feat(tailscale): disable for now, ssh works without

Reviewed-on: #137

.github/workflows/main.yml

@@ -0,0 +1,24 @@
+name: "Flake.lock: update Nix dependencies"
+
+on:
+  workflow_dispatch: # allows manual triggering
+  schedule:
+    - cron: '0 16 * * *' # runs weekly on Sunday at 00:00
+
+jobs:
+  nix-flake-update:
+    permissions:
+      contents: write
+      id-token: write
+      issues: write
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: DeterminateSystems/determinate-nix-action@v3
+      - uses: DeterminateSystems/update-flake-lock@main
+        with:
+          pr-title: "Update Nix flake inputs"
+          pr-labels: |                  
+            dependencies
+            automated

flake.lock

@@ -10,11 +10,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1754433428,
-        "narHash": "sha256-NA/FT2hVhKDftbHSwVnoRTFhes62+7dxZbxj5Gxvghs=",
+        "lastModified": 1770165109,
+        "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "9edb1787864c4f59ae5074ad498b6272b3ec308d",
+        "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb",
         "type": "github"
       },
       "original": {
@@ -29,11 +29,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1758493304,
-        "narHash": "sha256-A1xuSrELZIZhoKejIME0yemc9KlxZp/tKNxrF4LHrcw=",
+        "lastModified": 1772965444,
+        "narHash": "sha256-VjcI4CozsowxGkZBzxQ6LYe49e9T1qfT1BzNrnc96y0=",
         "owner": "9001",
         "repo": "copyparty",
-        "rev": "1923a258797285ac75487d3d53665063a5bd67df",
+        "rev": "981a7cd9dda0acedbc7f53b2c44adb241c38cb84",
         "type": "github"
       },
       "original": {
@@ -64,7 +64,62 @@
         "type": "github"
       }
     },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "nix-citizen",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772408722,
+        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib"
+      },
+      "locked": {
+        "lastModified": 1772408722,
+        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_3": {
       "inputs": {
         "nixpkgs-lib": [
           "nixvim",
@@ -72,11 +127,32 @@
         ]
       },
       "locked": {
-        "lastModified": 1756770412,
-        "narHash": "sha256-+uWLQZccFHwqpGqr2Yt5VsW/PbeJVTn9Dk6SHWhNRPw=",
+        "lastModified": 1769996383,
+        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "4524271976b625a4a605beefd893f270620fd751",
+        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_4": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "nur",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1733312601,
+        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
         "type": "github"
       },
       "original": {
@@ -100,21 +176,48 @@
         "type": "github"
       }
     },
-    "flake-utils_2": {
+    "git-hooks": {
       "inputs": {
-        "systems": "systems_2"
+        "flake-compat": "flake-compat",
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "nix-gaming",
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "lastModified": 1772893680,
+        "narHash": "sha256-JDqZMgxUTCq85ObSaFw0HhE+lvdOre1lx9iI6vYyOEs=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "8baab586afc9c9b57645a734c820e4ac0a604af9",
         "type": "github"
       },
       "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "nix-gaming",
+          "git-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
         "type": "github"
       }
     },
@@ -146,11 +249,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758464306,
-        "narHash": "sha256-i56XRXqjwJRdVYmpzVUQ0ktqBBHqNzQHQMQvFRF/acQ=",
+        "lastModified": 1772985285,
+        "narHash": "sha256-wEEmvfqJcl9J0wyMgMrj1TixOgInBW/6tLPhWGoZE3s=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "939e91e1cff1f99736c5b02529658218ed819a2a",
+        "rev": "5be5d8245cbc7bc0c09fbb5f38f23f223c543f85",
         "type": "github"
       },
       "original": {
@@ -159,52 +262,69 @@
         "type": "github"
       }
     },
-    "home-manager_3": {
+    "nix-citizen": {
       "inputs": {
-        "nixpkgs": [
-          "zen-browser",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1752603129,
-        "narHash": "sha256-S+wmHhwNQ5Ru689L2Gu8n1OD6s9eU9n9mD827JNR+kw=",
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "rev": "e8c19a3cec2814c754f031ab3ae7316b64da085b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "type": "github"
-      }
-    },
-    "ixx": {
-      "inputs": {
-        "flake-utils": [
-          "nixvim",
-          "nuschtosSearch",
-          "flake-utils"
+        "flake-parts": "flake-parts",
+        "nix-gaming": [
+          "nix-gaming"
         ],
+        "nix-github-actions": "nix-github-actions",
+        "nixpkgs": "nixpkgs_2",
+        "systems": "systems_2",
+        "treefmt-nix": "treefmt-nix"
+      },
+      "locked": {
+        "lastModified": 1772840927,
+        "narHash": "sha256-WdIuEJpH7eUP3ya8laJAYf71WilE4x7xetgMferL5Ko=",
+        "owner": "LovingMelody",
+        "repo": "nix-citizen",
+        "rev": "73c8d04ba69fb0bb5c4521c4b91a930a0ce283a5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "LovingMelody",
+        "repo": "nix-citizen",
+        "type": "github"
+      }
+    },
+    "nix-gaming": {
+      "inputs": {
+        "flake-parts": "flake-parts_2",
+        "git-hooks": "git-hooks",
+        "nixpkgs": "nixpkgs_3"
+      },
+      "locked": {
+        "lastModified": 1772937574,
+        "narHash": "sha256-Yw1tP/ASebNYuW2GcYDTgWf2Mg9qcUYo6MTagXyeFCs=",
+        "owner": "fufexan",
+        "repo": "nix-gaming",
+        "rev": "d2b0b283deb24cdbb2750e658fa7001fee5ad586",
+        "type": "github"
+      },
+      "original": {
+        "owner": "fufexan",
+        "repo": "nix-gaming",
+        "type": "github"
+      }
+    },
+    "nix-github-actions": {
+      "inputs": {
         "nixpkgs": [
-          "nixvim",
-          "nuschtosSearch",
+          "nix-citizen",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1754860581,
-        "narHash": "sha256-EM0IE63OHxXCOpDHXaTyHIOk2cNvMCGPqLt/IdtVxgk=",
-        "owner": "NuschtOS",
-        "repo": "ixx",
-        "rev": "babfe85a876162c4acc9ab6fb4483df88fa1f281",
+        "lastModified": 1737420293,
+        "narHash": "sha256-F1G5ifvqTpJq7fdkT34e/Jy9VCyzd5XfJ9TO8fHhJWE=",
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "rev": "f4158fa080ef4503c8f4c820967d946c2af31ec9",
         "type": "github"
       },
       "original": {
-        "owner": "NuschtOS",
-        "ref": "v0.1.1",
-        "repo": "ixx",
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
         "type": "github"
       }
     },
@@ -223,13 +343,60 @@
         "type": "indirect"
       }
     },
+    "nixpkgs-lib": {
+      "locked": {
+        "lastModified": 1772328832,
+        "narHash": "sha256-e+/T/pmEkLP6BHhYjx6GmwP5ivonQQn0bJdH9YrRB+Q=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "c185c7a5e5dd8f9add5b2f8ebeff00888b070742",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1758277210,
-        "narHash": "sha256-iCGWf/LTy+aY0zFu8q12lK8KuZp7yvdhStehhyX1v8w=",
+        "lastModified": 1772624091,
+        "narHash": "sha256-QKyJ0QGWBn6r0invrMAK8dmJoBYWoOWy7lN+UHzW1jc=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "80bdc1e5ce51f56b19791b52b2901187931f5353",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1772736753,
+        "narHash": "sha256-au/m3+EuBLoSzWUCb64a/MZq6QUtOV8oC0D9tY2scPQ=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "917fec990948658ef1ccd07cef2a1ef060786846",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1772773019,
+        "narHash": "sha256-E1bxHxNKfDoQUuvriG71+f+s/NT0qWkImXsYZNFFfCs=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "8eaee110344796db060382e15d3af0a9fc396e0e",
+        "rev": "aca4d95fce4914b3892661bcb80b8087293536c6",
         "type": "github"
       },
       "original": {
@@ -241,19 +408,18 @@
     },
     "nixvim": {
       "inputs": {
-        "flake-parts": "flake-parts",
+        "flake-parts": "flake-parts_3",
         "nixpkgs": [
           "nixpkgs"
         ],
-        "nuschtosSearch": "nuschtosSearch",
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1758459270,
-        "narHash": "sha256-r2VA33WYfxDJyWmJeo0TmPPrk9yGS9WWb/kld0e7X+I=",
+        "lastModified": 1772402258,
+        "narHash": "sha256-3DmCFOdmbkFML1/G9gj8Wb+rCCZFPOQtNoMCpqOF8SA=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "92ba37a3e8c25d470f9affe8d5f36f2cfb21e5dd",
+        "rev": "21ae25e13b01d3b4cdc750b5f9e7bad68b150c10",
         "type": "github"
       },
       "original": {
@@ -262,26 +428,24 @@
         "type": "github"
       }
     },
-    "nuschtosSearch": {
+    "nur": {
       "inputs": {
-        "flake-utils": "flake-utils_2",
-        "ixx": "ixx",
+        "flake-parts": "flake-parts_4",
         "nixpkgs": [
-          "nixvim",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1758272005,
-        "narHash": "sha256-1u3xTH+3kaHhztPmWtLAD8LF5pTYLR2CpsPFWTFnVtQ=",
-        "owner": "NuschtOS",
-        "repo": "search",
-        "rev": "aa975a3757f28ce862812466c5848787b868e116",
+        "lastModified": 1772985100,
+        "narHash": "sha256-EXFbJvUZrElVq839MnMgJEDnyXWn84Zx+MiHcZiCQmg=",
+        "owner": "nix-community",
+        "repo": "NUR",
+        "rev": "407db2f6f4ba94992815f872ffce9a9d99ccc13c",
         "type": "github"
       },
       "original": {
-        "owner": "NuschtOS",
-        "repo": "search",
+        "owner": "nix-community",
+        "repo": "NUR",
         "type": "github"
       }
     },
@@ -290,9 +454,11 @@
         "agenix": "agenix",
         "copyparty": "copyparty",
         "home-manager": "home-manager_2",
-        "nixpkgs": "nixpkgs_2",
+        "nix-citizen": "nix-citizen",
+        "nix-gaming": "nix-gaming",
+        "nixpkgs": "nixpkgs_4",
         "nixvim": "nixvim",
-        "zen-browser": "zen-browser"
+        "nur": "nur"
       }
     },
     "systems": {
@@ -340,24 +506,24 @@
         "type": "github"
       }
     },
-    "zen-browser": {
+    "treefmt-nix": {
       "inputs": {
-        "home-manager": "home-manager_3",
         "nixpkgs": [
+          "nix-citizen",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1759353433,
-        "narHash": "sha256-g3+737nvjYu3WrxLOiW6Wwtu4Ncdsy1KW9AGSTfzGOM=",
-        "owner": "0xc000022070",
-        "repo": "zen-browser-flake",
-        "rev": "480746c469a2e14551c73940bd096aa9a9cc7cbd",
+        "lastModified": 1772660329,
+        "narHash": "sha256-IjU1FxYqm+VDe5qIOxoW+pISBlGvVApRjiw/Y/ttJzY=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "3710e0e1218041bbad640352a0440114b1e10428",
         "type": "github"
       },
       "original": {
-        "owner": "0xc000022070",
-        "repo": "zen-browser-flake",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
         "type": "github"
       }
     }

flake.nix

@@ -12,24 +12,36 @@
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    nix-citizen = {
+      url = "github:LovingMelody/nix-citizen";
+      inputs.nix-gaming.follows = "nix-gaming";
+    };
+    nix-gaming.url = "github:fufexan/nix-gaming";
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
     nixvim = {
       url = "github:nix-community/nixvim";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    zen-browser = {
-      url = "github:0xc000022070/zen-browser-flake";
+    nur = {
+      url = "github:nix-community/NUR";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    # zen-browser = {
+    #   url = "github:0xc000022070/zen-browser-flake";
+    #   inputs.nixpkgs.follows = "nixpkgs";
+    # };
     # keep-sorted end
   };
 
   outputs =
     {
-      nixpkgs,
-      home-manager,
+      # keep-sorted start
       agenix,
-      zen-browser,
+      home-manager,
+      nixpkgs,
+      nur,
+      # zen-browser,
+      # keep-sorted end
       ...
     }@inputs:
     let
@@ -39,21 +51,30 @@
           userName ? "will",
           system ? "x86_64-linux",
         }:
+        let
+          util = import ./util.nix;
+        in
         nixpkgs.lib.nixosSystem {
           modules = [
             ./hosts/${hostName}/configuration.nix
+            nur.modules.nixos.default
             home-manager.nixosModules.home-manager
             {
               home-manager = {
                 users.${userName}.imports = [
                   ./hosts/${hostName}/home.nix
                   agenix.homeManagerModules.default
-                  zen-browser.homeModules.twilight
+                  # zen-browser.homeModules.twilight
                 ];
                 backupFileExtension = "backup";
                 extraSpecialArgs = {
-                  inherit userName;
-                  inherit hostName;
+                  inherit
+                    inputs
+                    hostName
+                    userName
+                    system
+                    util
+                    ;
                 };
                 useGlobalPkgs = true;
                 useUserPackages = true;
@@ -61,10 +82,13 @@
             }
           ];
           specialArgs = {
-            inherit inputs;
-            inherit hostName;
-            inherit userName;
-            inherit system;
+            inherit
+              inputs
+              hostName
+              userName
+              system
+              util
+              ;
           };
           inherit system;
         };

hosts/desktop/configuration.nix

@@ -1,25 +1,34 @@
 {
+  # keep-sorted start
   userName,
+  util,
+  # keep-sorted end
   ...
 }:
 {
   imports = [
+    # keep-sorted start
     ../../modules/nixos/default.nix
     ./hardware-configuration.nix
-  ];
-
-  # reusable modules
-
-  # keep-sorted start
-  amd-gpu.enable = true;
-  desktop.enable = true;
-  dev.enable = true;
-  external-speakers.enable = true;
-  gaming.enable = true;
-  link2c.enable = true;
-  plasma.enable = true;
-  # keep-sorted end
-  # config
+    # keep-sorted end
+  ]
+  ++ (util.toImports ../../modules/nixos/features [
+    # keep-sorted start
+    "amd-gpu"
+    "external-speakers"
+    "gaming"
+    "link2c"
+    "plasma"
+    "star-citizen"
+    # keep-sorted end
+  ])
+  ++ (util.toImports ../../modules/nixos/bundles [
+    # keep-sorted start
+    "desktop"
+    "dev"
+    "gui"
+    # keep-sorted end
+  ]);
 
   boot.initrd.luks.devices."luks-b164af31-c1c3-4b4e-83c8-eb39802c2027".device =
     "/dev/disk/by-uuid/b164af31-c1c3-4b4e-83c8-eb39802c2027";
@@ -30,8 +39,6 @@
 
   system.stateVersion = "24.11";
 
