Add nvf persistence

Signed-off-by: Nikolaos Karaolidis <nick@karaolidis.com>

.gitattributes

@@ -1,2 +0,0 @@
-**/wallpapers/*.jpg filter=lfs diff=lfs merge=lfs -text
-**/wallpapers/*.png filter=lfs diff=lfs merge=lfs -text

.gitignore

@@ -0,0 +1,7 @@
+# ---> Nix
+# Ignore build outputs from performing a nix-build or `nix build` command
+result
+result-*
+
+# Ignore automatically generated direnv output
+.direnv

.gitlab-ci.yml

@@ -1,27 +0,0 @@
-stages:
-  - build
-  - test
-
-variables:
-  GIT_SUBMODULE_STRATEGY: recursive
-
-cache: &global_cache
-  key:
-    files:
-      - flake.lock
-      - flake.nix
-  paths:
-    - /nix/store
-  policy: pull-push
-
-build:
-  image: nixos/nix
-  stage: build
-  timeout: 48h
-  cache:
-    <<: *global_cache
-  script:
-    - nix --experimental-features 'nix-command flakes' flake check --show-trace
-
-include:
-  - template: Jobs/Secret-Detection.gitlab-ci.yml

.gitmodules

@@ -1,9 +1,9 @@
-[submodule "submodules/nixpkgs"]
-	path = submodules/nixpkgs
-	url = git@github.com:karaolidis/nixpkgs.git
-	branch = integration
-
-[submodule "submodules/home-manager"]
-	path = submodules/home-manager
-	url = git@github.com:karaolidis/home-manager.git
-	branch = integration
+[submodule "secrets"]
+	path = submodules/secrets
+	url = git@karaolidis.com:karaolidis/nix-secrets.git
+[submodule "sas"]
+	path = submodules/sas
+	url = git@karaolidis.com:karaolidis/nix-sas.git
+[submodule "lib"]
+	path = submodules/lib
+	url = git@karaolidis.com:karaolidis/nix-lib.git

README.md

@@ -16,16 +16,15 @@ NixOS dotfiles and configuration for various hosts and users.
         - [`gui/`](./hosts/common/configs/user/gui): GUI-related settings.
   - `<name>/`: Individual host configurations.
 
-- `secrets/<namespace>/`: Global secrets for individual namespaces that apply across all hosts.
+- [`overlays/`](./overlays/): Custom patches.
 
-- [`lib/`](./lib): Nix library function definitions and utilities.
-  - [`scripts/`](./lib/scripts): Utility scripts for managing the repository.
-    - [`add-host.sh`](./lib/scripts/add-host.sh): Instantiate the keys for a new host configuration.
-    - [`remove-host.sh`](./lib/scripts/remove-host.sh): Remove references to a host.
-    - [`update-keys.sh`](./lib/scripts/update-keys.sh): Update the encryption keys in all relevant files using `sops.yaml` configurations.
-    - [`update.sh`](./lib/scripts/update.sh): Update flake and all git submodules.
+- [`packages/`](./packages/): Custom packages.
 
-- [`submodules/`](./submodules): Flake forks used in the repository, such as [`nixpkgs`](https://github.com/NixOS/nixpkgs) and [`home-manager`](https://github.com/nix-community/home-manager).
+- [`scripts/`](./lib/scripts): Utility scripts for managing the repository.
+  - [`add-host.sh`](./lib/scripts/add-host.sh): Instantiate the keys for a new host configuration.
+  - [`remove-host.sh`](./lib/scripts/remove-host.sh): Remove references to a host.
+  - [`update-keys.sh`](./lib/scripts/update-keys.sh): Update the encryption keys in all relevant files using `sops.yaml` configurations.
+  - [`update.sh`](./lib/scripts/update.sh): Update flake and all packages.
 
 Any `options.nix` files create custom option definitions when present.
 
@@ -33,8 +32,10 @@ Any `options.nix` files create custom option definitions when present.
 
 Below is a table of all hosts, with links to their respective README files, which may provide further details and/or post-installation checklists.
 
-| Host        | README                                                   |
-|-------------|----------------------------------------------------------|
-| `installer` | [hosts/installer/README.md](./hosts/installer/README.md) |
-| `eirene`    | [hosts/eirene/README.md](./hosts/eirene/README.md)       |
-| `elara`     | [hosts/elara/README.md](./hosts/elara/README.md)         |
+| Host          | README                                                       |
+| ------------- | ------------------------------------------------------------ |
+| `installer`   | [hosts/installer/README.md](./hosts/installer/README.md)     |
+| `himalia`     | [hosts/himalia/README.md](./hosts/himalia/README.md)         |
+| `elara`       | [hosts/elara/README.md](./hosts/elara/README.md)             |
+| `jupiter`     | [hosts/jupiter/README.md](./hosts/jupiter/README.md)         |
+| `jupiter-vps` | [hosts/jupiter-vps/README.md](./hosts/jupiter-vps/README.md) |

flake.lock

@@ -10,11 +10,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1736090999,
-        "narHash": "sha256-B5CJuHqfJrzPa7tObK0H9669/EClSHpa/P7B9EuvElU=",
+        "lastModified": 1754932414,
+        "narHash": "sha256-V8c+68Axn5AGDCaG9Zv+EqNU4D6xWPHNXLIapq6AGiM=",
         "owner": "aylur",
         "repo": "ags",
-        "rev": "5527c3c07d92c11e04e7fd99d58429493dba7e3c",
+        "rev": "9e6912b51d7bc58f35d10b11be1a126b926b56d3",
         "type": "github"
       },
       "original": {
@@ -30,11 +30,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1736497508,
-        "narHash": "sha256-murrCQMYKtZ8rkZ5O726ZCsCDee1l3ZdmV8yC9gRaIc=",
+        "lastModified": 1754893912,
+        "narHash": "sha256-kzU/3A4k+d3PsgMLohzSh4KJybTqvzqibUVqV2yXCGY=",
         "owner": "aylur",
         "repo": "astal",
-        "rev": "ef4f95608481414053ecdbe4de29bd86fb452813",
+        "rev": "5d4eef66392b0dff99a63a4f39ff886624bd69dd",
         "type": "github"
       },
       "original": {
@@ -43,6 +43,21 @@
         "type": "github"
       }
     },
+    "crane": {
+      "locked": {
+        "lastModified": 1754269165,
+        "narHash": "sha256-0tcS8FHd4QjbCVoxN9jI+PjHgA4vc/IjkUSp+N3zy0U=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "444e81206df3f7d92780680e45858e31d2f07a08",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
     "disko": {
       "inputs": {
         "nixpkgs": [
@@ -50,48 +65,67 @@
         ]
       },
       "locked": {
-        "lastModified": 1736437680,
-        "narHash": "sha256-9Sy17XguKdEU9M5peTrkWSlI/O5IAqjHzdzxbXnc30g=",
+        "lastModified": 1746728054,
+        "narHash": "sha256-eDoSOhxGEm2PykZFa/x9QG5eTH0MJdiJ9aR00VAofXE=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "4d5d07d37ff773338e40a92088f45f4f88e509c8",
+        "rev": "ff442f5d1425feb86344c028298548024f21256d",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
+        "ref": "latest",
         "repo": "disko",
         "type": "github"
       }
     },
     "flake-compat": {
-      "flake": false,
       "locked": {
         "lastModified": 1733328505,
         "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
         "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "revCount": 69,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.1.0/01948eb7-9cba-704f-bbf3-3fa956735b52/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz"
+      }
+    },
+    "flake-input-patcher": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": [
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1751871600,
+        "narHash": "sha256-I4/2ekJrbRMhOpKfzgnlrN45nQj9YQmZnoSeAaRa1SU=",
+        "owner": "jfly",
+        "repo": "flake-input-patcher",
+        "rev": "4ff068126d49829b106280738944bde91951d59d",
         "type": "github"
       },
       "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
+        "owner": "jfly",
+        "repo": "flake-input-patcher",
         "type": "github"
       }
     },
     "flake-parts": {
       "inputs": {
-        "nixpkgs-lib": [
-          "nur",
-          "nixpkgs"
-        ]
+        "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1733312601,
-        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
+        "lastModified": 1754487366,
+        "narHash": "sha256-pHYj8gUBapuUzKV/kN/tR3Zvqc7o6gdFB9XKXIp1SQ8=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
+        "rev": "af66ad14b28a127c5c0f3bbb298218fc63528a18",
         "type": "github"
       },
       "original": {
@@ -120,6 +154,28 @@
         "type": "github"
       }
     },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "pre-commit-hooks-nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -127,50 +183,156 @@
         ]
       },
       "locked": {
-        "lastModified": 1736504054,
-        "narHash": "sha256-Mb0aIdOIg5ge0Lju1zogdAcfklRciR8G0NY6R423oek=",
-        "owner": "karaolidis",
+        "lastModified": 1755442500,
+        "narHash": "sha256-RHK4H6SWzkAtW/5WBHsyugaXJX25yr5y7FAZznxcBJs=",
+        "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "baa0e7a14088ff1ed891afe4c6457faf40aa30a6",
+        "rev": "d2ffdedfc39c591367b1ddf22b4ce107f029dcc3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "lanzaboote": {
+      "inputs": {
+        "crane": "crane",
+        "flake-compat": [
+          "flake-compat"
+        ],
+        "flake-parts": [
+          "flake-parts"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pre-commit-hooks-nix": "pre-commit-hooks-nix",
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1754297745,
+        "narHash": "sha256-aD6/scLN3L4ZszmNbhhd3JQ9Pzv1ScYFphz14wHinfs=",
+        "owner": "nix-community",
+        "repo": "lanzaboote",
+        "rev": "892cbdca865d6b42f9c0d222fe309f7720259855",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "lanzaboote",
+        "type": "github"
+      }
+    },
+    "lib": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "treefmt-nix": [
+          "treefmt-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1755506074,
+        "narHash": "sha256-SztuKbAPppW5grMJLSGO5rBCXEWCOfhb39cPDONEUfo=",
+        "ref": "refs/heads/main",
+        "rev": "ac85b6f608ed88d424621ec30f3848d621383487",
+        "revCount": 6,
+        "type": "git",
+        "url": "https://git.karaolidis.com/karaolidis/nix-lib.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.karaolidis.com/karaolidis/nix-lib.git"
+      }
+    },
+    "mnw": {
+      "locked": {
+        "lastModified": 1748710831,
+        "narHash": "sha256-eZu2yH3Y2eA9DD3naKWy/sTxYS5rPK2hO7vj8tvUCSU=",
+        "owner": "Gerg-L",
+        "repo": "mnw",
+        "rev": "cff958a4e050f8d917a6ff3a5624bc4681c6187d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Gerg-L",
+        "repo": "mnw",
+        "type": "github"
+      }
+    },
+    "nixos-wsl": {
+      "inputs": {
+        "flake-compat": [
+          "flake-compat"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1755774185,
+        "narHash": "sha256-XjKqiTA19mkoBkja0VOy90qp2gC1f2fGgsLb9m1lg5Q=",
+        "owner": "karaolidis",
+        "repo": "NixOS-WSL",
+        "rev": "b1f426697f62006b99fac0cc25a106626c78f874",
         "type": "github"
       },
       "original": {
         "owner": "karaolidis",
-        "ref": "integration",
-        "repo": "home-manager",
+        "ref": "extra-files",
+        "repo": "NixOS-WSL",
         "type": "github"
       }
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1738059769,
-        "narHash": "sha256-SBOwc5HSi0zThWoj3EfYh673X1d1dc78N2qCtcJmIvo=",
-        "owner": "karaolidis",
+        "lastModified": 1755186698,
+        "narHash": "sha256-wNO3+Ks2jZJ4nTHMuks+cxAiVBGNuEBXsT29Bz6HASo=",
+        "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "befe9d27e7e7be485aae35d541f135c8471bd508",
+        "rev": "fbcf476f790d8a217c3eab4e12033dc4a0f6d23c",
         "type": "github"
       },
       "original": {
-        "owner": "karaolidis",
-        "ref": "integration",
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
+    "nixpkgs-lib": {
+      "locked": {
+        "lastModified": 1753579242,
+        "narHash": "sha256-zvaMGVn14/Zz8hnp4VWT9xVnhc8vuL3TStRqwk22biA=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "0f36c44e01a6129be94e3ade315a5883f0228a6e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
     "nur": {
       "inputs": {
-        "flake-parts": "flake-parts",
+        "flake-parts": [
+          "flake-parts"
+        ],
         "nixpkgs": [
           "nixpkgs"
-        ],
-        "treefmt-nix": "treefmt-nix"
+        ]
       },
       "locked": {
-        "lastModified": 1736500613,
-        "narHash": "sha256-OCEXlRyOIMzxrhmnzoX32e241A7+Z+zsuyR7i6AG608=",
+        "lastModified": 1755452770,
+        "narHash": "sha256-oc8xrqvVIoDxbfTlbkE1XQ7O88TgNZn5FOZKLiuIEmg=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "d51e847f68700c38f850a62c2b3e728864a38cde",
+        "rev": "eab62298402c7cdfdefda647a4046befa3a84051",
         "type": "github"
       },
       "original": {
@@ -179,18 +341,187 @@
         "type": "github"
       }
     },
+    "nvf": {
+      "inputs": {
+        "flake-compat": [
+          "flake-compat"
+        ],
+        "flake-parts": [
+          "flake-parts"
+        ],
+        "mnw": "mnw",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": [
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1755463179,
+        "narHash": "sha256-5Ggb1Mhf7ZlRgGi2puCa2PvWs6KbMnWBlW6KW7Vf79Y=",
+        "owner": "NotAShelf",
+        "repo": "nvf",
+        "rev": "03833118267ad32226b014b360692bdce9d6e082",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NotAShelf",
+        "repo": "nvf",
+        "type": "github"
+      }
+    },
+    "nvidia-patch": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "utils": [
+          "flake-utils"
+        ]
+      },
+      "locked": {
+        "lastModified": 1755069017,
+        "narHash": "sha256-cTD5WfZRK2mwrSktlYcrk6DOEEkQbE1z78O16TF293c=",
+        "owner": "icewind1991",
+        "repo": "nvidia-patch-nixos",
+        "rev": "d187885c14bdd8520d40f527134d536168f8d92b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "icewind1991",
+        "repo": "nvidia-patch-nixos",
+        "type": "github"
+      }
+    },
+    "pre-commit-hooks-nix": {
+      "inputs": {
+        "flake-compat": [
+          "lanzaboote",
+          "flake-compat"
+        ],
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1750779888,
+        "narHash": "sha256-wibppH3g/E2lxU43ZQHC5yA/7kIKLGxVEnsnVK1BtRg=",
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "rev": "16ec914f6fb6f599ce988427d9d94efddf25fe6d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "type": "github"
+      }
+    },
+    "quadlet-nix": {
+      "locked": {
+        "lastModified": 1754008153,
+        "narHash": "sha256-MYT1mDtSkiVg343agxgBFsnuNU3xS8vRy399JXX1Vw0=",
+        "owner": "SEIAROTg",
+        "repo": "quadlet-nix",
+        "rev": "1b2d27d460d8c7e4da5ba44ede463b427160b5c4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "SEIAROTg",
+        "repo": "quadlet-nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "ags": "ags",
         "astal": "astal",
         "disko": "disko",
+        "flake-compat": "flake-compat",
+        "flake-input-patcher": "flake-input-patcher",
+        "flake-parts": "flake-parts",
         "flake-utils": "flake-utils",
         "home-manager": "home-manager",
+        "lanzaboote": "lanzaboote",
+        "lib": "lib",
+        "nixos-wsl": "nixos-wsl",
         "nixpkgs": "nixpkgs",
         "nur": "nur",
+        "nvf": "nvf",
+        "nvidia-patch": "nvidia-patch",
+        "quadlet-nix": "quadlet-nix",
+        "sas": "sas",
+        "secrets": "secrets",
         "sops-nix": "sops-nix",
         "spicetify-nix": "spicetify-nix",
-        "systems": "systems"
+        "systems": "systems",
+        "treefmt-nix": "treefmt-nix"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1754189623,
+        "narHash": "sha256-fstu5eb30UYwsxow0aQqkzxNxGn80UZjyehQVNVHuBk=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "c582ff7f0d8a7ea689ae836dfb1773f1814f472a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "sas": {
+      "inputs": {
+        "lib": [
+          "lib"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "treefmt-nix": [
+          "treefmt-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1755506147,
+        "narHash": "sha256-B4e60+9j1cMEhAjpvgcNSSJbzPe2CUpAo2av15xd/0M=",
+        "ref": "refs/heads/main",
+        "rev": "ebe2f986fc82df849d879f5b0af403c78ead2002",
+        "revCount": 10,
+        "type": "git",
+        "url": "ssh://git@karaolidis.com/karaolidis/nix-sas.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://git@karaolidis.com/karaolidis/nix-sas.git"
+      }
+    },
+    "secrets": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1755454846,
+        "narHash": "sha256-tbI+AcQGvtucMKKr+VHM53ZI6upPBjD9kR5PCyF4K60=",
+        "ref": "refs/heads/main",
+        "rev": "c1a835c4f9ba9915671c79b3241f4d4863f11323",
+        "revCount": 33,
+        "type": "git",
+        "url": "ssh://git@karaolidis.com/karaolidis/nix-secrets.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://git@karaolidis.com/karaolidis/nix-secrets.git"
       }
     },
     "sops-nix": {
@@ -200,11 +531,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1736203741,
-        "narHash": "sha256-eSjkBwBdQk+TZWFlLbclF2rAh4JxbGg8az4w/Lfe7f4=",
+        "lastModified": 1754988908,
+        "narHash": "sha256-t+voe2961vCgrzPFtZxha0/kmFSHFobzF00sT8p9h0U=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "c9c88f08e3ee495e888b8d7c8624a0b2519cb773",
+        "rev": "3223c7a92724b5d804e9988c6b447a0d09017d48",
         "type": "github"
       },
       "original": {
@@ -215,7 +546,6 @@
     },
     "spicetify-nix": {
       "inputs": {
-        "flake-compat": "flake-compat",
         "nixpkgs": [
           "nixpkgs"
         ],
@@ -224,11 +554,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1736482561,
-        "narHash": "sha256-f4hvN4MF26NIYeFA/H1sVW6KU5X9/jy9l95WrMsNUIU=",
+        "lastModified": 1755405549,
+        "narHash": "sha256-0vJD6WhL1jfXbnpH6r8yr1RgzB8mGFWIWokKHaJMJ/4=",
         "owner": "Gerg-L",
         "repo": "spicetify-nix",
-        "rev": "77fb1ae39e0f5c60a7d0bd6ce078b9c56e3356cb",
+        "rev": "df1f5d4c0633040937358755defff9f07e9c0a73",
         "type": "github"
       },
       "original": {
@@ -248,7 +578,6 @@
       },
       "original": {
         "owner": "nix-systems",
-        "ref": "main",
         "repo": "default",
         "type": "github"
       }
@@ -256,16 +585,15 @@
     "treefmt-nix": {
       "inputs": {
         "nixpkgs": [
-          "nur",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1733222881,
-        "narHash": "sha256-JIPcz1PrpXUCbaccEnrcUS8jjEb/1vJbZz5KkobyFdM=",
+        "lastModified": 1754847726,
+        "narHash": "sha256-2vX8QjO5lRsDbNYvN9hVHXLU6oMl+V/PsmIiJREG4rE=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "49717b5af6f80172275d47a418c9719a31a78b53",
+        "rev": "7d81f6fb2e19bf84f1c65135d1060d829fae2408",
         "type": "github"
       },
       "original": {

flake.nix

@@ -1,61 +1,109 @@
 {
   inputs = {
-    nixpkgs = {
-      # --- Official
-      # type = "github";
-      # owner = "NixOS";
-      # repo = "nixpkgs";
-      # ref = "master";
-      # --- Fork
-      type = "github";
-      owner = "karaolidis";
-      repo = "nixpkgs";
-      ref = "integration";
-      # --- Local
-      # url = "git+file:./submodules/nixpkgs";
-    };
+    # Configuration
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
 
     home-manager = {
-      # --- Official
-      # type = "github";
-      # owner = "nix-community"
-      # repo = "home-manager";
-      # --- Fork
-      type = "github";
-      owner = "karaolidis";
-      repo = "home-manager";
-      ref = "integration";
-      # --- Local
-      # url = "git+file:./submodules/home-manager";
-
+      url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    disko = {
-      url = "github:nix-community/disko";
-      inputs.nixpkgs.follows = "nixpkgs";
+    # Packages
+    nur = {
+      url = "github:nix-community/NUR";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        flake-parts.follows = "flake-parts";
+      };
     };
 
