg==,iv:ZDsfSb3HK008e7/J/61iqVRafIzKbtPEdhH7ixo9lSY=,tag:3JbJ+2DJKQ9G2ui6VuWbOw==,type:str]
+grafana:
+    secret-key: ENC[AES256_GCM,data:RX0ox0r3Jwm9DMIfBnsL7ydarlrYSVBjbVXbooHR1Ms=,iv:l8Aud8VyGtz3dNARh6s8/Y6MBtc4xj1Wu/LLJv1e+KA=,tag:+7TFyRPhBS1Tvn2JLBEeAQ==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
         - recipient: age1hx7fdu4mcha7kkxe7yevtvs6xgzgaafgenm3drhvr609wlj94sgqm497je
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsdnRlZktJNHQwSWdlb2l6
-            aFNRS3U0UHM5UFVkTUtqMHU1Y093ZjdNMUhrCmZVMlBNSTlwYjlQaklzZENnR013
-            UXFNaWp3WXhQOC81dGFFQXNwVHVYajAKLS0tIGh5ek95NnNRbWFsVkRncFJ3VUdE
-            TjdZRldhSzVtMkVoTzY1NjdGbCswRVUK0pi+8UuLqRmytcR2ikxOAM02iccl8P1y
-            ixv0PKPLd+vQ23QeeQy/TfoGx16XttaDUnUrPLZR3TUKtAcld8+m6w==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZSnhmN0RTMDcxR3hWMWFq
+            TjZNNHEzM214Tm9hK2RENm9hSlRFUy9aNW5FCm1paEx2TEEzcEd6cVIzaDk1Sk92
+            NXNORGlONHQ1Uk9ocGlScXFIWmlwUDAKLS0tIDhTeDQ1KzhreEpMVFVvbFdiRjVR
+            SU1USkxFUUY2NVhmUHBhZkdrNDR1Q0kKiXIicInELRjDR3tuyA+lnXeCcd9lYvbV
+            GnBRGPM7BNO/6AA7HhAei48Kt+XE6+jQX66yTXyviKhK7Lpjrlb2YQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-12-18T16:45:32Z"
-    mac: ENC[AES256_GCM,data:ZsC4C+VpUnHuMyqHa3/TIursyWDPV1+we/cBrUhyeqeNdeDveJ4a26jmIzNxWWHbJU7uMPy6BF6iHpS91YK4m+KKSqoXZiTjB8b9p3y9ietT9XQOLXdt8pxVFBEOSH7g9DeVbrJUHTOhzYpugMqC/QXcDLE1GQwa0eGUq3JIDh8=,iv:vbDpVJAXvYw1qQ5Or6CxOs8OO4yhtlVF4zh07bkkFJw=,tag:IqVAItuv23AbbGQsPh5dsg==,type:str]
+    lastmodified: "2025-11-04T17:52:25Z"
+    mac: ENC[AES256_GCM,data:/q98uwoYJsPRLlWxxDn7gJQ0jRxlAfVxEmUw8ayP8gIkWzGN1DCR0jx2LFlSlWEuaPScThw5IhGxbBlBxX2wV952MC7tEoHAAMvMJberG1a6do8zSvotDHocdXVlyj4jJZhQvjUVAmeVsYBY3oRwOHdzis0JO5IW0hxgs3x+xoQ=,iv:9BR0ws9ZzukjxLpPjvl73B3RmLA+c9e7F3AVk5l0SGc=,tag:OJ/iGy/Umlj/82EtZxjLSg==,type:str]
     pgp:
-        - created_at: "2023-05-02T19:30:42Z"
-          enc: |
+        - created_at: "2024-01-31T01:20:30Z"
+          enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hF4D3ylLYNOsO+0SAQdA16evFPF5J4wB4iw3y6rQbjpyVKiU/M7qZmdsKOBpLQgw
-            CccmnhDpRDvQ2pTlHh674o0flfXTvFQ2H2a7KuVDLerdUuw+aBGD1RB+Ob0Vvfoi
-            0l4BKpYchtdJQpQuL2Gy5LToty9EZUVVRvhyIfSasWCdDH9ajNWHFcKn6MX9wj46
-            ly6CeFgZKAyyeQ6qWQnft7inEQk7krl53NBrbzDN3Rfz71zmpO97h/av7y7ilffa
-            =DpnU
+            hF4DY/xpNY5WhB0SAQdAVIYE8wlQqo3HcaT37fSDHQ5i0CxUv9kyPT9BiDgwxA4w
+            hJlT2XPeSK6Ob1P++oGUrVhkZCuFEnV+6ZtNjwIu9EfU6azyPZEcmffmi3PdlSvW
+            0l4BHCRW14iBbixIlZxloBUEEMCg5n5HNQ5vB4jRyq4af0uYxOgE3doZbb5gaVe2
+            sODYeeb0u1DdJRlvfyPgqPvit4tkovzLKsO/RUpHqTuh8cXHA8ibLIXlIUbS7FoN
+            =aGjt
             -----END PGP MESSAGE-----
-          fp: 66FB54F6081375106EEBF651A222365EB448F934
+          fp: 3044E71E3DEFF49B586CF5809BF4FCCB90854DA9
     unencrypted_suffix: _unencrypted
-    version: 3.8.1
+    version: 3.11.0

hosts/iron/services/avahi.nix

@@ -0,0 +1,20 @@
+let
+  interfaces = import ../interfaces.nix;
+in
+{
+  services.avahi = {
+    enable = true;
+    allowInterfaces = [ interfaces.lan ];
+    openFirewall = false;
+    publish = {
+      domain = true;
+      enable = true;
+      userServices = true;
+      workstation = true;
+    };
+  };
+
+  networking.firewall.interfaces."${interfaces.lan}".allowedUDPPorts = [
+    5353
+  ];
+}

hosts/iron/services/calibre.nix

@@ -0,0 +1,94 @@
+{ lib, config, ... }:
+let
+  inherit (config.networking) ports;
+in
+{
+  sops.secrets.calibre-htpasswd.owner = "nginx";
+
+  services = {
+    calibre-server = {
+      enable = true;
+      port = ports.calibre-server.tcp;
+      host = "127.0.0.1";
+    };
+
+    calibre-web = {
+      enable = true;
+      inherit (config.services.calibre-server) user;
+      inherit (config.services.calibre-server) group;
+      listen = {
+        ip = "127.0.0.1";
+        port = ports.calibre-web.tcp;
+      };
+      options = {
+        enableBookUploading = true;
+        reverseProxyAuth = {
+          enable = true;
+          header = "X-Remote-User";
+        };
+      };
+    };
+  };
+
+  systemd.services.calibre-web = {
+    serviceConfig = {
+      BindPaths = [
+        "/var/lib/calibre-web"
+        "/var/lib/calibre-server"
+      ];
+      BindReadOnlyPaths = [
+        "/nix/store"
+      ];
+      CapabilityBoundingSet = "";
+      IPAddressAllow = "localhost";
+      IPAddressDeny = "any";
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true;
+      PrivateDevices = lib.mkForce true;
+      PrivateTmp = true;
+      PrivateUsers = true;
+      ProcSubset = "pid";
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "noaccess";
+      ProtectSystem = "strict";
+      ReadWritePaths = "";
+      RemoveIPC = true;
+      RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      RootDirectory = "/run/calibre-web";
+      RuntimeDirectory = "calibre-web";
+      StateDirectory = "calibre-web";
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged"
+      ];
+      WorkingDirectory = "/var/lib/calibre-web";
+    };
+  };
+
+
+  services.nginx.virtualHosts."books.jalr.de" = {
+    enableACME = true;
+    forceSSL = true;
+    kTLS = true;
+    basicAuthFile = config.sops.secrets.calibre-htpasswd.path;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:${toString ports.calibre-web.tcp}/";
+      recommendedProxySettings = true;
+      extraConfig = ''
+        client_max_body_size 200M;
+        proxy_set_header     X-Remote-User $remote_user;
+      '';
+    };
+  };
+}

hosts/iron/services/default.nix

@@ -1,19 +1,29 @@
 {
   imports = [
+    ./avahi.nix
+    ./calibre.nix
     ./dnsmasq.nix
     ./dyndns.nix
-    ./home-assistant.nix
     ./esphome
-    ./jellyfin.nix
+    ./grafana.nix
+    ./home-assistant.nix
+    ./jellyfin
     ./mail.nix
     ./matrix.nix
     ./navidrome.nix
     ./nginx.nix
     ./ntp.nix
+    ./photoprism.nix
+    ./prometheus.nix
     ./public-ip-tunnel.nix
     ./radicale.nix
     ./remarkable.nix
+    ./snapcast
     ./sturzbach.nix
-    ./unifi-controller.nix
+    ./tts.nix
+    ./tvproxy.nix
+    ./unifi-controller
+    ./whatsapp.nix
+    ./wireguard-esphome.nix
   ];
 }

hosts/iron/services/dnsmasq.nix

@@ -1,12 +1,13 @@
-{ pkgs, ... }:
+{ lib, pkgs, ... }:
 
 let
-  stateDir = "/var/lib/dnsmasq";
+  interfaces = import ../interfaces.nix;
 in
 {
   services.dnsmasq = {
     enable = true;
     settings = {
+      bind-interfaces = true;
       listen-address = [
         "192.168.42.1"
         "10.20.0.1"
@@ -19,24 +20,35 @@ in
       ];
       dhcp-range = [
         "192.168.42.20,192.168.42.254,4h"
-        "10.20.0.20,10.20.3.254,12h"
+        "10.20.1.1,10.20.3.254,12h"
       ];
       cache-size = 10000;
       dns-forward-max = 1000;
       no-hosts = true;
       addn-hosts = "${pkgs.writeText "hosts.dnsmasq" ''
         192.168.42.1 aluminium unifi
+        10.20.0.10 kuechentisch.iot.bw.jalr.de
+        10.20.0.11 led-panel-schreibtisch.iot.bw.jalr.de
       ''}";
       server = [
         "142.250.185.78" # dns.as250.net
         "2001:470:20::2" # ordns.he.net
         "74.82.42.42" # ordns.he.net
       ];
+      dhcp-option = [
+        "option:ntp-server,192.168.42.1"
+      ];
     };
   };
 