-  i18n.extraLocaleSettings.LC_ALL = "en_AU.UTF-8";
-
   users.users.${userName} = {
     extraGroups = [
       # keep-sorted start

hosts/desktop/home.nix

@@ -1,18 +1,21 @@
 {
+  # keep-sorted start
   userName,
+  util,
+  # keep-sorted end
   ...
 }:
 {
-  imports = [ ../../modules/home-manager/default.nix ];
-
-  # reusable modules
-
-  # keep-sorted start
-  desktop.enable = true;
-  dev.enable = true;
-  # keep-sorted end 
-
-  # config
+  imports = [
+    ../../modules/home-manager/default.nix
+  ]
+  ++ (util.toImports ../../modules/home-manager/bundles [
+    # keep-sorted start
+    "desktop"
+    "dev"
+    "gui"
+    # keep-sorted end
+  ]);
 
   age.secrets."protonmail-desktop-password".file = ../../secrets/protonmail-desktop-password.age;
 

hosts/laptop/configuration.nix

@@ -1,31 +1,35 @@
 {
+  # keep-sorted start
   userName,
+  util,
+  # keep-sorted end
   ...
 }:
 {
   imports = [
+    # keep-sorted start
     ../../modules/nixos/default.nix
     ./hardware-configuration.nix
-  ];
+    # keep-sorted end
+  ]
+  ++ (util.toImports ../../modules/nixos/features [
+    # keep-sorted start
+    "amd-gpu"
+    "gnome"
+    "tlp"
+    # keep-sorted end
+  ])
+  ++ (util.toImports ../../modules/nixos/bundles [
+    # keep-sorted start
+    "desktop"
+    "dev"
+    "gui"
+    # keep-sorted end
+  ]);
 
-  # reusable modules
+  boot.initrd.luks.devices."luks-c2f5123c-0be0-4357-b383-b3f422e99a34".device = "/dev/disk/by-uuid/c2f5123c-0be0-4357-b383-b3f422e99a34";
 
-  # keep-sorted start
-  amd-gpu.enable = true;
-  desktop.enable = true;
-  dev.enable = true;
-  gnome.enable = true;
-  tlp.enable = true;
-  # keep-sorted end
-
-  # config
-
-  boot.initrd.luks.devices."luks-a7726a9d-535f-44bc-9c0e-adc501fad371".device =
-    "/dev/disk/by-uuid/a7726a9d-535f-44bc-9c0e-adc501fad371";
-
-  system.stateVersion = "24.11";
-
-  i18n.extraLocaleSettings.LC_ALL = "en_AU.UTF-8";
+  system.stateVersion = "25.05";
 
   users.users.${userName} = {
     extraGroups = [

hosts/laptop/hardware-configuration.nix

@@ -14,20 +14,20 @@
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/b772799b-5434-4d5e-b0f9-ab425e36b9a1";
+    { device = "/dev/disk/by-uuid/a240787a-6cc8-4c03-8a01-742adf305b1e";
       fsType = "ext4";
     };
 
-  boot.initrd.luks.devices."luks-de6f14d8-8c7e-4e77-bfe5-264a39ef0bea".device = "/dev/disk/by-uuid/de6f14d8-8c7e-4e77-bfe5-264a39ef0bea";
+  boot.initrd.luks.devices."luks-f7d7a54f-d217-4260-8754-3cac7022e7d5".device = "/dev/disk/by-uuid/f7d7a54f-d217-4260-8754-3cac7022e7d5";
 
   fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/3730-5237";
+    { device = "/dev/disk/by-uuid/B3C9-7C0A";
       fsType = "vfat";
       options = [ "fmask=0077" "dmask=0077" ];
     };
 
   swapDevices =
-    [ { device = "/dev/disk/by-uuid/081de704-5e9a-4e6d-ae8d-df492d0f662c"; }
+    [ { device = "/dev/disk/by-uuid/b07c858a-2bd7-4b9a-aec3-3f9593c461c9"; }
     ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking

hosts/laptop/home.nix

@@ -1,18 +1,21 @@
 {
+  # keep-sorted start
   userName,
+  util,
+  # keep-sorted end
   ...
 }:
 {
-  imports = [ ../../modules/home-manager/default.nix ];
-
-  # reusable modules
-
-  # keep-sorted start
-  desktop.enable = true;
-  dev.enable = true;
-  # keep-sorted end
-
-  # config
+  imports = [
+    ../../modules/home-manager/default.nix
+  ]
+  ++ (util.toImports ../../modules/home-manager/bundles [
+    # keep-sorted start
+    "desktop"
+    "dev"
+    "gui"
+    # keep-sorted end
+  ]);
 
   age.secrets."protonmail-laptop-password".file = ../../secrets/protonmail-laptop-password.age;
 

hosts/server/configuration.nix

@@ -1,27 +1,61 @@
 {
+  # keep-sorted start
   hostName,
   userName,
+  util,
+  # keep-sorted end
   ...
 }:
 {
   imports = [
+    # keep-sorted start
     ../../modules/nixos/default.nix
     ./hardware-configuration.nix
-  ];
+    # keep-sorted end
+  ]
+  ++ (util.toImports ../../modules/nixos/features [
+    # keep-sorted start
+    "borgbackup"
+    "intel-gpu"
+    # keep-sorted end
+  ])
+  ++ (util.toImports ../../modules/nixos/bundles [
+    "server"
+  ]);
 
-  # reusable modules
+  # external drive
+  services.udisks2.enable = true;
+  fileSystems."/mnt/external" = {
+    device = "/dev/disk/by-uuid/d3b3d7dc-d634-4327-9ea2-9d8daa4ecf4e";
+    fsType = "ext4";
+    options = [
+      "nofail"
+    ];
+  };
 
-  # keep-sorted start
-  borgmatic.enable = true;
-  intel-gpu.enable = true;
-  server.enable = true;
-  # keep-sorted end
+  networking = {
+    hostName = "${hostName}";
+    firewall.interfaces."enp2s0".allowedTCPPorts = [
+      80
+      443
+    ];
+  };
 
-  # config
-
-  networking.hostName = "${hostName}";
-
-  services.openssh.enable = true;
+  # hardened openssh
+  services.openssh = {
+    allowSFTP = false;
+    extraConfig = ''
+      AllowTcpForwarding yes
+      X11Forwarding no
+      AllowAgentForwarding no
+      AllowStreamLocalForwarding no
+      AuthenticationMethods publickey
+    '';
+    settings = {
+      KbdInteractiveAuthentication = false;
+      PasswordAuthentication = false;
+    };
+  };
 
   system.stateVersion = "24.11";
 

hosts/server/home.nix

@@ -3,7 +3,9 @@
   ...
 }:
 {
-  imports = [ ../../modules/home-manager/default.nix ];
+  imports = [
+    ../../modules/home-manager/default.nix
+  ];
 
   home = {
     username = "${userName}";

modules/home-manager/bundles/desktop.nix

@@ -1,24 +1,13 @@
 {
-  config,
-  lib,
+  util,
   ...
 }:
-let
-  feature = "desktop";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
+  imports = util.toImports ../features [
     # keep-sorted start
-    aerc.enable = true;
-    kitty.enable = true;
-    mail.enable = true;
-    obsidian.enable = true;
-    zellij.enable = true;
-    zen-browser.enable = true;
+    "aerc"
+    "mail"
+    "zellij"
     # keep-sorted end
-  };
-
-  imports = [ ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+  ];
 }

modules/home-manager/bundles/dev.nix

@@ -1,19 +1,11 @@
 {
-  config,
-  lib,
+  util,
   ...
 }:
-let
-  feature = "dev";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
+  imports = util.toImports ../features [
     # keep-sorted start
-    zed-editor.enable = lib.mkDefault true;
+    "direnv"
     # keep-sorted end
-  };
-
-  imports = [ ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+  ];
 }

modules/home-manager/bundles/gui.nix

@@ -0,0 +1,14 @@
+{
+  util,
+  ...
+}:
+{
+  imports = util.toImports ../features [
+    # keep-sorted start
+    "alacritty"
+    "librewolf"
+    "obsidian"
+    # "zen-browser"
+    # keep-sorted end
+  ];
+}

modules/home-manager/default.nix

@@ -1,22 +1,23 @@
-{ lib, ... }:
-let
-  featureBundler =
-    featuresDir:
-    map (name: featuresDir + "/${name}") (builtins.attrNames (builtins.readDir featuresDir));
-in
 {
-  imports = (featureBundler ./bundles) ++ (featureBundler ./features);
-
-  # keep-sorted start
-  agenix.enable = lib.mkDefault true;
-  bat.enable = lib.mkDefault true;
-  direnv.enable = lib.mkDefault true;
-  eza.enable = lib.mkDefault true;
-  fish.enable = lib.mkDefault true;
-  gh.enable = lib.mkDefault true;
-  git.enable = lib.mkDefault true;
-  starship.enable = lib.mkDefault true;
-  yazi.enable = lib.mkDefault true;
-  zoxide.enable = lib.mkDefault true;
-  # keep-sorted end
+  util,
+  ...
+}:
+{
+  imports = util.toImports ./features [
+    # keep-sorted start
+    "agenix"
+    "bash"
+    "bat"
+    "bottom"
+    "delta"
+    "eza"
+    "fd"
+    "git"
+    "lazygit"
+    "shell-aliases"
+    "starship"
+    "yazi"
+    "zoxide"
+    # keep-sorted end
+  ];
 }