+    # DevOps
     sops-nix = {
       url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    systems = {
-      type = "github";
-      owner = "nix-systems";
-      repo = "default";
-      ref = "main";
-    };
-
-    nur = {
-      url = "github:nix-community/NUR";
+    treefmt-nix = {
+      url = "github:numtide/treefmt-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    flake-utils = {
-      url = "github:numtide/flake-utils";
-      inputs.systems.follows = "systems";
+    flake-input-patcher = {
+      url = "github:jfly/flake-input-patcher";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        systems.follows = "systems";
+      };
+    };
+
+    # Personal
+    lib = {
+      # FIXME: https://github.com/NixOS/nix/issues/12281
+      url = "git+https://git.karaolidis.com/karaolidis/nix-lib.git";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        treefmt-nix.follows = "treefmt-nix";
+      };
+    };
+
+    sas = {
+      # FIXME: https://github.com/NixOS/nix/issues/12281
+      url = "git+ssh://git@karaolidis.com/karaolidis/nix-sas.git";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        lib.follows = "lib";
+        treefmt-nix.follows = "treefmt-nix";
+      };
+    };
+
+    secrets = {
+      # FIXME: https://github.com/NixOS/nix/issues/12281
+      url = "git+ssh://git@karaolidis.com/karaolidis/nix-secrets.git";
+      flake = false;
+    };
+
+    # Hardware
+    disko = {
+      url = "github:nix-community/disko/latest";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    lanzaboote = {
+      url = "github:nix-community/lanzaboote";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        flake-compat.follows = "flake-compat";
+        flake-parts.follows = "flake-parts";
+      };
+    };
+
+    nixos-wsl = {
+      url = "github:karaolidis/NixOS-WSL/extra-files";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        flake-compat.follows = "flake-compat";
+      };
+    };
+
+    # Applications
+    nvf = {
+      url = "github:NotAShelf/nvf";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        flake-compat.follows = "flake-compat";
+        flake-parts.follows = "flake-parts";
+        systems.follows = "systems";
+      };
+    };
+
+    quadlet-nix.url = "github:SEIAROTg/quadlet-nix";
+
+    nvidia-patch = {
+      url = "github:icewind1991/nvidia-patch-nixos";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        utils.follows = "flake-utils";
+      };
     };
 
     astal = {
@@ -78,49 +126,70 @@
         systems.follows = "systems";
       };
     };
+
+    # Transitive Dependencies
+    systems.url = "github:nix-systems/default";
+
+    flake-parts.url = "github:hercules-ci/flake-parts";
+
+    flake-utils = {
+      url = "github:numtide/flake-utils";
+      inputs.systems.follows = "systems";
+    };
+
+    flake-compat.url = "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz";
   };
 
   outputs =
-    { self, nixpkgs, ... }@inputs:
+    unpatchedInputs:
+    let
+      patchInputs =
+        system:
+        let
+          patcher = unpatchedInputs.flake-input-patcher.lib.${system};
+          patches = import ./patches.nix { inherit patcher; };
+        in
+        if patches != { } then patcher.patch unpatchedInputs patches else unpatchedInputs;
+
+      mkNixosConfiguration =
+        inputs: system: modules:
+        inputs.nixpkgs.lib.nixosSystem {
+          inherit system modules;
+          specialArgs = { inherit inputs system; };
+        };
+    in
     {
-      nixosConfigurations = {
-        installer = nixpkgs.lib.nixosSystem rec {
-          system = "x86_64-linux";
-          modules = [ ./hosts/installer ];
-          specialArgs = { inherit inputs system; };
-        };
-
-        eirene = nixpkgs.lib.nixosSystem rec {
-          system = "x86_64-linux";
-          modules = [ ./hosts/eirene ];
-          specialArgs = { inherit inputs system; };
-        };
-
-        elara = nixpkgs.lib.nixosSystem rec {
-          system = "x86_64-linux";
-          modules = [ ./hosts/elara ];
-          specialArgs = { inherit inputs system; };
-        };
-      };
+      overlays.default = import ./overlays;
     }
-    // inputs.flake-utils.lib.eachDefaultSystem (
-      system:
+    // (
       let
-        pkgs = nixpkgs.legacyPackages.${system};
+        system = "x86_64-linux";
+        inputs = patchInputs system;
+
+        pkgs = import inputs.nixpkgs {
+          inherit system;
+          config.allowUnfree = true;
+          overlays = [
+            inputs.lib.overlays.default
+            inputs.self.overlays.default
+          ];
+        };
+
+        treefmt = inputs.treefmt-nix.lib.evalModule pkgs ./treefmt.nix;
       in
       {
-        devShells = {
-          bun = import ./hosts/common/shells/bun { inherit pkgs; };
-          c = import ./hosts/common/shells/c { inherit pkgs; };
-          go = import ./hosts/common/shells/go { inherit pkgs; };
-          java = import ./hosts/common/shells/java { inherit pkgs; };
-          nix = import ./hosts/common/shells/nix { inherit pkgs; };
-          nodejs = import ./hosts/common/shells/nodejs { inherit pkgs; };
-          python = import ./hosts/common/shells/python { inherit pkgs; };
+        nixosConfigurations = {
+          installer = mkNixosConfiguration inputs system [ ./hosts/installer ];
+          himalia = mkNixosConfiguration inputs system [ ./hosts/himalia ];
+          elara = mkNixosConfiguration inputs system [ ./hosts/elara ];
+          jupiter = mkNixosConfiguration inputs system [ ./hosts/jupiter ];
+          jupiter-vps = mkNixosConfiguration inputs system [ ./hosts/jupiter-vps ];
         };
 
-        formatter = pkgs.nixfmt-rfc-style;
+        devShells.${system} = import ./hosts/common/shells { inherit pkgs; };
+        packages.${system} = import ./packages { inherit pkgs; };
+        formatter.${system} = treefmt.config.build.wrapper;
+        checks.${system}.formatting = treefmt.config.build.check inputs.self;
       }
     );
-
 }

hosts/.gitignore

@@ -1,2 +1,2 @@
-*/secrets/ssh_host_ed25519_key
-*/secrets/.decrypted~*
+**/secrets/ssh_host_ed25519_key
+**/secrets/.decrypted~*

hosts/common/configs/system/backup/backup.completion.zsh

@@ -1,16 +0,0 @@
-_backup_completion() {
-  local options=(
-    '-m[Partition to mount for backup]:partition:($(_partitions))'
-    '-b[Backup directory]:backup directory:_files -/'
-  )
-  local curcontext="$curcontext" state line
-  typeset -A opt_args
-
-  _partitions() {
-    lsblk -rno NAME | sed 's/^/\/dev\//'
-  }
-
-  _arguments -s $options
-}
-
-compdef _backup_completion backup

hosts/common/configs/system/backup/backup.sh

@@ -1,64 +0,0 @@
-if [[ "$EUID" -ne 0 ]]; then
-  echo "Please run the script as root."
-  exit 1
-fi
-
-usage() {
-  echo "Usage: $0 [-m partition] [-b backup_location]"
-  exit 1
-}
-
-cleanup() {
-  if [ -d "/persist.bak" ]; then btrfs -q subvolume delete "/persist.bak"; fi
-  if [ -n "$backup_location" ]; then rm -f "$backup_location.tmp"; fi
-
-  if [ -n "$mount_location" ]; then
-    if mount | grep -q "$mount_location"; then umount "$mount_location"; fi
-    if [ -d "$mount_location" ]; then rmdir "$mount_location"; fi
-  fi
-}
-
-partition=""
-backup_location=""
-mount_location=""
-
-trap cleanup EXIT
-
-while getopts "m:b:" opt; do
-  case "$opt" in
-    m) partition="$OPTARG" ;;
-    b) backup_location="$OPTARG" ;;
-    *) usage ;;
-  esac
-done
-
-if [ -n "$partition" ]; then
-  mount_location=$(mktemp -d /mnt/backup.XXXXXX)
-  echo "Mounting $partition at $mount_location..."
-  mount "$partition" "$mount_location"
-fi
-
-if [ -z "$mount_location" ]; then
-  if [[ "$backup_location" != /* ]]; then
-    backup_location="$(realpath "$backup_location")"
-  fi
-else
-  if [[ "$backup_location" = /* ]]; then
-    echo "Error: When a partition is mounted, backup_location must be relative."
-    exit 1
-  fi
-
-  backup_location="$(realpath "$mount_location/$backup_location")"
-fi
-
-backup_location="$backup_location/$(hostname)-$(date +%Y-%m-%d-%H-%M-%S).btrfs.gz"
-
-echo "Creating /persist snapshot..."
-btrfs -q subvolume snapshot -r "/persist" "/persist.bak"
-
-echo "Creating backup at $backup_location..."
-btrfs -q send "/persist.bak" | gzip > "$backup_location.tmp"
-
-mv "$backup_location.tmp" "$backup_location"
-
-echo "Backup completed successfully!"

hosts/common/configs/system/backup/default.nix

@@ -1,20 +0,0 @@
-{ pkgs, ... }:
-{
-  environment.systemPackages = [
-    (pkgs.writeShellApplication {
-      name = "backup";
-      runtimeInputs = with pkgs; [
-        btrfs-progs
-        coreutils-full
-        util-linux
-      ];
-      text = builtins.readFile ./backup.sh;
-    })
-  ];
-
-  home-manager.sharedModules = [
-    {
-      programs.zsh.initExtra = builtins.readFile ./backup.completion.zsh;
-    }
-  ];
-}

hosts/common/configs/system/bluetooth/default.nix

@@ -8,15 +8,11 @@
     };
   };
 
-  environment.persistence."/persist"."/var/lib/bluetooth" = { };
+  environment.persistence."/persist/state"."/var/lib/bluetooth" = { };
 
   systemd.services.bluetooth.after = [
-    config.environment.persistence."/persist"."/var/lib/bluetooth".mount
+    config.environment.persistence."/persist/state"."/var/lib/bluetooth".mount
   ];
 
-  home-manager.sharedModules = [
-    {
-      services.mpris-proxy.enable = config.services.pipewire.enable;
-    }
-  ];
+  home-manager.sharedModules = [ { services.mpris-proxy.enable = config.services.pipewire.enable; } ];
 }

hosts/common/configs/system/boot/default.nix

@@ -10,11 +10,8 @@
       timeout = 1;
       efi.canTouchEfiVariables = true;
     };
+
     initrd.systemd.enable = true;
     kernelPackages = pkgs.linuxPackages_latest;
-    supportedFilesystems = [
-      "btrfs"
-      "ntfs"
-    ];
   };
 }

hosts/common/configs/system/btrbk/default.nix

@@ -0,0 +1,33 @@
+{ ... }:
+{
+  systemd.tmpfiles.rules = [
+    "d /persist/user.bak 0755 root root"
+    "d /persist/state.bak 0755 root root"
+  ];
+
+  services.btrbk = {
+    ioSchedulingClass = "idle";
+    niceness = 19;
+    instances = {
+      persist-user = {
+        onCalendar = "hourly";
+        settings.volume."/persist" = {
+          subvolume = "user";
+          snapshot_dir = "user.bak";
+          snapshot_preserve_min = "latest";
+          snapshot_preserve = "48h 14d 4w 6m";
+        };
+      };
+
+      persist-state = {
+        onCalendar = "daily";
+        settings.volume."/persist" = {
+          subvolume = "state";
+          snapshot_dir = "state.bak";
+          snapshot_preserve_min = "latest";
+          snapshot_preserve = "7d 4w 3m";
+        };
+      };
+    };
+  };
+}

hosts/common/configs/system/btrfs/default.nix

@@ -1,7 +1,14 @@
-{ ... }:
+{ pkgs, ... }:
 {
+  boot = {
+    initrd.supportedFilesystems = [ "btrfs" ];
+    supportedFilesystems = [ "btrfs" ];
+  };
+
   services.btrfs.autoScrub = {
     enable = true;
     interval = "weekly";
   };
+
+  environment.systemPackages = with pkgs; [ compsize ];
 }

hosts/common/configs/system/cloudflared/default.nix

@@ -1,5 +0,0 @@
-{ ... }:
-{
-  # https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/get-started/create-local-tunnel/
-  services.cloudflared.enable = true;
-}

hosts/common/configs/system/cpu/default.nix

@@ -1,4 +0,0 @@
-{ ... }:
-{
-  imports = [ ./options.nix ];
-}

hosts/common/configs/system/default.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  imports = [
+    ./cpu/options.nix
+    ./impermanence/options.nix
+  ];
+}

hosts/common/configs/system/docker/default.nix

@@ -1,29 +0,0 @@
-{ config, pkgs, ... }:
-{
-  virtualisation.docker = {
-    enable = true;
-    enableOnBoot = false;
-    storageDriver = "btrfs";
-
-    daemon.settings = {
-      experimental = true;
-      ipv6 = true;
-      fixed-cidr-v6 = "fd00::/80";
-    };
-
-    autoPrune = {
-      enable = true;
-      flags = [ "--all" ];
-    };
-  };
-
-  environment = {
-    persistence."/persist"."/var/lib/docker" = { };
-    systemPackages = with pkgs; [ docker-compose ];
-  };
-
-  systemd = {
-    services.docker.after = [ config.environment.persistence."/persist"."/var/lib/docker".mount ];
-    sockets.docker.after = [ config.environment.persistence."/persist"."/var/lib/docker".mount ];
-  };
-}

hosts/common/configs/system/documentation/default.nix

@@ -1,5 +1,10 @@
-{ ... }:
+{ pkgs, ... }:
 {
+  environment.systemPackages = with pkgs; [
+    man-pages
+    man-pages-posix
+  ];
+
   documentation = {
     enable = true;
 

hosts/common/configs/system/fail2ban/default.nix

@@ -0,0 +1,14 @@
+{ ... }:
+{
+  environment.persistence."/persist/state"."/var/lib/fail2ban" = { };
+
+  services.fail2ban = {
+    enable = true;
+    bantime = "24h";
+    bantime-increment = {
+      enable = true;
+      maxtime = "720h";
+      overalljails = true;
+    };
+  };
+}

hosts/common/configs/system/gpg-agent/default.nix

@@ -1,4 +0,0 @@
-{ ... }:
-{
-  programs.gnupg.agent.enable = true;
-}

hosts/common/configs/system/impermanence/default.nix

@@ -1,48 +1,16 @@
 { config, pkgs, ... }:
 {
-  imports = [ ./options.nix ];
-
-  boot.initrd.systemd = {
-    enable = true;
-
-    initrdBin = with pkgs; [
-      coreutils
-      util-linux
-      findutils
-      btrfs-progs
-    ];
-
-    services.impermanence = {
-      description = "Rollback BTRFS subvolumes to a pristine state";
-      wantedBy = [ "initrd.target" ];
-      before = [ "sysroot.mount" ];
-      after = [
-        "cryptsetup.target"
-        "local-fs-pre.target"
-      ];
-      unitConfig.DefaultDependencies = false;
-      serviceConfig.Type = "oneshot";
-      environment.DEVICE = config.environment.impermanence.device;
-      script = builtins.readFile ./scripts/wipe.sh;
-    };
-  };
-
   # uuidgen -r | tr -d -
   # https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/administration/systemd-state.section.md
   # https://github.com/NixOS/nixpkgs/pull/286140/files
   # https://git.eisfunke.com/config/nixos/-/blob/e65e1dc21d06d07b454005762b177ef151f8bfb6/nixos/machine-id.nix
-  sops.secrets."machineId".mode = "0444";
+  sops.secrets.machineId.mode = "0444";
 
   environment = {
-    etc."machine-id".source = pkgs.runCommandLocal "machine-id-link" { } ''
-      ln -s ${config.sops.secrets."machineId".path} $out
-    '';
+    impermanence.enable = true;
 