-  networking.firewall = {
-    allowedUDPPorts = [ 53 67 ];
-    allowedTCPPorts = [ 53 ];
-  };
+  networking.firewall.interfaces = lib.attrsets.genAttrs [
+    interfaces.lan
+    "iot"
+  ]
+    (
+      _: {
+        allowedUDPPorts = [ 53 67 ];
+        allowedTCPPorts = [ 53 ];
+      }
+    );
 }

hosts/iron/services/dyndns.nix

@@ -1,17 +1,56 @@
-{ config, ... }:
+{ config, lib, pkgs, ... }:
+let
+  interfaces = import ../interfaces.nix;
+
+  mkService = config:
+    lib.mapAttrs'
+      (name: cfg: lib.nameValuePair "godns-${name}" (
+        let
+          config = cfg.settings // {
+            login_token_file = "$CREDENTIALS_DIRECTORY/login_token";
+          };
+          configFile = (pkgs.formats.yaml { }).generate "config.yaml" config;
+        in
+        {
+          description = "GoDNS service";
+          wantedBy = [ "multi-user.target" ];
+          after = [ "network.target" ];
+          serviceConfig = {
+            DynamicUser = true;
+            ExecStart = "${lib.getExe pkgs.godns} -c ${configFile}";
+            LoadCredential = "login_token:${cfg.tokenPath}";
+            Restart = "always";
+            RestartSec = "2s";
+          };
+        }
+      ))
+      config;
+in
 {
-  sops.secrets.duckdns-secret = {
-    sopsFile = ../secrets.yaml;
-  };
-  services.ddclient = {
-    enable = true;
-    interval = "1min";
-    protocol = "duckdns";
-    server = "www.duckdns.org";
-    username = "nouser";
-    passwordFile = config.sops.secrets.duckdns-secret.path;
-    domains = [ "jalr-bw" ];
-    use = "if, if=enp3s5";
-    #usev6=ifv6, ifv6=enp3s4
+  systemd.services = mkService {
+    ip4 = {
+      tokenPath = config.sops.secrets.duckdns-secret.path;
+      settings = {
+        provider = "DuckDNS";
+        domains = [{ domain_name = "www.duckdns.org"; sub_domains = [ "jalr-bw" ]; }];
+        resolver = "8.8.8.8";
+        ip_interface = interfaces.wan;
+        ip_urls = [ "" ];
+        ip_type = "IPv4";
+        interval = 60;
+      };
+    };
+    ip6 = {
+      tokenPath = config.sops.secrets.duckdns-secret.path;
+      settings = {
+        provider = "DuckDNS";
+        domains = [{ domain_name = "www.duckdns.org"; sub_domains = [ "jalr-bw" ]; }];
+        resolver = "2001:4860:4860::8888";
+        ip_interface = interfaces.lan;
+        ip_urls = [ "" ];
+        ip_type = "IPv6";
+        interval = 60;
+      };
+    };
   };
 }

hosts/iron/services/esphome/default.nix

@@ -1,73 +1,25 @@
-args@{ lib, pkgs, config, custom-utils, ... }:
+{ pkgs
+, config
+, ...
+}:
 let
-  ports = import ../../ports.nix args;
-  cfg = config.services.esphome;
-  stateDir = "/var/lib/esphome";
-  devices = [
-    ./yeelight-meteorite.yaml
-  ];
-  cfgdir = pkgs.stdenvNoCC.mkDerivation {
-    name = "esphome-config";
-    src = ./devices;
-    dontBuild = true;
-    installPhase = ''
-      mkdir $out
-      cp -r * $out
-      ln -snf "${config.sops.secrets.esphome.path}" "$out/secrets.yaml"
-      ln -snf "${stateDir}/.esphome" "$out/.esphome"
-      ln -snf "${stateDir}/.gitignore" "$out/.gitignore"
-    '';
-  };
-  esphomeParams =
-    if cfg.enableUnixSocket
-    then "--socket /run/esphome/esphome.sock"
-    else "--address ${cfg.address} --port ${toString cfg.port}";
+  inherit (config.networking) ports;
 in
 {
-  sops.secrets.esphome = {
-    sopsFile = ../../secrets.yaml;
-    owner = "esphome";
-    group = "esphome";
-    mode = "0400";
-  };
+  sops.secrets.esphome.restartUnits = [ config.systemd.services.esphome.name ];
 
-  services.esphome = {
+  jalr.esphome = {
     enable = true;
-    address = "127.0.0.1";
     port = ports.esphome.tcp;
-    /*
-      package = pkgs.esphome.overrideAttrs (o: o // {
-      propagatedBuildInputs = (o.propagatedBuildInputs or []) ++ [
-        pkgs.gcc
-      ];
-      makeWrapperArgs = [
-        # platformio is used in esphomeyaml/platformio_api.py
-        # esptool is used in esphomeyaml/__main__.py
-        # git is used in esphomeyaml/writer.py
-        "--prefix PATH : ${lib.makeBinPath (with pkgs; [ platformio esptool_3 git gcc])}"
-        "--set ESPHOME_USE_SUBPROCESS ''"
-      ];
-      });
-    */
-  };
-
-  systemd.services.esphome.serviceConfig = {
-    WorkingDirectory = lib.mkForce cfgdir;
-    ExecStart = lib.mkForce "${cfg.package}/bin/esphome dashboard ${esphomeParams} ${cfgdir}";
-    /*
-      Environment = [
-      "NIX_LD=/nix/store/qn3ggz5sf3hkjs2c797xf7nan3amdxmp-glibc-2.38-27/lib/ld-linux-x86-64.so.2"
-      "NIX_LD_LIBRARY_PATH=/nix/store/myw67gkgayf3s2mniij7zwd79lxy8v0k-gcc-12.3.0-lib/lib"
-      ];
-    */
-  };
-
-  system.activationScripts.esphome-custom = {
-    deps = [ "users" "groups" ];
-    text = ''
-      mkdir -p "${stateDir}/.esphome"
-      touch "${stateDir}/.gitignore"
-      chown esphome:esphome "${stateDir}/.esphome" "${stateDir}/.gitignore"
-    '';
+    secretsFile = config.sops.secrets.esphome.path;
+    configDir = pkgs.stdenvNoCC.mkDerivation {
+      name = "esphome-config";
+      src = ./devices;
+      dontBuild = true;
+      installPhase = ''
+        mkdir $out
+        cp -r * $out
+      '';
+    };
   };
 }

hosts/iron/services/esphome/devices/.env

@@ -0,0 +1,2 @@
+ESPHOME_HOST="jalr-bw.duckdns.org"
+ESPHOME_SECRETS_FILE="esphome_${ESPHOME_HOST}_secrets.yaml"

hosts/iron/services/esphome/devices/.gitignore

@@ -0,0 +1,2 @@
+/.esphome/
+/secrets.yaml

hosts/iron/services/esphome/devices/badspiegel.yaml

@@ -0,0 +1,134 @@
+esphome:
+  name: "badspiegel"
+  friendly_name: "Badspiegel"
+  platformio_options:
+    board_build.flash_mode: dio
+  on_boot:
+    then:
+      - light.turn_on:
+          id: front_light
+          brightness: 30%
+          color_temperature: 2700 K
+      - light.turn_on:
+          id: background_light
+          brightness: 20%
+          color_temperature: 2700 K
+
+esp32:
+  board: az-delivery-devkit-v4
+  framework:
+    type: arduino
+    version: recommended
+    platform_version: 5.4.0
+
+logger:
+
+api:
+  encryption:
+    key: !secret apikey_badspiegel
+
+ota:
+  - platform: esphome
+    password: !secret otapass_badspiegel
+
+wifi:
+  ssid: !secret wifi_ssid_bw
+  password: !secret wifi_password_bw
+  domain: .iot.bw.jalr.de
+  power_save_mode: none
+  enable_on_boot: True
+  fast_connect: On
+  output_power: 8.5
+
+output:
+  - platform: ledc
+    pin: GPIO33
+    id: output_background_warm
+  - platform: ledc
+    pin: GPIO32
+    id: output_background_cold
+  - platform: ledc
+    pin: GPIO25
+    id: output_front_warm
+  - platform: ledc
+    pin: GPIO14
+    id: output_front_cold
+
+light:
+  - platform: cwww
+    name: "Background light"
+    id: background_light
+    cold_white: output_background_cold
+    warm_white: output_background_warm
+    cold_white_color_temperature: 6500 K
+    warm_white_color_temperature: 2700 K
+    constant_brightness: true
+    gamma_correct: 0
+  - platform: cwww
+    name: "Front light"
+    id: front_light
+    cold_white: output_front_cold
+    warm_white: output_front_warm
+    cold_white_color_temperature: 6500 K
+    warm_white_color_temperature: 2700 K
+    constant_brightness: true
+    gamma_correct: 0
+
+switch:
+  - platform: gpio
+    name: "Heating"
+    id: heating
+    pin: GPIO26
+    icon: "mdi:thermometer"
+  - platform: gpio
+    name: "Soundsystem"
+    id: soundsystem
+    pin: GPIO23
+    icon: "mdi:speaker"
+
+esp32_touch:
+#  setup_mode: true
+
+
+sensor:
+  - platform: wifi_signal
+    name: "WiFi Signal Sensor"
+    update_interval: 60s
+  - platform: dht
+    pin: GPIO22
+    model: DHT22
+    temperature:
+      name: "Temperatur"
+      id: temperature
+    humidity:
+      name: "Feuchtigkeit"
+      id: humidity
+      accuracy_decimals: 1
+    update_interval: 30s
+
+binary_sensor:
+# ESP32 touch pins: 4, 13, 27, 32, 33
+  # Touch Pad T4
+  - platform: esp32_touch
+    name: "touch pad GPIO13"
+    pin: GPIO13
+    threshold: 902
+    on_press:
+      then:
+        - light.toggle:
+            id: front_light
+    internal: true
+    filters:
+      settle: 1s
+  # Touch Pad T7
+  - platform: esp32_touch
+    name: "touch pad GPIO27"
+    pin: GPIO27
+    threshold: 1086
+    on_press:
+      then:
+        - light.toggle:
+            id: background_light
+    internal: true
+    filters:
+      settle: 1s

hosts/iron/services/esphome/devices/chinafrickeldeckenleuchte.yaml

@@ -5,6 +5,11 @@ esp8266:
 
 logger:
 
+sensor:
+  - platform: wifi_signal
+    name: "WiFi Signal Sensor"
+    update_interval: 60s
+
 bp5758d:
   data_pin: GPIO4
   clock_pin: GPIO5
@@ -14,22 +19,32 @@ output:
     id: output_ch1
     channel: 1
     current: 20
+    min_power: 0.02
+    zero_means_zero: true
   - platform: bp5758d
     id: output_ch2
     channel: 2
     current: 20
+    min_power: 0.02
+    zero_means_zero: true
   - platform: bp5758d
     id: output_ch3
     channel: 3
     current: 20
+    min_power: 0.02
+    zero_means_zero: true
   - platform: bp5758d
     id: output_ch4
     channel: 4
-    current: 20
+    current: 80
+    min_power: 0.02
+    zero_means_zero: true
   - platform: bp5758d
     id: output_ch5
     channel: 5
-    current: 20
+    current: 80
+    min_power: 0.02
+    zero_means_zero: true
 
 light:
   - platform: rgbww
@@ -42,3 +57,4 @@ light:
     cold_white: output_ch5
     warm_white_color_temperature: 2700 K
     cold_white_color_temperature: 6500 K
+    color_interlock: true

hosts/iron/services/esphome/devices/eingang-deckenleuchte.yaml

@@ -16,7 +16,8 @@ api:
     key: !secret apikey_eingang_deckenleuchte
 
 ota:
-  password: !secret otapass_eingang_deckenleuchte
+  - platform: esphome
+    password: !secret otapass_eingang_deckenleuchte
 