modules/home-manager/features/aerc.nix

@@ -1,67 +1,181 @@
 {
-  config,
-  lib,
-  ...
-}:
-let
-  feature = "aerc";
-in
-{
-  config = lib.mkIf config.${feature}.enable {
-    accounts.email.accounts.personal.aerc.enable = true;
-    programs.aerc = {
-      enable = true;
-      extraAccounts.personal = {
-        default = "INBOX";
-        folders-sort = "INBOX, Starred, Drafts, Sent, Trash, Archive, Spam";
+  accounts.email.accounts.personal.aerc.enable = true;
+  programs.aerc = {
+    enable = true;
+    extraAccounts.personal = {
+      default = "INBOX";
+      folders-sort = "INBOX, Starred, Drafts, Sent, Trash, Archive, Spam";
+    };
+    extraConfig = {
+      general.unsafe-accounts-conf = true;
+      filters = {
+        "text/plain" = "colorize";
+        "text/calendar" = "calendar | colorize";
+        "text/html" = "html | colorize";
       };
-      extraConfig = {
-        general.unsafe-accounts-conf = true;
-        filters = {
-          "text/plain" = "colorize";
-          "text/calendar" = "calendar | colorize";
-          "text/html" = "html | colorize";
-        };
-        ui = {
-          styleset-name = "catppuccin-mocha";
-          sort = "-r date";
-        };
-      };
-      stylesets = {
-        catppuccin-mocha = {
-          "*.default" = true;
-          "*.normal" = true;
-          "default.fg" = "#cdd6f4";
-          "error.fg" = "#f38ba8";
-          "warning.fg" = "#fab387";
-          "success.fg" = "#a6e3a1";
-          "tab.fg" = "#6c7086";
-          "tab.bg" = "#181825";
-          "tab.selected.fg" = "#cdd6f4";
-          "tab.selected.bg" = "#1e1e2e";
-          "tab.selected.bold" = true;
-          "border.fg" = "#11111b";
-          "border.bold" = true;
-          "msglist_unread.bold" = true;
-          "msglist_flagged.fg" = "#f9e2af";
-          "msglist_flagged.bold" = true;
-          "msglist_result.fg" = "#89b4fa";
-          "msglist_result.bold" = true;
-          "msglist_*.selected.bold" = true;
-          "msglist_*.selected.bg" = "#313244";
-          "dirlist_*.selected.bold" = true;
-          "dirlist_*.selected.bg" = "#313244";
-          "statusline_default.fg" = "#9399b2";
-          "statusline_default.bg" = "#313244";
-          "statusline_error.bold" = true;
-          "statusline_success.bold" = true;
-          "completion_default.selected.bg" = "#313244";
-        };
+      ui = {
+        styleset-name = "catppuccin-mocha";
+        sort = "-r date";
       };
     };
+    extraBinds = {
+      global = {
+        # keep-sorted start
+        "<C-n>" = ":next-tab <Enter>";
+        "<C-p>" = ":prev-tab<Enter>";
+        "<C-t>" = ":term<Enter>";
+        "?" = ":help keys<Enter>";
+        # keep-sorted end
+      };
+      messages = {
+        # keep-sorted start
+        "!" = ":term<space>";
+        "$" = ":term<space>";
+        "/" = ":search<space>-a<space>";
+        "<C-b>" = ":prev 100%<Enter>";
+        "<C-d>" = ":next 50%<Enter>";
+        "<C-f>" = ":next 100%<Enter>";
+        "<C-u>" = ":prev 50%<Enter>";
+        "<Down>" = ":next<Enter>";
+        "<Enter>" = ":view<Enter>";
+        "<Esc>" = ":clear<Enter>";
+        "<PgDn>" = ":next 100%<Enter>";
+        "<PgUp>" = ":prev 100%<Enter>";
+        "<Up>" = ":prev<Enter>";
+        "\\" = ":filter <space>";
+        "|" = ":pipe<space>";
+        A = ":archive flat<Enter>";
+        C = ":compose<Enter>";
+        D = ":move Trash<Enter>";
+        G = ":select -1<Enter>";
+        H = ":collapse-folder<Enter>";
+        I = ":read<Enter>";
+        J = ":next-folder <Enter>";
+        K = ":prev-folder<Enter>";
+        L = ":expand-folder<Enter>";
+        N = ":prev-result<Enter>";
+        Rq = ":reply -q<Enter>";
+        Rr = ":reply<Enter>";
+        T = ":toggle-threads<Enter>";
+        U = ":unread<Enter>";
+        V = ":mark -v<Enter>";
+        c = ":cf<space>";
+        d = ":prompt 'Really delete this message?' 'delete-message'<Enter>";
+        g = ":select 0 <Enter>";
+        j = ":next <Enter>";
+        k = ":prev <Enter>";
+        n = ":next-result<Enter>";
+        q = ":quit<Enter>";
+        rq = ":reply -aq<Enter>";
+        rr = ":reply -a<Enter>";
+        v = ":mark -t<Enter>";
+        # keep-sorted end
+      };
+      "messages:folder=Drafts" = {
+        "<Enter>" = ":recall<Enter>";
+      };
+      view = {
+        # keep-sorted start
+        "/" = ":toggle-key-passthrough <Enter> /";
+        "<C-j>" = ":next-part<Enter>";
+        "<C-k>" = ":prev-part<Enter>";
+        "<C-l>" = ":open-link <space>";
+        "|" = ":pipe<space>";
+        A = ":archive flat<Enter>";
+        D = ":move Trash<Enter>";
+        H = ":toggle-headers<Enter>";
+        J = ":next <Enter>";
+        K = ":prev<Enter>";
+        O = ":open<Enter>";
+        R = ":read<Enter>";
+        Rq = ":reply -q<Enter>";
+        Rr = ":reply<Enter>";
+        S = ":save<space>";
+        U = ":unread<Enter>";
+        f = ":forward <Enter>";
+        q = ":close<Enter>";
+        rq = ":reply -aq<Enter>";
+        rr = ":reply -a<Enter>";
+        # keep-sorted end
+      };
+      "view::passthrough" = {
+        # keep-sorted start
+        "$ex" = "<C-x>";
+        "$noinherit" = "true";
+        "<Esc>" = ":toggle-key-passthrough<Enter>";
+        # keep-sorted end
+      };
+      compose = {
+        # keep-sorted start
+        "$ex" = "<C-x>";
+        "$noinherit" = "true";
+        "<A-n>" = ":switch-account -n<Enter>";
+        "<A-p>" = ":switch-account -p<Enter>";
+        "<C-j>" = ":next-field<Enter>";
+        "<C-k>" = ":prev-field<Enter>";
+        "<C-n>" = ":next-tab<Enter>";
+        "<C-p>" = ":prev-tab<Enter>";
+        "<tab>" = ":next-field<Enter>";
+        # keep-sorted end
+      };
+      "compose::editor" = {
+        # keep-sorted start
+        "$ex" = "<C-x>";
+        "$noinherit" = "true";
+        "<C-j>" = ":next-field<Enter>";
+        "<C-k>" = ":prev-field<Enter>";
+        "<C-n>" = ":next-tab<Enter>";
+        "<C-p>" = ":prev-tab<Enter>";
+        # keep-sorted end
+      };
+      "compose::review" = {
+        # keep-sorted start
+        a = ":attach<space>";
+        d = ":detach<space>";
+        e = ":edit<Enter>";
+        n = ":abort<Enter>";
+        p = ":postpone<Enter>";
+        q = ":choose -o d discard abort -o p postpone postpone<Enter>";
+        y = ":send <Enter>";
+        # keep-sorted end
+      };
+      terminal = {
+        # keep-sorted start
+        "$ex" = "<C-x>";
+        "$noinherit" = "true";
+        "<C-n>" = ":next-tab<Enter>";
+        "<C-p>" = ":prev-tab<Enter>";
+        # keep-sorted end
+      };
+    };
+    stylesets.catppuccin-mocha = ''
+      "*.default" = true
+      "*.normal" = true
+      "default.fg" = "#cdd6f4"
+      "error.fg" = "#f38ba8"
+      "warning.fg" = "#fab387"
+      "success.fg" = "#a6e3a1"
+      "tab.fg" = "#6c7086"
+      "tab.bg" = "#181825"
+      "tab.selected.fg" = "#cdd6f4"
+      "tab.selected.bg" = "#1e1e2e"
+      "tab.selected.bold" = true
+      "border.fg" = "#11111b"
+      "border.bold" = true
+      "msglist_unread.bold" = true
+      "msglist_flagged.fg" = "#f9e2af"
+      "msglist_flagged.bold" = true
+      "msglist_result.fg" = "#89b4fa"
+      "msglist_result.bold" = true
+      "msglist_*.selected.bold" = true
+      "msglist_*.selected.bg" = "#313244"
+      "dirlist_*.selected.bold" = true
+      "dirlist_*.selected.bg" = "#313244"
+      "statusline_default.fg" = "#9399b2"
+      "statusline_default.bg" = "#313244"
+      "statusline_error.bold" = true
+      "statusline_success.bold" = true
+      "completion_default.selected.bg" = "#313244"
+    '';
   };
-
-  imports = [ ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
 }

modules/home-manager/features/agenix.nix

@@ -1,16 +1,8 @@
 {
-  config,
-  lib,
   userName,
   ...
 }:
-let
-  feature = "agenix";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
-    age.identityPaths = [ "/home/${userName}/.ssh/id_ed25519" ];
-  };
+  age.identityPaths = [ "/home/${userName}/.ssh/id_ed25519" ];
 
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
 }

modules/home-manager/features/alacritty.nix

@@ -0,0 +1,27 @@
+{
+  # keep-sorted start
+  lib,
+  pkgs,
+  # keep-sorted end
+  ...
+}:
+{
+  programs.alacritty = {
+    enable = true;
+    settings = {
+      font = {
+        normal = {
+          family = "JetBrainsMono Nerd Font";
+          style = "Regular";
+        };
+        size = 13;
+      };
+      window.startup_mode = "Maximized";
+      terminal.shell = {
+        program = "${lib.getExe pkgs.zellij}";
+        args = [ "-l=welcome" ];
+      };
+    };
+    theme = "catppuccin_mocha";
+  };
+}

modules/home-manager/features/bash.nix

@@ -0,0 +1,4 @@
+{
+  home.shell.enableBashIntegration = true;
+  programs.bash.enable = true;
+}

modules/home-manager/features/bat.nix

@@ -1,22 +1,8 @@
 {
-  config,
-  lib,
-  ...
-}:
-let
-  feature = "bat";
-in
-{
-  config = lib.mkIf config.${feature}.enable {
-    programs.bat = {
-      enable = true;
-      config = {
-        theme = "Dracula";
-      };
+  programs.bat = {
+    enable = true;
+    config = {
+      theme = "Dracula";
     };
   };
-
-  imports = [ ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
 }

modules/home-manager/features/bottom.nix

@@ -0,0 +1,78 @@
+{
+  programs.bottom = {
+    enable = true;
+    settings = {
+      flags = {
+        group_processes = true;
+        process_memory_as_value = true;
+      };
+      styles = {
+        cpu = {
+          all_entry_color = "#f5e0dc";
+          avg_entry_color = "#eba0ac";
+          cpu_core_colors = [
+            "#f38ba8"
+            "#fab387"
+            "#f9e2af"
+            "#a6e3a1"
+            "#74c7ec"
+            "#cba6f7"
+          ];
+        };
+        memory = {
+          ram_color = "#a6e3a1";
+          cache_color = "#f38ba8";
+          swap_color = "#fab387";
+          gpu_colors = [
+            "#74c7ec"
+            "#cba6f7"
+            "#f38ba8"
+            "#fab387"
+            "#f9e2af"
+            "#a6e3a1"
+          ];
+          arc_color = "#89dceb";
+        };
+        network = {
+          rx_color = "#a6e3a1";
+          tx_color = "#f38ba8";
+          rx_total_color = "#89dceb";
+          tx_total_color = "#a6e3a1";
+        };
+        battery = {
+          high_battery_color = "#a6e3a1";
+          medium_battery_color = "#f9e2af";
+          low_battery_color = "#f38ba8";
+        };
+        tables = {
+          headers = {
+            color = "#f5e0dc";
+          };
+        };
+        graphs = {
+          graph_color = "#a6adc8";
+          legend_text = {
+            color = "#a6adc8";
+          };
+        };
+        widgets = {
+          border_color = "#585b70";
+          selected_border_color = "#f5c2e7";
+          widget_title = {
+            color = "#f2cdcd";
+          };
+          text = {
+            color = "#cdd6f4";
+          };
+          selected_text = {
+            color = "#11111b";
+            bg_color = "#cba6f7";
+          };
+          disabled_text = {
+            color = "#1e1e2e";
+          };
+        };
+      };
+    };
+  };
+}

modules/home-manager/features/delta.nix

@@ -0,0 +1,6 @@
+{
+  programs.delta = {
+    enable = true;
+    options.theme = "Dracula";
+  };
+}

modules/home-manager/features/direnv.nix

@@ -1,13 +1,3 @@
 {
-  config,
-  lib,
-  ...
-}:
-let
-  feature = "direnv";
-in
-{
-  config = lib.mkIf config.${feature}.enable { programs.direnv.enable = true; };
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+  programs.direnv.enable = true;
 }

modules/home-manager/features/espanso.nix

@@ -1,20 +1,6 @@
 {
-  config,
-  lib,
-  ...
-}:
-let
-  feature = "espanso";
-in
-{
-  config = lib.mkIf config.${feature}.enable {
-    services.espanso = {
-      enable = true;
-      configs = { };
-    };
+  services.espanso = {
+    enable = true;
+    configs = { };
   };
-
-  imports = [ ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
 }

modules/home-manager/features/eza.nix

@@ -1,297 +1,283 @@
 {
-  config,
-  lib,
-  ...
-}:
-let
-  feature = "eza";
-in
-{
-  config = lib.mkIf config.${feature}.enable {
-    programs.eza = {
-      enable = true;
-      extraOptions = [
-        "--long"
-        "--header"
-        "--group-directories-first"
-      ];
-      git = true;
-      icons = "always";
-      theme = {
-        colourful = true;
+  programs.eza = {
+    enable = true;
+    extraOptions = [
+      "--long"
+      "--header"
+      "--group-directories-first"
+    ];
+    git = true;
+    icons = "always";
+    theme = {
+      colourful = true;
 