-    persistence."/persist" = {
-      "/etc/nixos" = { };
-      "/var/lib/nixos" = { };
-      "/var/lib/systemd" = { };
-      "/var/log" = { };
-    };
+    etc.machine-id.source = pkgs.runCommandLocal "machine-id-link" { } ''
+      ln -s ${config.sops.secrets.machineId.path} $out
+    '';
   };
 }

hosts/common/configs/system/impermanence/options.nix

@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  pkgs,
   utils,
   ...
 }:
@@ -47,12 +48,16 @@ in
     with lib;
     with types;
     {
-      impermanence.device = mkOption {
-        type = str;
-        default = config.disko.devices.disk.main.content.partitions.root.content.name;
-        description = ''
-          LUKS BTRFS partition to wipe on boot.
-        '';
+      impermanence = {
+        enable = mkEnableOption "Impermanence";
+
+        device = mkOption {
+          type = str;
+          default = config.disko.devices.disk.main.content.partitions.root.content.content.device;
+          description = ''
+            LUKS BTRFS partition to wipe on boot.
+          '';
+        };
       };
 
       persistence =
@@ -116,6 +121,19 @@ in
                         type = str;
                         readOnly = true;
                       };
+
+                      create = mkOption {
+                        type = enum [
+                          "none"
+                          "file"
+                          "directory"
+                        ];
+                        default = "none";
+                        description = ''
+                          Whether to create the file or directory
+                          in persistence if it does not exist.
+                        '';
+                      };
                     };
                   }
                 )
@@ -179,8 +197,31 @@ in
     let
       all = lib.lists.flatten (builtins.concatMap builtins.attrValues (builtins.attrValues cfg));
     in
-    {
-      fileSystems = builtins.mapAttrs (_: _: { neededForBoot = true; }) cfg;
+    lib.mkIf config.environment.impermanence.enable {
+      boot.initrd.systemd = {
+        enable = true;
+
+        initrdBin = with pkgs; [
+          coreutils
+          util-linux
+          findutils
+          btrfs-progs
+        ];
+
+        services.impermanence = {
+          description = "Rollback BTRFS subvolumes to a pristine state";
+          wantedBy = [ "initrd.target" ];
+          before = [ "sysroot.mount" ];
+          after = [
+            "cryptsetup.target"
+            "local-fs-pre.target"
+          ];
+          unitConfig.DefaultDependencies = false;
+          serviceConfig.Type = "oneshot";
+          environment.DEVICE = config.environment.impermanence.device;
+          script = builtins.readFile ./scripts/wipe.sh;
+        };
+      };
 
       systemd = {
         mounts = builtins.map (c: {
@@ -192,11 +233,11 @@ in
           unitConfig.ConditionPathExists = [ (lib.strings.escape [ " " ] c.source) ];
           what = c.source;
           where = c.target;
-          options = lib.strings.concatStringsSep "," ([
+          options = lib.strings.concatStringsSep "," [
             "bind"
             "X-fstrim.notrim"
             "x-gvfs-hide"
-          ]);
+          ];
         }) all;
 
         services = builtins.listToAttrs (
@@ -229,6 +270,7 @@ in
                 source=${lib.strings.escapeShellArg c._sourceRoot}
                 target=${lib.strings.escapeShellArg c._targetRoot}
                 path=${lib.strings.escapeShellArg c.path}
+                create=${lib.strings.escapeShellArg c.create}
 
                 ${builtins.readFile ./scripts/start.sh}
               '';
@@ -236,6 +278,7 @@ in
                 source=${lib.strings.escapeShellArg c._sourceRoot}
                 target=${lib.strings.escapeShellArg c._targetRoot}
                 path=${lib.strings.escapeShellArg c.path}
+                create=${lib.strings.escapeShellArg c.create}
 
                 ${builtins.readFile ./scripts/stop.sh}
               '';
@@ -244,6 +287,19 @@ in
         );
       };
 
+      fileSystems = builtins.mapAttrs (_: _: { neededForBoot = true; }) cfg // {
+        "/persist".neededForBoot = true;
+      };
+
+      environment.persistence = {
+        "/persist/user"."/etc/nixos" = { };
+        "/persist/state" = {
+          "/var/lib/nixos" = { };
+          "/var/lib/systemd" = { };
+          "/var/log" = { };
+        };
+      };
+
       assertions =
         let
           paths = builtins.map (c: c.path) all;

hosts/common/configs/system/impermanence/scripts/start.sh

@@ -1,19 +1,49 @@
-echo "Starting impermanence mount with source: $source, target: $target, path: $path."
+# shellcheck shell=bash
+
+# shellcheck disable=SC2154
+echo "Starting impermanence mount with source: $source, target: $target, path: $path, create: $create"
 
 source_current="$source"
 target_current="$target"
 
-IFS='/' read -ra path_parts <<< "$path"
-unset "path_parts[-1]"
+IFS='/' read -ra parts <<< "$path"
+leaf="${parts[-1]}"
 
-for part in "${path_parts[@]}"; do
-  source_current="$source_current/$part"
-  target_current="$target_current/$part"
+for part in "${parts[@]}"; do
+  source_current+="/$part"
+  target_current+="/$part"
 
-  if [[ ! -d "$source_current" ]]; then
+  if [[ -e "$source_current" ]]; then
+    read -r mode owner group <<< "$(stat -c '%a %u %g' "$source_current")"
+
+    if [[ -d "$source_current" ]]; then
+      install -d -m "$mode" -o "$owner" -g "$group" "$target_current"
+      continue
+    fi
+
+    if [[ "$part" != "$leaf" ]]; then
+      echo "Error: $source_current is not a directory, persistence for $path can not be applied."
+      exit 1
+    fi
+
+    install -m "$mode" -o "$owner" -g "$group" /dev/null "$target_current"
+  fi
+
+  if [[ "$create" == "none" ]]; then
     break
   fi
 
-  read -r mode owner group <<< "$(stat -c '%a %u %g' "$source_current")"
-  install -d -m "$mode" -o "$owner" -g "$group" "$target_current"
+  if [[ -e "$target_current" ]]; then
+    template="$target_current"
+  else
+    template="${source_current%/*}"
+  fi
+
+  read -r mode owner group <<< "$(stat -c '%a %u %g' "$template")"
+
+  if [[ "$part" == "$leaf" && "$create" == "file" ]]; then
+    install -m "$mode" -o "$owner" -g "$group" /dev/null "$source_current"
+  else
+    install -d -m "$mode" -o "$owner" -g "$group" "$source_current"
+  fi
 done

hosts/common/configs/system/impermanence/scripts/stop.sh

@@ -1,4 +1,7 @@
-echo "Stopping impermanence mount with source: $source, target: $target, path: $path."
+# shellcheck shell=bash
+
+# shellcheck disable=SC2154
+echo "Stopping impermanence mount with source: $source, target: $target, path: $path, create: $create"
 
 source_current="$source"
 target_current="$target"

hosts/common/configs/system/impermanence/scripts/wipe.sh

@@ -1,3 +1,5 @@
+# shellcheck shell=bash
+
 delete_subvolume_recursively() {
   IFS=$'\n'
   for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
@@ -6,21 +8,27 @@ delete_subvolume_recursively() {
   btrfs subvolume delete "$1"
 }
 
-if [[ -z "$DEVICE" ]]; then
-  echo "Error: DEVICE variable is not set."
-  exit 1
-fi
-
 mkdir -p /mnt/btrfs
-mount "/dev/mapper/$DEVICE" /mnt/btrfs
+mount "$DEVICE" /mnt/btrfs
 
 if [[ -e /mnt/btrfs/@ ]]; then
   mkdir -p /mnt/btrfs/@.bak
-  timestamp=$(date --date="@$(stat -c %Y /mnt/btrfs/@)" "+%Y-%m-%d_%H:%M:%S")
-  mv /mnt/btrfs/@ "/mnt/btrfs/@.bak/$timestamp"
+  timestamp=$(date --date="@$(stat -c %Y /mnt/btrfs/@)" "+%Y%m%dT%H%M")
+  base="@.$timestamp"
+
+  target="/mnt/btrfs/@.bak/$base"
+  if [[ -e "$target" ]]; then
+    i=1
+    while [[ -e "/mnt/btrfs/@.bak/${base}_$i" ]]; do
+      (( i++ ))
+    done
+    target="/mnt/btrfs/@.bak/${base}_$i"
+  fi
+
+  mv /mnt/btrfs/@ "$target"
 fi
 
-find /mnt/btrfs/@.bak/ -maxdepth 1 -mtime +14 | while IFS= read -r i; do
+find /mnt/btrfs/@.bak/ -maxdepth 1 -mtime +7 | while IFS= read -r i; do
   delete_subvolume_recursively "$i"
 done
 

hosts/common/configs/system/kubernetes/addons/bootstrap/default.nix

@@ -1,212 +0,0 @@
-{ config, ... }:
-{
-  bootstrap-node-bootstrapper-crb = {
-    apiVersion = "rbac.authorization.k8s.io/v1";
-    kind = "ClusterRoleBinding";
-    metadata = {
-      name = "create-csrs-for-bootstrapping";
-    };
-    subjects = [
-      {
-        kind = "Group";
-        name = "system:bootstrappers";
-        apiGroup = "rbac.authorization.k8s.io";
-      }
-    ];
-    roleRef = {
-      kind = "ClusterRole";
-      name = "system:node-bootstrapper";
-      apiGroup = "rbac.authorization.k8s.io";
-    };
-  };
-
-  bootstrap-csr-nodeclient-crb = {
-    apiVersion = "rbac.authorization.k8s.io/v1";
-    kind = "ClusterRoleBinding";
-    metadata = {
-      name = "auto-approve-csrs-for-group";
-    };
-    subjects = [
-      {
-        kind = "Group";
-        name = "system:bootstrappers";
-        apiGroup = "rbac.authorization.k8s.io";
-      }
-    ];
-    roleRef = {
-      kind = "ClusterRole";
-      name = "system:certificates.k8s.io:certificatesigningrequests:nodeclient";
-      apiGroup = "rbac.authorization.k8s.io";
-    };
-  };
-
-  bootstrap-csr-selfnodeclient-crb = {
-    apiVersion = "rbac.authorization.k8s.io/v1";
-    kind = "ClusterRoleBinding";
-    metadata = {
-      name = "auto-approve-renewals-for-nodes";
-    };
-    subjects = [
-      {
-        kind = "Group";
-        name = "system:nodes";
-        apiGroup = "rbac.authorization.k8s.io";
-      }
-    ];
-    roleRef = {
-      kind = "ClusterRole";
-      name = "system:certificates.k8s.io:certificatesigningrequests:selfnodeclient";
-      apiGroup = "rbac.authorization.k8s.io";
-    };
-  };
-
-  csr-approver-cr = {
-    apiVersion = "rbac.authorization.k8s.io/v1";
-    kind = "ClusterRole";
-    metadata = {
-      name = "kubelet-csr-approver";
-    };
-    rules = [
-      {
-        apiGroups = [ "certificates.k8s.io" ];
-        resources = [ "certificatesigningrequests" ];
-        verbs = [
-          "get"
-          "list"
-          "watch"
-        ];
-      }
-      {
-        apiGroups = [ "coordination.k8s.io" ];
-        resources = [ "leases" ];
-        verbs = [
-          "create"
-          "get"
-          "update"
-        ];
-      }
-      {
-        apiGroups = [ "certificates.k8s.io" ];
-        resources = [ "certificatesigningrequests/approval" ];
-        verbs = [ "update" ];
-      }
-      {
-        apiGroups = [ "certificates.k8s.io" ];
-        resourceNames = [ "kubernetes.io/kubelet-serving" ];
-        resources = [ "signers" ];
-        verbs = [ "approve" ];
-      }
-      {
-        apiGroups = [ "" ];
-        resources = [ "events" ];
-        verbs = [ "create" ];
-      }
-    ];
-  };
-
-  csr-approver-crb = {
-    apiVersion = "rbac.authorization.k8s.io/v1";
-    kind = "ClusterRoleBinding";
-    metadata = {
-      name = "kubelet-csr-approver";
-      namespace = "kube-system";
-    };
-    roleRef = {
-      apiGroup = "rbac.authorization.k8s.io";
-      kind = "ClusterRole";
-      name = "kubelet-csr-approver";
-    };
-    subjects = [
-      {
-        kind = "ServiceAccount";
-        name = "kubelet-csr-approver";
-        namespace = "kube-system";
-      }
-    ];
-  };
-
-  csr-approver-sa = {
-    apiVersion = "v1";
-    kind = "ServiceAccount";
-    metadata = {
-      name = "kubelet-csr-approver";
-      namespace = "kube-system";
-    };
-  };
-
-  csr-approver-d = {
-    apiVersion = "apps/v1";
-    kind = "Deployment";
-    metadata = {
-      name = "kubelet-csr-approver";
-      namespace = "kube-system";
-    };
-    spec = {
-      replicas = 1;
-      selector = {
-        matchLabels = {
-          app = "kubelet-csr-approver";
-        };
-      };
-      template = {
-        metadata = {
-          labels = {
-            app = "kubelet-csr-approver";
-          };
-        };
-        spec = {
-          serviceAccountName = "kubelet-csr-approver";
-          containers = [
-            {
-              name = "kubelet-csr-approver";
-              image = "postfinance/kubelet-csr-approver:latest";
-              args = [
-                "-metrics-bind-address"
-                ":8080"
-                "-health-probe-bind-address"
-                ":8081"
-              ];
-              livenessProbe = {
-                httpGet = {
-                  path = "/healthz";
-                  port = 8081;
-                };
-              };
-              resources = {
-                requests = {
-                  cpu = "100m";
-                  memory = "200Mi";
-                };
-              };
-              env = [
-                {
-                  name = "PROVIDER_REGEX";
-                  value = "^${config.services.kubernetes.kubelet.hostname}$";
-                }
-                {
-                  name = "PROVIDER_IP_PREFIXES";
-                  value = "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.0/8,169.254.0.0/16,::1/128,fe80::/10,fc00::/7";
-                }
-                {
-                  name = "MAX_EXPIRATION_SEC";
-                  value = "31622400";
-                }
-                {
-                  name = "BYPASS_DNS_RESOLUTION";
-                  value = "true";
-                }
-              ];
-            }
-          ];
-          tolerations = [
-            {
-              effect = "NoSchedule";
-              key = "node-role.kubernetes.io/control-plane";
-              operator = "Equal";
-            }
-          ];
-        };
-      };
-    };
-  };
-}

hosts/common/configs/system/kubernetes/addons/default.nix

@@ -1,7 +0,0 @@
-{ config, lib, ... }:
-{
-  services.kubernetes.addonManager.bootstrapAddons = lib.mkMerge [
-    (import ./bootstrap { inherit config; })
-    (import ./metrics-server { })
-  ];
-}

hosts/common/configs/system/kubernetes/addons/metrics-server/default.nix

@@ -1,297 +0,0 @@
-{ ... }:
-{
-  metrics-server-sa = {
-    apiVersion = "v1";
-    kind = "ServiceAccount";
-    metadata = {
-      labels = {
-        k8s-app = "metrics-server";
-      };
-      name = "metrics-server";
-      namespace = "kube-system";
-    };
-  };
-
-  metrics-server-metrics-reader-cr = {
-    apiVersion = "rbac.authorization.k8s.io/v1";
-    kind = "ClusterRole";
-    metadata = {
-      labels = {
-        k8s-app = "metrics-server";
-        "rbac.authorization.k8s.io/aggregate-to-admin" = "true";
-        "rbac.authorization.k8s.io/aggregate-to-edit" = "true";
-        "rbac.authorization.k8s.io/aggregate-to-view" = "true";
-      };
-      name = "system:aggregated-metrics-reader";
-    };
-    rules = [
-      {
-        apiGroups = [ "metrics.k8s.io" ];
-        resources = [
-          "pods"
-          "nodes"
-        ];
-        verbs = [
-          "get"
-          "list"
-          "watch"
-        ];
-      }
-    ];
-  };
-
-  metrics-server-cr = {
-    apiVersion = "rbac.authorization.k8s.io/v1";
-    kind = "ClusterRole";
-    metadata = {
-      labels = {
-        k8s-app = "metrics-server";
-      };
-      name = "system:metrics-server";
-    };
-    rules = [
-      {
-        apiGroups = [ "" ];
-        resources = [ "nodes/metrics" ];
-        verbs = [ "get" ];
-      }
-      {
-        apiGroups = [ "" ];
-        resources = [
-          "pods"
-          "nodes"
-        ];
-        verbs = [
-          "get"
-          "list"
-          "watch"
-        ];
-      }
-    ];
-  };
-
-  metrics-server-rb = {
-    apiVersion = "rbac.authorization.k8s.io/v1";
-    kind = "RoleBinding";
-    metadata = {
-      labels = {
-        k8s-app = "metrics-server";
-      };
-      name = "metrics-server-auth-reader";
-      namespace = "kube-system";
-    };
-    roleRef = {
-      apiGroup = "rbac.authorization.k8s.io";
-      kind = "Role";
-      name = "extension-apiserver-authentication-reader";
-    };
-    subjects = [
-      {
-        kind = "ServiceAccount";
-        name = "metrics-server";
-        namespace = "kube-system";
-      }
-    ];
-  };
-
-  metrics-server-auth-delegator-crb = {
-    apiVersion = "rbac.authorization.k8s.io/v1";
-    kind = "ClusterRoleBinding";
-    metadata = {
-      labels = {
-        k8s-app = "metrics-server";
-      };
-      name = "metrics-server:system:auth-delegator";
-    };
-    roleRef = {
-      apiGroup = "rbac.authorization.k8s.io";
-      kind = "ClusterRole";
-      name = "system:auth-delegator";
-    };
-    subjects = [
-      {
-        kind = "ServiceAccount";
-        name = "metrics-server";
-        namespace = "kube-system";
-      }
-    ];
-  };
-
-  metrics-server-crb = {
-    apiVersion = "rbac.authorization.k8s.io/v1";
-    kind = "ClusterRoleBinding";
-    metadata = {
-      labels = {
-        k8s-app = "metrics-server";
-      };
-      name = "system:metrics-server";
-    };
-    roleRef = {
-      apiGroup = "rbac.authorization.k8s.io";
-      kind = "ClusterRole";
-      name = "system:metrics-server";
-    };
-    subjects = [
-      {
-        kind = "ServiceAccount";
-        name = "metrics-server";
-        namespace = "kube-system";
-      }
-    ];
-  };
-
-  metrics-server-s = {
-    apiVersion = "v1";
-    kind = "Service";
-    metadata = {
-      labels = {
-        k8s-app = "metrics-server";
-      };
-      name = "metrics-server";
-      namespace = "kube-system";
-    };
-    spec = {
-      ports = [
-        {
-          name = "https";
-          port = 443;
-          protocol = "TCP";
-          targetPort = "https";
-        }
-      ];
-      selector = {
-        k8s-app = "metrics-server";
-      };
-    };
-  };
-
-  metrics-server-d = {
-    apiVersion = "apps/v1";
-    kind = "Deployment";
-    metadata = {
-      labels = {
-        k8s-app = "metrics-server";
-      };
-      name = "metrics-server";
-      namespace = "kube-system";
-    };
-    spec = {
-      selector = {
-        matchLabels = {
-          k8s-app = "metrics-server";
-        };
-      };
-      strategy = {
-        rollingUpdate = {
-          maxUnavailable = 0;
-        };
-      };
-      template = {
-        metadata = {
-          labels = {
-            k8s-app = "metrics-server";
-          };
-        };
-        spec = {
-          containers = [
-            {
-              args = [
-                "--cert-dir=/tmp"
-                "--secure-port=10250"
-                "--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname"
-                "--kubelet-use-node-status-port"
-                "--metric-resolution=15s"
-              ];
-              image = "registry.k8s.io/metrics-server/metrics-server:v0.7.2";
-              imagePullPolicy = "IfNotPresent";
-              livenessProbe = {
-                failureThreshold = 3;
-                httpGet = {
-                  path = "/livez";
-                  port = "https";
-                  scheme = "HTTPS";
-                };
-                periodSeconds = 10;
-              };
-              name = "metrics-server";
-              ports = [
-                {
-                  containerPort = 10250;
-                  name = "https";
-                  protocol = "TCP";
-                }
-              ];
-              readinessProbe = {
-                failureThreshold = 3;
-                httpGet = {
-                  path = "/readyz";
-                  port = "https";
-                  scheme = "HTTPS";
-                };
-                initialDelaySeconds = 20;
-                periodSeconds = 10;
-              };
-              resources = {
-                requests = {
-                  cpu = "100m";
-                  memory = "200Mi";
-                };
-              };
-              securityContext = {
-                allowPrivilegeEscalation = false;
-                capabilities = {
-                  drop = [ "ALL" ];
-                };
-                readOnlyRootFilesystem = true;
-                runAsNonRoot = true;
-                runAsUser = 1000;
-                seccompProfile = {
-                  type = "RuntimeDefault";
-                };
-              };
-              volumeMounts = [
-                {
-                  mountPath = "/tmp";
-                  name = "tmp-dir";
-                }
-              ];
-            }
-          ];
-          nodeSelector = {
-            "kubernetes.io/os" = "linux";
-          };
-          priorityClassName = "system-cluster-critical";
-          serviceAccountName = "metrics-server";
-          volumes = [
-            {
-              emptyDir = { };
-              name = "tmp-dir";
-            }
-          ];
-        };
-      };
-    };
-  };
-
-  metrics-server-apis = {
-    apiVersion = "apiregistration.k8s.io/v1";
-    kind = "APIService";
-    metadata = {
-      labels = {
-        k8s-app = "metrics-server";
-      };
-      name = "v1beta1.metrics.k8s.io";
-    };
-    spec = {
-      group = "metrics.k8s.io";
-      groupPriorityMinimum = 100;
-      insecureSkipTLSVerify = true;
-      service = {
-        name = "metrics-server";
-        namespace = "kube-system";
-      };
-      version = "v1beta1";
-      versionPriority = 100;
-    };
-  };
-}