 wifi:
   ssid: !secret wifi_ssid_bw

hosts/iron/services/esphome/devices/fussbodenheizung.yaml

@@ -0,0 +1,195 @@
+esphome:
+  name: "fussbodenheizung"
+  friendly_name: "Fußbodenheizung"
+
+esp8266:
+  board: d1_mini
+  framework:
+    version: recommended
+
+logger:
+
+api:
+  encryption:
+    key: !secret apikey_fussbodenheizung
+
+ota:
+  - platform: esphome
+    password: !secret otapass_fussbodenheizung
+
+wifi:
+  ssid: !secret wifi_ssid_bw
+  password: !secret wifi_password_bw
+  domain: .iot.bw.jalr.de
+  enable_on_boot: True
+  fast_connect: On
+
+switch:
+  - platform: gpio
+    pin:
+      number: 16
+      inverted: true
+    id: relay_1
+    icon: "mdi:electric-switch"
+  - platform: gpio
+    pin:
+      number: 14
+      inverted: true
+    id: relay_2
+    icon: "mdi:electric-switch"
+  - platform: gpio
+    pin:
+      number: 12
+      inverted: true
+    id: relay_3
+    icon: "mdi:electric-switch"
+  - platform: gpio
+    pin:
+      number: 13
+      inverted: true
+    id: relay_4
+    icon: "mdi:electric-switch"
+  - platform: gpio
+    pin:
+      number: 0
+      inverted: true
+    id: relay_5
+    icon: "mdi:electric-switch"
+
+sensor:
+  - platform: wifi_signal
+    name: "WiFi Signal Sensor"
+    update_interval: 60s
+  - platform: dht
+    model: DHT22
+    pin: GPIO2
+    temperature:
+      name: "Temperatur"
+      id: temperature_local
+    humidity:
+      name: "Feuchtigkeit"
+      id: humidity
+      accuracy_decimals: 1
+    update_interval: 60s
+  - platform: homeassistant
+    id: temperature_kitchen
+    entity_id: sensor.kueche_leiste_temperatur
+  - platform: homeassistant
+    id: humidity_kitchen
+    entity_id: sensor.kueche_leiste_feuchtigkeit
+  - platform: homeassistant
+    id: temperature_bathroom
+    entity_id: sensor.badspiegel_temperatur
+  - platform: homeassistant
+    id: humidity_bathroom
+    entity_id: sensor.badspiegel_feuchtigkeit
+  - platform: homeassistant
+    entity_id: sensor.bthome_sensor_e8e8_temperature
+    id: temperature_bedroom
+  - platform: homeassistant
+    entity_id: sensor.bthome_sensor_e8e8_humidity
+    id: humidity_bedroom
+
+climate:
+  - platform: thermostat
+    name: "Bad"
+    sensor: temperature_bathroom
+    humidity_sensor: humidity_bathroom
+    min_heating_off_time: 1s
+    min_heating_run_time: 1s
+    min_idle_time: 30s
+    heat_action:
+      - switch.turn_on: relay_1
+    idle_action:
+      - switch.turn_off: relay_1
+    default_preset: tag
+    on_boot_restore_from: memory
+    preset:
+      - name: morgens
+        default_target_temperature_low: 23 °C
+      - name: tag
+        default_target_temperature_low: 20 °C
+      - name: nacht
+        default_target_temperature_low: 18 °C
+      - name: abwesend
+        default_target_temperature_low: 16 °C
+  - platform: thermostat
+    name: "Schlafzimmer"
+    sensor: temperature_bedroom
+    humidity_sensor: humidity_bedroom
+    min_heating_off_time: 1s
+    min_heating_run_time: 1s
+    min_idle_time: 30s
+    heat_action:
+      - switch.turn_on: relay_2
+    idle_action:
+      - switch.turn_off: relay_2
+    default_preset: tag
+    on_boot_restore_from: memory
+    preset:
+      - name: tag
+        default_target_temperature_low: 22 °C
+      - name: nacht
+        default_target_temperature_low: 18 °C
+      - name: abwesend
+        default_target_temperature_low: 15 °C
+  - platform: thermostat
+    name: "West"
+    sensor: temperature_kitchen
+    humidity_sensor: humidity_kitchen
+    min_heating_off_time: 1s
+    min_heating_run_time: 1s
+    min_idle_time: 30s
+    heat_action:
+      - switch.turn_on: relay_3
+    idle_action:
+      - switch.turn_off: relay_3
+    default_preset: tag
+    on_boot_restore_from: memory
+    preset:
+      - name: tag
+        default_target_temperature_low: 19 °C
+      - name: nacht
+        default_target_temperature_low: 17 °C
+      - name: abwesend
+        default_target_temperature_low: 16 °C
+  - platform: thermostat
+    name: "Mitte"
+    sensor: temperature_local
+    humidity_sensor: humidity
+    min_heating_off_time: 1s
+    min_heating_run_time: 1s
+    min_idle_time: 30s
+    heat_action:
+      - switch.turn_on: relay_4
+    idle_action:
+      - switch.turn_off: relay_4
+    default_preset: tag
+    on_boot_restore_from: memory
+    preset:
+      - name: tag
+        default_target_temperature_low: 19 °C
+      - name: nacht
+        default_target_temperature_low: 17 °C
+      - name: abwesend
+        default_target_temperature_low: 16 °C
+  - platform: thermostat
+    name: "Ost"
+    sensor: temperature_local # FIXME
+    #humidity_sensor:
+    min_heating_off_time: 1s
+    min_heating_run_time: 1s
+    min_idle_time: 30s
+    heat_action:
+      - switch.turn_on: relay_5
+    idle_action:
+      - switch.turn_off: relay_5
+    default_preset: tag
+    on_boot_restore_from: memory
+    preset:
+      - name: tag
+        default_target_temperature_low: 21 °C
+      - name: nacht
+        default_target_temperature_low: 19 °C
+      - name: abwesend
+        default_target_temperature_low: 16 °C

hosts/iron/services/esphome/devices/justfile

@@ -0,0 +1 @@
+../../../../../modules/esphome/devices/justfile

hosts/iron/services/esphome/devices/kueche-leiste.yaml

@@ -0,0 +1,116 @@
+esphome:
+  name: "kueche-leiste"
+  friendly_name: "Küche Leiste"
+  platformio_options:
+    board_build.flash_mode: dio
+  on_boot:
+    then:
+      - light.control:
+          id: led_light
+          brightness: 50%
+          color_temperature: 2700 K
+
+esp32:
+  board: esp32-c3-devkitm-1
+  variant: ESP32C3
+  framework:
+    type: esp-idf
+
+logger:
+
+api:
+  encryption:
+    key: !secret apikey_kueche_leiste
+
+ota:
+  - platform: esphome
+    password: !secret otapass_kueche_leiste
+
+wifi:
+  ssid: !secret wifi_ssid_bw
+  password: !secret wifi_password_bw
+  domain: .iot.bw.jalr.de
+  enable_on_boot: True
+  fast_connect: On
+
+esp32_ble_tracker:
+  scan_parameters:
+    active: false
+
+bluetooth_proxy:
+  active: true
+
+xiaomi_ble:
+
+output:
+  - platform: ledc
+    pin: GPIO0
+    id: output_warm
+  - platform: ledc
+    pin: GPIO1
+    id: output_cold
+
+light:
+  - platform: cwww
+    name: "LED light"
+    id: led_light
+    cold_white: output_cold
+    warm_white: output_warm
+    cold_white_color_temperature: 6500 K
+    warm_white_color_temperature: 2700 K
+    constant_brightness: true
+    gamma_correct: 0
+
+sensor:
+  - platform: wifi_signal
+    name: "WiFi Signal Sensor"
+    update_interval: 60s
+  - platform: dht
+    model: DHT22
+    pin: GPIO5
+    temperature:
+      name: "Temperatur"
+      id: temperature
+    humidity:
+      name: "Feuchtigkeit"
+      id: humidity
+      accuracy_decimals: 1
+    update_interval: 60s
+
+binary_sensor:
+  - platform: gpio
+    pin:
+      number: GPIO6
+      mode:
+        input: true
+        pullup: true
+      inverted: true
+    name: "Physical Power Button"
+    on_press:
+      then:
+        - light.toggle:
+            id: led_light
+    internal: True
+
+spi:
+  - id: spi_bus_main
+    clk_pin: GPIO21
+    mosi_pin: GPIO10
+    miso_pin: GPIO20
+
+pn532_spi:
+  spi_id: spi_bus_main
+  # FIXME: GPIO9 is a strapping pin
+  cs_pin: GPIO9
+  update_interval: 1s
+  on_tag:
+    then:
+      - homeassistant.tag_scanned: !lambda 'return x;'
+      - switch.turn_on: buzzer
+      - delay: 250ms
+      - switch.turn_off: buzzer
+
+switch:
+  - platform: gpio
+    pin: GPIO7
+    id: buzzer

hosts/iron/services/esphome/devices/kuechentisch.yaml

@@ -1,6 +1,6 @@
 esphome:
-  name: "yeelight-meteorite"
-  friendly_name: "Yeelight Meteorite"
+  name: "kuechentisch"
+  friendly_name: "Küchentisch"
   on_boot:
     then:
       - light.turn_on:
@@ -21,29 +21,44 @@ logger:
 
 api:
   encryption:
-    key: !secret apikey_yeelight_meteorite
+    key: !secret apikey_kuechentisch
 
 ota:
-  password: !secret otapass_yeelight_meteorite
+  - platform: esphome
+    password: !secret otapass_kuechentisch
 
 wifi:
   ssid: !secret wifi_ssid_bw
   password: !secret wifi_password_bw
   domain: .iot.bw.jalr.de
+  fast_connect: true
+  manual_ip:
+    static_ip: 10.20.0.10
+    gateway: 10.20.0.1
+    subnet: 255.255.240.0
+
+sensor:
+  - platform: wifi_signal
+    name: "WiFi Signal Sensor"
+    update_interval: 60s
 
 output:
   - platform: ledc
     pin: GPIO19
     id: output_warm
     power_supply: power
-#    min_power: 0.13
-    max_power: 0.82
+    min_power: 0.13
+    max_power: 0.77
+    frequency: 1220Hz
+    zero_means_zero: true
   - platform: ledc
     pin: GPIO21
     id: output_cold
     power_supply: power
-#    min_power: 0.13
-    max_power: 0.82
+    frequency: 1220Hz
+    zero_means_zero: true
+    min_power: 0.13
+    max_power: 0.76
 
   - platform: ledc
     pin: GPIO23

hosts/iron/services/esphome/devices/led-panel-schreibtisch.yaml

@@ -1,6 +1,8 @@
 esphome:
   name: "led-panel-schreibtisch"
   friendly_name: "LED Panel Schreibtisch"
+  platformio_options:
+    board_build.flash_mode: dio
   on_boot:
     then:
       - light.turn_on:
@@ -14,37 +16,50 @@ api:
     key: !secret apikey_panel_schreibtisch
 
 ota:
-  password: !secret otapass_panel_schreibtisch
+  - platform: esphome
+    password: !secret otapass_panel_schreibtisch
 
 wifi:
   ssid: !secret wifi_ssid_bw
   password: !secret wifi_password_bw
   domain: .iot.bw.jalr.de
+  power_save_mode: none
+  enable_on_boot: True
+  fast_connect: true
+  manual_ip:
+    static_ip: 10.20.0.11
+    gateway: 10.20.0.1
+    subnet: 255.255.240.0
+  output_power: 8.5
 
 esp32:
-  board: wemos_d1_uno32
+  board: esp32-c3-devkitm-1
+  variant: ESP32C3
   framework:
-    type: arduino
-    version: recommended
-    platform_version: 5.4.0
+    type: esp-idf
 
 logger:
 