-        filekinds = {
-          normal = {
-            foreground = "#BAC2DE";
-          };
-          directory = {
-            foreground = "#89B4FA";
-          };
-          symlink = {
-            foreground = "#89DCEB";
-          };
-          pipe = {
-            foreground = "#7F849C";
-          };
-          block_device = {
-            foreground = "#EBA0AC";
-          };
-          char_device = {
-            foreground = "#EBA0AC";
-          };
-          socket = {
-            foreground = "#585B70";
-          };
-          special = {
-            foreground = "#CBA6F7";
-          };
-          executable = {
-            foreground = "#A6E3A1";
-          };
-          mount_point = {
-            foreground = "#74C7EC";
-          };
+      filekinds = {
+        normal = {
+          foreground = "#BAC2DE";
         };
-
-        perms = {
-          user_read = {
-            foreground = "#CDD6F4";
-          };
-          user_write = {
-            foreground = "#F9E2AF";
-          };
-          user_execute_file = {
-            foreground = "#A6E3A1";
-          };
-          user_execute_other = {
-            foreground = "#A6E3A1";
-          };
-          group_read = {
-            foreground = "#BAC2DE";
-          };
-          group_write = {
-            foreground = "#F9E2AF";
-          };
-          group_execute = {
-            foreground = "#A6E3A1";
-          };
-          other_read = {
-            foreground = "#A6ADC8";
-          };
-          other_write = {
-            foreground = "#F9E2AF";
-          };
-          other_execute = {
-            foreground = "#A6E3A1";
-          };
-          special_user_file = {
-            foreground = "#CBA6F7";
-          };
-          special_other = {
-            foreground = "#585B70";
-          };
-          attribute = {
-            foreground = "#A6ADC8";
-          };
+        directory = {
+          foreground = "#89B4FA";
         };
-
-        size = {
-          major = {
-            foreground = "#A6ADC8";
-          };
-          minor = {
-            foreground = "#89DCEB";
-          };
-          number_byte = {
-            foreground = "#CDD6F4";
-          };
-          number_kilo = {
-            foreground = "#BAC2DE";
-          };
-          number_mega = {
-            foreground = "#89B4FA";
-          };
-          number_giga = {
-            foreground = "#CBA6F7";
-          };
-          number_huge = {
-            foreground = "#CBA6F7";
-          };
-          unit_byte = {
-            foreground = "#A6ADC8";
-          };
-          unit_kilo = {
-            foreground = "#89B4FA";
-          };
-          unit_mega = {
-            foreground = "#CBA6F7";
-          };
-          unit_giga = {
-            foreground = "#CBA6F7";
-          };
-          unit_huge = {
-            foreground = "#74C7EC";
-          };
-        };
-
-        users = {
-          user_you = {
-            foreground = "#CDD6F4";
-          };
-          user_root = {
-            foreground = "#F38BA8";
-          };
-          user_other = {
-            foreground = "#CBA6F7";
-          };
-          group_yours = {
-            foreground = "#BAC2DE";
-          };
-          group_other = {
-            foreground = "#7F849C";
-          };
-          group_root = {
-            foreground = "#F38BA8";
-          };
-
-        };
-        links = {
-          normal = {
-            foreground = "#89DCEB";
-          };
-          multi_link_file = {
-            foreground = "#74C7EC";
-          };
-        };
-
-        git = {
-          new = {
-            foreground = "#A6E3A1";
-          };
-          modified = {
-            foreground = "#F9E2AF";
-          };
-          deleted = {
-            foreground = "#F38BA8";
-          };
-          renamed = {
-            foreground = "#94E2D5";
-          };
-          typechange = {
-            foreground = "#F5C2E7";
-          };
-          ignored = {
-            foreground = "#7F849C";
-          };
-          conflicted = {
-            foreground = "#EBA0AC";
-          };
-        };
-        git_repo = {
-          branch_main = {
-            foreground = "#CDD6F4";
-          };
-          branch_other = {
-            foreground = "#CBA6F7";
-          };
-          git_clean = {
-            foreground = "#A6E3A1";
-          };
-          git_dirty = {
-            foreground = "#F38BA8";
-          };
-        };
-        security_context = {
-          colon = {
-            foreground = "#7F849C";
-          };
-          user = {
-            foreground = "#BAC2DE";
-          };
-          role = {
-            foreground = "#CBA6F7";
-          };
-          typ = {
-            foreground = "#585B70";
-          };
-          range = {
-            foreground = "#CBA6F7";
-          };
-        };
-        file_type = {
-          image = {
-            foreground = "#F9E2AF";
-          };
-          video = {
-            foreground = "#F38BA8";
-          };
-          music = {
-            foreground = "#A6E3A1";
-          };
-          lossless = {
-            foreground = "#94E2D5";
-          };
-          crypto = {
-            foreground = "#585B70";
-          };
-          document = {
-            foreground = "#CDD6F4";
-          };
-          compressed = {
-            foreground = "#F5C2E7";
-          };
-          temp = {
-            foreground = "#EBA0AC";
-          };
-          compiled = {
-            foreground = "#74C7EC";
-          };
-          build = {
-            foreground = "#585B70";
-          };
-          source = {
-            foreground = "#89B4FA";
-          };
-        };
-        punctuation = {
-          foreground = "#7F849C";
-        };
-        date = {
-          foreground = "#F9E2AF";
-        };
-        inode = {
-          foreground = "#A6ADC8";
-        };
-        blocks = {
-          foreground = "#9399B2";
-        };
-        header = {
-          foreground = "#CDD6F4";
-        };
-        octal = {
-          foreground = "#94E2D5";
-        };
-        flags = {
-          foreground = "#CBA6F7";
-        };
-
-        symlink_path = {
+        symlink = {
           foreground = "#89DCEB";
         };
-        control_char = {
-          foreground = "#74C7EC";
+        pipe = {
+          foreground = "#7F849C";
         };
-        broken_symlink = {
-          foreground = "#F38BA8";
+        block_device = {
+          foreground = "#EBA0AC";
         };
-        broken_path_overlay = {
+        char_device = {
+          foreground = "#EBA0AC";
+        };
+        socket = {
           foreground = "#585B70";
         };
+        special = {
+          foreground = "#CBA6F7";
+        };
+        executable = {
+          foreground = "#A6E3A1";
+        };
+        mount_point = {
+          foreground = "#74C7EC";
+        };
+      };
+
+      perms = {
+        user_read = {
+          foreground = "#CDD6F4";
+        };
+        user_write = {
+          foreground = "#F9E2AF";
+        };
+        user_execute_file = {
+          foreground = "#A6E3A1";
+        };
+        user_execute_other = {
+          foreground = "#A6E3A1";
+        };
+        group_read = {
+          foreground = "#BAC2DE";
+        };
+        group_write = {
+          foreground = "#F9E2AF";
+        };
+        group_execute = {
+          foreground = "#A6E3A1";
+        };
+        other_read = {
+          foreground = "#A6ADC8";
+        };
+        other_write = {
+          foreground = "#F9E2AF";
+        };
+        other_execute = {
+          foreground = "#A6E3A1";
+        };
+        special_user_file = {
+          foreground = "#CBA6F7";
+        };
+        special_other = {
+          foreground = "#585B70";
+        };
+        attribute = {
+          foreground = "#A6ADC8";
+        };
+      };
+
+      size = {
+        major = {
+          foreground = "#A6ADC8";
+        };
+        minor = {
+          foreground = "#89DCEB";
+        };
+        number_byte = {
+          foreground = "#CDD6F4";
+        };
+        number_kilo = {
+          foreground = "#BAC2DE";
+        };
+        number_mega = {
+          foreground = "#89B4FA";
+        };
+        number_giga = {
+          foreground = "#CBA6F7";
+        };
+        number_huge = {
+          foreground = "#CBA6F7";
+        };
+        unit_byte = {
+          foreground = "#A6ADC8";
+        };
+        unit_kilo = {
+          foreground = "#89B4FA";
+        };
+        unit_mega = {
+          foreground = "#CBA6F7";
+        };
+        unit_giga = {
+          foreground = "#CBA6F7";
+        };
+        unit_huge = {
+          foreground = "#74C7EC";
+        };
+      };
+
+      users = {
+        user_you = {
+          foreground = "#CDD6F4";
+        };
+        user_root = {
+          foreground = "#F38BA8";
+        };
+        user_other = {
+          foreground = "#CBA6F7";
+        };
+        group_yours = {
+          foreground = "#BAC2DE";
+        };
+        group_other = {
+          foreground = "#7F849C";
+        };
+        group_root = {
+          foreground = "#F38BA8";
+        };
+
+      };
+      links = {
+        normal = {
+          foreground = "#89DCEB";
+        };
+        multi_link_file = {
+          foreground = "#74C7EC";
+        };
+      };
+
+      git = {
+        new = {
+          foreground = "#A6E3A1";
+        };
+        modified = {
+          foreground = "#F9E2AF";
+        };
+        deleted = {
+          foreground = "#F38BA8";
+        };
+        renamed = {
+          foreground = "#94E2D5";
+        };
+        typechange = {
+          foreground = "#F5C2E7";
+        };
+        ignored = {
+          foreground = "#7F849C";
+        };
+        conflicted = {
+          foreground = "#EBA0AC";
+        };
+      };
+      git_repo = {
+        branch_main = {
+          foreground = "#CDD6F4";
+        };
+        branch_other = {
+          foreground = "#CBA6F7";
+        };
+        git_clean = {
+          foreground = "#A6E3A1";
+        };
+        git_dirty = {
+          foreground = "#F38BA8";
+        };
+      };
+      security_context = {
+        colon = {
+          foreground = "#7F849C";
+        };
+        user = {
+          foreground = "#BAC2DE";
+        };
+        role = {
+          foreground = "#CBA6F7";
+        };
+        typ = {
+          foreground = "#585B70";
+        };
+        range = {
+          foreground = "#CBA6F7";
+        };
+      };
+      file_type = {
+        image = {
+          foreground = "#F9E2AF";
+        };
+        video = {
+          foreground = "#F38BA8";
+        };
+        music = {
+          foreground = "#A6E3A1";
+        };
+        lossless = {
+          foreground = "#94E2D5";
+        };
+        crypto = {
+          foreground = "#585B70";
+        };
+        document = {
+          foreground = "#CDD6F4";
+        };
+        compressed = {
+          foreground = "#F5C2E7";
+        };
+        temp = {
+          foreground = "#EBA0AC";
+        };
+        compiled = {
+          foreground = "#74C7EC";
+        };
+        build = {
+          foreground = "#585B70";
+        };
+        source = {
+          foreground = "#89B4FA";
+        };
+      };
+      punctuation = {
+        foreground = "#7F849C";
+      };
+      date = {
+        foreground = "#F9E2AF";
+      };
+      inode = {
+        foreground = "#A6ADC8";
+      };
+      blocks = {
+        foreground = "#9399B2";
+      };
+      header = {
+        foreground = "#CDD6F4";
+      };
+      octal = {
+        foreground = "#94E2D5";
+      };
+      flags = {
+        foreground = "#CBA6F7";
+      };
+
+      symlink_path = {
+        foreground = "#89DCEB";
+      };
+      control_char = {
+        foreground = "#74C7EC";
+      };
+      broken_symlink = {
+        foreground = "#F38BA8";
+      };
+      broken_path_overlay = {
+        foreground = "#585B70";
       };
     };
   };
-
-  imports = [ ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
 }

modules/home-manager/features/fd.nix

@@ -0,0 +1,6 @@
+{
+  programs.fd = {
+    enable = true;
+    hidden = true;
+  };
+}