hosts/common/configs/system/kubernetes/default.nix

@@ -1,233 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  adminKubeconfig = config.services.kubernetes.lib.mkKubeConfig "admin" {
-    caFile = config.sops.secrets."kubernetes/ca/crt".path;
-    keyFile = config.sops.secrets."kubernetes/accounts/admin/key".path;
-    certFile = config.sops.secrets."kubernetes/accounts/admin/crt".path;
-    server = config.services.kubernetes.apiserverAddress;
-  };
-in
-{
-  imports = [
-    ./addons
-    ./secrets
-  ];
-
-  environment = {
-    persistence."/persist" = {
-      "/var/lib/containerd" = { };
-      "/var/lib/kubernetes" = { };
-      "/var/lib/kubelet" = { };
-      "/var/lib/etcd" = { };
-    };
-
-    etc."kubeconfig".source = adminKubeconfig;
-    systemPackages = with pkgs; [ kubectl ];
-  };
-
-  services = {
-    kubernetes = {
-      roles = [
-        "master"
-        "node"
-      ];
-
-      masterAddress = "localhost";
-      easyCerts = false;
-      caFile = config.sops.secrets."kubernetes/ca/crt".path;
-      addonManager.enable = true;
-
-      apiserver = {
-        allowPrivileged = true;
-
-        clientCaFile = config.sops.secrets."kubernetes/ca/crt".path;
-        kubeletClientCaFile = config.sops.secrets."kubernetes/ca/crt".path;
-        tlsKeyFile = config.sops.secrets."kubernetes/apiserver/cert/key".path;
-        tlsCertFile = config.sops.secrets."kubernetes/apiserver/cert/crt".path;
-        kubeletClientKeyFile = config.sops.secrets."kubernetes/apiserver/kubelet-client/key".path;
-        kubeletClientCertFile = config.sops.secrets."kubernetes/apiserver/kubelet-client/crt".path;
-        proxyClientKeyFile = config.sops.secrets."kubernetes/front-proxy/client/key".path;
-        proxyClientCertFile = config.sops.secrets."kubernetes/front-proxy/client/crt".path;
-        serviceAccountSigningKeyFile = config.sops.secrets."kubernetes/sa/key".path;
-        serviceAccountKeyFile = config.sops.secrets."kubernetes/sa/pub".path;
-
-        extraOpts = lib.strings.concatStringsSep " " [
-          "--enable-bootstrap-token-auth=true"
-          "--token-auth-file=${config.sops.secrets."kubernetes/accounts/kubelet-bootstrap/csv".path}"
-          "--requestheader-client-ca-file=${config.sops.secrets."kubernetes/front-proxy/ca/crt".path}"
-          "--requestheader-allowed-names=front-proxy-client"
-          "--requestheader-extra-headers-prefix=X-Remote-Extra-"
-          "--requestheader-group-headers=X-Remote-Group"
-          "--requestheader-username-headers=X-Remote-User"
-        ];
-
-        etcd = {
-          servers = [ "https://etcd.local:2379" ];
-          caFile = config.sops.secrets."kubernetes/etcd/ca/crt".path;
-          keyFile = config.sops.secrets."kubernetes/apiserver/etcd-client/key".path;
-          certFile = config.sops.secrets."kubernetes/apiserver/etcd-client/crt".path;
-        };
-      };
-
-      controllerManager = {
-        rootCaFile = config.sops.secrets."kubernetes/ca/crt".path;
-        serviceAccountKeyFile = config.sops.secrets."kubernetes/sa/key".path;
-
-        extraOpts = lib.strings.concatStringsSep " " [
-          "--client-ca-file=${config.sops.secrets."kubernetes/ca/crt".path}"
-          "--cluster-signing-cert-file=${config.sops.secrets."kubernetes/ca/crt".path}"
-          "--cluster-signing-key-file=${config.sops.secrets."kubernetes/ca/key".path}"
-          "--requestheader-client-ca-file=${config.sops.secrets."kubernetes/front-proxy/ca/crt".path}"
-        ];
-
-        kubeconfig = {
-          caFile = config.sops.secrets."kubernetes/ca/crt".path;
-          keyFile = config.sops.secrets."kubernetes/accounts/controller-manager/key".path;
-          certFile = config.sops.secrets."kubernetes/accounts/controller-manager/crt".path;
-        };
-      };
-
-      kubelet = {
-        clientCaFile = config.sops.secrets."kubernetes/ca/crt".path;
-
-        extraOpts = lib.strings.concatStringsSep " " [
-          "--bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubeconfig"
-          "--kubeconfig=/var/lib/kubelet/kubeconfig"
-          "--cert-dir=/var/lib/kubelet"
-        ];
-
-        extraConfig = {
-          failSwapOn = false;
-          rotateCertificates = true;
-          serverTLSBootstrap = true;
-          memorySwap.swapBehavior = "LimitedSwap";
-        };
-
-        featureGates = {
-          RotateKubeletServerCertificate = true;
-          NodeSwap = true;
-        };
-      };
-
-      proxy.kubeconfig = {
-        caFile = config.sops.secrets."kubernetes/ca/crt".path;
-        keyFile = config.sops.secrets."kubernetes/accounts/proxy/key".path;
-        certFile = config.sops.secrets."kubernetes/accounts/proxy/crt".path;
-      };
-
-      scheduler.kubeconfig = {
-        caFile = config.sops.secrets."kubernetes/ca/crt".path;
-        keyFile = config.sops.secrets."kubernetes/accounts/scheduler/key".path;
-        certFile = config.sops.secrets."kubernetes/accounts/scheduler/crt".path;
-      };
-    };
-
-    etcd = {
-      keyFile = config.sops.secrets."kubernetes/etcd/server/key".path;
-      certFile = config.sops.secrets."kubernetes/etcd/server/crt".path;
-      peerKeyFile = config.sops.secrets."kubernetes/etcd/peer/key".path;
-      peerCertFile = config.sops.secrets."kubernetes/etcd/peer/crt".path;
-      trustedCaFile = config.sops.secrets."kubernetes/etcd/ca/crt".path;
-      peerTrustedCaFile = config.sops.secrets."kubernetes/etcd/ca/crt".path;
-      listenClientUrls = [ "https://127.0.0.1:2379" ];
-      listenPeerUrls = [ "https://127.0.0.1:2380" ];
-      advertiseClientUrls = [ "https://etcd.local:2379" ];
-      initialCluster = [ "${config.services.kubernetes.masterAddress}=https://etcd.local:2380" ];
-      initialAdvertisePeerUrls = [ "https://etcd.local:2380" ];
-    };
-
-    flannel.kubeconfig = config.services.kubernetes.lib.mkKubeConfig "flannel" {
-      caFile = config.sops.secrets."kubernetes/ca/crt".path;
-      keyFile = config.sops.secrets."kubernetes/accounts/flannel/key".path;
-      certFile = config.sops.secrets."kubernetes/accounts/flannel/crt".path;
-      server = config.services.kubernetes.apiserverAddress;
-    };
-  };
-
-  networking = {
-    firewall.enable = false;
-    extraHosts = lib.strings.optionalString (config.services.etcd.enable) ''
-      127.0.0.1 etcd.${config.services.kubernetes.addons.dns.clusterDomain} etcd.local
-    '';
-  };
-
-  systemd.services = {
-    kube-addon-manager = {
-      after = [
-        "sops-nix.service"
-        config.environment.persistence."/persist"."/var/lib/kubernetes".mount
-      ];
-
-      environment.KUBECONFIG = config.services.kubernetes.lib.mkKubeConfig "addon-manager" {
-        caFile = config.sops.secrets."kubernetes/ca/crt".path;
-        keyFile = config.sops.secrets."kubernetes/accounts/addon-manager/key".path;
-        certFile = config.sops.secrets."kubernetes/accounts/addon-manager/crt".path;
-        server = config.services.kubernetes.apiserverAddress;
-      };
-
-      serviceConfig.PermissionsStartOnly = true;
-
-      preStart = ''
-        export KUBECONFIG=${adminKubeconfig}
-        ${config.services.kubernetes.package}/bin/kubectl apply -f ${
-          lib.strings.concatStringsSep " \\\n -f " (
-            lib.attrsets.mapAttrsToList (
-              n: v: pkgs.writeText "${n}.json" (builtins.toJSON v)
-            ) config.services.kubernetes.addonManager.bootstrapAddons
-          )
-        }
-      '';
-    };
-
-    kubelet = {
-      preStart = ''
-        mkdir -p /etc/kubernetes
-        cat > /etc/kubernetes/bootstrap-kubeconfig <<EOF
-        apiVersion: v1
-        kind: Config
-        clusters:
-        - cluster:
-            certificate-authority: ${config.sops.secrets."kubernetes/ca/crt".path}
-            server: ${config.services.kubernetes.apiserverAddress}
-          name: local
-        contexts:
-        - context:
-            cluster: local
-            user: kubelet-bootstrap
-          name: bootstrap
-        current-context: bootstrap
-        preferences: {}
-        users:
-        - name: kubelet-bootstrap
-          user:
-            token: $(<${config.sops.secrets."kubernetes/accounts/kubelet-bootstrap/token".path})
-        EOF
-      '';
-
-      after = [
-        "sops-nix.service"
-        config.environment.persistence."/persist"."/var/lib/kubelet".mount
-      ];
-    };
-
-    kube-apiserver.after = [
-      "sops-nix.service"
-      config.environment.persistence."/persist"."/var/lib/kubernetes".mount
-    ];
-
-    etcd.after = [
-      "sops-nix.service"
-      config.environment.persistence."/persist"."/var/lib/etcd".mount
-    ];
-
-    kube-controller-manager.after = [ "sops-nix.service" ];
-    kube-proxy.after = [ "sops-nix.service" ];
-    kube-scheduler.after = [ "sops-nix.service" ];
-    flannel.after = [ "sops-nix.service" ];
-  };
-}

hosts/common/configs/system/kubernetes/secrets/default.nix

@@ -1,204 +0,0 @@
-{ ... }:
-{
-  sops.secrets = {
-    "kubernetes/ca/crt" = {
-      owner = "kubernetes";
-      group = "users";
-      mode = "0440";
-    };
-
-    "kubernetes/ca/key" = {
-      owner = "kubernetes";
-      group = "users";
-      mode = "0440";
-    };
-
-    "kubernetes/front-proxy/ca/crt" = {
-      owner = "kubernetes";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/front-proxy/ca/key" = {
-      owner = "kubernetes";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/etcd/ca/crt" = {
-      owner = "etcd";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/etcd/ca/key" = {
-      owner = "etcd";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/apiserver/cert/crt" = {
-      owner = "kubernetes";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/apiserver/cert/key" = {
-      owner = "kubernetes";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/apiserver/kubelet-client/crt" = {
-      owner = "kubernetes";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/apiserver/kubelet-client/key" = {
-      owner = "kubernetes";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/apiserver/etcd-client/crt" = {
-      owner = "kubernetes";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/apiserver/etcd-client/key" = {
-      owner = "kubernetes";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/front-proxy/client/crt" = {
-      owner = "kubernetes";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/front-proxy/client/key" = {
-      owner = "kubernetes";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/etcd/server/crt" = {
-      owner = "etcd";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/etcd/server/key" = {
-      owner = "etcd";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/etcd/peer/crt" = {
-      owner = "etcd";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/etcd/peer/key" = {
-      owner = "etcd";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/sa/key" = {
-      owner = "kubernetes";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/sa/pub" = {
-      owner = "kubernetes";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/accounts/admin/crt" = {
-      group = "kubernetes";
-    };
-
-    "kubernetes/accounts/admin/key" = {
-      group = "kubernetes";
-    };
-
-    "kubernetes/accounts/controller-manager/crt" = {
-      owner = "kubernetes";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/accounts/controller-manager/key" = {
-      owner = "kubernetes";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/accounts/addon-manager/crt" = {
-      owner = "kubernetes";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/accounts/addon-manager/key" = {
-      owner = "kubernetes";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/accounts/scheduler/crt" = {
-      owner = "kubernetes";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/accounts/scheduler/key" = {
-      owner = "kubernetes";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/accounts/proxy/crt" = {
-      owner = "kubernetes";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/accounts/proxy/key" = {
-      owner = "kubernetes";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/accounts/flannel/crt" = {
-      owner = "kubernetes";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/accounts/flannel/key" = {
-      owner = "kubernetes";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/accounts/kubelet-bootstrap/token" = {
-      owner = "kubernetes";
-      group = "kubernetes";
-      mode = "0440";
-    };
-
-    "kubernetes/accounts/kubelet-bootstrap/csv" = {
-      owner = "kubernetes";
-      group = "kubernetes";
-      mode = "0440";
-    };
-  };
-}