+sensor:
+  - platform: wifi_signal
+    name: "WiFi Signal Sensor"
+    update_interval: 60s
+
 output:
   - platform: ledc
-    pin: GPIO16
+    pin: GPIO1
     id: output_warm
     power_supply: power
     frequency: 2kHz
   - platform: ledc
-    pin: GPIO17
+    pin: GPIO3
     id: output_cold
     power_supply: power
     frequency: 2kHz
 
 power_supply:
   - id: power
-    pin: GPIO25
+    pin: GPIO0
     enable_time: 0s
     keep_on_time: 0s
 

hosts/iron/services/esphome/devices/pflanzenleuchte.yaml

@@ -0,0 +1,60 @@
+esphome:
+  name: "pflanzenleuchte"
+  friendly_name: "Pflanzenleuchte"
+  platformio_options:
+    board_build.flash_mode: dio
+
+esp32:
+  board: esp32-c3-devkitm-1
+  variant: ESP32C3
+  framework:
+    type: esp-idf
+
+logger:
+
+api:
+  encryption:
+    key: !secret apikey_pflanzenleuchte
+
+ota:
+  - platform: esphome
+    password: !secret otapass_pflanzenleuchte
+
+wifi:
+  ssid: !secret wifi_ssid_bw
+  password: !secret wifi_password_bw
+  domain: .iot.bw.jalr.de
+  enable_on_boot: True
+  fast_connect: On
+  output_power: 8.5
+
+sensor:
+  - platform: wifi_signal
+    name: "WiFi Signal Sensor"
+    update_interval: 60s
+
+output:
+  - platform: ledc
+    pin: GPIO0
+    id: output_royal_blue
+    inverted: true
+    min_power: 0.25
+    zero_means_zero: true
+  - platform: ledc
+    pin: GPIO1
+    id: output_deep_red
+    inverted: true
+    min_power: 0.25
+    zero_means_zero: true
+
+light:
+  - platform: monochromatic
+    name: "Royalblau"
+    id: royal_blue
+    output: output_royal_blue
+    gamma_correct: false
+  - platform: monochromatic
+    name: "Tiefrot"
+    id: deep_red
+    output: output_deep_red
+    gamma_correct: false

hosts/iron/services/esphome/devices/pinspot.yaml

@@ -0,0 +1,53 @@
+esphome:
+  name: "pinspot"
+  friendly_name: "Pinspot"
+  platformio_options:
+    board_build.flash_mode: dio
+
+esp32:
+  board: esp32-c3-devkitm-1
+  variant: ESP32C3
+  framework:
+    type: esp-idf
+
+logger:
+
+api:
+  encryption:
+    key: !secret apikey_pinspot
+
+ota:
+  - platform: esphome
+    password: !secret otapass_pinspot
+
+wifi:
+  ssid: !secret wifi_ssid_bw
+  password: !secret wifi_password_bw
+  domain: .iot.bw.jalr.de
+  enable_on_boot: True
+  fast_connect: On
+  output_power: 8.5
+
+sensor:
+  - platform: wifi_signal
+    name: "WiFi Signal Sensor"
+    update_interval: 60s
+
+output:
+  - platform: ledc
+    pin: GPIO1
+    id: output_led_brightness
+    min_power: 0.028
+    zero_means_zero: true
+  - platform: ledc
+    pin: GPIO4
+    inverted: true
+    id: output_led_colortemp
+
+light:
+  - platform: color_temperature
+    name: "Pinspot"
+    color_temperature: output_led_colortemp
+    brightness: output_led_brightness
+    cold_white_color_temperature: 6000 K
+    warm_white_color_temperature: 2700 K

hosts/iron/services/esphome/devices/shroombox.yaml

@@ -0,0 +1,128 @@
+esphome:
+  name: "shroombox"
+  friendly_name: "shroombox"
+
+esp32:
+  board: esp-wrover-kit
+
+api:
+  encryption:
+    key: !secret apikey_shroombox
+
+ota:
+  - platform: esphome
+    password: !secret otapass_shroombox
+
+ethernet:
+  type: LAN8720
+  mdc_pin: GPIO23
+  mdio_pin: GPIO18
+  clk_mode: GPIO0_IN
+  phy_addr: 1
+  power_pin: GPIO16
+
+logger:
+
+i2c:
+  sda: GPIO4
+  scl: GPIO14
+  scan: true
+
+sensor:
+  - platform: scd30
+    id: scd30_sensor
+    co2:
+      name: "Shroombox CO2"
+      accuracy_decimals: 1
+    temperature:
+      name: "Shroombox Temperature"
+      accuracy_decimals: 2
+    humidity:
+      name: "Shroombox Humidity"
+      accuracy_decimals: 1
+      id: humidity
+    address: 0x61
+    update_interval: 5s
+    automatic_self_calibration: false
+
+  - platform: hx711
+    name: "Water tank weight"
+    dout_pin: GPIO32
+    clk_pin: GPIO33
+    gain: 128
+    update_interval: 5s
+    filters:
+      - calibrate_linear:
+          - -35884 -> 0
+          - 334800 -> 887
+    unit_of_measurement: g
+  - platform: pulse_counter
+    pin:
+      number: GPIO36
+      #mode: INPUT_PULLUP
+      mode: INPUT
+    unit_of_measurement: 'RPM'
+    id: fan_rpm
+    name: Fan Speed
+    accuracy_decimals: 0
+
+output:
+  - platform: ledc
+    id: fan_duty
+    pin: GPIO15
+    frequency: "25000 Hz"
+    min_power: 10%
+    max_power: 100%
+    zero_means_zero: true
+
+fan:
+  - platform: speed
+    output: fan_duty
+    name: "Fan"
+    id: fan1
+
+switch:
+  - platform: gpio
+    pin: GPIO2
+    id: humidifier
+    name: "Humidifier"
+
+number:
+  - platform: template
+    name: "CO2 calibration value"
+    optimistic: true
+    min_value: 350
+    max_value: 4500
+    step: 1
+    id: co2_cal
+    icon: "mdi:molecule-co2"
+    entity_category: "config"
+
+button:
+  - platform: template
+    name: "SCD30 Force manual calibration"
+    entity_category: "config"
+    on_press:
+      then:
+        - scd30.force_recalibration_with_reference:
+            value: !lambda 'return id(co2_cal).state;'
+
+climate:
+  - platform: thermostat
+    name: "Humidistat"
+    sensor: humidity
+    min_idle_time: 20s
+    min_heating_off_time: 60s
+    min_heating_run_time: 60s
+    visual:
+      min_temperature: 0
+      max_temperature: 100
+    preset:
+      - name: default
+        mode: heat
+        default_target_temperature_low: 80
+
+    heat_action:
+      - switch.turn_on: humidifier
+    idle_action:
+      - switch.turn_off: humidifier

hosts/iron/services/esphome/devices/tuerschloss.yaml

@@ -0,0 +1,85 @@
+esphome:
+  name: "tuerschloss"
+  friendly_name: "Türschloss"
+  platformio_options:
+    board_build.flash_mode: dio
+
+esp32:
+  board: esp32-c3-devkitm-1
+  variant: ESP32C3
+  framework:
+    type: esp-idf
+
+logger:
+
+api:
+  encryption:
+    key: !secret apikey_tuerschloss
+
+ota:
+  - platform: esphome
+    password: !secret otapass_tuerschloss
+
+wifi:
+  ssid: !secret wifi_ssid_bw
+  password: !secret wifi_password_bw
+  domain: .iot.bw.jalr.de
+  enable_on_boot: True
+  fast_connect: On
+  output_power: 8.5
+
+sensor:
+  - platform: wifi_signal
+    name: "WiFi Signal Sensor"
+    update_interval: 60s
+
+output:
+  - platform: gpio
+    pin:
+      number: GPIO0
+      inverted: true
+      mode:
+        output: true
+        open_drain: true
+    id: btn_unlock
+  - platform: gpio
+    pin:
+      number: GPIO1
+      inverted: true
+      mode:
+        output: true
+        open_drain: true
+    id: btn_lock
+  - platform: gpio
+    pin:
+      number: GPIO3
+    id: btn_open
+
+lock:
+  - platform: template
+    name: "Türschloss"
+    id: tuerschloss
+    assumed_state: true
+    lock_action:
+      - output.turn_on: btn_lock
+      - delay: 250ms
+      - output.turn_off: btn_lock
+      - delay: 5s
+      - lambda: id(tuerschloss).publish_state(LOCK_STATE_LOCKED);
+    unlock_action:
+      - output.turn_on: btn_unlock
+      - delay: 250ms
+      - output.turn_off: btn_unlock
+      - delay: 5s
+      - lambda: id(tuerschloss).publish_state(LOCK_STATE_UNLOCKED);
+
+button:
+  - platform: template
+    name: "Türöffner"
+    id: tueroeffner
+    icon: mdi:lock-open
+    on_press:
+      - logger.log: "Button pressed"
+      - output.turn_on: btn_open
+      - delay: 250ms
+      - output.turn_off: btn_open

hosts/iron/services/esphome/devices/tuersprechanlage.yaml

@@ -0,0 +1,124 @@
+esphome:
+  name: "tuersprechanlage"
+  friendly_name: "Türsprechanlage"
+
+esp32:
+  board: lolin_s2_mini
+  variant: ESP32S2
+  framework:
+    type: esp-idf
+    sdkconfig_options:
+        CONFIG_ESP_CONSOLE_USB_CDC: y
+
+logger:
+  hardware_uart: USB_CDC
+
+api:
+  encryption:
+    key: !secret apikey_tuersprechanlage
+
+ota:
+  - platform: esphome
+    password: !secret otapass_tuersprechanlage
+
+wifi:
+  ssid: !secret wifi_ssid_bw
+  password: !secret wifi_password_bw
+  domain: .iot.bw.jalr.de
+  enable_on_boot: True
+  fast_connect: True
+  power_save_mode: none
+  output_power: 10
+
+sensor:
+  - platform: wifi_signal
+    name: "WiFi Signal Sensor"
+    update_interval: 60s
+
+binary_sensor:
+  - platform: gpio
+    name: Etagenklingel
+    id: floor_bell
+    pin:
+      number: GPIO16
+      mode:
+        input: true
+        pullup: true
+    filters:
+      - delayed_off: 10s
+
+  - platform: gpio
+    name: Treppenlicht
+    id: staircase_light
+    pin:
+      number: GPIO18
+      mode:
+        input: true
+        pullup: true
+    filters:
+      - invert
+      - delayed_off: 10s
+    on_press:
+      then:
+        - output.turn_on: output_staircase_light_ssr
+        - delay: 200ms
+        - output.turn_off: output_staircase_light_ssr
+
+output:
+  - platform: gpio
+    pin: GPIO15
+    id: output_door_opener
+  - platform: ledc
+    pin:
+      number: GPIO33
+      inverted: true
+    id: output_staircase_light_ssr
+    frequency: 50000
+    min_power: 0
+    max_power: 0.12
+  - platform: template
+    type: binary
+    id: output_staircase_light_permanent
+    write_action:
+      - if:
+          condition:
+            lambda: 'return state;'
+          then:
+            - script.execute: script_staircase_permanent
+          else:
+            - script.stop: script_staircase_permanent
+
+button:
+  - platform: template
+    name: "Türöffner"
+    id: btn_tueroeffner
+    icon: mdi:lock-open
+    on_press:
+      - output.turn_on: output_door_opener
+      - delay: 500ms
+      - output.turn_off: output_door_opener
+  - platform: template
+    name: "Treppenlicht"
+    id: btn_staircase_light
+    icon: mdi:stairs
+    on_press:
+      - output.turn_on: output_staircase_light_ssr
+      - delay: 200ms
+      - output.turn_off: output_staircase_light_ssr
+
+light:
+  - platform: binary
+    id: staircase_permanent
+    name: Treppenlicht permanent
+    output: output_staircase_light_permanent
+
+script:
+  - id: script_staircase_permanent
+    mode: restart
+    then:
+      - while:
+          condition:
+            lambda: 'return true;'
+          then:
+            - button.press: btn_staircase_light
+            - delay: 90s