modules/home-manager/features/firefox.nix

@@ -0,0 +1,254 @@
+{
+  pkgs,
+  ...
+}:
+{
+  programs.firefox = {
+    enable = true;
+    languagePacks = [ "en-GB" ];
+    profiles.will = {
+      settings = {
+        # keep-sorted start
+        "browser.aboutwelcome.enabled" = false;
+        "browser.bookmarks.addedImportButton" = false;
+        "browser.bookmarks.restore_default_bookmarks" = false;
+        "browser.download.useDownloadDir" = true;
+        "browser.newtabpage.enabled" = false;
+        "browser.safebrowsing.downloads.enabled" = false;
+        "browser.safebrowsing.malware.enabled" = false;
+        "browser.safebrowsing.phishing.enabled" = false;
+        "browser.safebrowsing.remote.block_potentially_unwanted" = false;
+        "browser.safebrowsing.remote.block_uncommon" = false;
+        "browser.search.suggest.enabled" = false;
+        "browser.startup.homepage" = "chrome://browser/content/blanktab.html";
+        "browser.startup.page" = 3;
+        "browser.tabs.groups.smart.userEnabled" = false;
+        "browser.tabs.warnOnClose" = true;
+        "browser.tabs.warnOnOpen" = false;
+        "browser.toolbars.bookmarks.visibility" = "never";
+        "browser.urlbar.suggest.searches" = false;
+        "datareporting.healthreport.uploadEnabled" = false;
+        "datareporting.usage.uploadEnabled" = false;
+        "dom.security.https_only_mode" = true;
+        "dom.security.https_only_mode_ever_enabled" = true;
+        "extensions.formautofill.creditCards.enabled" = false;
+        "general.autoScroll" = true;
+        "intl.locale.requested" = "en-GB";
+        "network.trr.mode" = 3;
+        "network.trr.uri" = "https://firefox.dns.nextdns.io/";
+        "privacy.annotate_channels.strict_list.enabled" = true;
+        "privacy.bounceTrackingProtection.mode" = 1;
+        "privacy.fingerprintingProtection" = true;
+        "privacy.globalprivacycontrol.enabled" = true;
+        "privacy.globalprivacycontrol.was_ever_enabled" = true;
+        "privacy.history.custom" = false;
+        "privacy.query_stripping.enabled " = true;
+        "privacy.query_stripping.enabled.pbmode" = true;
+        "privacy.sanitize.sanitizeOnShutdown" = false;
+        "privacy.trackingprotection.allow_list.baseline.enabled" = true;
+        "privacy.trackingprotection.allow_list.convenience.enabled" = false;
+        "privacy.trackingprotection.consentmanager.skip.pbmode.enabled" = false;
+        "privacy.trackingprotection.emailtracking.enabled" = true;
+        "privacy.trackingprotection.enabled" = true;
+        "privacy.trackingprotection.socialtracking.enabled" = true;
+        "services.sync.engine.passwords" = false;
+        "sidebar.main.tools" = "syncedtabs,history,bookmarks";
+        "sidebar.new-sidebar.has-used" = true;
+        "sidebar.position_start" = false;
+        "sidebar.revamp" = true;
+        "sidebar.verticalTabs" = true;
+        "sidebar.verticalTabs.dragToPinPromo.dismissed" = true;
+        "signon.autofillForms" = false;
+        "signon.firefoxRelay.feature" = "disabled";
+        "signon.generation.enabled" = false;
+        "signon.management.page.breach-alerts.enabled" = false;
+        "signon.rememberSignons" = false;
+        "toolkit.telemetry.reportingpolicy.firstRun" = false;
+        # keep-sorted end
+      };
+      search = {
+        default = "ddg";
+        privateDefault = "ddg";
+        engines = { };
+        order = [ ];
+        force = true;
+      };
+      extensions = {
+        force = true;
+        packages = with pkgs.nur.repos.rycee.firefox-addons; [
+          # keep-sorted start sticky_comments=no
+          # detect-cloudflare
+          bitwarden
+          dearrow
+          nixpkgs-pr-tracker
+          react-devtools
+          return-youtube-dislikes
+          sponsorblock
+          ublock-origin
+          # keep-sorted end
+        ];
+        settings = {
+          # keep-sorted start block=yes
+          # sponsorblock
+          "sponsorBlocker@ajay.app".settings = {
+            hideSegmentCreationInPopup = false;
+            autoSkipOnMusicVideosUpdate = true;
+            changeChapterColor = true;
+            autoSkipOnMusicVideos = false;
+            hideVideoPlayerControls = false;
+            useVirtualTime = true;
+            categoryPillColors = { };
+            payments = {
+              chaptersAllowed = false;
+              freeAccess = false;
+              lastCheck = 0;
+              lastFreeCheck = 0;
+              licenseKey = null;
+            };
+            allowExpirements = true;
+            allowScrollingToEdit = true;
+            audioNotificationOnSkip = false;
+            autoHideInfoButton = true;
+            categoryPillUpdate = true;
+            chapterCategoryAdded = true;
+            checkForUnlistedVideos = false;
+            cleanPopup = false;
+            darkMode = true;
+            deArrowInstalled = true;
+            defaultCategory = "chooseACategory";
+            disableSkipping = false;
+            donateClicked = 0;
+            dontShowNotice = false;
+            forceChannelCheck = false;
+            fullVideoLabelsOnThumbnails = true;
+            fullVideoSegments = true;
+            hideDeleteButtonPlayerControls = false;
+            hideDiscordLaunches = 0;
+            hideDiscordLink = false;
+            hideInfoButtonPlayerControls = false;
+            hideSkipButtonPlayerControls = false;
+            hideUploadButtonPlayerControls = false;
+            categorySelections = [
+              {
+                name = "sponsor";
+                option = 2;
+              }
+              {
+                name = "poi_highlight";
+                option = 1;
+              }
+              {
+                name = "exclusive_access";
+                option = 0;
+              }
+              {
+                name = "chapter";
+                option = 0;
+              }
+              {
+                name = "selfpromo";
+                option = 1;
+              }
+              {
+                name = "interaction";
+                option = 1;
+              }
+              {
+                name = "intro";
+                option = 1;
+              }
+              {
+                name = "outro";
+                option = 1;
+              }
+              {
+                name = "preview";
+                option = 1;
+              }
+              {
+                name = "filler";
+                option = 1;
+              }
+              {
+                name = "music_offtopic";
+                option = 2;
+              }
+              {
+                name = "hook";
+                option = 1;
+              }
+            ];
+            manualSkipOnFullVideo = false;
+            minDuration = 0;
+            isVip = false;
+            muteSegments = false;
+            noticeVisibilityMode = 3;
+            renderSegmentsAsChapters = false;
+            scrollToEditTimeUpdate = false;
+            serverAddress = "https://sponsor.ajay.app";
+            showAutogeneratedChapters = false;
+            showCategoryGuidelines = true;
+            showCategoryWithoutPermission = false;
+            showChapterInfoMessage = true;
+            showDeArrowInSettings = true;
+            showDeArrowPromotion = true;
+            showDonationLink = false;
+            showNewFeaturePopups = false;
+            showSegmentFailedToFetchWarning = true;
+            showSegmentNameInChapterBar = true;
+            showTimeWithSkips = true;
+            showUpcomingNotice = false;
+            showUpsells = false;
+            minutesSaved = 67.630516;
+            shownDeArrowPromotion = false;
+            showZoomToFillError2 = false;
+            skipNoticeDuration = 4;
+            sponsorTimesContributed = 0;
+            testingServer = false;
+            trackDownvotes = false;
+            trackDownvotesInPrivate = false;
+            trackViewCount = false;
+            trackViewCountInPrivate = false;
+            ytInfoPermissionGranted = false;
+            skipNonMusicOnlyOnYoutubeMusic = false;
+            hookUpdate = false;
+            permissions = {
+              sponsor = true;
+              selfpromo = true;
+              exclusive_access = true;
+              interaction = true;
+              intro = true;
+              outro = true;
+              preview = true;
+              hook = true;
+              music_offtopic = true;
+              filler = true;
+              poi_highlight = true;
+              chapter = false;
+            };
+            segmentListDefaultTab = 0;
+            prideTheme = false;
+          };
+          # ublock-origin
+          "uBlock0@raymondhill.net".settings = {
+            advancedUserEnabled = true;
+            selectedFilterLists = [
+              "user-filters"
+              "ublock-filters"
+              "ublock-badware"
+              "ublock-privacy"
+              "ublock-quick-fixes"
+              "ublock-unbreak"
+              "easylist"
+              "easyprivacy"
+              "adguard-spyware-url"
+              "urlhaus-1"
+              "plowe-0"
+            ];
+          };
+          # keep-sorted end
+        };
+      };
+    };
+  };
+}

modules/home-manager/features/fish.nix

@@ -1,74 +1,39 @@
 {
-  config,
-  lib,
   pkgs,
   ...
 }:
-let
-  feature = "fish";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
-    home.shell.enableFishIntegration = true;
-    programs.fish = {
-      enable = true;
-      interactiveShellInit = ''
-        set fish_greeting
-      '';
-      shellAliases = {
-        # keep-sorted start
-        cat = "bat";
-        # cd = "j";
-        cut = "choose";
-        df = "duf";
-        du = "dua";
-        # find = "fd";
-        g = "lazygit";
-        l = "eza";
-        la = "eza -a";
-        ls = "eza";
-        ns = "nh os switch";
-        # curl = "xh";
-        ping = "gping";
-        ps = "procs";
-        # sed = "sd";
-        # grep = "rga";
-        top = "btm";
-        unzip = "ripunzip";
-        vi = "nvim";
-        vim = "nvim";
-        # keep-sorted end
-      };
-      plugins = [
-        # INFO: Using this to get shell completion for programs added to the path through nix+direnv.
-        # Issue to upstream into direnv:Add commentMore actions
-        # https://github.com/direnv/direnv/issues/443
-        {
-          name = "completion-sync";
-          src = pkgs.fetchFromGitHub {
-            owner = "iynaix";
-            repo = "fish-completion-sync";
-            rev = "4f058ad2986727a5f510e757bc82cbbfca4596f0";
-            sha256 = "sha256-kHpdCQdYcpvi9EFM/uZXv93mZqlk1zCi2DRhWaDyK5g=";
-          };
-        }
-      ];
-    };
-
-    # https://nixos.wiki/wiki/Fish#Setting_fish_as_your_shell
-    programs.bash = {
-      enable = true;
-      initExtra = ''
-        if [[ $(${pkgs.procps}/bin/ps --no-header --pid=$PPID --format=comm) != "fish" && -z ''${BASH_EXECUTION_STRING} ]]
-        then
-          shopt -q login_shell && LOGIN_OPTION='--login' || LOGIN_OPTION=""
-          exec ${pkgs.fish}/bin/fish $LOGIN_OPTION
-        fi
-      '';
-    };
+  home.shell.enableFishIntegration = true;
+  programs.fish = {
+    enable = true;
+    interactiveShellInit = ''
+      set fish_greeting
+    '';
+    plugins = [
+      # INFO: Using this to get shell completion for programs added to the path through nix+direnv.
+      # Issue to upstream into direnv:Add commentMore actions
+      # https://github.com/direnv/direnv/issues/443
+      {
+        name = "completion-sync";
+        src = pkgs.fetchFromGitHub {
+          owner = "iynaix";
+          repo = "fish-completion-sync";
+          rev = "4f058ad2986727a5f510e757bc82cbbfca4596f0";
+          sha256 = "sha256-kHpdCQdYcpvi9EFM/uZXv93mZqlk1zCi2DRhWaDyK5g=";
+        };
+      }
+    ];
   };
 
-  imports = [ ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+  # https://nixos.wiki/wiki/Fish#Setting_fish_as_your_shell
+  programs.bash = {
+    enable = true;
+    initExtra = ''
+      if [[ $(${pkgs.procps}/bin/ps --no-header --pid=$PPID --format=comm) != "fish" && -z ''${BASH_EXECUTION_STRING} ]]
+      then
+        shopt -q login_shell && LOGIN_OPTION='--login' || LOGIN_OPTION=""
+        exec ${pkgs.fish}/bin/fish $LOGIN_OPTION
+      fi
+    '';
+  };
 }

modules/home-manager/features/gh.nix

@@ -1,23 +1,9 @@
 {
-  config,
-  lib,
-  ...
-}:
-let
-  feature = "gh";
-in
-{
-  config = lib.mkIf config.${feature}.enable {
-    programs.gh = {
-      enable = true;
-      settings = {
-        git_protocol = "ssh";
-        editor = "nvim";
-      };
+  programs.gh = {
+    enable = true;
+    settings = {
+      git_protocol = "ssh";
+      editor = "nvim";
     };
   };
-
-  imports = [ ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
 }

modules/home-manager/features/git.nix

@@ -1,24 +1,12 @@
 {
-  config,
-  lib,
+  userName,
   ...
 }:
-let
-  feature = "git";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
-    programs.${feature} = {
-      enable = true;
-
-      delta = {
-        enable = true;
-        options.theme = "Dracula";
-      };
-
-      userName = "wi11-holdsworth";
-      userEmail = "83637728+wi11-holdsworth@users.noreply.github.com";
-
+  programs.git = {
+    enable = true;
+    settings = {
+      # keep-sorted start block=yes
       aliases = {
         # keep-sorted start
         a = "add";
@@ -39,18 +27,20 @@ in
         s = "status -s";
         # keep-sorted end
       };
-
-      extraConfig = {
-        init.defaultBranch = "main";
-
-        core.editor = "nvim";
-
-        push.autoSetupRemote = true;
-
-        pull.rebase = false;
+      core.editor = "nvim";
+      init.defaultBranch = "main";
+      pull.rebase = true;
+      push.autoSetupRemote = true;
+      user = {
+        name = "Will Holdsworth";
+        email = "me@fi33.buzz";
       };
+      # keep-sorted end
+    };
+    signing = {
+      key = "/home/${userName}/.ssh/git_signature.pub";
+      format = "ssh";
+      signByDefault = true;
     };
   };
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
 }

modules/home-manager/features/kitty.nix

@@ -1,32 +1,21 @@
 {
-  config,
-  lib,
   pkgs,
   ...
 }:
-let
-  feature = "kitty";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
-    programs.kitty = {
-      enable = true;
-      enableGitIntegration = true;
-      font = {
-        package = pkgs.nerd-fonts.jetbrains-mono;
-        name = "JetBrainsMono Nerd Font";
-        size = 13;
-      };
-      themeFile = "Catppuccin-Mocha";
-      settings = {
-        shell = "zellij -l welcome";
-        remember_window_size = true;
-        confirm_os_window_close = 0;
-      };
+  programs.kitty = {
+    enable = true;
+    enableGitIntegration = true;
+    font = {
+      package = pkgs.nerd-fonts.jetbrains-mono;
+      name = "JetBrainsMono Nerd Font";
+      size = 13;
+    };
+    themeFile = "Catppuccin-Mocha";
+    settings = {
+      shell = "zellij -l welcome";
+      remember_window_size = true;
+      confirm_os_window_close = 0;
     };
   };
-
-  imports = [ ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
 }

modules/home-manager/features/lazygit.nix

@@ -0,0 +1,15 @@
+{
+  ...
+}:
+{
+  programs.lazygit = {
+    enable = true;
+    settings = {
+      git.overrideGpg = true;
+      log = {
+        localBranchSortOrder = "recency";
+        remoteBranchSortOrder = "recency";
+      };
+    };
+  };
+}