hosts/common/configs/system/kubernetes/secrets/generate-secrets.sh

@@ -1,210 +0,0 @@
-#!/usr/bin/env -S nix shell nixpkgs#openssl nixpkgs#yq-go nixpkgs#sops -c bash
-
-set -o errexit
-set -o pipefail
-
-generate_ca() {
-  local target_dir=$1
-  local ca_name=$2
-  local ca_days=$3
-  local cn=$4
-
-  mkdir -p "${target_dir}"
-  local ca_key=${target_dir}/${ca_name}.key
-  local ca_cert=${target_dir}/${ca_name}.crt
-
-  openssl genrsa -out "${ca_key}" 2048
-  openssl req -x509 -new -nodes -key "${ca_key}" -days "${ca_days}" -out "${ca_cert}" -subj "/CN=${cn}"
-}
-
-generate_alt_names() {
-  local hosts=("$@")
-  local dns=0
-  local ip=0
-  local alt_names=""
-
-  for host in "${hosts[@]}"; do
-    if [[ ${host} =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-      alt_names="${alt_names}IP.${ip} = ${host}\n"
-      ((ip++))
-    else
-      alt_names="${alt_names}DNS.${dns} = ${host}\n"
-      ((dns++))
-    fi
-  done
-
-  echo -e "${alt_names}"
-}
-
-generate_cnf() {
-  local target_dir=$1
-  local cnf_name=$2
-  local cn=$3
-  local hosts=("${@:4}")
-
-  mkdir -p "${target_dir}"
-  local cnf_file=${target_dir}/${cnf_name}.cnf
-
-  cat <<EOF > "${cnf_file}"
-[req]
-prompt = no
-
-[ req_ext ]
-subjectAltName = @alt_names
-
-[ alt_names ]
-$(generate_alt_names "${hosts[@]}")
-
-[ v3_ext ]
-authorityKeyIdentifier=keyid,issuer:always
-basicConstraints=CA:FALSE
-keyUsage=keyEncipherment,dataEncipherment,digitalSignature
-extendedKeyUsage=serverAuth,clientAuth
-subjectAltName=@alt_names
-EOF
-}
-
-generate_crt() {
-  local target_dir=$1
-  local cert_name=$2
-  local cert_days=$3
-  local cn=$4
-  local o=$5
-  local ca_key=$6
-  local ca_cert=$7
-  local hosts=("${@:8}")
-
-  mkdir -p "${target_dir}"
-  local cert_key=${target_dir}/${cert_name}.key
-  local cert_csr=${target_dir}/${cert_name}.csr
-  local cert_cert=${target_dir}/${cert_name}.crt
-
-  openssl genrsa -out "${cert_key}" 2048
-
-  local subject="/CN=${cn}"
-  if [ -n "${o}" ]; then
-    subject="${subject}/O=${o}"
-  fi
-
-  if [ -n "${hosts}" ]; then
-    generate_cnf "${target_dir}" "${cert_name}" "${cn}" "${hosts[@]}"
-    openssl req -new -key "${cert_key}" -out "${cert_csr}" -subj "${subject}" -config "${target_dir}"/"${cert_name}".cnf
-    openssl x509 -req -in "${cert_csr}" -CA "${ca_cert}" -CAkey "${ca_key}" -CAcreateserial -out "${cert_cert}" -days "${cert_days}" -extfile "${target_dir}"/"${cert_name}".cnf -extensions v3_ext
-  else
-    openssl req -new -key "${cert_key}" -out "${cert_csr}" -subj "${subject}"
-    openssl x509 -req -in "${cert_csr}" -CA "${ca_cert}" -CAkey "${ca_key}" -CAcreateserial -out "${cert_cert}" -days "${cert_days}"
-  fi
-}
-
-generate_key_pair() {
-  local target_dir=$1
-  local key_name=$2
-
-  mkdir -p "${target_dir}"
-  local private_key=${target_dir}/${key_name}.key
-  local public_key=${target_dir}/${key_name}.pub
-
-  openssl genrsa -out "${private_key}" 2048
-  openssl rsa -in "${private_key}" -pubout -out "${public_key}"
-}
-
-generate_auth_token() {
-  local target_dir=$1
-  local token_name=$2
-  local user=$3
-  local id=$4
-  local groups=$5
-
-  mkdir -p "${target_dir}"
-  local token_file="${target_dir}/${token_name}.token"
-  local token_auth_file="${target_dir}/${token_name}.csv"
-
-  token="$(head -c 16 /dev/urandom | od -An -t x | tr -d ' ')"
-  echo "${token}" > "${token_file}"
-  echo "${token},${user},${id},\"${groups}\"" > "${token_auth_file}"
-}
-
-DEFAULT_CA_DAYS=3650
-
-if [[ -z "$SOPS_AGE_KEY_FILE" ]]; then
-  echo "Please set the SOPS_AGE_KEY_FILE environment variable"
-  exit 1
-fi
-
-hostname=${1:-$(hostname)}
-
-if [ -z "${hostname}" ]; then
-  echo "Usage: $0 [hostname]"
-  exit 1
-fi
-
-generate_ca out ca ${DEFAULT_CA_DAYS} kubernetes-ca ""
-generate_ca out/front-proxy ca ${DEFAULT_CA_DAYS} kubernetes-front-proxy-ca ""
-generate_ca out/etcd ca ${DEFAULT_CA_DAYS} etcd-ca ""
-
-generate_crt out/apiserver cert ${DEFAULT_CA_DAYS} kube-apiserver "" out/ca.key out/ca.crt "kubernetes" "kubernetes.default" "kubernetes.default.svc" "kubernetes.default.svc.cluster" "kubernetes.default.svc.cluster.local" "localhost" "10.0.0.1" "127.0.0.1"
-generate_crt out/apiserver kubelet-client ${DEFAULT_CA_DAYS} kube-apiserver-kubelet-client system:masters out/ca.key out/ca.crt ""
-generate_crt out/apiserver etcd-client ${DEFAULT_CA_DAYS} kube-apiserver-etcd-client "" out/etcd/ca.key out/etcd/ca.crt ""
-generate_crt out/front-proxy client ${DEFAULT_CA_DAYS} front-proxy-client "" out/front-proxy/ca.key out/front-proxy/ca.crt ""
-generate_crt out/etcd server ${DEFAULT_CA_DAYS} kube-etcd "" out/etcd/ca.key out/etcd/ca.crt "etcd.local" "etcd.cluster.local" "localhost" "127.0.0.1"
-generate_crt out/etcd peer ${DEFAULT_CA_DAYS} kube-etcd-peer "" out/etcd/ca.key out/etcd/ca.crt "etcd.local" "etcd.cluster.local" "localhost" "127.0.0.1"
-
-generate_key_pair out sa
-
-generate_crt out/accounts admin ${DEFAULT_CA_DAYS} kubernetes-admin system:masters out/ca.key out/ca.crt ""
-generate_crt out/accounts users ${DEFAULT_CA_DAYS} kubernetes-users system:masters out/ca.key out/ca.crt ""
-generate_crt out/accounts controller-manager ${DEFAULT_CA_DAYS} system:kube-controller-manager "" out/ca.key out/ca.crt ""
-generate_crt out/accounts addon-manager ${DEFAULT_CA_DAYS} system:kube-addon-manager "" out/ca.key out/ca.crt ""
-generate_crt out/accounts scheduler ${DEFAULT_CA_DAYS} system:kube-scheduler "" out/ca.key out/ca.crt ""
-generate_crt out/accounts proxy ${DEFAULT_CA_DAYS} system:kube-proxy "" out/ca.key out/ca.crt ""
-generate_crt out/accounts flannel ${DEFAULT_CA_DAYS} flannel-client "" out/ca.key out/ca.crt ""
-
-generate_auth_token out/accounts kubelet-bootstrap "kubelet-bootstrap" 10001 "system:bootstrappers"
-
-sops_config="../../../../../$(hostname)/secrets/sops.yaml"
-secrets_file="../../../../../$(hostname)/secrets/secrets.yaml"
-decrypted_secrets_file="../../../../../$(hostname)/secrets/.decrypted~secrets.yaml"
-sops -d "${secrets_file}" > "${decrypted_secrets_file}"
-
-yq -i '
-  del(.kubernetes) |
-  .kubernetes.ca.crt = load_str("out/ca.crt") |
-  .kubernetes.ca.key = load_str("out/ca.key") |
-  .kubernetes.front-proxy.ca.crt = load_str("out/front-proxy/ca.crt") |
-  .kubernetes.front-proxy.ca.key = load_str("out/front-proxy/ca.key") |
-  .kubernetes.etcd.ca.crt = load_str("out/etcd/ca.crt") |
-  .kubernetes.etcd.ca.key = load_str("out/etcd/ca.key") |
-  .kubernetes.apiserver.cert.crt = load_str("out/apiserver/cert.crt") |
-  .kubernetes.apiserver.cert.key = load_str("out/apiserver/cert.key") |
-  .kubernetes.apiserver.kubelet-client.crt = load_str("out/apiserver/kubelet-client.crt") |
-  .kubernetes.apiserver.kubelet-client.key = load_str("out/apiserver/kubelet-client.key") |
-  .kubernetes.apiserver.etcd-client.crt = load_str("out/apiserver/etcd-client.crt") |
-  .kubernetes.apiserver.etcd-client.key = load_str("out/apiserver/etcd-client.key") |
-  .kubernetes.front-proxy.client.crt = load_str("out/front-proxy/client.crt") |
-  .kubernetes.front-proxy.client.key = load_str("out/front-proxy/client.key") |
-  .kubernetes.etcd.server.crt = load_str("out/etcd/server.crt") |
-  .kubernetes.etcd.server.key = load_str("out/etcd/server.key") |
-  .kubernetes.etcd.peer.crt = load_str("out/etcd/peer.crt") |
-  .kubernetes.etcd.peer.key = load_str("out/etcd/peer.key") |
-  .kubernetes.sa.key = load_str("out/sa.key") |
-  .kubernetes.sa.pub = load_str("out/sa.pub") |
-  .kubernetes.accounts.admin.crt = load_str("out/accounts/admin.crt") |
-  .kubernetes.accounts.admin.key = load_str("out/accounts/admin.key") |
-  .kubernetes.accounts.users.crt = load_str("out/accounts/users.crt") |
-  .kubernetes.accounts.users.key = load_str("out/accounts/users.key") |
-  .kubernetes.accounts.controller-manager.crt = load_str("out/accounts/controller-manager.crt") |
-  .kubernetes.accounts.controller-manager.key = load_str("out/accounts/controller-manager.key") |
-  .kubernetes.accounts.addon-manager.crt = load_str("out/accounts/addon-manager.crt") |
-  .kubernetes.accounts.addon-manager.key = load_str("out/accounts/addon-manager.key") |
-  .kubernetes.accounts.scheduler.crt = load_str("out/accounts/scheduler.crt") |
-  .kubernetes.accounts.scheduler.key = load_str("out/accounts/scheduler.key") |
-  .kubernetes.accounts.proxy.crt = load_str("out/accounts/proxy.crt") |
-  .kubernetes.accounts.proxy.key = load_str("out/accounts/proxy.key") |
-  .kubernetes.accounts.flannel.crt = load_str("out/accounts/flannel.crt") |
-  .kubernetes.accounts.flannel.key = load_str("out/accounts/flannel.key") |
-  .kubernetes.accounts.kubelet-bootstrap.token = load_str("out/accounts/kubelet-bootstrap.token") |
-  .kubernetes.accounts.kubelet-bootstrap.csv = load_str("out/accounts/kubelet-bootstrap.csv")
-' "${decrypted_secrets_file}"
-
-sops --config "${sops_config}" -e "${decrypted_secrets_file}" > "${secrets_file}"
-rm -rf out

hosts/common/configs/system/lanzaboote/default.nix

@@ -0,0 +1,22 @@
+{
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  imports = [ inputs.lanzaboote.nixosModules.lanzaboote ];
+
+  environment = {
+    persistence."/persist/state"."/var/lib/sbctl" = { };
+
+    systemPackages = with pkgs; [ sbctl ];
+  };
+
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+
+  boot.lanzaboote = {
+    enable = true;
+    pkiBundle = "/var/lib/sbctl";
+  };
+}

hosts/common/configs/system/libvirt/default.nix

@@ -12,16 +12,20 @@
     spiceUSBRedirection.enable = true;
   };
 
-  systemd.services.libvirtd-network-default = {
-    description = "Start Default Virtual Network for Libvirt";
-    script = "${config.virtualisation.libvirtd.package}/bin/virsh net-start default";
-    preStop = "${config.virtualisation.libvirtd.package}/bin/virsh net-destroy default";
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
+  systemd.services = {
+    libvirtd.after = [ "NetworkManager.service" ];
+
+    libvirtd-network-default = {
+      description = "Start Default Virtual Network for Libvirt";
+      script = "${config.virtualisation.libvirtd.package}/bin/virsh net-start default";
+      preStop = "${config.virtualisation.libvirtd.package}/bin/virsh net-destroy default";
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+      wantedBy = [ "libvirtd.service" ];
+      after = [ "libvirtd.service" ];
     };
-    wantedBy = [ "libvirtd.service" ];
-    after = [ "libvirtd.service" ];
   };
 
   environment = {
@@ -32,7 +36,7 @@
       "ovmf/edk2-i386-vars.fd".source =
         "${config.virtualisation.libvirtd.qemu.package}/share/qemu/edk2-i386-vars.fd";
     };
-    persistence."/persist"."/var/lib/libvirt" = { };
+    persistence."/persist/state"."/var/lib/libvirt" = { };
   };
 
   programs.virt-manager.enable = true;

hosts/common/configs/system/networking/default.nix

@@ -1,10 +0,0 @@
-{ config, ... }:
-{
-  networking.networkmanager.enable = true;
-
-  environment.persistence."/persist"."/etc/NetworkManager/system-connections" = { };
-
-  systemd.services.NetworkManager.after = [
-    config.environment.persistence."/persist"."/etc/NetworkManager/system-connections".mount
-  ];
-}

hosts/common/configs/system/networkmanager/default.nix

@@ -0,0 +1,10 @@
+{ config, ... }:
+{
+  networking.networkmanager.enable = true;
+
+  environment.persistence."/persist/state"."/etc/NetworkManager/system-connections" = { };
+
+  systemd.services.NetworkManager.after = [
+    config.environment.persistence."/persist/state"."/etc/NetworkManager/system-connections".mount
+  ];
+}

hosts/common/configs/system/nix-cleanup/cleanup.sh

@@ -1,3 +1,5 @@
+# shellcheck shell=bash
+
 if [[ "${EUID}" -ne 0 ]]; then
   echo "Please run the script as root."
   exit 1
@@ -16,13 +18,8 @@ if [[ -e /mnt/btrfs && -n $(mountpoint -q /mnt/btrfs) ]]; then
   exit 1
 fi
 
-if [[ -z "$DEVICE" ]]; then
-  echo "Error: DEVICE variable is not set."
-  exit 1
-fi
-
 mkdir -p /mnt/btrfs
-mount "/dev/mapper/$DEVICE" /mnt/btrfs
+mount "$DEVICE" /mnt/btrfs
 
 if [[ -e /mnt/btrfs/@.bak ]]; then
   if [[ -n "$(ls -A /mnt/btrfs/@.bak)" ]]; then

hosts/common/configs/system/nix-install/default.nix

@@ -8,6 +8,7 @@
         iputils
         jq
         nix
+        sops
         inputs.disko.packages.${system}.disko
       ];
       text = builtins.readFile ./install.sh;
@@ -15,8 +16,6 @@
   ];
 
   home-manager.sharedModules = [
-    {
-      programs.zsh.initExtra = builtins.readFile ./install.completion.zsh;
-    }
+    { programs.zsh.initContent = builtins.readFile ./install.completion.zsh; }
   ];
 }

hosts/common/configs/system/nix-install/install.completion.zsh

@@ -4,7 +4,7 @@ _nix-install_completion() {
     '-m[Mode: 'install' or 'repair']:mode:(install repair)'
     '-h[Host to configure]:host:($(_list_hosts))'
     '-k[Key file to copy to user config]:key:($(_list_keys))'
-    '-p[LUKS password file to use for encryption]:password_file:_files'
+    '-s[Enroll secure boot keys on current device]'
     '-c[Copy configuration to target]'
     '-r[Reboot after completion]'
   )

hosts/common/configs/system/nix-install/install.sh

@@ -1,12 +1,14 @@
+# shellcheck shell=bash
+
 usage() {
-  echo "Usage: $0 flake -m install|repair -h host [-k key] [-p password_file] [-c] [-r]"
+  echo "Usage: $0 flake -m install|repair -h host [-k key] [-p password_file] [-s] [-c] [-r]"
   echo
   echo "Options:"
   echo "  flake               Directory containing the flake.nix file."
   echo "  -m mode             Mode: 'install' or 'repair'."
   echo "  -h host             Host to configure."
   echo "  -k key              Key file to copy to user config."
-  echo "  -p password_file    LUKS password file to use for encryption."
+  echo "  -s                  Enroll secure boot keys on current device."
   echo "  -c                  Copy configuration to target."
   echo "  -r                  Reboot after completion."
   exit 1
@@ -34,48 +36,37 @@ check_flake() {
 }
 
 check_host() {
-  if ! nix flake show --quiet --json "$flake" 2>/dev/null | jq -e ".nixosConfigurations[\"$host\"]" &>/dev/null; then
+  if ! nix flake show --allow-import-from-derivation --quiet --json "$flake" 2>/dev/null | jq -e ".nixosConfigurations[\"$host\"]" &>/dev/null; then
     echo "Host '$host' not found in flake."
     exit 1
   fi
 }
 
 check_key() {
-  if [[ -n "$key" ]] && [[ ! -f "$flake/secrets/$key/key.txt" ]]; then
+  if [[ -n "$key" ]] && [[ ! -f "$flake/submodules/secrets/domains/$key/key.txt" ]]; then
     echo "Key '$key' not found."
     exit 1
   fi
 }
 
 set_password_file() {
-  if [[ -n "$password_file" ]]; then
-    if [[ ! -f "$password_file" ]]; then
-      echo "LUKS key file '$password_file' not found."
-      exit 1
-    fi
-
-    ln -sf "$(realpath "$password_file")" /tmp/installer.key
-  else
-    echo "Enter password for LUKS encryption:"
-    IFS= read -r -s password
-    echo "Enter password again to confirm: "
-    IFS= read -r -s password_check
-    [ "$password" != "$password_check" ]
-    echo -n "$password" > /tmp/installer.key
-    unset password password_check
-  fi
+  SOPS_AGE_KEY_FILE="$flake/submodules/secrets/domains/$key/key.txt"
+  export SOPS_AGE_KEY_FILE
+  install -m 600 /dev/null /tmp/keyfile
+  sops --decrypt --extract "['luks']" "$flake/submodules/secrets/hosts/$host/secrets.yaml" > /tmp/keyfile
+  unset SOPS_AGE_KEY_FILE
 }
 
 prepare_disk() {
   local disko_mode="$1"
   mkdir -p /mnt
   root=$(mktemp -d /mnt/install.XXXXXX)
-  disko -m "$disko_mode" --yes-wipe-all-disks --root-mountpoint "$root" "$flake/hosts/$host/format.nix" --arg device "\"$device\""
+  disko -m "$disko_mode" --yes-wipe-all-disks --root-mountpoint "$root" "$flake/hosts/$host/format.nix"
 }
 
-copy_keys() {
-  mkdir -p "$root/persist/etc/ssh"
-  cp "$flake/hosts/$host/secrets/ssh_host_ed25519_key" "$root/persist/etc/ssh/ssh_host_ed25519_key"
+copy_sops_keys() {
+  mkdir -p "$root/persist/state/etc/ssh"
+  cp -f "$flake/submodules/secrets/hosts/$host/ssh_host_ed25519_key" "$root/persist/state/etc/ssh/ssh_host_ed25519_key"
 
   for path in "$flake/hosts/$host/users"/*; do
     if [[ -z "$key" ]]; then
@@ -84,90 +75,119 @@ copy_keys() {
 
     local user
     user=$(basename "$path")
-    mkdir -p "$root/persist/home/$user/.config/sops-nix"
-    cp "$flake/secrets/$key/key.txt" "$root/persist/home/$user/.config/sops-nix/key.txt"
-    chown -R "$(cat "$flake/hosts/$host/users/$user/uid"):100" "$root/persist/home/$user"
+
+    mkdir -p "$root/persist/state/home/$user/.config/sops-nix"
+    cp -f "$flake/submodules/secrets/domains/$key/key.txt" "$root/persist/state/home/$user/.config/sops-nix/key.txt"
+
+    owner=$(cat "$flake/hosts/$host/users/$user/uid")
+    group=100
+    chown "$owner:$group" \
+      "$root/persist/state/home/$user" \
+      "$root/persist/state/home/$user/.config" \
+      "$root/persist/state/home/$user/.config/sops-nix" \
+      "$root/persist/state/home/$user/.config/sops-nix/key.txt"
   done
 }
 