hosts/iron/services/esphome/devices/waschmaschine.yaml

@@ -7,7 +7,8 @@ api:
     key: !secret apikey_waschmaschine
 
 ota:
-  password: !secret otapass_waschmaschine
+  - platform: esphome
+    password: !secret otapass_waschmaschine
 
 wifi:
   ssid: !secret wifi_ssid_bw
@@ -27,6 +28,9 @@ external_components:
     components: [ miele_w433 ]
 
 sensor:
+  - platform: wifi_signal
+    name: "WiFi Signal Sensor"
+    update_interval: 60s
   - platform: miele_w433
     enable_7segment_pin: 27
     clock_pin: 14
@@ -38,4 +42,83 @@ sensor:
       name: "in Betrieb"
     current_operation:
       name: "aktueller Vorgang"
+      id: current_operation
 
+number:
+  - platform: template
+    name: "Waschmittelmenge"
+    id: detergent_dosing
+    min_value: 25.0
+    max_value: 150.0
+    step: 1
+    unit_of_measurement: "ml"
+    icon: 'mdi:cup-water'
+    restore_value: true
+    initial_value: 75.0
+    optimistic: true
+  - platform: template
+    name: "Waschmittelvorrat"
+    id: detergent_supply
+    min_value: 0.0
+    max_value: 5000
+    step: 1.0
+    unit_of_measurement: "ml"
+    icon: 'mdi:cup-water'
+    restore_value: true
+    initial_value: 0
+    optimistic: true
+
+stepper:
+  - platform: a4988
+    id: detergent_stepper
+    step_pin: GPIO32
+    sleep_pin: GPIO33
+    dir_pin: GPIO25 # not used
+    max_speed: 600 steps/s
+    acceleration: 125 steps/s^2
+    deceleration: 125 steps/s^2
+
+globals:
+  - id: dosing_enabled
+    type: bool
+    restore_value: false
+    initial_value: 'true'
+
+interval:
+  - interval: 1s
+    then:
+      if:
+        condition:
+          and:
+            #- lambda: return id(current_operation).state == "Einw/Vorwäsche";
+            - lambda: return id(current_operation).state == "Waschen";
+            - lambda: return id(dosing_enabled);
+        then:
+          - lambda: &dosing |-
+                float dose = id(detergent_dosing).state;
+                float current_supply = id(detergent_supply).state;
+                if (current_supply >= dose) {
+                  id(detergent_stepper).set_target(dose * 125);
+                  id(detergent_stepper).report_position(0);
+                  id(detergent_supply).publish_state(current_supply - dose);
+                  ESP_LOGD("custom", "Waschmitteldosierung durchgeführt: %.2f ml, verbleibender Vorrat: %.2f ml", dose, current_supply - dose);
+                } else {
+                  ESP_LOGW("custom", "Nicht genug Waschmittelvorrat! Aktueller Vorrat: %.2f ml, gewünschte Dosierung: %.2f ml", current_supply, dose);
+                }
+          - lambda: |-
+              id(dosing_enabled) = false;
+  - interval: 1s
+    then:
+      if:
+        condition:
+          lambda: return id(current_operation).state == "Knitterschutz/Ende";
+        then:
+          - lambda: |-
+              id(dosing_enabled) = true;
+
+button:
+  - platform: template
+    name: "Waschmitteldosierung auslösen"
+    icon: "mdi:cup-water"
+    on_press:
+      - lambda: *dosing

hosts/iron/services/esphome/devices/water-bottle.yaml

@@ -0,0 +1,238 @@
+substitutions:
+  tolerance: "10"
+  minimum_sip: "20"
+  default_bottle_tare: "198"
+
+esphome:
+  name: "water-bottle"
+  friendly_name: "Water bottle"
+
+esp32:
+  board: lolin_s2_mini
+  variant: ESP32S2
+  framework:
+    type: esp-idf
+    sdkconfig_options:
+        CONFIG_ESP_CONSOLE_USB_CDC: y
+
+logger:
+  hardware_uart: USB_CDC
+
+api:
+  encryption:
+    key: !secret apikey_water_bottle
+  on_client_connected:
+    - light.turn_on:
+        id: pixels
+        effect: "scan"
+        red: 0%
+        green: 25%
+        blue: 0%
+    - delay: 2s
+    - light.turn_off:
+        id: pixels
+
+ota:
+  - platform: esphome
+    password: !secret otapass_water_bottle
+
+wifi:
+  ssid: !secret wifi_ssid_bw
+  password: !secret wifi_password_bw
+  domain: .iot.bw.jalr.de
+  enable_on_boot: True
+  fast_connect: True
+  power_save_mode: none
+  output_power: 10
+
+globals:
+  - id: volume_when_removed
+    type: int
+    restore_value: no
+    initial_value: "NAN"
+  - id: bottle_returned
+    type: bool
+    restore_value: no
+    initial_value: "false"
+
+sensor:
+  - platform: wifi_signal
+    name: "WiFi Signal Sensor"
+    update_interval: 60s
+  - platform: hx711
+    internal: true
+    id: scale
+    dout_pin: GPIO16
+    clk_pin: GPIO17
+    gain: 128
+    update_interval: 0.1s
+    unit_of_measurement: g
+    filters:
+      - quantile:
+          window_size: 10
+          send_every: 5
+          send_first_at: 5
+          quantile: .9
+      - calibrate_linear:
+          - 197155 -> 0
+          - 246676 -> 50
+  - platform: copy
+    name: "absolute volume"
+    id: volume_absolute
+    icon: "mdi:water"
+    source_id: scale
+    filters:
+      - lambda: "return x - id(bottle_tare).state;"
+      - clamp:
+          min_value: 0
+          ignore_out_of_range: true
+      - quantile:
+          window_size: 5
+          send_every: 5
+          send_first_at: 5
+          quantile: .9
+    on_value:
+      then:
+        - if:
+            condition:
+              lambda: |-
+                if (id(bottle_returned)) {
+                  id(bottle_returned) = false;
+                  return true;
+                }
+                return false;
+            then:
+              - lambda: |-
+                  ESP_LOGI("main", "Bottle returned, waiting to settle");
+                  ESP_LOGI("main", "Volume absolute: %f", id(volume_absolute).state);
+              - delay: 3s
+              - lambda: |-
+                  ESP_LOGI("main", "Bottle settled");
+                  ESP_LOGI("main", "Volume when removed: %d", id(volume_when_removed));
+                  ESP_LOGI("main", "Volume absolute: %f", id(volume_absolute).state);
+                  if (id(volume_when_removed) > id(volume_absolute).state + ${minimum_sip}) {
+                    ESP_LOGI("main", "Volume total before: %f", id(volume_total).state);
+                    auto call = id(volume_total).make_call();
+                    call.set_value(id(volume_when_removed) - id(volume_absolute).state + id(volume_total).state);
+                    call.perform();
+                    ESP_LOGI("main", "Volume total now: %f", id(volume_total).state);
+                  }
+  - platform: template
+    name: "Water consumption rate"
+    id: "volume_total_derivative"
+    unit_of_measurement: "ml/h"
+    icon: "mdi:water-check"
+    lambda: |-
+      static float last_value = 0;
+      static float last_time = 0;
+      float time = (float) millis();
+      if (last_time == 0){
+        last_value = id(volume_total).state;
+        last_time  = time;
+        return {};
+      }                    
+      float change = ( ( id(volume_total).state - last_value ) / ( time - last_time ) ) *1000*60*60;
+      last_value = id(volume_total).state;
+      last_time  = time;
+      return change;
+    filters:
+      - sliding_window_moving_average:
+          window_size: 3
+          send_every: 2          
+      - or: 
+        - delta: 0.01  
+        - heartbeat: 120minutes            
+      - throttle: 30s
+
+number:
+  - platform: template
+    name: "Bottle tare"
+    id: bottle_tare
+    icon: mdi:weight-gram
+    optimistic: true
+    initial_value: "${default_bottle_tare}"
+    unit_of_measurement: "g"
+    step: 1
+    min_value: 0
+    max_value: 1000
+  - platform: template
+    name: "total volume"
+    id: volume_total
+    optimistic: true
+    icon: "mdi:water"
+    unit_of_measurement: "ml"
+    step: 1
+    min_value: 0
+    max_value: 10000
+
+binary_sensor:
+  - platform: template
+    name: "Bottle present"
+    id: bottle_present
+    lambda: |-
+      if (id(scale).state > id(bottle_tare).state - ${tolerance}) {
+        return true;
+      } else {
+        return false;
+      }
+    on_release:
+      then:
+        - lambda: |-
+            id(volume_when_removed) = id(volume_absolute).state;
+            ESP_LOGI("main", "Volume absolute: %f ml", id(volume_absolute).state);
+            ESP_LOGI("main", "Bottle removed with %d ml", id(volume_when_removed));
+        - light.turn_on:
+            id: pixels
+            effect: "normal_pulse"
+            red: 75%
+            green: 0%
+            blue: 0%
+    on_press:
+      then:
+        - globals.set:
+            id: bottle_returned
+            value: "true"
+        - if:
+            condition:
+              lambda: "return id(volume_absolute).state > 250;"
+            then:
+              - light.turn_on:
+                  id: pixels
+                  effect: "normal_pulse"
+                  red: 0%
+                  green: 50%
+                  blue: 50%
+            else:
+              - light.turn_on:
+                  id: pixels
+                  effect: "normal_pulse"
+                  red: 50%
+                  green: 25%
+                  blue: 0%
+        - delay: 2s
+        - light.turn_off:
+            id: pixels
+
+e131:
+  method: multicast
+
+light:
+  - platform: esp32_rmt_led_strip
+    id: pixels
+    rgb_order: GRB
+    pin: GPIO12
+    num_leds: 8
+    rmt_channel: 0
+    chipset: ws2812
+    effects:
+      - addressable_scan:
+          name: scan
+          move_interval: 20ms
+          scan_width: 1
+      - pulse:
+          name: slow_pulse
+          transition_length: 500ms
+          update_interval: 10s
+      - pulse:
+          name: normal_pulse
+          min_brightness: 20%