modules/home-manager/features/librewolf.nix

@@ -0,0 +1,255 @@
+{
+  pkgs,
+  ...
+}:
+{
+  programs.librewolf = {
+    enable = true;
+    languagePacks = [ "en-GB" ];
+    profiles.will = {
+      settings = {
+        # keep-sorted start
+        "browser.aboutwelcome.enabled" = false;
+        "browser.bookmarks.addedImportButton" = false;
+        "browser.bookmarks.restore_default_bookmarks" = false;
+        "browser.download.useDownloadDir" = true;
+        "browser.newtabpage.enabled" = false;
+        "browser.safebrowsing.downloads.enabled" = false;
+        "browser.safebrowsing.malware.enabled" = false;
+        "browser.safebrowsing.phishing.enabled" = false;
+        "browser.safebrowsing.remote.block_potentially_unwanted" = false;
+        "browser.safebrowsing.remote.block_uncommon" = false;
+        "browser.search.suggest.enabled" = false;
+        "browser.startup.homepage" = "chrome://browser/content/blanktab.html";
+        "browser.startup.page" = 3;
+        "browser.tabs.groups.smart.userEnabled" = false;
+        "browser.tabs.warnOnClose" = true;
+        "browser.tabs.warnOnOpen" = false;
+        "browser.toolbars.bookmarks.visibility" = "never";
+        "browser.urlbar.suggest.searches" = false;
+        "datareporting.healthreport.uploadEnabled" = false;
+        "datareporting.usage.uploadEnabled" = false;
+        "dom.security.https_only_mode" = true;
+        "dom.security.https_only_mode_ever_enabled" = true;
+        "extensions.formautofill.creditCards.enabled" = false;
+        "general.autoScroll" = true;
+        "identity.fxaccounts.enabled" = true;
+        "intl.locale.requested" = "en-GB";
+        "network.trr.mode" = 3;
+        "network.trr.uri" = "https://firefox.dns.nextdns.io/";
+        "privacy.annotate_channels.strict_list.enabled" = true;
+        "privacy.bounceTrackingProtection.mode" = 1;
+        "privacy.fingerprintingProtection" = true;
+        "privacy.globalprivacycontrol.enabled" = true;
+        "privacy.globalprivacycontrol.was_ever_enabled" = true;
+        "privacy.history.custom" = false;
+        "privacy.query_stripping.enabled " = true;
+        "privacy.query_stripping.enabled.pbmode" = true;
+        "privacy.sanitize.sanitizeOnShutdown" = false;
+        "privacy.trackingprotection.allow_list.baseline.enabled" = true;
+        "privacy.trackingprotection.allow_list.convenience.enabled" = false;
+        "privacy.trackingprotection.consentmanager.skip.pbmode.enabled" = false;
+        "privacy.trackingprotection.emailtracking.enabled" = true;
+        "privacy.trackingprotection.enabled" = true;
+        "privacy.trackingprotection.socialtracking.enabled" = true;
+        "services.sync.engine.passwords" = false;
+        "sidebar.main.tools" = "syncedtabs,history,bookmarks";
+        "sidebar.new-sidebar.has-used" = true;
+        "sidebar.position_start" = false;
+        "sidebar.revamp" = true;
+        "sidebar.verticalTabs" = true;
+        "sidebar.verticalTabs.dragToPinPromo.dismissed" = true;
+        "signon.autofillForms" = false;
+        "signon.firefoxRelay.feature" = "disabled";
+        "signon.generation.enabled" = false;
+        "signon.management.page.breach-alerts.enabled" = false;
+        "signon.rememberSignons" = false;
+        "toolkit.telemetry.reportingpolicy.firstRun" = false;
+        # keep-sorted end
+      };
+      search = {
+        default = "ddg";
+        privateDefault = "ddg";
+        engines = { };
+        order = [ ];
+        force = true;
+      };
+      extensions = {
+        force = true;
+        packages = with pkgs.nur.repos.rycee.firefox-addons; [
+          # keep-sorted start sticky_comments=no
+          # detect-cloudflare
+          bitwarden
+          dearrow
+          nixpkgs-pr-tracker
+          react-devtools
+          return-youtube-dislikes
+          sponsorblock
+          ublock-origin
+          # keep-sorted end
+        ];
+        settings = {
+          # keep-sorted start block=yes
+          # sponsorblock
+          "sponsorBlocker@ajay.app".settings = {
+            hideSegmentCreationInPopup = false;
+            autoSkipOnMusicVideosUpdate = true;
+            changeChapterColor = true;
+            autoSkipOnMusicVideos = false;
+            hideVideoPlayerControls = false;
+            useVirtualTime = true;
+            categoryPillColors = { };
+            payments = {
+              chaptersAllowed = false;
+              freeAccess = false;
+              lastCheck = 0;
+              lastFreeCheck = 0;
+              licenseKey = null;
+            };
+            allowExpirements = true;
+            allowScrollingToEdit = true;
+            audioNotificationOnSkip = false;
+            autoHideInfoButton = true;
+            categoryPillUpdate = true;
+            chapterCategoryAdded = true;
+            checkForUnlistedVideos = false;
+            cleanPopup = false;
+            darkMode = true;
+            deArrowInstalled = true;
+            defaultCategory = "chooseACategory";
+            disableSkipping = false;
+            donateClicked = 0;
+            dontShowNotice = false;
+            forceChannelCheck = false;
+            fullVideoLabelsOnThumbnails = true;
+            fullVideoSegments = true;
+            hideDeleteButtonPlayerControls = false;
+            hideDiscordLaunches = 0;
+            hideDiscordLink = false;
+            hideInfoButtonPlayerControls = false;
+            hideSkipButtonPlayerControls = false;
+            hideUploadButtonPlayerControls = false;
+            categorySelections = [
+              {
+                name = "sponsor";
+                option = 2;
+              }
+              {
+                name = "poi_highlight";
+                option = 1;
+              }
+              {
+                name = "exclusive_access";
+                option = 0;
+              }
+              {
+                name = "chapter";
+                option = 0;
+              }
+              {
+                name = "selfpromo";
+                option = 1;
+              }
+              {
+                name = "interaction";
+                option = 1;
+              }
+              {
+                name = "intro";
+                option = 1;
+              }
+              {
+                name = "outro";
+                option = 1;
+              }
+              {
+                name = "preview";
+                option = 1;
+              }
+              {
+                name = "filler";
+                option = 1;
+              }
+              {
+                name = "music_offtopic";
+                option = 2;
+              }
+              {
+                name = "hook";
+                option = 1;
+              }
+            ];
+            manualSkipOnFullVideo = false;
+            minDuration = 0;
+            isVip = false;
+            muteSegments = false;
+            noticeVisibilityMode = 3;
+            renderSegmentsAsChapters = false;
+            scrollToEditTimeUpdate = false;
+            serverAddress = "https://sponsor.ajay.app";
+            showAutogeneratedChapters = false;
+            showCategoryGuidelines = true;
+            showCategoryWithoutPermission = false;
+            showChapterInfoMessage = true;
+            showDeArrowInSettings = true;
+            showDeArrowPromotion = true;
+            showDonationLink = false;
+            showNewFeaturePopups = false;
+            showSegmentFailedToFetchWarning = true;
+            showSegmentNameInChapterBar = true;
+            showTimeWithSkips = true;
+            showUpcomingNotice = false;
+            showUpsells = false;
+            minutesSaved = 67.630516;
+            shownDeArrowPromotion = false;
+            showZoomToFillError2 = false;
+            skipNoticeDuration = 4;
+            sponsorTimesContributed = 0;
+            testingServer = false;
+            trackDownvotes = false;
+            trackDownvotesInPrivate = false;
+            trackViewCount = false;
+            trackViewCountInPrivate = false;
+            ytInfoPermissionGranted = false;
+            skipNonMusicOnlyOnYoutubeMusic = false;
+            hookUpdate = false;
+            permissions = {
+              sponsor = true;
+              selfpromo = true;
+              exclusive_access = true;
+              interaction = true;
+              intro = true;
+              outro = true;
+              preview = true;
+              hook = true;
+              music_offtopic = true;
+              filler = true;
+              poi_highlight = true;
+              chapter = false;
+            };
+            segmentListDefaultTab = 0;
+            prideTheme = false;
+          };
+          # ublock-origin
+          "uBlock0@raymondhill.net".settings = {
+            advancedUserEnabled = true;
+            selectedFilterLists = [
+              "user-filters"
+              "ublock-filters"
+              "ublock-badware"
+              "ublock-privacy"
+              "ublock-quick-fixes"
+              "ublock-unbreak"
+              "easylist"
+              "easyprivacy"
+              "adguard-spyware-url"
+              "urlhaus-1"
+              "plowe-0"
+            ];
+          };
+          # keep-sorted end
+        };
+      };
+    };
+  };
+}

modules/home-manager/features/mail.nix

@@ -1,62 +1,54 @@
 {
+  # keep-sorted start
   config,
-  lib,
   hostName,
+  # keep-sorted end
   ...
 }:
-let
-  feature = "mail";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
-    accounts.email =
-      let
-        certificatesFile = config.age.secrets.protonmail-cert.path;
-      in
-      {
-        inherit certificatesFile;
-        accounts =
-          let
-            # keep-sorted start block=yes
-            address = "willholdsworth@pm.me";
-            authentication = "login";
-            host = "127.0.0.1";
-            tls = {
-              enable = false;
-              useStartTls = true;
-              inherit certificatesFile;
-            };
-            # keep-sorted end
-          in
-          {
-            personal = {
-              enable = true;
-              # keep-sorted start block=yes
-              imap = {
-                port = 1143;
-                inherit tls;
-                inherit authentication;
-                inherit host;
-              };
-              inherit address;
-              passwordCommand = "cat ${config.age.secrets."protonmail-${hostName}-password".path}";
-              primary = true;
-              realName = "Will Holdsworth";
-              smtp = {
-                port = 1025;
-                inherit tls;
-                inherit authentication;
-                inherit host;
-              };
-              userName = address;
-              # keep-sorted end
-            };
+  accounts.email =
+    let
+      certificatesFile = config.age.secrets.protonmail-cert.path;
+    in
+    {
+      inherit certificatesFile;
+      accounts =
+        let
+          # keep-sorted start block=yes
+          address = "willholdsworth@pm.me";
+          authentication = "login";
+          host = "127.0.0.1";
+          tls = {
+            enable = false;
+            useStartTls = true;
+            inherit certificatesFile;
           };
-      };
-    age.secrets."protonmail-cert".file = ../../../secrets/protonmail-cert.age;
-  };
-
-  imports = [ ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+          # keep-sorted end
+        in
+        {
+          personal = {
+            enable = true;
+            # keep-sorted start block=yes
+            imap = {
+              port = 1143;
+              inherit tls;
+              inherit authentication;
+              inherit host;
+            };
+            inherit address;
+            passwordCommand = "cat ${config.age.secrets."protonmail-${hostName}-password".path}";
+            primary = true;
+            realName = "Will Holdsworth";
+            smtp = {
+              port = 1025;
+              inherit tls;
+              inherit authentication;
+              inherit host;
+            };
+            userName = address;
+            # keep-sorted end
+          };
+        };
+    };
+  age.secrets."protonmail-cert".file = ../../../secrets/protonmail-cert.age;
 }

modules/home-manager/features/obsidian.nix

@@ -1,126 +1,116 @@
-{ config, lib, ... }:
-let
-  feature = "obsidian";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
-    programs.obsidian = {
-      enable = true;
-      defaultSettings = {
-        app = {
-          tabSize = 2;
-          trashOption = "local";
-          alwaysUpdateLinks = true;
-          attachmentFolderPath = "/";
-          defaultViewMode = "preview";
-          vimMode = true;
-          showLineNumber = true;
-        };
-        appearance = {
-          monospaceFontFamily = "JetBrainsMono Nerd Font";
-          interfaceFontFamily = "JetBrainsMono Nerd Font";
-          textFontFamily = "JetBrainsMono Nerd Font";
-          nativeMenus = false;
-          cssTheme = "Catppuccin";
-          showRibbon = false;
-        };
-        communityPlugins = [
-          # keep-sorted start
-          "obsidian-editor-shortcuts"
-          "obsidian-excalidraw-plugin"
-          "obsidian-livesync"
-          "obsidian-relative-line-numbers"
-          "oz-clear-unused-images"
-          "pdf-plus"
-          "tag-wrangler"
-          "virtual-linker"
-          # keep-sorted end
+  programs.obsidian = {
+    enable = true;
+    defaultSettings = {
+      app = {
+        tabSize = 2;
+        trashOption = "local";
+        alwaysUpdateLinks = true;
+        attachmentFolderPath = "/";
+        defaultViewMode = "preview";
+        vimMode = true;
+        showLineNumber = true;
+      };
+      appearance = {
+        monospaceFontFamily = "JetBrainsMono Nerd Font";
+        interfaceFontFamily = "JetBrainsMono Nerd Font";
+        textFontFamily = "JetBrainsMono Nerd Font";
+        nativeMenus = false;
+        cssTheme = "Catppuccin";
+        showRibbon = false;
+      };
+      communityPlugins = [
+        # keep-sorted start
+        "obsidian-editor-shortcuts"
+        "obsidian-excalidraw-plugin"
+        "obsidian-livesync"
+        "obsidian-relative-line-numbers"
+        "oz-clear-unused-images"
+        "pdf-plus"
+        "tag-wrangler"
+        "virtual-linker"
+        # keep-sorted end
+      ];
+      corePlugins = [
+        # keep-sorted start
+        "backlink"
+        "bases"
+        "bookmarks"
+        "canvas"
+        "command-palette"
+        "daily-notes"
+        "editor-status"
+        "file-explorer"
+        "file-recovery"
+        "global-search"
+        "graph"
+        "markdown-importer"
+        "note-composer"
+        "outgoing-link"
+        "outline"
+        "page-preview"
+        "properties"
+        "random-note"
+        "slash-command"
+        "slides"
+        "switcher"
+        "tag-pane"
+        "templates"
+        "word-count"
+        "workspaces"
+        "zk-prefixer"
+        # keep-sorted end
+      ];
+      hotkeys = {
+        "editor:swap-line-down" = [
+          {
+            "modifiers" = [ "Alt" ];
+            "key" = "ArrowDown";
+          }
         ];
-        corePlugins = [
-          # keep-sorted start
-          "backlink"
-          "bases"
-          "bookmarks"
-          "canvas"
-          "command-palette"
-          "daily-notes"
-          "editor-status"
-          "file-explorer"
-          "file-recovery"
-          "global-search"
-          "graph"
-          "markdown-importer"
-          "note-composer"
-          "outgoing-link"
-          "outline"
-          "page-preview"
-          "properties"
-          "random-note"
-          "slash-command"
-          "slides"
-          "switcher"
-          "tag-pane"
-          "templates"
-          "word-count"
-          "workspaces"
-          "zk-prefixer"
-          # keep-sorted end
+        "editor:swap-line-up" = [
+          {
+            "modifiers" = [ "Alt" ];
+            "key" = "ArrowUp";
+          }
+        ];
+        "app:toggle-left-sidebar" = [
+          {
+            "modifiers" = [
+              "Mod"
+              "Shift"
+            ];
+            "key" = "/";
+          }
+        ];
+        "app:toggle-right-sidebar" = [
+          {
+            "modifiers" = [
+              "Mod"
+              "Shift"
+            ];
+            "key" = "\\";
+          }
+        ];
+        "window:reset-zoom" = [
+          {
+            "modifiers" = [ "Mod" ];
+            "key" = "0";
+          }
+        ];
+        "app:go-back" = [
+          {
+            "modifiers" = [ "Alt" ];
+            "key" = "ArrowLeft";
+          }
+        ];
+        "app:go-forward" = [
+          {
+            "modifiers" = [ "Alt" ];
+            "key" = "ArrowRight";
+          }
         ];
-        hotkeys = {
-          "editor:swap-line-down" = [
-            {
-              "modifiers" = [ "Alt" ];
-              "key" = "ArrowDown";
-            }
-          ];
-          "editor:swap-line-up" = [
-            {
-              "modifiers" = [ "Alt" ];
-              "key" = "ArrowUp";
-            }
-          ];
-          "app:toggle-left-sidebar" = [
-            {
-              "modifiers" = [
-                "Mod"
-                "Shift"
-              ];
-              "key" = "/";
-            }
-          ];
-          "app:toggle-right-sidebar" = [
-            {
-              "modifiers" = [
-                "Mod"
-                "Shift"
-              ];
-              "key" = "\\";
-            }
-          ];
-          "window:reset-zoom" = [
-            {
-              "modifiers" = [ "Mod" ];
-              "key" = "0";
-            }
-          ];
-          "app:go-back" = [
-            {
-              "modifiers" = [ "Alt" ];
-              "key" = "ArrowLeft";
-            }
-          ];
-          "app:go-forward" = [
-            {
-              "modifiers" = [ "Alt" ];
-              "key" = "ArrowRight";
-            }
-          ];
-        };
       };
     };
   };
-
-  imports = [ ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
 }