-install() {
+copy_secure_boot_keys() {
+  mkdir -p "$root/persist/state/var/lib/sbctl/keys"/{db,KEK,PK}
+
+  SOPS_AGE_KEY_FILE="$flake/submodules/secrets/domains/$key/key.txt"
+  export SOPS_AGE_KEY_FILE
+
+  sops --decrypt --extract "['guid']" "$flake/submodules/secrets/domains/lanzaboote/secrets.yaml" > "$root/persist/state/var/lib/sbctl/GUID"
+  sops --decrypt --extract "['keys']['kek']['key']" "$flake/submodules/secrets/domains/lanzaboote/secrets.yaml" > "$root/persist/state/var/lib/sbctl/keys/KEK/KEK.key"
+  sops --decrypt --extract "['keys']['kek']['pem']" "$flake/submodules/secrets/domains/lanzaboote/secrets.yaml" > "$root/persist/state/var/lib/sbctl/keys/KEK/KEK.pem"
+  sops --decrypt --extract "['keys']['pk']['key']" "$flake/submodules/secrets/domains/lanzaboote/secrets.yaml" > "$root/persist/state/var/lib/sbctl/keys/PK/PK.key"
+  sops --decrypt --extract "['keys']['pk']['pem']" "$flake/submodules/secrets/domains/lanzaboote/secrets.yaml" > "$root/persist/state/var/lib/sbctl/keys/PK/PK.pem"
+  sops --decrypt --extract "['keys']['db']['key']" "$flake/submodules/secrets/domains/lanzaboote/secrets.yaml" > "$root/persist/state/var/lib/sbctl/keys/db/db.key"
+  sops --decrypt --extract "['keys']['db']['pem']" "$flake/submodules/secrets/domains/lanzaboote/secrets.yaml" > "$root/persist/state/var/lib/sbctl/keys/db/db.pem"
+
+  chmod 400 "$root/persist/state/var/lib/sbctl/keys"/*/*
+
+  unset SOPS_AGE_KEY_FILE
+
+  mkdir -p "$root/var/lib/sbctl"
+  mount --bind -o X-fstrim.notrim,x-gvfs-hide "$root/persist/state/var/lib/sbctl" "$root/var/lib/sbctl"
+}
+
+install_nixos() {
   nixos-install --root "$root" --flake "$flake#$host" --no-root-passwd
 }
 
+enroll_secure_boot() {
+  sbctl enroll-keys --microsoft
+}
+
 copy_config() {
   echo "Copying configuration..."
-  rm -rf "$root/persist/etc/nixos"
-  cp -r "$flake" "$root/persist/etc/nixos"
-}
-
-finish() {
-  echo "Rebooting system..."
-  trap - EXIT
-  cleanup
-  reboot
+  mkdir -p "$root/persist/user/etc"
+  rm -rf "$root/persist/user/etc/nixos"
+  cp -r "$flake" "$root/persist/user/etc/nixos"
 }
 
 cleanup() {
-  rm -f /tmp/installer.key
-  if [[ -n "$host" && -n "$device" ]]; then disko -m "unmount" "$flake/hosts/$host/format.nix" --arg device "\"$device\""; fi
+  rm -f /tmp/keyfile
+  if [[ -d "$root" ]]; then umount "$root/var/lib/sbctl"; fi
+  if [[ -n "$host" ]]; then disko -m "unmount" "$flake/hosts/$host/format.nix"; fi
   if [[ -d "$root" ]]; then rmdir "$root"; fi
 }
 
-check_root
-check_network
+main() {
+  check_root
+  check_network
 
-if [[ "$#" -lt 1 ]]; then
-  usage
-fi
+  if [[ "$#" -lt 1 ]]; then usage; fi
 
-flake="$(realpath "$1")"
-check_flake
-shift
+  flake="$(realpath "$1")"
+  check_flake
+  shift
 
-mode=""
-host=""
-key=""
-password_file=""
-copy_config_flag="false"
-reboot_flag="false"
+  mode=""
+  host=""
+  key=""
+  enroll_secure_boot_flag="false"
+  copy_config_flag="false"
+  reboot_flag="false"
 
-while getopts "m:h:k:p:cr" opt; do
-  case "$opt" in
-    m) mode="$OPTARG" ;;
-    h) host="$OPTARG" ;;
-    k) key="$OPTARG" ;;
-    p) password_file="$OPTARG" ;;
-    c) copy_config_flag="true" ;;
-    r) reboot_flag="true" ;;
-    *) usage ;;
+  while getopts "m:h:k:scr" opt; do
+    case "$opt" in
+      m) mode="$OPTARG" ;;
+      h) host="$OPTARG" ;;
+      k) key="$OPTARG" ;;
+      s) enroll_secure_boot_flag="true" ;;
+      c) copy_config_flag="true" ;;
+      r) reboot_flag="true" ;;
+      *) usage ;;
+    esac
+  done
+
+  if [[ -z "$mode" || -z "$host" ]]; then usage; fi
+
+  check_host
+  check_key
+  set_password_file
+
+  case "$mode" in
+    install) prepare_disk "destroy,format,mount";;
+    repair) prepare_disk "mount";;
+    *)
+      echo "Invalid mode: $mode"
+      usage
+      ;;
   esac
-done
 
-if [[ -z "$mode" || -z "$host" ]]; then
-  usage
-fi
+  copy_sops_keys
+  copy_secure_boot_keys
 
-check_host
-check_key
-until set_password_file; do echo "Passwords did not match, please try again."; done
+  install_nixos
 
-device=$(grep -oP '(?<=device = ")[^"]+' "$flake/hosts/$host/default.nix")
+  [[ "$enroll_secure_boot_flag" == "true" ]] && enroll_secure_boot
+  [[ "$copy_config_flag" == "true" ]] && copy_config
 
-case "$mode" in
-  install)
-    prepare_disk "destroy,format,mount"
-    copy_keys
-    install
-    if [[ "$copy_config_flag" == "true" ]]; then copy_config; fi
-    if [[ "$reboot_flag" == "true" ]]; then finish; fi
-    ;;
-  repair)
-    prepare_disk "mount"
-    install
-    if [[ "$reboot_flag" == "true" ]]; then finish; fi
-    ;;
-  *)
-    echo "Invalid mode: $mode"
-    usage
-    ;;
-esac
+  cleanup
+
+  [[ "$reboot_flag" == "true" ]] && reboot
+}
+
+main "$@"

hosts/common/configs/system/nix-ld/default.nix

@@ -1,7 +1,4 @@
 { ... }:
 {
-  programs.nix-ld = {
-    enable = true;
-    libraries = [ ];
-  };
+  programs.nix-ld.enable = true;
 }

hosts/common/configs/system/nix-update/default.nix

@@ -0,0 +1,4 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [ nix-update ];
+}

hosts/common/configs/system/nix/default.nix

@@ -1,8 +1,19 @@
 { config, inputs, ... }:
 {
-  sops.secrets."nix/accessTokens/github" = {
-    sopsFile = ../../../../../secrets/personal/secrets.yaml;
-    group = "users";
+  sops = {
+    secrets = {
+      "git/credentials/github.com/public/username".sopsFile =
+        "${inputs.secrets}/domains/personal/secrets.yaml";
+      "git/credentials/github.com/public/password".sopsFile =
+        "${inputs.secrets}/domains/personal/secrets.yaml";
+    };
+
+    templates.nix-access-tokens = {
+      content = ''
+        access-tokens = github.com=${config.sops.placeholder."git/credentials/github.com/public/password"}
+      '';
+      group = "users";
+    };
   };
 
   nix = {
@@ -12,14 +23,18 @@
         "nix-command"
         "flakes"
       ];
+      download-buffer-size = 524288000;
     };
 
-    registry.self.flake = inputs.self;
+    channel.enable = false;
+
     gc.automatic = true;
     optimise.automatic = true;
 
+    registry.self.flake = inputs.self;
+
     extraOptions = ''
-      !include ${config.sops.secrets."nix/accessTokens/github".path}
+      !include ${config.sops.templates.nix-access-tokens.path}
     '';
   };
 }

hosts/common/configs/system/nixpkgs/default.nix

@@ -1,6 +1,7 @@
-{ inputs, ... }:
+{ system, ... }:
 {
-  imports = [ inputs.nur.modules.nixos.default ];
-
-  nixpkgs.config.allowUnfree = true;
+  nixpkgs = {
+    hostPlatform = system;
+    config.allowUnfree = true;
+  };
 }

hosts/common/configs/system/pipewire/default.nix

@@ -8,12 +8,16 @@
     };
     pulse.enable = true;
     jack.enable = true;
-    extraConfig.pipewire-pulse = {
-      pulse.cmd = [
+    extraConfig.pipewire-pulse.pipewire-pulse = {
+      "pulse.cmd" = [
         {
           cmd = "load-module";
           args = "module-switch-on-connect";
         }
+        {
+          cmd = "load-module";
+          args = "module-combine-sink";
+        }
       ];
     };
   };

hosts/common/configs/system/podman/default.nix

@@ -0,0 +1,27 @@
+{ pkgs, inputs, ... }:
+{
+  imports = [ inputs.quadlet-nix.nixosModules.quadlet ];
+
+  virtualisation = {
+    podman.enable = true;
+
+    containers = {
+      enable = true;
+      storage.settings.storage.driver = "btrfs";
+    };
+
+    quadlet = {
+      enable = true;
+      autoEscape = true;
+    };
+  };
+
+  environment = {
+    persistence."/persist/state"."/var/lib/containers".create = "directory";
+
+    systemPackages = with pkgs; [
+      podman-compose
+      kompose
+    ];
+  };
+}

hosts/common/configs/system/power/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  powerManagement.enable = true;
+}

hosts/common/configs/system/powertop/default.nix

@@ -1,5 +0,0 @@
-{ pkgs, ... }:
-{
-  environment.systemPackages = with pkgs; [ powertop ];
-  powerManagement.powertop.enable = true;
-}

hosts/common/configs/system/printing/default.nix

@@ -18,19 +18,19 @@
     };
   };
 
-  environment.persistence."/persist" = {
+  environment.persistence."/persist/state" = {
     "/var/lib/cups/ppd" = { };
     "/var/lib/cups/printers.conf" = { };
   };
 
   systemd = {
     services.cups.after = [
-      config.environment.persistence."/persist"."/var/lib/cups/ppd".mount
-      config.environment.persistence."/persist"."/var/lib/cups/printers.conf".mount
+      config.environment.persistence."/persist/state"."/var/lib/cups/ppd".mount
+      config.environment.persistence."/persist/state"."/var/lib/cups/printers.conf".mount
     ];
     sockets.cups.after = [
-      config.environment.persistence."/persist"."/var/lib/cups/ppd".mount
-      config.environment.persistence."/persist"."/var/lib/cups/printers.conf".mount
+      config.environment.persistence."/persist/state"."/var/lib/cups/ppd".mount
+      config.environment.persistence."/persist/state"."/var/lib/cups/printers.conf".mount
     ];
   };
 }

hosts/common/configs/system/smartmontools/default.nix

@@ -0,0 +1,12 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    smartmontools
+    nvme-cli
+  ];
+
+  services.smartd = {
+    enable = true;
+    defaults.autodetected = "-a -o on -n idle,10 -s (S/../.././02|L/../../7/04)";
+  };
+}

hosts/common/configs/system/sops/default.nix

@@ -8,13 +8,27 @@
   imports = [ inputs.sops-nix.nixosModules.sops ];
 
   environment = {
-    persistence."/persist"."/etc/ssh/ssh_host_ed25519_key" = { };
-    systemPackages = with pkgs; [ sops ];
+    persistence."/persist/state"."/etc/ssh/ssh_host_ed25519_key" = { };
+
+    systemPackages = with pkgs; [
+      sops
+      age
+      ssh-to-age
+    ];
   };
 
-  sops.age = {
-    generateKey = true;
-    sshKeyPaths = [ config.environment.persistence."/persist"."/etc/ssh/ssh_host_ed25519_key".source ];
-    keyFile = "/var/lib/sops-nix/key.txt";
+  sops = {
+    defaultSopsFile = "${inputs.secrets}/hosts/${config.networking.hostName}/secrets.yaml";
+
+    age = {
+      generateKey = true;
+      keyFile = "/var/lib/sops-nix/key.txt";
+
+      sshKeyPaths =
+        if config.environment.impermanence.enable then
+          [ config.environment.persistence."/persist/state"."/etc/ssh/ssh_host_ed25519_key".source ]
+        else
+          [ "/etc/ssh/ssh_host_ed25519_key" ];
+    };
   };
 }

hosts/common/configs/system/ssh/default.nix

@@ -1,12 +1,23 @@
-{ ... }:
+{ inputs, ... }:
 {
-  programs.ssh = {
-    startAgent = true;
+  programs.ssh.knownHosts = {
+    installer.publicKeyFile = "${inputs.secrets}/hosts/installer/ssh_host_ed25519_key.pub";
+    elara.publicKeyFile = "${inputs.secrets}/hosts/elara/ssh_host_ed25519_key.pub";
+    himalia.publicKeyFile = "${inputs.secrets}/hosts/himalia/ssh_host_ed25519_key.pub";
 
-    knownHosts = {
-      installer.publicKeyFile = ../../../../installer/secrets/ssh_host_ed25519_key.pub;
-      eirene.publicKeyFile = ../../../../eirene/secrets/ssh_host_ed25519_key.pub;
-      elara.publicKeyFile = ../../../../elara/secrets/ssh_host_ed25519_key.pub;
+    jupiter = {
+      publicKeyFile = "${inputs.secrets}/hosts/jupiter/ssh_host_ed25519_key.pub";
+      extraHostNames = [ "karaolidis.com" ];
+    };
+
+    jupiter-sish = {
+      publicKeyFile = "${inputs.secrets}/hosts/jupiter/ssh_sish_ed25519_key.pub";
+      extraHostNames = [ "karaolidis.com" ];
+    };
+
+    jupiter-vps = {
+      publicKeyFile = "${inputs.secrets}/hosts/jupiter-vps/ssh_host_ed25519_key.pub";
+      extraHostNames = [ "vps.karaolidis.com" ];
     };
   };
 }

hosts/common/configs/system/sshd/default.nix

@@ -0,0 +1,12 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [ kitty.terminfo ];
+
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      PrintMotd = false;
+    };
+  };
+}

hosts/common/configs/system/sudo/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  security.pam.services.sudo.nodelay = true;
+}

hosts/common/configs/system/system/default.nix

@@ -1,17 +1,4 @@
-{ inputs, ... }:
+{ ... }:
 {
-  system = {
-    autoUpgrade = {
-      enable = true;
-      flake = inputs.self.outPath;
-      flags = [
-        "--update-input"
-        "nixpkgs"
-        "-L"
-      ];
-      dates = "02:00";
-    };
-
-    stateVersion = "24.11";
-  };
+  system.stateVersion = "24.11";
 }

hosts/common/configs/system/timezone/timezone.sh

@@ -1,3 +1,5 @@
+# shellcheck shell=bash
+
 case "$2" in
   connectivity-change)
     if timezone=$(curl --fail https://ipapi.co/timezone); then

hosts/common/configs/system/tlp/default.nix

@@ -1,12 +0,0 @@
-{ ... }:
-{
-  services.tlp = {
-    enable = true;
-    settings = {
-      CPU_SCALING_GOVERNOR_ON_AC = "performance";
-      CPU_SCALING_GOVERNOR_ON_BAT = "powersave";
-      CPU_ENERGY_PERF_POLICY_ON_AC = "performance";
-      CPU_ENERGY_PERF_POLICY_ON_BAT = "power";
-    };
-  };
-}

hosts/common/configs/system/tmux/default.nix

@@ -1,10 +0,0 @@
-{ ... }:
-{
-  programs.tmux = {
-    enable = true;
-    clock24 = true;
-    historyLimit = 10000;
-    keyMode = "vi";
-    newSession = true;
-  };
-}

hosts/common/configs/system/tree/default.nix

@@ -1,4 +0,0 @@
-{ pkgs, ... }:
-{
-  environment.systemPackages = with pkgs; [ tree ];
-}

hosts/common/configs/system/upower/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  services.upower = {
+    enable = true;
+    allowRiskyCriticalPowerAction = true;
+    criticalPowerAction = "Ignore";
+  };
+}

hosts/common/configs/system/wget/default.nix

@@ -1,4 +0,0 @@
-{ pkgs, ... }:
-{
-  environment.systemPackages = with pkgs; [ wget ];
-}

hosts/common/configs/system/zsh/default.nix

@@ -6,7 +6,9 @@
   };
 
   environment = {
-    persistence."/persist"."/var/lib/zsh" = { };
+    persistence."/persist/state"."/var/lib/zsh" = { };
     pathsToLink = [ "/share/zsh" ];
   };
+
+  systemd.tmpfiles.rules = [ "d /var/lib/zsh 0755 root root" ];
 }

hosts/common/configs/user/console/android/default.nix

@@ -1,23 +1,12 @@
-{
-  user ? throw "user argument is required",
-  home ? throw "home argument is required",
-}:
+{ user, home }:
 { config, pkgs, ... }:
 {
-  nixpkgs.overlays = [
-    (final: prev: {
-      android-tools = prev.android-tools.overrideAttrs (oldAttrs: {
-        patches = oldAttrs.patches or [ ] ++ [ ./env-var-user-home.patch ];
-      });
-    })
-  ];
-
   programs.adb.enable = true;
   services.gvfs.enable = true;
 
   users.users.${user}.extraGroups = [ "adbusers" ];
 