hosts/iron/services/esphome/devices/wohnungstuer.yaml

@@ -0,0 +1,253 @@
+esphome:
+  name: "wohnungstuer"
+  friendly_name: "Wohnungstür"
+
+api:
+  encryption:
+    key: !secret apikey_wohnungstuer
+
+ota:
+  - platform: esphome
+    password: !secret otapass_wohnungstuer
+
+wifi:
+  ssid: !secret wifi_ssid_bw
+  password: !secret wifi_password_bw
+  domain: .iot.bw.jalr.de
+
+esp32_ble_tracker:
+  scan_parameters:
+    active: false
+
+bluetooth_proxy:
+  active: true
+
+xiaomi_ble:
+
+esp32:
+  board: esp32doit-devkit-v1
+  framework:
+    type: arduino
+    version: recommended
+
+logger:
+
+sensor:
+  - platform: wifi_signal
+    name: "WiFi Signal Sensor"
+    update_interval: 60s
+
+globals:
+   - id: leaving
+     type: int
+     restore_value: no
+     initial_value: '0'
+
+binary_sensor:
+  - platform: template
+    name: "At home"
+    id: presence
+    device_class: presence
+  - platform: gpio
+    name: Tür
+    id: door
+    pin:
+      number: GPIO32
+      mode:
+        input: true
+        pullup: true
+    filters:
+      - delayed_on_off: 1s
+    device_class: door
+    on_press: # on opening door
+      then:
+        - lambda: |-
+            id(leaving) |= 1;
+        - if:
+            condition:
+              # bowl is occupied
+              binary_sensor.is_on: key_bowl
+            then:
+              - light.turn_on:
+                  id: pixels
+                  effect: strobe_red
+              - script.execute:
+                  id: beep
+                  on_ms: 250
+                  off_ms: 250
+
+            else:
+              - if:
+                  condition:
+                    binary_sensor.is_off: presence # when away
+                  then:
+                    - light.turn_on:
+                        id: pixels
+                        effect: "None"
+                        red: 75%
+                        green: 25%
+
+    on_release: # on closing door
+      then:
+        - if:
+            condition:
+              binary_sensor.is_off: presence # when away
+            then:
+              - light.turn_on:
+                  id: pixels
+                  effect: "scan"
+                  red: 0%
+                  green: 0%
+                  blue: 100%
+              - script.execute:
+                  id: beep
+                  on_ms: 100
+                  off_ms: 1000
+        - if:
+            condition:
+              lambda: |-
+                  return id(leaving) == 3;
+            then:
+              - light.turn_off:
+                  id: pixels
+              - script.stop: beep
+              - switch.turn_off: buzzer
+              - binary_sensor.template.publish: # set away state
+                  id: presence
+                  state: OFF
+            else:
+              - if:
+                  condition:
+                    # when keys are in the bowl
+                    binary_sensor.is_on: key_bowl
+                  then:
+                    - script.stop: beep
+                    - switch.turn_off: buzzer
+                    - light.turn_on:
+                        id: pixels
+                        effect: "None"
+                        red: 0%
+                        green: 50%
+                        blue: 0%
+                    - delay: 30s
+                    - light.turn_off:
+                        id: pixels
+                        transition_length: 3s
+        - lambda: |-
+            id(leaving) = 0;
+        - if:
+            condition:
+              binary_sensor.is_on: presence # when at home
+            then:
+              - light.turn_off:
+                  id: pixels
+              - script.stop: beep
+              - switch.turn_off: buzzer
+
+  - platform: gpio
+    name: Schlüsselschale
+    id: key_bowl
+    pin:
+      number: GPIO23
+      mode:
+        input: true
+        pullup: true
+    device_class: occupancy
+    filters:
+      - invert:
+      - delayed_on_off: 250ms
+    on_press: # when keys fall in bowl
+      then:
+        - binary_sensor.template.publish: # set at home state
+            id: presence
+            state: ON
+        - lambda: |-
+            id(leaving) = 0;
+        - if:
+            condition:
+              # door is closed
+              binary_sensor.is_off: door
+            then:
+              - script.stop: beep
+              - switch.turn_off: buzzer
+              - light.turn_on:
+                  id: pixels
+                  effect: "None"
+                  red: 0%
+                  green: 50%
+                  blue: 0%
+              - delay: 30s
+              - light.turn_off:
+                  id: pixels
+                  transition_length: 3s
+    on_release: # when keys are removed from bowl
+      then:
+        - if:
+            condition:
+              lambda: |-
+                return id(leaving) == 1;
+            then:
+              - light.turn_off:
+                  id: pixels
+              - script.stop: beep
+              - switch.turn_off: buzzer
+        - lambda: |-
+            id(leaving) |= 2;
+        - if:
+            condition:
+              # door is closed
+              binary_sensor.is_off: door
+            then:
+              - light.turn_on:
+                  id: pixels
+                  effect: "rainbow"
+
+light:
+  - platform: esp32_rmt_led_strip
+    id: pixels
+    rgb_order: GRB
+    pin: GPIO12
+    num_leds: 5
+    rmt_channel: 0
+    chipset: ws2812
+    effects:
+      - strobe:
+          name: strobe_red
+          colors:
+            - state: true
+              brightness: 100%
+              red: 100%
+              green: 0%
+              blue: 0%
+              duration: 250ms
+            - state: false
+              duration: 250ms
+      - addressable_rainbow:
+          name: rainbow
+          speed: 20
+          width: 10
+      - addressable_scan:
+          name: scan
+          move_interval: 20ms
+          scan_width: 1
+
+switch:
+  - platform: gpio
+    pin: GPIO22
+    id: buzzer
+
+script:
+  - id: beep
+    mode: restart
+    parameters:
+      on_ms: int
+      off_ms: int
+    then:
+      - while:
+          condition:
+            lambda: 'return true;'
+          then:
+            - switch.turn_on: buzzer
+            - delay: !lambda return on_ms;
+            - switch.turn_off: buzzer
+            - delay: !lambda return off_ms;

hosts/iron/services/grafana.nix

@@ -0,0 +1,146 @@
+{ config
+, lib
+, pkgs
+, ...
+}:
+let
+  inherit (config.networking) ports;
+  domain = "grafana.jalr.de";
+  cfg = config.services.grafana;
+in
+{
+  sops.secrets = {
+    "grafana/secret-key" = {
+      sopsFile = ../secrets.yaml;
+      owner = config.systemd.services.grafana.serviceConfig.User;
+    };
+  };
+
+  services.grafana = {
+    enable = true;
+    settings = {
+      server = {
+        inherit domain;
+        root_url = "https://%(domain)s";
+        http_addr = "127.0.0.1";
+        http_port = ports.grafana.tcp;
+      };
+      security = {
+        content_security_policy = true;
+        cookie_samesite = "strict";
+        cookie_secure = true;
+        secret_key = "$__file{${config.sops.secrets."grafana/secret-key".path}}";
+        strict_transport_security = true;
+        strict_transport_security_preload = true;
+        strict_transport_security_subdomains = true;
+      };
+      analytics = {
+        reporting_enabled = false;
+        check_for_updates = false;
+        check_for_plugin_updates = false;
+      };
+    };
+    provision = {
+      datasources.settings = {
+        apiVersion = 1;
+        datasources = with config.services.prometheus;
+          (
+            lib.lists.optional enable {
+              name = "Prometheus";
+              type = "prometheus";
+              url = "http://${listenAddress}:${toString port}";
+              orgId = 1;
+            }
+          )
+          ++ (with config.services.prometheus.alertmanager; (
+            lib.lists.optional enable {
+              name = "Alertmanager";
+              type = "alertmanager";
+              url = "http://${listenAddress}:${toString port}";
+              orgId = 1;
+            }
+          ));
+        deleteDatasources = [
+          {
+            name = "Prometheus";
+            orgId = 1;
+          }
+          {
+            name = "Alertmanager";
+            orgId = 1;
+          }
+        ];
+      };
+
+      dashboards.settings.providers =
+        let
+          # https://grafana.com/grafana/dashboards/
+          fetchDashboard =
+            { name
+            , hash
+            , id
+            , version
+            ,
+            }:
+            pkgs.fetchurl {
+              inherit name hash;
+              url = "https://grafana.com/api/dashboards/${toString id}/revisions/${toString version}/download";
+              recursiveHash = true;
+              postFetch = ''
+                mv "$out" temp
+                mkdir -p "$out"
+                mv temp "$out/${name}.json";
+              '';
+            };
+          dashboard = name: fetchArgs: {
+            inherit name;
+            options.path = fetchDashboard fetchArgs;
+          };
+        in
+        [
+          (dashboard "Node Exporter Full"
+            {
+              name = "node-exporter-full";
+              hash = "sha256-QTHG9ioy7E8U8O8x/qFabOxK2qBjlGlzuEvwYKug0CQ=";
+              id = 1860;
+              version = 36;
+            })
+          (dashboard "Node Exporter"
+            {
+              name = "node-exporter";
+              hash = "sha256-2xgE0m3SUFiux501uCVb4aH3zGfapW/SmfxRsFC/514=";
+              id = 13978;
+              version = 2;
+            })
+          (dashboard "AlertManager"
+            {
+              name = "alertmanager";
+              hash = "sha256-Yvw0DGQJpqBYNzE4ES/x7ZAYF7iJ4SUNBKB+sJRuGBw=";
+              id = 9578;
+              version = 4;
+            })
+        ];
+    };
+  };
+  services.nginx.virtualHosts = {
+    "${domain}" = {
+      enableACME = true;
+      forceSSL = true;
+
+      locations."/" = {
+        proxyPass = "http://${cfg.settings.server.http_addr}:${toString cfg.settings.server.http_port}";
+        proxyWebsockets = true;
+        recommendedProxySettings = true;
+      };
+    };
+  };
+
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/grafana";
+      user = "grafana";
+      group = "grafana";
+      mode = "u=rwx,g=,o=";
+    }
+  ];
+}