modules/home-manager/features/shell-aliases.nix

@@ -0,0 +1,27 @@
+{
+  home.shellAliases = {
+    # keep-sorted start
+    ",cat" = "bat";
+    ",curl" = "xh";
+    ",cut" = "choose";
+    ",df" = "duf";
+    ",diff" = "delta";
+    ",du" = "dua";
+    ",find" = "fd";
+    ",grep" = "rga";
+    ",ping" = "gping";
+    ",ps" = "procs";
+    ",sed" = "sd";
+    ",ss" = "snitch";
+    ",top" = "btm";
+    ",unzip" = "ripunzip";
+    "g" = "lazygit";
+    "l" = "eza";
+    "la" = "eza -a";
+    "ls" = "eza";
+    "ns" = "nh os switch";
+    "vi" = "nvim";
+    "vim" = "nvim";
+    # keep-sorted end
+  };
+}

modules/home-manager/features/starship.nix

@@ -1,21 +1,9 @@
 {
-  config,
-  lib,
-  ...
-}:
-let
-  feature = "starship";
-in
-{
-  config = lib.mkIf config.${feature}.enable {
-    programs.starship = {
-      enable = true;
-      settings.character = {
-        success_symbol = "[%](bold green) ";
-        error_symbol = "[%](bold red) ";
-      };
+  programs.starship = {
+    enable = true;
+    settings.character = {
+      success_symbol = "[%](bold green) ";
+      error_symbol = "[%](bold red) ";
     };
   };
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
 }

modules/home-manager/features/yazi.nix

@@ -1,35 +1,25 @@
 {
-  config,
-  lib,
   pkgs,
   ...
 }:
-let
-  feature = "yazi";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
-    programs.yazi = {
-      enable = true;
-      plugins = {
-        # keep-sorted start
-        diff = pkgs.yaziPlugins.diff;
-        git = pkgs.yaziPlugins.git;
-        mediainfo = pkgs.yaziPlugins.mediainfo;
-        mount = pkgs.yaziPlugins.mount;
-        ouch = pkgs.yaziPlugins.ouch;
-        relative-motions = pkgs.yaziPlugins.relative-motions;
-        restore = pkgs.yaziPlugins.restore;
-        rich-preview = pkgs.yaziPlugins.rich-preview;
-        starship = pkgs.yaziPlugins.starship;
-        vcs-files = pkgs.yaziPlugins.vcs-files;
-        yatline-githead = pkgs.yaziPlugins.yatline-githead;
-        # keep-sorted end 
-      };
+  programs.yazi = {
+    enable = true;
+    shellWrapperName = "y";
+    plugins = {
+      # keep-sorted start
+      diff = pkgs.yaziPlugins.diff;
+      git = pkgs.yaziPlugins.git;
+      mediainfo = pkgs.yaziPlugins.mediainfo;
+      mount = pkgs.yaziPlugins.mount;
+      ouch = pkgs.yaziPlugins.ouch;
+      relative-motions = pkgs.yaziPlugins.relative-motions;
+      restore = pkgs.yaziPlugins.restore;
+      rich-preview = pkgs.yaziPlugins.rich-preview;
+      starship = pkgs.yaziPlugins.starship;
+      vcs-files = pkgs.yaziPlugins.vcs-files;
+      yatline-githead = pkgs.yaziPlugins.yatline-githead;
+      # keep-sorted end
     };
   };
-
-  imports = [ ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
 }

modules/home-manager/features/zed-editor.nix

@@ -1,97 +1,89 @@
 {
-  config,
+  # keep-sorted start
   lib,
   pkgs,
+  # keep-sorted end
   ...
 }:
-let
-  feature = "zed-editor";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
-    programs.zed-editor = {
-      enable = true;
-      package = pkgs.zed-editor-fhs;
-      extensions = [
-        # keep-sorted start
-        "catppuccin"
-        "catppuccin-icons"
-        "codebook"
-        "emmet"
-        "git-firefly"
-        "haskell"
-        "html"
-        "nix"
-        # keep-sorted end
-      ];
-      extraPackages = with pkgs; [
-        # keep-sorted start
-        haskell-language-server
-        nil
-        nixd
-        package-version-server
-        rust-analyzer
-        # keep-sorted end
-      ];
-      installRemoteServer = true;
-      userSettings = {
-        # keep-sorted start block=yes
-        base_keymap = "VSCode";
-        buffer_font_family = "JetBrainsMono Nerd Font";
-        buffer_font_size = 15;
-        disable_ai = true;
-        icon_theme = "Catppuccin Mocha";
-        inlay_hints = {
-          enabled = true;
-          show_value_hints = true;
-          show_type_hints = true;
-          show_parameter_hints = true;
-          show_other_hints = true;
-          show_background = false;
-          edit_debounce_ms = 700;
-          scroll_debounce_ms = 50;
-          toggle_on_modifiers_press = {
-            control = false;
-            alt = false;
-            shift = false;
-            platform = false;
-            function = false;
-          };
+  programs.zed-editor = {
+    enable = true;
+    package = pkgs.zed-editor-fhs;
+    extensions = [
+      # keep-sorted start
+      "catppuccin"
+      "catppuccin-icons"
+      "codebook"
+      "emmet"
+      "git-firefly"
+      "haskell"
+      "html"
+      "nix"
+      # keep-sorted end
+    ];
+    extraPackages = with pkgs; [
+      # keep-sorted start
+      haskell-language-server
+      nil
+      nixd
+      package-version-server
+      rust-analyzer
+      # keep-sorted end
+    ];
+    installRemoteServer = true;
+    userSettings = {
+      # keep-sorted start block=yes
+      base_keymap = "VSCode";
+      buffer_font_family = "JetBrainsMono Nerd Font";
+      buffer_font_size = 15;
+      disable_ai = true;
+      icon_theme = "Catppuccin Mocha";
+      inlay_hints = {
+        enabled = true;
+        show_value_hints = true;
+        show_type_hints = true;
+        show_parameter_hints = true;
+        show_other_hints = true;
+        show_background = false;
+        edit_debounce_ms = 700;
+        scroll_debounce_ms = 50;
+        toggle_on_modifiers_press = {
+          control = false;
+          alt = false;
+          shift = false;
+          platform = false;
+          function = false;
         };
-        # https://wiki.nixos.org/wiki/Zed#rust-analyzer
-        lsp.rust-analyzer.binary.path = lib.getExe pkgs.rust-analyzer;
-        minimap = {
-          show = "auto";
-        };
-        preferred_line_length = 80;
-        relative_line_numbers = true;
-        soft_wrap = "preferred_line_length";
-        tab_bar = {
-          show_nav_history_buttons = false;
-        };
-        tab_size = 2;
-        tabs = {
-          file_icons = true;
-          git_status = true;
-        };
-        telemetry = {
-          diagnostics = false;
-          metrics = false;
-        };
-        theme = {
-          mode = "system";
-          light = "One Light";
-          dark = "Catppuccin Mocha";
-        };
-        ui_font_family = "JetBrainsMono Nerd Font";
-        ui_font_size = 16;
-        vim_mode = true;
-        # keep-sorted end
       };
+      # https://wiki.nixos.org/wiki/Zed#rust-analyzer
+      lsp.rust-analyzer.binary.path = lib.getExe pkgs.rust-analyzer;
+      minimap = {
+        show = "auto";
+      };
+      preferred_line_length = 80;
+      relative_line_numbers = true;
+      soft_wrap = "preferred_line_length";
+      tab_bar = {
+        show_nav_history_buttons = false;
+      };
+      tab_size = 2;
+      tabs = {
+        file_icons = true;
+        git_status = true;
+      };
+      telemetry = {
+        diagnostics = false;
+        metrics = false;
+      };
+      theme = {
+        mode = "system";
+        light = "One Light";
+        dark = "Catppuccin Mocha";
+      };
+      ui_font_family = "JetBrainsMono Nerd Font";
+      ui_font_size = 16;
+      vim_mode = true;
+      # keep-sorted end
     };
   };
-
-  imports = [ ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
 }

modules/home-manager/features/zellij.nix

@@ -1,24 +1,9 @@
 {
-  config,
-  lib,
-  ...
-}:
-let
-  feature = "zellij";
-in
-{
-  config = lib.mkIf config.${feature}.enable {
-    programs.zellij = {
-      enable = true;
-      settings = {
-        theme = "catppuccin-mocha";
-        show_startup_tips = false;
-        default_shell = "fish";
-      };
+  programs.zellij = {
+    enable = true;
+    settings = {
+      theme = "catppuccin-mocha";
+      show_startup_tips = false;
     };
   };
-
-  imports = [ ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
 }

modules/home-manager/features/zen-browser.nix

@@ -1,15 +1,13 @@
 {
-  config,
-  lib,
-  ...
-}:
-let
-  feature = "zen-browser";
-in
-{
-  config = lib.mkIf config.${feature}.enable {
-    programs.zen-browser = {
+  programs.zen-browser =
+    let
+      profileName = "fmnikwnj.Default Profile";
+    in
+    {
       enable = true;
+      profiles.${profileName}.settings = {
+        zen.tabs.vertical.right-side = true;
+      };
       policies =
         let
           mkLockedAttrs = builtins.mapAttrs (
@@ -66,7 +64,4 @@ in
           # keep-sorted end
         };
     };
-  };
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
 }

modules/home-manager/features/zoxide.nix

@@ -1,23 +1,8 @@
 {
-  config,
-  lib,
-  ...
-}:
-let
-  feature = "zoxide";
-in
-{
-  config = lib.mkIf config.${feature}.enable {
-    programs.zoxide = {
-      enable = true;
-      enableBashIntegration = true;
-      options = [
-        "--cmd j"
-      ];
-    };
+  programs.zoxide = {
+    enable = true;
+    options = [
+      "--cmd j"
+    ];
   };
-
-  imports = [ ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
 }

modules/nixos/bundles/desktop.nix

@@ -1,36 +1,13 @@
 {
-  config,
-  lib,
-  pkgs,
+  util,
   ...
 }:
-let
-  feature = "desktop";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
+  imports = util.toImports ../features [
     # keep-sorted start
-    pipewire.enable = true;
-    print-and-scan.enable = true;
-    protonmail-bridge.enable = true;
+    "pipewire"
+    "print-and-scan"
+    "protonmail-bridge"
     # keep-sorted end
-
-    environment.systemPackages = with pkgs; [
-      # keep-sorted start
-      beeper
-      # TODO: replace with lue/epy
-      calibre
-      cameractrls-gtk3
-      # https://github.com/NixOS/nixpkgs/issues/437865
-      # jellyfin-media-player
-      # TODO: replace with sc-im/visidata
-      onlyoffice-desktopeditors
-      textsnatcher
-      # keep-sorted end
-    ];
-  };
-
-  imports = [ ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+  ];
 }

modules/nixos/bundles/dev.nix

@@ -1,26 +1,13 @@
 {
-  config,
-  lib,
   pkgs,
   ...
 }:
-let
-  feature = "dev";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
-    environment.systemPackages = with pkgs; [
-      # keep-sorted start
-      bacon
-      cargo-info
-      devenv
-      just
-      mask
-      rusty-man
-      vscode
-      # keep-sorted end
-    ];
-  };
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+  environment.systemPackages = with pkgs; [
+    # keep-sorted start
+    bacon
+    cargo-info
+    mask
+    # keep-sorted end
+  ];
 }

modules/nixos/bundles/gui.nix

@@ -0,0 +1,24 @@
+{
+  # keep-sorted start
+  pkgs,
+  util,
+  # keep-sorted end
+  ...
+}:
+{
+  imports = util.toImports ../features [
+    # keep-sorted start
+    "fonts"
+    # keep-sorted end
+  ];
+
+  environment.systemPackages = with pkgs; [
+    # keep-sorted start
+    cameractrls-gtk3
+    jellyfin-desktop
+    libreoffice
+    signal-desktop
+    textsnatcher
+    # keep-sorted end
+  ];
+}

modules/nixos/bundles/server.nix

@@ -1,39 +1,41 @@
 {
-  config,
-  lib,
+  util,
   ...
 }:
-let
-  feature = "server";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
+  imports = util.toImports ../features [
     # keep-sorted start
-    copyparty.enable = true;
-    couchdb.enable = true;
-    flaresolverr.enable = true;
-    homepage-dashboard.enable = true;
-    immich.enable = true;
-    jellyfin.enable = true;
-    lidarr.enable = true;
-    miniflux.enable = true;
-    nginx.enable = true;
-    ntfy-sh.enable = true;
-    paperless.enable = true;
-    prowlarr.enable = true;
-    qbittorrent.enable = true;
-    radarr.enable = true;
-    sonarr.enable = true;
-    syncthing.enable = true;
-    vaultwarden.enable = true;
+    "bazarr"
+    "caddy"
+    "copyparty"
+    "couchdb"
+    "cryptpad"
+    "fi33.buzz"
+    "gatus"
+    "homepage-dashboard"
+    "immich"
+    "jellyfin"
+    "kavita"
+    "libretranslate"
+    "lidarr"
+    "mealie"
+    "miniflux"
+    "ntfy-sh"
+    "nzbget"
+    "paperless"
+    "prowlarr"
+    "qbittorrent"
+    "radarr"
+    "radicale"
+    "readarr"
+    "send"
+    "sonarr"
+    "vaultwarden"
     # keep-sorted end
+  ];
 