-  environment.persistence."/persist" = {
+  environment.persistence."/persist/state" = {
     "${home}/.local/share/android/adbkey" = { };
     "${home}/.local/share/android/adbkey.pub" = { };
   };

hosts/common/configs/user/console/bashmount/default.nix

@@ -1,8 +0,0 @@
-{
-  user ? throw "user argument is required",
-  home ? throw "home argument is required",
-}:
-{ lib, pkgs, ... }:
-{
-  home-manager.users.${user}.programs.bashmount.enable = true;
-}

hosts/common/configs/user/console/brightnessctl/default.nix

@@ -1,13 +1,8 @@
-{
-  user ? throw "user argument is required",
-  home ? throw "home argument is required",
-}:
+{ user, home }:
 { lib, pkgs, ... }:
 {
   users.users.${user}.extraGroups = [
     "video"
     "inputs"
   ];
-
-  home-manager.users.${user}.home.packages = with pkgs; [ brightnessctl ];
 }

hosts/common/configs/user/console/btop/default.nix

@@ -1,20 +1,34 @@
+{ user, home }:
+{ lib, pkgs, ... }:
 {
-  user ? throw "user argument is required",
-  home ? throw "home argument is required",
-}:
-{ ... }:
-{
-  home-manager.users.${user}.programs.btop = {
-    enable = true;
-    settings = {
-      theme_background = false;
-      presets = "";
-      vim_keys = true;
-      shown_boxes = "cpu mem net proc gpu0 gpu1";
-      update_ms = 1000;
-      proc_tree = true;
-      cpu_single_graph = true;
-      disks_filter = "/ /nix /persist /cache";
+  home-manager.users.${user} = {
+    programs.btop = {
+      enable = true;
+      settings = {
+        color_theme = "matugen";
+        theme_background = false;
+        presets = "";
+        vim_keys = true;
+        shown_boxes = "cpu mem net proc gpu0 gpu1";
+        update_ms = 1000;
+        proc_tree = true;
+        cpu_single_graph = true;
+        disks_filter = "/ /nix /persist";
+      };
+    };
+
+    theme = {
+      template.".config/btop/themes/matugen.theme".source = ./theme.theme;
+
+      reloadExtraConfig = "${
+        lib.meta.getExe (
+          pkgs.writeShellApplication {
+            name = "reload-btop";
+            runtimeInputs = with pkgs; [ procps ];
+            text = "exec pkill btop -SIGUSR2";
+          }
+        )
+      } &";
     };
   };
 }

hosts/common/configs/user/console/dive/default.nix

@@ -0,0 +1,19 @@
+{ user, home }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  hmConfig = config.home-manager.users.${user};
+in
+{
+  home-manager.users.${user} = {
+    home.packages = with pkgs; [ dive ];
+
+    xdg.configFile."dive/config.yaml" = lib.mkIf (
+      config.virtualisation.podman.enable || hmConfig.services.podman.enable
+    ) { source = (pkgs.formats.yaml { }).generate "config.yaml" { container-engine = "podman"; }; };
+  };
+}

hosts/common/configs/user/console/docker/default.nix

@@ -1,55 +0,0 @@
-{
-  user ? throw "user argument is required",
-  home ? throw "home argument is required",
-  rootless ? true,
-}:
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-lib.mkMerge [
-  {
-    virtualisation.docker.rootless = {
-      enable = rootless;
-      setSocketVariable = true;
-      enableOnBoot = false;
-      storageDriver = "btrfs";
-
-      daemon.settings = {
-        experimental = true;
-        ipv6 = true;
-        fixed-cidr-v6 = "fd00::/80";
-      };
-
-      autoPrune = {
-        enable = true;
-        flags = [ "--all" ];
-      };
-    };
-
-    home-manager.users.${user}.home = {
-      packages = with pkgs; [ docker-compose ];
-
-      sessionVariables = {
-        DOCKER_CONFIG = "${home}/.config/docker";
-      };
-    };
-  }
-  (lib.mkIf rootless {
-    environment.persistence."/persist"."${home}/.local/share/docker" = { };
-
-    systemd.user = {
-      services.docker.after = [
-        config.environment.persistence."/persist"."${home}/.local/share/docker".mount
-      ];
-      sockets.docker.after = [
-        config.environment.persistence."/persist"."${home}/.local/share/docker".mount
-      ];
-    };
-  })
-  (lib.mkIf (!rootless) {
-    users.users.${user}.extraGroups = [ "docker" ];
-  })
-]

hosts/common/configs/user/console/fastfetch/default.nix

@@ -1,7 +1,4 @@
-{
-  user ? throw "user argument is required",
-  home ? throw "home argument is required",
-}:
+{ user, home }:
 { ... }:
 {
   home-manager.users.${user}.programs.fastfetch.enable = true;

hosts/common/configs/user/console/ffmpeg/default.nix

@@ -1,8 +1,8 @@
-{
-  user ? throw "user argument is required",
-  home ? throw "home argument is required",
-}:
+{ user, home }:
 { pkgs, ... }:
 {
-  home-manager.users.${user}.home.packages = with pkgs; [ ffmpeg ];
+  home-manager.users.${user}.home.packages = with pkgs; [
+    ffmpeg
+    mediainfo
+  ];
 }

hosts/common/configs/user/console/git/commit-msg.sh

@@ -1,3 +1,5 @@
+# shellcheck shell=bash
+
 git interpret-trailers --if-exists doNothing --trailer \
   "Signed-off-by: $(git config user.name) <$(git config user.email)>" \
   --in-place "$1"

hosts/common/configs/user/console/git/default.nix

@@ -1,7 +1,4 @@
-{
-  user ? throw "user argument is required",
-  home ? throw "home argument is required",
-}:
+{ user, home }:
 {
   config,
   lib,

hosts/common/configs/user/console/gpg-agent/default.nix

@@ -1,7 +1,4 @@
-{
-  user ? throw "user argument is required",
-  home ? throw "home argument is required",
-}:
+{ user, home }:
 {
   config,
   lib,
@@ -23,6 +20,7 @@
       enable = true;
       defaultCacheTtl = 31536000;
       maxCacheTtl = 31536000;
+      pinentry.package = pkgs.pinentry-tty;
     };
 
     systemd.user = {

hosts/common/configs/user/console/gpg-agent/import-gpg-keys.sh

@@ -1,3 +1,5 @@
+# shellcheck shell=bash
+
 install -d -m 700 "$GNUPGHOME"
 
 KEYS="$HOME/.config/sops-nix/secrets/gpg"

hosts/common/configs/user/console/home-manager/default.nix

@@ -1,7 +1,4 @@
-{
-  user ? throw "user argument is required",
-  home ? throw "home argument is required",
-}:
+{ user, home }:
 { config, inputs, ... }:
 {
   imports = [ inputs.home-manager.nixosModules.default ];
@@ -9,9 +6,7 @@
   programs.dconf.enable = true;
 
   home-manager = {
-    extraSpecialArgs = {
-      inherit inputs;
-    };
+    extraSpecialArgs = { inherit inputs; };
     backupFileExtension = "bak";
     useUserPackages = true;
     useGlobalPkgs = true;

hosts/common/configs/user/console/imagemagick/default.nix

@@ -1,7 +1,4 @@
-{
-  user ? throw "user argument is required",
-  home ? throw "home argument is required",
-}:
+{ user, home }:
 { pkgs, ... }:
 {
   home-manager.users.${user}.home.packages = with pkgs; [ imagemagick ];

hosts/common/configs/user/console/ip/default.nix

@@ -0,0 +1,12 @@
+{ user, home }:
+{ pkgs, ... }:
+{
+  home-manager.users.${user}.home.packages = with pkgs; [
+    iproute2
+    iptables
+    ipset
+    ethtool
+    tcpdump
+    ipcalc
+  ];
+}

hosts/common/configs/user/console/jq/default.nix

@@ -1,7 +1,4 @@
-{
-  user ? throw "user argument is required",
-  home ? throw "home argument is required",
-}:
+{ user, home }:
 { ... }:
 {
   home-manager.users.${user}.programs.jq.enable = true;

hosts/common/configs/user/console/kubernetes/default.nix

@@ -1,7 +1,4 @@
-{
-  user ? throw "user argument is required",
-  home ? throw "home argument is required",
-}:
+{ user, home }:
 {
   config,
   lib,
@@ -9,51 +6,19 @@
   ...
 }:
 {
-  nixpkgs.overlays = [
-    (final: prev: {
-      k9s = prev.k9s.overrideAttrs (oldAttrs: {
-        patches = oldAttrs.patches or [ ] ++ [ ./remove-splash.patch ];
-      });
-    })
-  ];
-
   environment.persistence = {
-    "/persist"."${home}/.kube" = { };
-    "/cache"."${home}/.kube/cache" = { };
-  };
-
-  users.users.${user}.extraGroups = [ "kubernetes" ];
-
-  sops.secrets = {
-    "kubernetes/accounts/${user}/crt" = {
-      key = "kubernetes/accounts/users/crt";
-      group = "users";
-      mode = "0440";
-    };
-
-    "kubernetes/accounts/${user}/key" = {
-      key = "kubernetes/accounts/users/key";
-      group = "users";
-      mode = "0440";
-    };
+    "/persist/user"."${home}/.kube" = { };
+    "/persist/cache"."${home}/.kube/cache" = { };
   };
 
   home-manager.users.${user} = {
-    home = {
-      packages = with pkgs; [
-        kubectl
-        kustomize
-        kubernetes-helm
-        kompose
-      ];
-
-      file.".kube/local".source = config.services.kubernetes.lib.mkKubeConfig user {
-        caFile = config.sops.secrets."kubernetes/ca/crt".path;
-        certFile = config.sops.secrets."kubernetes/accounts/${user}/crt".path;
-        keyFile = config.sops.secrets."kubernetes/accounts/${user}/key".path;
-        server = config.services.kubernetes.apiserverAddress;
-      };
-    };
+    home.packages = with pkgs; [
+      kubectl
+      kustomize
+      kubernetes-helm
+      kompose
+      kind
+    ];
 
     programs = {
       k9s = {
@@ -67,19 +32,20 @@
           ui = {
             skin = "matugen";
             logoless = true;
+            splashless = true;
             reactive = true;
           };
         };
       };
 
       zsh = {
-        initExtra = ''
+        initContent = ''
           kubeswitch() {
             local target="$HOME/.kube/$1"
             local config="$HOME/.kube/config"
 
             if [[ -f "$target" && "$target" != "$config" ]]; then
-              ln -sf "$target" "$config"
+              ln -srf "$target" "$config"
               echo "Switched kube context to $1"
               p10k reload
             else
@@ -101,6 +67,6 @@
       };
     };
 
-    theme.template."${home}/.config/k9s/skins/matugen.yaml".source = ./theme.yaml;
+    theme.template.".config/k9s/skins/matugen.yaml".source = ./theme.yaml;
   };
 }

hosts/common/configs/user/console/kubernetes/remove-splash.patch

@@ -1,123 +0,0 @@
-diff --git a/internal/ui/splash.go b/internal/ui/splash.go
-index bfe58e46..21683c53 100644
---- a/internal/ui/splash.go
-+++ b/internal/ui/splash.go
-@@ -3,14 +3,6 @@
- 
- package ui
- 
--import (
--	"fmt"
--	"strings"
--
--	"github.com/derailed/k9s/internal/config"
--	"github.com/derailed/tview"
--)
--
- // LogoSmall K9s small log.
- var LogoSmall = []string{
- 	` ____  __.________       `,
-@@ -30,42 +22,3 @@ var LogoBig = []string{
- 	`|____|__ \ /____//____  >\______  /_______ \___|`,
- 	`        \/            \/        \/        \/    `,
- }
--
--// Splash represents a splash screen.
--type Splash struct {
--	*tview.Flex
--}
--
--// NewSplash instantiates a new splash screen with product and company info.
--func NewSplash(styles *config.Styles, version string) *Splash {
--	s := Splash{Flex: tview.NewFlex()}
--	s.SetBackgroundColor(styles.BgColor())
--
--	logo := tview.NewTextView()
--	logo.SetDynamicColors(true)
--	logo.SetTextAlign(tview.AlignCenter)
--	s.layoutLogo(logo, styles)
--
--	vers := tview.NewTextView()
--	vers.SetDynamicColors(true)
--	vers.SetTextAlign(tview.AlignCenter)
--	s.layoutRev(vers, version, styles)
--
--	s.SetDirection(tview.FlexRow)
--	s.AddItem(logo, 10, 1, false)
--	s.AddItem(vers, 1, 1, false)
--
--	return &s
--}
--
--func (s *Splash) layoutLogo(t *tview.TextView, styles *config.Styles) {
--	logo := strings.Join(LogoBig, fmt.Sprintf("\n[%s::b]", styles.Body().LogoColor))
--	fmt.Fprintf(t, "%s[%s::b]%s\n",
--		strings.Repeat("\n", 2),
--		styles.Body().LogoColor,
--		logo)
--}
--
--func (s *Splash) layoutRev(t *tview.TextView, rev string, styles *config.Styles) {
--	fmt.Fprintf(t, "[%s::b]Revision [red::b]%s", styles.Body().FgColor, rev)
--}
-diff --git a/internal/ui/splash_test.go b/internal/ui/splash_test.go
-deleted file mode 100644
-index 69b4b50d..00000000
---- a/internal/ui/splash_test.go
-+++ /dev/null
-@@ -1,22 +0,0 @@
--// SPDX-License-Identifier: Apache-2.0
--// Copyright Authors of K9s
--
--package ui_test
--
--import (
--	"testing"
--
--	"github.com/derailed/k9s/internal/config"
--	"github.com/derailed/k9s/internal/ui"
--	"github.com/stretchr/testify/assert"
--)
--
--func TestNewSplash(t *testing.T) {
--	s := ui.NewSplash(config.NewStyles(), "bozo")
--
--	x, y, w, h := s.GetRect()
--	assert.Equal(t, 0, x)
--	assert.Equal(t, 0, y)
--	assert.Equal(t, 15, w)
--	assert.Equal(t, 10, h)
--}
-diff --git a/internal/view/app.go b/internal/view/app.go
-index 4ac7e7c2..2b3a3fc5 100644
---- a/internal/view/app.go
-+++ b/internal/view/app.go
-@@ -35,7 +35,6 @@ import (
- var ExitStatus = ""
- 
- const (
--	splashDelay      = 1 * time.Second
- 	clusterRefresh   = 15 * time.Second
- 	clusterInfoWidth = 50
- 	clusterInfoPad   = 15
-@@ -165,8 +164,7 @@ func (a *App) layout(ctx context.Context) {
- 	}
- 	main.AddItem(flash, 1, 1, false)
- 
--	a.Main.AddPage("main", main, true, false)
--	a.Main.AddPage("splash", ui.NewSplash(a.Styles, a.version), true, true)
-+	a.Main.AddPage("main", main, true, true)
- 	a.toggleHeader(!a.Config.K9s.IsHeadless(), !a.Config.K9s.IsLogoless())
- }
- 
-@@ -520,10 +518,7 @@ func (a *App) Run() error {
- 	a.Resume()
- 
- 	go func() {
--		<-time.After(splashDelay)
- 		a.QueueUpdateDraw(func() {
--			a.Main.SwitchToPage("main")
--			// if command bar is already active, focus it
- 			if a.CmdBuff().IsActive() {
- 				a.SetFocus(a.Prompt())
- 			}

hosts/common/configs/user/console/libvirt/default.nix

@@ -1,7 +1,4 @@
-{
-  user ? throw "user argument is required",
-  home ? throw "home argument is required",
-}:
+{ user, home }:
 { pkgs, ... }:
 {
   home-manager.users.${user}.dconf.settings = {

hosts/common/configs/user/console/lsof/default.nix

@@ -1,7 +1,4 @@
-{
-  user ? throw "user argument is required",
-  home ? throw "home argument is required",
-}:
+{ user, home }:
 { pkgs, ... }:
 {
   home-manager.users.${user}.home.packages = with pkgs; [ lsof ];

hosts/common/configs/user/console/mprocs/default.nix

@@ -0,0 +1,5 @@
+{ user, home }:
+{ pkgs, ... }:
+{
+  home-manager.users.${user}.home.packages = with pkgs; [ mprocs ];
+}

hosts/common/configs/user/console/ncdu/default.nix

@@ -1,7 +1,4 @@
-{
-  user ? throw "user argument is required",
-  home ? throw "home argument is required",
-}:
+{ user, home }:
 { pkgs, ... }:
 {
   home-manager.users.${user} = {

hosts/common/configs/user/console/ncspot/default.nix

@@ -0,0 +1,28 @@
+{ user, home }:
+{ lib, pkgs, ... }:
+{
+  environment.persistence = {
+    "/persist/state"."${home}/.config/ncspot/userstate.cbor" = { };
+    "/persist/cache"."${home}/.cache/ncspot" = { };
+  };
+
+  home-manager.users.${user} = {
+    programs.ncspot.enable = true;
+
+    theme = {
+      template.".config/ncspot/config.toml".source = ./theme.toml;
+
+      reloadExtraConfig = "${
+        lib.meta.getExe (
+          pkgs.writeShellApplication {
+            name = "reload-ncspot";
+            runtimeInputs = with pkgs; [ netcat ];
+            text = ''
+              printf "reload\n" | nc -W 1 -U "''${XDG_RUNTIME_DIR:-/run/user/$UID}/ncspot/ncspot.sock"
+            '';
+          }
+        )
+      } &";
+    };
+  };
+}

hosts/common/configs/user/console/ncspot/theme.toml

@@ -0,0 +1,26 @@
+use_nerdfont = true
+volnorm = true
+default_keybindings = true
+library_tabs = [ "albums", "artists", "playlists", "browse" ]
+
+[keybindings]
+"Esc" = "back"
+
+[theme]
+background = "{{colors.surface.default.hex}}"
+primary = "{{colors.on_surface.default.hex}}"
+secondary = "{{colors.inverse_surface.default.hex}}"
+title = "{{colors.primary.default.hex}}"
+playing = "{{colors.primary.default.hex}}"
+playing_bg = "{{colors.surface.default.hex}}"
+highlight = "{{colors.on_primary.default.hex}}"
+highlight_bg = "{{colors.primary.default.hex}}"
+playing_selected = "{{colors.on_primary.default.hex}}"
+error = "{{colors.on_error.default.hex}}"
+error_bg = "{{colors.error.default.hex}}"
+statusbar = "{{colors.primary.default.hex}}"
+statusbar_progress = "{{colors.primary.default.hex}}"
+statusbar_bg = "{{colors.surface.default.hex}}"
+cmdline = "{{colors.on_surface.default.hex}}"
+cmdline_bg = "{{colors.surface.default.hex}}"
+search_match = "{{colors.tertiary.default.hex}}"

hosts/common/configs/user/console/neovim/default.nix

@@ -1,25 +1,203 @@
+{ user, home }:
+{ inputs, ... }:
 {
-  user ? throw "user argument is required",
-  home ? throw "home argument is required",
-}:
-{ ... }:
-{
-  home-manager.users.${user}.programs = {
-    neovim = {
-      enable = true;
-      defaultEditor = true;
-      viAlias = true;
-      vimAlias = true;
-      vimdiffAlias = true;
-      extraConfig = ''
-        set tabstop=2
-        set shiftwidth=2
-        set expandtab
-        set smartindent
-        set mouse=
-      '';
-    };
+  environment.persistence = {
+    "/persist/state"."${home}/.local/share/nvf" = { };
+    "/persist/cache"."${home}/.cache/nvf" = { };
+  };
 