hosts/iron/services/home-assistant.nix

@@ -1,95 +1,265 @@
-args@{ lib, pkgs, config, custom-utils, ... }:
+{ lib, pkgs, config, ... }:
 let
-  ports = import ../ports.nix args;
+  inherit (config.networking) ports;
+  interfaces = import ../interfaces.nix;
+  domain = "hass.jalr.de";
 in
 {
-  services.home-assistant = {
-    enable = true;
-    lovelaceConfig = {
-      title = "Home";
-      views = [
-        {
-          path = "default_view";
-          title = "Home";
-          cards = [
-            {
-              type = "entities";
-              entities = [
-                "switch.circadian_lighting_circadian_lighting"
-              ];
-            }
-            {
-              title = "Eingang";
-              type = "entities";
-              entities = [
-                {
-                  entity = "light.eingang_deckenleuchte_deckenleuchte";
-                  name = "Deckenleuchte";
-                }
-              ];
-            }
-            {
-              name = "Esstisch";
-              type = "entities";
-              entities = [
-                {
-                  entity = "light.yeelight_meteorite_ambient_light";
-                  name = "Ambient light";
-                }
-                {
-                  entity = "light.yeelight_meteorite_ceiling_light";
-                  name = "Ceiling light";
-                }
-                {
-                  entity = "light.yeelight_meteorite_night_light";
-                  name = "Night light";
-                }
-              ];
-            }
-          ];
-        }
+  sops.secrets.home-assistant = {
+    owner = "root";
+    group = "hass";
+    mode = "0640";
+  };
+
+  networking.firewall.interfaces = {
+    "${interfaces.lan}".allowedTCPPorts = [ ports.mqtt.tcp ];
+    iot.allowedTCPPorts = [ ports.mqtt.tcp ];
+  };
+
+  services = {
+    home-assistant = {
+      enable = true;
+      lovelaceConfig = {
+        title = "Home";
+        views = [
+          {
+            path = "default_view";
+            title = "Home";
+            cards = [
+              {
+                title = "Eingang";
+                type = "entities";
+                entities = [
+                  {
+                    entity = "light.eingang_deckenleuchte_deckenleuchte";
+                    name = "Deckenleuchte";
+                  }
+                ];
+              }
+              {
+                name = "Esstisch";
+                type = "entities";
+                entities = [
+                  {
+                    entity = "light.yeelight_meteorite_ambient_light";
+                    name = "Ambient light";
+                  }
+                  {
+                    entity = "light.yeelight_meteorite_ceiling_light";
+                    name = "Ceiling light";
+                  }
+                  {
+                    entity = "light.yeelight_meteorite_night_light";
+                    name = "Night light";
+                  }
+                ];
+              }
+            ];
+          }
+        ];
+      };
+      extraComponents = [
+        # See https://www.home-assistant.io/integrations
+        "bthome"
+        "caldav"
+        "esphome"
+        "local_todo"
+        "openweathermap"
+        "wyoming"
+        "xiaomi_ble"
+        "vlc_telnet"
       ];
-    };
-    extraComponents = [
-      # See https://www.home-assistant.io/integrations
-      "esphome"
-    ];
-    customComponents = [
-      pkgs.home-assistant-custom-components.circadian_lighting
-    ];
-    lovelaceConfigWritable = false;
-    configWritable = false;
-    config = {
-      http = {
-        server_host = [ "127.0.0.1" ];
-        server_port = ports.home-assistant.tcp;
-        use_x_forwarded_for = true;
-        trusted_proxies = [ "127.0.0.1" ];
-      };
-      homeassistant = {
-        unit_system = "metric";
-        time_zone = "Europe/Berlin";
-        temperature_unit = "C";
-        longitude = config.location.longitude;
-        latitude = config.location.latitude;
-      };
-      default_config = { };
-      circadian_lighting = { };
-      switch = [
-        {
-          platform = "circadian_lighting";
-          lights_ct = [
+      customComponents = with pkgs.home-assistant-custom-components; [
+        adaptive_lighting
+      ];
+      customLovelaceModules = with pkgs.home-assistant-custom-lovelace-modules; [
+        valetudo-map-card
+      ];
+      lovelaceConfigWritable = false;
+      configWritable = false;
+      config = {
+        http = {
+          server_host = [ "127.0.0.1" ];
+          server_port = ports.home-assistant.tcp;
+          use_x_forwarded_for = true;
+          trusted_proxies = [ "127.0.0.1" ];
+        };
+        homeassistant = {
+          unit_system = "metric";
+          time_zone = "Europe/Berlin";
+          temperature_unit = "C";
+          inherit (config.location) longitude;
+          inherit (config.location) latitude;
+          external_url = "https://${domain}/";
+          internal_url = "https://${domain}/";
+        };
+        default_config = { };
+        adaptive_lighting = {
+          lights = [
             "light.yeelight_meteorite_ceiling_light"
             "light.eingang_deckenleuchte_deckenleuchte"
             "light.led_panel_schreibtisch_panel"
+            "light.kueche_leiste_led_light"
+            "light.badspiegel_background_light"
+            "light.badspiegel_front_light"
           ];
-          min_brightness = 20;
+        };
+        "automation nix" = [
+          {
+            alias = "Waschmaschine fertig Benachrichtigung";
+            trigger = {
+              platform = "state";
+              entity_id = "sensor.waschmaschine_aktueller_vorgang";
+              to = "Knitterschutz/Ende";
+            };
+            action = [
+              {
+                service = "notify.mobile_app_shift6mq";
+                data = {
+                  message = "Die Waschmaschine hat das Programm beendet.";
+                  title = "Wäsche fertig";
+                };
+              }
+            ];
+          }
+        ];
+        "automation ui" = "!include automations.yaml";
+        "scene nix" = [
+        ];
+        "scene ui" = "!include scenes.yaml";
+        bluetooth = { };
+        device_tracker = [
+          {
+            platform = "bluetooth_le_tracker";
+          }
+        ];
+        "script nix" = [
+          {
+            lights_off_except = {
+              icon = "mdi:home-lightbulb";
+              fields.exclude_lights.description = "Excluded lights as list";
+              sequence = [
+                {
+                  service = "logbook.log";
+                  data_template = {
+                    entity_id = "script.turn_off_lights";
+                    name = "Exclude log";
+                    message = "Turning of all lights except: {{ exclude_lights }}";
+                  };
+                }
+                {
+                  service = "light.turn_off";
+                  data_template.entity_id = ''
+                    {{ states.light | rejectattr('entity_id', 'in', exclude_lights) | rejectattr('state', 'in', 'off') | join(',', attribute='entity_id') }}
+                  '';
+                }
+              ];
+            };
+          }
+        ];
+        "script ui" = "!include scripts.yaml";
+        calendar = [
+          {
+            platform = "caldav";
+            username = "jalr@jalr.de";
+            password = "!secret radicale";
+            url = "https://cal.jalr.de/radicale";
+          }
+        ];
+        mqtt = { };
+        media_player = [
+          {
+            platform = "mpd";
+            name = "mpd@iron";
+            host = "127.0.0.1";
+          }
+        ];
+      };
+    };
+
+    mosquitto = {
+      enable = true;
+      persistence = true;
+      listeners = [
+        {
+          port = ports.mqtt.tcp;
+          users = {
+            valetudo = {
+              passwordFile = config.sops.secrets."mqtt-users/valetudo".path;
+              acl = [
+                "readwrite homeassistant/+/donald/#"
+                "readwrite valetudo/donald/#"
+              ];
+            };
+            home-assistant = {
+              passwordFile = config.sops.secrets."mqtt-users/home-assistant".path;
+              acl = [ "readwrite #" ];
+            };
+          };
         }
       ];
     };
   };
 
-  services.nginx.virtualHosts."hass.jalr.de" = {
+  systemd.services = {
+    home-assistant.serviceConfig.ExecStartPre = [
+      (
+        pkgs.writeShellScript "home-assistant-secrets" ''
+          ln -sf "${config.sops.secrets.home-assistant.path}" "${config.services.home-assistant.configDir}/secrets.yaml"
+        ''
+      )
+    ];
+    hass-vlc = {
+      script = ''
+        exec ${pkgs.vlc}/bin/cvlc \
+            --no-video \
+            -I telnet \
+            --telnet-password=vlc \
+            --sout='#transcode{acodec=s16le,channels=2,samplerate=48000}:std{access=file,mux=raw,dst=/run/snapserver/hass.fifo}' \
+            --aout=none
+      '';
+      wants = [ "snapserver.service" ];
+      after = [ "snapserver.service" ];
+      serviceConfig = {
+        BindPaths = [ "/run/snapserver/hass.fifo" ];
+        BindReadOnlyPaths = [ "/nix/store" "/etc/ssl/certs" "/etc/static/ssl/certs" "/bin/sh" ];
+        CapabilityBoundingSet = "";
+        DynamicUser = "true";
+        Group = "snapserver";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = lib.mkForce true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "noaccess";
+        ProtectSystem = "strict";
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        RootDirectory = "/run/hass-vlc";
+        RuntimeDirectory = "hass-vlc";
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" "~@privileged" ];
+      };
+      wantedBy = [ "multi-user.target" ];
+    };
+  };
+
+  systemd.tmpfiles.rules = [
+    "f ${config.services.home-assistant.configDir}/automations.yaml 0755 hass hass"
+    "f ${config.services.home-assistant.configDir}/scenes.yaml 0755 hass hass"
+  ];
+
+  services.nginx.virtualHosts."${domain}" = {
     enableACME = true;
     forceSSL = true;
     kTLS = true;

hosts/iron/services/jellyfin/default.nix

@@ -1,29 +1,54 @@
-args@{ lib, pkgs, custom-utils, ... }:
+{ config, lib, pkgs, ... }:
 let
-  ports = import ../ports.nix args;
+  inherit (config.networking) ports;
+  logoPng = pkgs.stdenvNoCC.mkDerivation {
+    name = "broflix.png";
+    src = ./broflix.svg;
+    dontBuild = true;
+    dontUnpack = true;
+    installPhase = ''
+      export PATH="$PATH:${pkgs.lib.makeBinPath [pkgs.imagemagick]}"
+      convert \
+        -background transparent \
+        $src \
+        -resize 1302x \
+        $out
+    '';
+  };
 in
 {
+  imports = [
+    ./rar2fs.nix
+  ];
+
   services.jellyfin = {
     enable = true;
   };
+
   systemd.services.jellyfin = {
     serviceConfig = {
       ###MemoryDenyWriteExecute = true;
       BindPaths = [
+        "/dev/dri/renderD128"
         "/var/cache/jellyfin"
         "/var/lib/jellyfin"
       ];
       BindReadOnlyPaths = [
-        "/nix/store"
+        "/etc/resolv.conf"
+        "/etc/ssl"
+        "/etc/static/ssl"
         "/filebitch/pub/Filme"
         "/filebitch/pub/Serien"
-        "/var/lib/qbittorrent/downloads"
+        "/nix/store"
+        "/run/opengl-driver"
+        "/var/lib/qBittorrent/downloads"
       ];
       CapabilityBoundingSet = "";
+      DeviceAllow = "/dev/dri/renderD128 rw";
       #IPAddressAllow = "localhost";
       #IPAddressDeny = "any";
       LockPersonality = true;
-      PrivateDevices = lib.mkForce true;
+      PrivateDevices = false;
       PrivateUsers = true;
       ProtectClock = true;
       ProtectControlGroups = true;
@@ -69,6 +94,15 @@ in
         proxy_set_header X-Forwarded-Host $http_host;
         proxy_buffering off;
       }
+      location = /web/broflix.svg {
+        alias ${./broflix.svg};
+      }
+      location = /web/assets/img/banner-light.png {
+        alias ${logoPng};
+      }
+      location = /web/assets/img/banner-dark.png {
+        alias ${logoPng};
+      }
       location = /web/ {
         proxy_pass http://127.0.0.1:${toString ports.jellyfin.tcp}/web/index.html;
         proxy_set_header Host $host;