-    zsh.p10k.extraRightPromptElements = [ "vim_shell" ];
+  home-manager.users.${user} = {
+    imports = [ inputs.nvf.homeManagerModules.default ];
+
+    programs = {
+      nvf = {
+        enable = true;
+        defaultEditor = true;
+
+        settings = {
+          vim = {
+            enableLuaLoader = true;
+
+            viAlias = true;
+            vimAlias = true;
+
+            # autocomplete = {
+            #   blink-cmp.enable = true;
+            #   enableSharedCmpSources = true;
+            # };
+
+            binds = {
+              hardtime-nvim.enable = true;
+              whichKey.enable = true;
+            };
+
+            clipboard = {
+              enable = true;
+              providers.wl-copy.enable = true;
+              registers = "unnamedplus";
+            };
+
+            comments = {
+              comment-nvim.enable = true;
+            };
+
+            # dashboard = {
+            #   alpha.enable = true;
+            # };
+
+            filetree = {
+              neo-tree = {
+                enable = true;
+                setupOpts = {
+                  git_status_async = true;
+
+                  filesystem = {
+                    position = "current";
+                    hijack_netrw_behavior = "open_current";
+                  };
+                };
+              };
+            };
+
+            # formatter = {
+            #   conform-nvim.enable = true;
+            # };
+
+            git = {
+              enable = true;
+              # git-conflict.enable = true;
+              gitsigns.enable = true;
+              # neogit.enable = true;
+            };
+
+            languages = {
+              enableDAP = true;
+              enableFormat = true;
+              enableTreesitter = true;
+              enableExtraDiagnostics = true;
+
+              assembly.enable = true;
+              bash.enable = true;
+              clang.enable = true;
+              csharp.enable = true;
+              css.enable = true;
+              go.enable = true;
+              html.enable = true;
+              java.enable = true;
+              lua.enable = true;
+              markdown.enable = true;
+              nix = {
+                enable = true;
+                format.type = "nixfmt";
+              };
+              php.enable = true;
+              python.enable = true;
+              rust.enable = true;
+              sql.enable = true;
+              svelte.enable = true;
+              ts.enable = true;
+              yaml.enable = true;
+            };
+
+            lsp = {
+              enable = true;
+              formatOnSave = true;
+              # nvim-docs-view.enable = true;
+              # otter-nvim.enable = true;
+              # trouble.enable = true;
+            };
+
+            # minimap = {
+            #   codewindow.enable = true;
+            # };
+
+            notify = {
+              nvim-notify.enable = true;
+            };
+
+            options = {
+              tabstop = 2;
+              shiftwidth = 2;
+              expandtab = true;
+              smartindent = true;
+            };
+
+            # projects = {
+            #   project-nvim.enable = true;
+            # };
+
+            searchCase = "smart";
+
+            # snippets = {
+            #   luasnip.enable = true;
+            # };
+
+            # tabline = {
+            #   nvimBufferline.enable = true;
+            # };
+
+            telescope = {
+              enable = true;
+            };
+
+            terminal = {
+              toggleterm = {
+                enable = true;
+                setupOpts.winbar.enabled = false;
+              };
+            };
+
+            treesitter = {
+              enable = true;
+              context.enable = true;
+              fold = true;
+              textobjects.enable = true;
+            };
+
+            ui = {
+              # breadcrumbs = {
+              #   enable = true;
+              #   navbuddy.enable = true;
+              # };
+              colorizer.enable = true;
+              # fastaction.enable = true;
+              # illuminate.enable = true;
+            };
+
+            undoFile.enable = true;
+
+            utility = {
+              # diffview-nvim.enable = true;
+              # icon-picker.enable = true;
+              # images = {
+              #   img-clip.enable = true;
+              # };
+              # mkdir.enable = true;
+              motion = {
+                precognition.enable = true;
+              };
+              # multicursors.enable = true;
+              # nvim-biscuits.enable = true;
+              # smart-splits.enable = true;
+              # surround.enable = true;
+              # undotree.enable = true;
+              # yazi-nvim.enable = true;
+            };
+
+            visuals = {
+              # cinnamon-nvim.enable = true;
+              # fidget-nvim.enable = true;
+              # highlight-undo.enable = true;
+              indent-blankline.enable = true;
+              nvim-cursorline.enable = true;
+              # nvim-scrollbar.enable = true;
+              nvim-web-devicons.enable = true;
+            };
+          };
+        };
+      };
+
+      zsh.p10k.extraRightPromptElements = [ "vim_shell" ];
+    };
   };
 }

hosts/common/configs/user/console/nix-cleanup/default.nix

@@ -1,7 +1,4 @@
-{
-  user ? throw "user argument is required",
-  home ? throw "home argument is required",
-}:
+{ user, home }:
 { ... }:
 {
   home-manager.users.${user}.programs.zsh.shellAliases.ncl = "sudo nix-cleanup";

hosts/common/configs/user/console/nix-develop/default.nix

@@ -1,7 +1,4 @@
-{
-  user ? throw "user argument is required",
-  home ? throw "home argument is required",
-}:
+{ user, home }:
 {
   lib,
   inputs,
@@ -12,7 +9,7 @@
   home-manager.users.${user}.programs.zsh = {
     shellAliases.nd = "nix-develop";
 
-    initExtra =
+    initContent =
       let
         devShells = lib.strings.concatStringsSep " " (
           lib.attrsets.mapAttrsToList (key: _: key) inputs.self.devShells.${system}
@@ -35,7 +32,16 @@
           done
 
           if [[ -z "$devshell" ]]; then
-            if [ ! -f flake.nix ]; then cp "${./template.nix}" flake.nix; fi
+            if [ ! -f flake.nix ]; then
+              cp "${./template.nix}" flake.nix
+              chmod 755 flake.nix
+            fi
+
+            if [ ! treefmt.nix ]; then
+              cp "${./treefmt.nix}" treefmt.nix
+              chmod 755 treefmt.nix
+            fi
+
             nix develop -c "$SHELL"
           else
             nix develop self#"$devshell" -c "$SHELL"

hosts/common/configs/user/console/nix-develop/template.nix

@@ -1,30 +1,31 @@
 {
   inputs = {
-    nixpkgs = {
-      type = "github";
-      owner = "karaolidis";
-      repo = "nixpkgs";
-      ref = "integration";
-    };
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
 
-    flake-utils = {
-      url = "github:numtide/flake-utils";
+    treefmt-nix = {
+      url = "github:numtide/treefmt-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
   };
 
   outputs =
-    { nixpkgs, ... }@inputs:
-    inputs.flake-utils.lib.eachDefaultSystem (
-      system:
+    inputs:
+    (
       let
-        pkgs = nixpkgs.legacyPackages.${system};
-      in
-      {
-        devShells.default = pkgs.mkShell {
-          packages = [ ];
+        system = "x86_64-linux";
+
+        pkgs = import inputs.nixpkgs {
+          inherit system;
+          config.allowUnfree = true;
         };
 
-        formatter = pkgs.nixfmt-rfc-style;
+        treefmt = inputs.treefmt-nix.lib.evalModule pkgs ./treefmt.nix;
+      in
+      {
+        devShells.${system}.default = pkgs.mkShell { packages = with pkgs; [ ]; };
+
+        formatter.${system} = treefmt.config.build.wrapper;
+        checks.formatting.${system} = treefmt.config.build.check inputs.self;
       }
     );
 }

hosts/common/configs/user/console/nix-develop/treefmt.nix

@@ -0,0 +1,13 @@
+{ ... }:
+{
+  projectRootFile = "flake.nix";
+
+  programs = {
+    nixfmt = {
+      enable = true;
+      strict = true;
+    };
+  };
+
+  settings.global.excludes = [ ".envrc" ];
+}

hosts/common/configs/user/console/nix-direnv/default.nix

@@ -1,7 +1,4 @@
-{
-  user ? throw "user argument is required",
-  home ? throw "home argument is required",
-}:
+{ user, home }:
 {
   lib,
   pkgs,
@@ -10,83 +7,19 @@
   ...
 }:
 {
-  home-manager.users.${user} = {
-    programs = {
-      direnv = {
-        enable = true;
-        silent = true;
-        nix-direnv.enable = true;
-        enableZshIntegration = true;
+  home-manager.users.${user}.programs = {
+    direnv = {
+      enable = true;
+      silent = true;
+      nix-direnv.enable = true;
+      enableZshIntegration = true;
+
+      config = {
+        global.warn_timeout = 0;
       };
 
-      zsh = {
-        shellAliases.nde = "nix-direnv";
-
-        initExtra =
-          let
-            devShells = lib.strings.concatStringsSep " " (
-              lib.attrsets.mapAttrsToList (key: _: key) inputs.self.devShells.${system}
-            );
-          in
-          ''
-            nix-direnv() {
-              local devshell=""
-              local hide=false
-
-              while getopts "s:h" opt; do
-                case $opt in
-                  s)
-                    devshell=$OPTARG
-                    ;;
-                  h)
-                    hide=true
-                    ;;
-                  *)
-                    echo "Usage: nix-direnv [-s <devshell>] [-h]"
-                    return 1
-                    ;;
-                esac
-              done
-
-              if [[ -z "$devshell" ]]; then
-                echo "use flake" > .envrc
-                if [ ! -f flake.nix ]; then cp "${../nix-develop/template.nix}" flake.nix; fi
-              else
-                echo "use flake self#$devshell" > .envrc
-              fi
-
-              if hide && git rev-parse --is-inside-work-tree &>/dev/null; then
-                local top
-                top=$(git rev-parse --show-toplevel)
-                if ! grep -q "^\.envrc$" "$top/.gitignore" "$top/.git/info/exclude"; then echo "$(realpath --relative-to="$top" .envrc)" >> "$top/.git/info/exclude"; fi
-                if [ -z "$devshell" ]; then
-                  if ! grep -q "^flake.nix$" "$top/.gitignore" "$top/.git/info/exclude"; then echo "flake.nix" >> "$top/.git/info/exclude"; fi
-                  if ! grep -q "^flake.lock$" "$top/.gitignore" "$top/.git/info/exclude"; then echo "flake.lock" >> "$top/.git/info/exclude"; fi
-                fi
-              fi
-
-              direnv allow
-            }
-
-            _nix-direnv_completion() {
-              local options=(
-                '-s[Dev shell from root flake]:shell:(${devShells})'
-                '-h[Hide .envrc and flake.nix in git]'
-              )
-
-              _arguments -s $options
-            }
-
-            compdef _nix-direnv_completion nix-direnv
-          '';
-
-        p10k.extraRightPromptElements = [ "direnv" ];
-      };
-    };
-
-    # https://github.com/direnv/direnv/wiki/Customizing-cache-location
-    xdg.configFile = {
-      "direnv/direnvrc".text = ''
+      # https://github.com/direnv/direnv/wiki/Customizing-cache-location
+      stdlib = ''
         declare -A direnv_layout_dirs
         direnv_layout_dir() {
           local hash path
@@ -97,17 +30,89 @@
           )}"
         }
       '';
+    };
 
-      "direnv/direnv.toml".source = (
-        (pkgs.formats.toml { }).generate "direnv.toml" {
-          global.warn_timeout = 0;
-        }
-      );
+    zsh = {
+      shellAliases.nde = "nix-direnv";
+
+      initContent =
+        let
+          devShells = lib.strings.concatStringsSep " " (
+            lib.attrsets.mapAttrsToList (key: _: key) inputs.self.devShells.${system}
+          );
+        in
+        ''
+          nix-direnv() {
+            local devshell=""
+            local hide=false
+
+            while getopts "s:h" opt; do
+              case $opt in
+                s)
+                  devshell="$OPTARG"
+                  ;;
+                h)
+                  hide=true
+                  ;;
+                *)
+                  echo "Usage: nix-direnv [-s <devshell>] [-h]"
+                  return 1
+                  ;;
+              esac
+            done
+
+            if [[ -z "$devshell" ]]; then
+              if "$hide"; then
+                echo "use flake path:." > .envrc;
+              else
+                echo "use flake" > .envrc;
+              fi
+
+              if [ ! -f flake.nix ]; then
+                cp "${../nix-develop/template.nix}" flake.nix
+                chmod 755 flake.nix
+              fi
+
+              if [ ! -f treefmt.nix ]; then
+                cp "${../nix-develop/treefmt.nix}" treefmt.nix
+                chmod 755 treefmt.nix
+              fi
+            else
+              echo "use flake self#$devshell" > .envrc
+            fi
+
+            if "$hide" && git rev-parse --is-inside-work-tree &>/dev/null; then
+              local top
+              top="$(git rev-parse --show-toplevel)"
+              if ! grep -q "^\.envrc$" "$top/.gitignore" "$top/.git/info/exclude"; then echo "$(realpath --relative-to="$top" .envrc)" >> "$top/.git/info/exclude"; fi
+              if [ -z "$devshell" ]; then
+                if ! grep -q "^flake.nix$" "$top/.gitignore" "$top/.git/info/exclude"; then echo "flake.nix" >> "$top/.git/info/exclude"; fi
+                if ! grep -q "^flake.lock$" "$top/.gitignore" "$top/.git/info/exclude"; then echo "flake.lock" >> "$top/.git/info/exclude"; fi
+                if ! grep -q "^treefmt.nix$" "$top/.gitignore" "$top/.git/info/exclude"; then echo "treefmt.nix" >> "$top/.git/info/exclude"; fi
+              fi
+            fi
+
+            direnv allow
+          }
+
+          _nix-direnv_completion() {
+            local options=(
+              '-s[Dev shell from root flake]:shell:(${devShells})'
+              '-h[Hide .envrc and flake.nix in git]'
+            )
+
+            _arguments -s $options
+          }
+
+          compdef _nix-direnv_completion nix-direnv
+        '';
+
+      p10k.extraRightPromptElements = [ "direnv" ];
     };
   };
 
   environment.persistence = {
-    "/persist"."${home}/.local/share/direnv/allow" = { };
-    "/cache"."${home}/.cache/direnv" = { };
+    "/persist/state"."${home}/.local/share/direnv/allow" = { };
+    "/persist/cache"."${home}/.cache/direnv" = { };
   };
 }

hosts/common/configs/user/console/nix/default.nix

@@ -1,13 +1,14 @@
+{ user, home }:
+{ pkgs, ... }:
 {
-  user ? throw "user argument is required",
-  home ? throw "home argument is required",
-}:
-{ ... }:
-{
-  environment.persistence."/cache"."${home}/.cache/nix" = { };
+  environment.persistence."/persist/cache"."${home}/.cache/nix" = { };
 
-  home-manager.users.${user}.programs.zsh.shellAliases = {
-    nrs = "sudo nixos-rebuild switch --flake .#$(hostname) --show-trace";
-    nrb = "sudo nixos-rebuild boot --flake .#$(hostname) --show-trace";
+  home-manager.users.${user} = {
+    home.packages = with pkgs; [ nurl ];
+
+    programs.zsh.shellAliases = {
+      nrs = "sudo nixos-rebuild switch --flake .#$(hostname) --show-trace";
+      nrb = "sudo nixos-rebuild boot --flake .#$(hostname) --show-trace";
+    };
   };
 }

hosts/common/configs/user/console/nixpkgs/default.nix

@@ -1,10 +0,0 @@
-{
-  user ? throw "user argument is required",
-  home ? throw "home argument is required",
-}:
-{ inputs, ... }:
-{
-  home-manager.users.${user} = {
-    imports = [ inputs.nur.modules.homeManager.default ];
-  };
-}

hosts/common/configs/user/console/ouch/default.nix

@@ -0,0 +1,5 @@
+{ user, home }:
+{ pkgs, ... }:
+{
+  home-manager.users.${user}.home.packages = with pkgs; [ ouch ];
+}

hosts/common/configs/user/console/pipewire/default.nix

@@ -1,19 +1,17 @@
-{
-  user ? throw "user argument is required",
-  home ? throw "home argument is required",
-}:
+{ user, home }:
 { config, pkgs, ... }:
 {
-  environment.persistence."/persist"."${home}/.local/state/wireplumber" = { };
+  environment.persistence."/persist/state"."${home}/.local/state/wireplumber" = { };
 
   systemd.user.services.wireplumber.after = [
-    config.environment.persistence."/persist"."${home}/.local/state/wireplumber".mount
+    config.environment.persistence."/persist/state"."${home}/.local/state/wireplumber".mount
   ];
 
   home-manager.users.${user} = {
     home.packages = with pkgs; [
       wireplumber
       playerctl
+      easyeffects
     ];
 
     services.playerctld.enable = true;

hosts/common/configs/user/console/podman/default.nix

@@ -0,0 +1,33 @@
+{ user, home }:
+{
+  lib,
+  pkgs,
+  inputs,
+  ...
+}:
+{
+  environment.persistence."/persist/state"."${home}/.local/share/containers".create = "directory";
+
+  home-manager.users.${user} = {
+    imports = [ inputs.quadlet-nix.homeManagerModules.quadlet ];
+
+    services.podman = {
+      enable = true;
+      settings.storage.storage.driver = "btrfs";
+    };
+
+    virtualisation.quadlet = {
+      enable = true;
+      autoEscape = true;
+    };
+
+    home = {
+      packages = with pkgs; [
+        podman-compose
+        kompose
+      ];
+
+      sessionVariables.REGISTRY_AUTH_FILE = "${home}/.config/containers/auth.json";
+    };
+  };
+}

hosts/common/configs/user/console/ranger/default.nix

@@ -1,21 +0,0 @@
-{
-  user ? throw "user argument is required",
-  home ? throw "home argument is required",
-}:
-{ ... }:
-{
-  environment.persistence."/cache"."${home}/.cache/ranger" = { };
-
-  home-manager.users.${user}.programs = {
-    ranger = {
-      enable = true;
-
-      settings = {
-        preview_images = true;
-        preview_images_method = "kitty";
-      };
-    };
-
-    zsh.p10k.extraRightPromptElements = [ "ranger" ];
-  };
-}