hosts/iron/services/jellyfin/rar2fs.nix

@@ -0,0 +1,62 @@
+{ lib, pkgs, ... }:
+
+let
+  rar2fs = pkgs.rar2fs.override { unrar = pkgs.unrar_6; };
+  rar2fs_mounts = pkgs.writeScriptBin "rar2fs_mounts" (lib.strings.concatLines [
+    "#!${pkgs.python3}/bin/python"
+    (builtins.readFile ./rar2fs_mounts.py)
+  ]);
+  rar_path = "/var/lib/qBittorrent/downloads";
+  mount_path = "/run/jellyfin/rar2fs";
+in
+{
+  programs.fuse = {
+    userAllowOther = true;
+    mountMax = 1000;
+  };
+
+  environment.systemPackages = [
+    rar2fs
+  ];
+
+  systemd.services.jellyfin-rar2fs = {
+    after = [ "jellyfin.service" ];
+    wantedBy = [ "multi-user.target" ];
+    path = [ rar2fs "/run/wrappers/bin" ];
+    environment.USER = "jellyfin";
+    serviceConfig = {
+      AmbientCapabilities = "CAP_SYS_ADMIN CAP_SETUID CAP_SETGID";
+      CapabilityBoundingSet = "CAP_SYS_ADMIN CAP_SETUID CAP_SETGID";
+      DeviceAllow = "/dev/fuse rw";
+      ExecStart = "${rar2fs_mounts}/bin/rar2fs_mounts ${rar_path} ${mount_path}";
+      Group = "jellyfin";
+      IPAddressDeny = "any";
+      LockPersonality = true;
+      NoNewPrivileges = "no";
+      PrivateDevices = false;
+      PrivateMounts = false;
+      PrivateTmp = false;
+      PrivateUsers = false;
+      ProtectClock = true;
+      ProtectControlGroups = false; # implies MountAPIVFS
+      ProtectHome = false;
+      ProtectHostname = true;
+      ProtectKernelLogs = false;
+      ProtectKernelModules = false;
+      ProtectKernelTunables = false; # implies MountAPIVFS
+      #ProtectProc = "noaccess"; # implies MountAPIVFS
+      ProtectSystem = false;
+      RestrictAddressFamilies = "none";
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "@mount"
+        "@setuid"
+        "umount2"
+      ];
+      User = "jellyfin";
+    };
+  };
+}

hosts/iron/services/jellyfin/rar2fs_mounts.py

@@ -0,0 +1,112 @@
+from pathlib import Path
+import argparse
+import errno
+import os
+import signal
+import subprocess
+import sys
+import time
+
+
+mounts = {}
+
+
+class RarMount:
+    process = None
+
+    @property
+    def mountpoint(self):
+        result = self.mount_root / self.rar_file.relative_to(self.rar_root).parent
+        return result
+
+    def __init__(self, mount_root: str, rar_file: Path, rar_root: Path):
+        self.mount_root = mount_root
+        self.rar_file = rar_file
+        self.rar_root = rar_root
+
+        os.makedirs(self.mountpoint, exist_ok=True)
+
+        print(f"Mounting '{self.rar_file}' at '{self.mountpoint}'")
+        self.process = subprocess.Popen(
+            [
+                "rar2fs",
+                "-f",
+                "-o",
+                "auto_unmount",
+                "-o",
+                "allow_other",
+                "--no-inherit-perm",
+                self.rar_file,
+                self.mountpoint,
+            ]
+        )
+
+    def __del__(self):
+        if self.process:
+            self.process.terminate()
+            self.process.communicate()
+
+        for i in range(10):
+            try:
+                os.rmdir(self.mountpoint)
+            except FileNotFoundError:
+                pass
+            except OSError as ex:
+                # if ex.errno == errno.ENOEMPTY:
+                #    break
+                if ex.errno == errno.EBUSY:
+                    time.sleep(1)
+                raise
+            else:
+                break
+
+        for dir in self.mountpoint.relative_to(self.mount_root).parents:
+            try:
+                os.rmdir(self.mount_root.joinpath(dir))
+            except OSError as ex:
+                pass
+
+
+def signal_handler(sig, frame):
+    for rar_file, mount in mounts.items():
+        del mount
+
+    sys.exit(0)
+
+
+def parse_args():
+    parser = argparse.ArgumentParser(
+        description="Recursively globs a path containing rar files and mounts them under a given mount path."
+    )
+
+    parser.add_argument("rar_path", type=Path, help="Path to the RAR directory")
+
+    parser.add_argument("mount_path", type=Path, help="Path to the mount directory")
+
+    return parser.parse_args()
+
+
+def main():
+    args = parse_args()
+
+    if not args.rar_path.is_dir():
+        parser.error(f"RAR path '{args.rar_path}' is not a valid directory.")
+
+    signal.signal(signal.SIGINT, signal_handler)
+
+    for rar_file in args.rar_path.rglob("*.rar"):
+        if rar_file in mounts:
+            continue
+        if len(rar_file.parts) >= 2 and rar_file.parts[-2].lower() in ["subs", "proof"]:
+            continue
+
+        mounts[rar_file] = RarMount(args.mount_path, rar_file, args.rar_path)
+
+    while True:
+        time.sleep(600)
+
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

hosts/iron/services/mail.nix

@@ -1,17 +1,10 @@
-args@{ config, pkgs, custom-utils, ... }:
+{ config, ... }:
 
 let
-  ports = import ../ports.nix args;
+  inherit (config.networking) ports;
 in
 {
-  sops.secrets.hetzner-api-key = {
-    sopsFile = ../secrets.yaml;
-    owner = "acme";
-  };
-  #sops.secrets."domain_key_jalr.de" = {
-  #  sopsFile = ../secrets.yaml;
-  #  owner = "rspamd";
-  #};
+  #sops.secrets."domain_key_jalr.de".owner = "rspamd";
   jalr = {
     mailserver = {
       enable = true;
@@ -31,13 +24,18 @@ in
       messageSizeLimit = 50 * 1024 * 1024;
     };
   };
-  services.postfix.config = {
-    smtp_bind_address = "159.69.103.126";
-    smtp_bind_address_enforce = true;
+  services.postfix = {
+    config = {
+      smtp_bind_address = "159.69.103.126";
+      smtp_bind_address_enforce = true;
+    };
+    masterConfig.smtp.args = [
+      "-o"
+      "inet_protocols=ipv4"
+    ];
   };
-
-  security.acme.certs."hha.jalr.de" = {
-    dnsProvider = "hetzner";
-    credentialsFile = pkgs.writeText "certbotCredentialsFile" "HETZNER_API_KEY_FILE=${config.sops.secrets.hetzner-api-key.path}";
+  services.nginx.virtualHosts."hha.jalr.de" = {
+    enableACME = true;
+    forceSSL = true;
   };
 }

hosts/iron/services/matrix.nix

@@ -1,15 +1,12 @@
-args@{ config, pkgs, custom-utils, ... }:
+{ config, pkgs, ... }:
 
 let
-  ports = import ../ports.nix args;
+  inherit (config.networking) ports;
+  signalPhoneNumber = "+4915566437153";
+  signalUser = "jalr";
 in
 {
-  sops.secrets = {
-    synapse-turn-shared-secret = {
-      owner = "matrix-synapse";
-      sopsFile = ../secrets.yaml;
-    };
-  };
+  sops.secrets.synapse-turn-shared-secret.owner = "matrix-synapse";
   jalr.matrix = {
     enable = true;
     fqdn = "matrix.jalr.de";
@@ -19,17 +16,6 @@ in
       host = "turn.jalr.de";
       sharedSecretFile = config.sops.secrets.synapse-turn-shared-secret.path;
     };
-    mautrix-whatsapp = {
-      enable = true;
-      port = ports.mautrix-whatsapp.tcp;
-      settings.bridge.permissions = {
-        # Only one user since using the name from the address book does not
-        # work with multiple users
-        #"@jalr:jalr.de" = 100;
-        "@jalr:jalr.de" = "admin";
-        "jalr.de" = "user";
-      };
-    };
     mautrix-signal = {
       enable = true;
       port = ports.mautrix-signal.tcp;
@@ -43,4 +29,27 @@ in
       };
     };
   };
+
+  systemd.services.signal-cli-receive = {
+    description = "Run signal-cli to receive messages";
+    serviceConfig = {
+      Type = "oneshot";
+      User = signalUser;
+      CapabilityBoundingSet = null;
+      RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+      RestrictNamespaces = true;
+      SystemCallFilter = "@system-service";
+    };
+    script = "${pkgs.signal-cli}/bin/signal-cli -u ${signalPhoneNumber} receive";
+  };
+  systemd.timers.signal-cli-receive = {
+    description = "Run signal-cli to receive messages";
+    after = [ "network.target" ];
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      Persistent = true;
+      OnCalendar = "*-*-* *:00:00";
+      Unit = config.systemd.services.signal-cli-receive.name;
+    };
+  };
 }

hosts/iron/services/navidrome.nix

@@ -1,12 +1,13 @@
-args@{ config, lib, pkgs, utils, custom-utils, ... }:
+{ config, lib, pkgs, ... }:
 
 let
-  ports = import ../ports.nix args;
+  inherit (config.networking) ports;
   settings = {
     # https://www.navidrome.org/docs/usage/configuration-options/#available-options
     Address = "127.0.0.1";
     Port = ports.navidrome.tcp;
     DevActivityPanel = false;
+    MusicFolder = "/var/lib/navidrome/music";
   };
   passwordEncryptionKeyFile = config.sops.secrets.navidrome-password-encryption-key.path;
   configFile = (pkgs.formats.json { }).generate "navidrome.json" settings;
@@ -17,21 +18,18 @@ let
     if [ -e "''$password_encryption_key_file" ]; then
       export ND_PASSWORDENCRYPTIONKEY="$(cat "''$password_encryption_key_file")"
     fi
-    exec ${pkgs.navidrome}/bin/navidrome --configfile ${configFile}
+    exec ${config.services.navidrome.package}/bin/navidrome --configfile ${configFile}
   '';
 in
 {
   services.navidrome.enable = true;
   systemd.services.navidrome = {
     serviceConfig = {
-      ExecStart = lib.mkForce "${utils.systemdUtils.lib.makeJobScript "navidrome-start" script} %d";
+      ExecStart = lib.mkForce "${pkgs.writeShellScript "navidrome-start" script} %d";
     } // lib.attrsets.optionalAttrs (passwordEncryptionKeyFile != null) {
       LoadCredential = "PasswordEncryptionKey:${passwordEncryptionKeyFile}";
     };
   };
-  sops.secrets.navidrome-password-encryption-key = {
-    sopsFile = ../secrets.yaml;
-  };
   services.nginx.virtualHosts."navidrome.jalr.de" = {
     enableACME = true;
     forceSSL = true;

hosts/iron/services/nginx.nix

@@ -1,7 +1,7 @@
-args@{ pkgs, custom-utils, ... }:
+{ config, ... }:
 
 let
-  ports = import ../ports.nix args;
+  inherit (config.networking) ports;
 in
 {
   services.nginx = {