-    users.groups.media = { };
-
-    services.borgmatic.settings.source_directories = [ "/srv" ];
+  services.borgbackup.jobs = {
+    onsite.paths = [ "/srv" ];
+    offsite.paths = [ "/srv" ];
   };
-
-  imports = [ ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
 }

modules/nixos/default.nix

@@ -1,44 +1,35 @@
 {
-  lib,
+  # keep-sorted start
   pkgs,
+  util,
+  # keep-sorted end
   ...
 }:
-let
-  featureBundler =
-    featuresDir:
-    map (name: featuresDir + "/${name}") (builtins.attrNames (builtins.readDir featuresDir));
-in
 {
-  imports = (featureBundler ./bundles) ++ (featureBundler ./features);
-  # keep-sorted start
-  agenix.enable = lib.mkDefault true;
-  fonts.enable = lib.mkDefault true;
-  localisation.enable = lib.mkDefault true;
-  network.enable = lib.mkDefault true;
-  nh.enable = lib.mkDefault true;
-  nix-settings.enable = lib.mkDefault true;
-  nixpkgs.enable = lib.mkDefault true;
-  nixvim.enable = lib.mkDefault true;
-  syncthing.enable = lib.mkDefault true;
-  systemd-boot.enable = lib.mkDefault true;
-  tailscale.enable = lib.mkDefault true;
-  # keep-sorted end
+  imports = util.toImports ./features [
+    # keep-sorted start
+    "agenix"
+    "localisation"
+    "network"
+    "nh"
+    "nix"
+    "nixvim"
+    "syncthing"
+    "systemd-boot"
+    # keep-sorted end
+  ];
 
   environment.systemPackages =
     with pkgs;
     [
       # keep-sorted start
-      bottom # top
       broot # large directory browser
       choose # cut
-      circumflex # hacker news browsing
-      cointop # crypto ticker
       ddgr # web search
-      dogdns # dns
+      doggo # dns
       dua # du
       duf # df
       epy # ebook reading
-      fd # find
       fselect # find with sql syntax
       fx # json processor and viewer
       fzf # fuzzy finder
@@ -48,13 +39,12 @@ in
       hexyl # hexadecimal viewer
       hyperfine # benchmarking tool
       keep-sorted # alphabetical formatter
-      lazygit # git tui
       mprocs # run long running commands and monitor output
       navi # cheatsheet browser
       nb # note taking
       nil # nix language server
       nixd # nix language server
-      nixfmt-rfc-style # nix file formatting
+      nixfmt # nix file formatting
       nom # stylistic nix dependency graphs
       pastel # colour generation
       pdd # datetime calculations
@@ -66,10 +56,11 @@ in
       ripunzip # unzip
       sd # sed
       slides # presentations
+      snitch # netstat
       ticker # stock ticker
       tldr # cheat sheets
       tmpmail # temporary email address
-      topydo # todo.txt helper tool
+      # topydo # todo.txt helper tool
       tt # typing test
       wtfutil # terminal homepage
       xh # curl

modules/nixos/features/agenix.nix

@@ -1,21 +1,14 @@
 {
-  config,
+  # keep-sorted start
   inputs,
-  lib,
   system,
   userName,
+  # keep-sorted end 
   ...
 }:
-let
-  feature = "agenix";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
-    environment.systemPackages = [ inputs.agenix.packages.${system}.default ];
-    age.identityPaths = [ "/home/${userName}/.ssh/id_ed25519" ];
-  };
+  environment.systemPackages = [ inputs.agenix.packages.${system}.default ];
+  age.identityPaths = [ "/home/${userName}/.ssh/id_ed25519" ];
 
   imports = [ inputs.agenix.nixosModules.default ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
 }

modules/nixos/features/amd-gpu.nix

@@ -1,26 +1,11 @@
 {
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  feature = "amd-gpu";
-in
-{
-  config = lib.mkIf config.${feature}.enable {
+  # load graphics drivers before anything else
+  boot.initrd.kernelModules = [ "amdgpu" ];
 
-    # load graphics drivers before anything else
-    boot.initrd.kernelModules = [ "amdgpu" ];
-
-    hardware.graphics = {
-      enable = true;
-      enable32Bit = true;
-      extraPackages = with pkgs; [ amdvlk ];
-    };
-
-    services.xserver.videoDrivers = [ "amdgpu" ];
+  hardware.graphics = {
+    enable = true;
+    enable32Bit = true;
   };
 
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+  services.xserver.videoDrivers = [ "amdgpu" ];
 }

modules/nixos/features/bazarr.nix

@@ -0,0 +1,38 @@
+let
+  port = 5017;
+  certloc = "/var/lib/acme/fi33.buzz";
+  hostname = "subtitles.fi33.buzz";
+  url = "https://${hostname}";
+in
+{
+  services = {
+    bazarr = {
+      enable = true;
+      dataDir = "/srv/bazarr";
+      group = "srv";
+      listenPort = port;
+    };
+
+    gatus.settings.endpoints = [
+      {
+        name = "Bazarr";
+        group = "Media Management";
+        inherit url;
+        interval = "5m";
+        conditions = [
+          "[STATUS] == 200"
+          "[CONNECTED] == true"
+          "[RESPONSE_TIME] < 500"
+        ];
+        alerts = [ { type = "ntfy"; } ];
+      }
+    ];
+
+    caddy.virtualHosts.${hostname}.extraConfig = ''
+      reverse_proxy localhost:${toString port}
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
+  };
+}

modules/nixos/features/borgbackup.nix

@@ -0,0 +1,57 @@
+{
+  config,
+  pkgs,
+  ...
+}:
+let
+  jobConfig = {
+    compression = "auto,zlib";
+    doInit = false;
+    preHook = ''
+      /run/wrappers/bin/sudo -u postgres ${pkgs.postgresql}/bin/pg_dumpall > /srv/backup/database/postgres/dump.sql
+    '';
+    postHook = ''
+      rm /srv/backup/database/postgres/dump.sql
+    '';
+    prune.keep = {
+      daily = 7;
+      weekly = 4;
+      monthly = 6;
+      yearly = 1;
+    };
+    readWritePaths = [
+      "/srv/backup"
+    ];
+    startAt = "*-*-* 03:00:00";
+    extraCreateArgs = [ "-v" ];
+  };
+in
+{
+  services.borgbackup = {
+    jobs = {
+      onsite = {
+        encryption = {
+          passCommand = "cat ${config.age.secrets.borgbackup-onsite.path}";
+          mode = "repokey-blake2";
+        };
+        removableDevice = true;
+        repo = "/mnt/external/backup/take2";
+      }
+      // jobConfig;
+      offsite = {
+        encryption = {
+          passCommand = "cat ${config.age.secrets.borgbackup-offsite.path}";
+          mode = "repokey-blake2";
+        };
+        environment.BORG_RSH = "ssh -i /home/srv/.ssh/id_ed25519";
+        repo = "ssh://vuc5c3xq@vuc5c3xq.repo.borgbase.com/./repo";
+      }
+      // jobConfig;
+    };
+  };
+
+  age.secrets = {
+    borgbackup-onsite.file = ../../../secrets/borgbackup-onsite.age;
+    borgbackup-offsite.file = ../../../secrets/borgbackup-offsite.age;
+  };
+}

modules/nixos/features/borgmatic.nix

@@ -1,92 +1,82 @@
 {
+  # keep-sorted start
   config,
   lib,
+  # keep-sorted end
   ...
 }:
-let
-  feature = "borgmatic";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
-    # service
-    services.borgmatic = {
-      enable = true;
-      settings = {
-        # keep-sorted start block=yes
-        compression = "auto,zlib";
-        encryption_passcommand = "cat ${config.age.secrets.borgmatic.path}";
-        keep_daily = 7;
-        keep_monthly = 6;
-        keep_weekly = 4;
-        keep_yearly = 1;
-        ntfy = {
-          topic = "backups";
-          server = config.services.ntfy-sh.settings.base-url;
-          finish = {
-            title = "Ping!";
-            message = "Your backups have succeeded :)";
-            tags = "tada,BorgBackup,Server";
-          };
-          fail = {
-            title = "Ping!";
-            message = "Your backups have failed :(";
-            tags = "rotating_light,BorgBackup,Server";
-          };
-          states = [
-            "finish"
-            "fail"
-          ];
+  # service
+  services.borgmatic = {
+    enable = true;
+    settings = {
+      # keep-sorted start block=yes
+      compression = "auto,zlib";
+      encryption_passcommand = "cat ${config.age.secrets.borgmatic.path}";
+      keep_daily = 7;
+      keep_monthly = 6;
+      keep_weekly = 4;
+      keep_yearly = 1;
+      ntfy = {
+        topic = "backups";
+        server = config.services.ntfy-sh.settings.base-url;
+        username = "borgmatic";
+        password = "{credential file ${config.age.secrets.borgmatic-ntfy.path}}";
+        finish = {
+          title = "Ping!";
+          message = "Your backups have succeeded :)";
+          tags = "tada,BorgBackup,Server";
         };
-        repositories = [
-          {
-            path = "/backup/repo";
-            label = "onsite";
-            # encryption = "repokey-blake2";
-          }
-          {
-            path = "ssh://vuc5c3xq@vuc5c3xq.repo.borgbase.com/./repo";
-            label = "offsite";
-            # encryption = "repokey-blake2";
-          }
+        fail = {
+          title = "Ping!";
+          message = "Your backups have failed :(";
+          tags = "rotating_light,BorgBackup,Server";
+        };
+        states = [
+          "finish"
+          "fail"
         ];
-        retries = 3;
-        retry_wait = 10;
-        ssh_command = "ssh -i /home/srv/.ssh/id_ed25519";
-        # keep-sorted end
       };
-    };
-
-    # postgres
-    services.postgresql.ensureUsers = [
-      {
-        name = "root";
-      }
-    ];
-    systemd.services.postgresql.postStart = lib.mkAfter ''
-      /run/current-system/sw/bin/psql postgres -c "GRANT pg_read_all_data TO root"
-    '';
-    systemd.services.borgmatic.path = [
-      config.services.postgresql.package
-    ];
-
-    # credentials
-    systemd.services.borgmatic.serviceConfig.LoadCredential = [
-      "borgmatic-pg:${config.age.secrets.borgmatic-pg.path}"
-    ];
-
-    # onsite drive
-    services.udisks2.enable = true;
-    fileSystems."/backup" = {
-      device = "/dev/disk/by-uuid/d3b3d7dc-d634-4327-9ea2-9d8daa4ecf4e";
-      fsType = "ext4";
-    };
-
-    # secrets
-    age.secrets = {
-      "borgmatic".file = ../../../secrets/borgmatic.age;
-      "borgmatic-pg".file = ../../../secrets/borgmatic-pg.age;
+      relocated_repo_access_is_ok = true;
+      repositories = [
+        {
+          path = "/mnt/external/backup/repo";
+          label = "onsite";
+        }
+        {
+          path = "ssh://vuc5c3xq@vuc5c3xq.repo.borgbase.com/./repo";
+          label = "offsite";
+        }
+      ];
+      retries = 3;
+      retry_wait = 10;
+      ssh_command = "ssh -i /home/srv/.ssh/id_ed25519";
+      # keep-sorted end
     };
   };
 
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+  # postgres
+  services.postgresql.ensureUsers = [
+    {
+      name = "root";
+    }
+  ];
+  systemd.services.postgresql.postStart = lib.mkAfter ''
+    /run/current-system/sw/bin/psql postgres -c "GRANT pg_read_all_data TO root"
+  '';
+  systemd.services.borgmatic.path = [
+    config.services.postgresql.package
+  ];
+
+  # credentials
+  systemd.services.borgmatic.serviceConfig.LoadCredential = [
+    "borgmatic-pg:${config.age.secrets.borgmatic-pg.path}"
+  ];
+
+  # secrets
+  age.secrets = {
+    "borgmatic".file = ../../../secrets/borgmatic.age;
+    "borgmatic-ntfy".file = ../../../secrets/borgmatic-ntfy.age;
+    "borgmatic-pg".file = ../../../secrets/borgmatic-pg.age;
+  };
 }

modules/nixos/features/caddy.nix

@@ -0,0 +1,29 @@
+{
+  config,
+  ...
+}:
+{
+  services.caddy = {
+    enable = true;
+    dataDir = "/srv/caddy";
+    globalConfig = ''
+      auto_https disable_redirects
+    '';
+    openFirewall = true;
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "festive-steed-fit@duck.com";
+    certs."fi33.buzz" = {
+      group = config.services.caddy.group;
+      domain = "fi33.buzz";
+      extraDomainNames = [ "*.fi33.buzz" ];
+      dnsProvider = "porkbun";
+      dnsPropagationCheck = true;
+      credentialsFile = config.age.secrets."porkbun-api".path;
+    };
+  };
+
+  age.secrets."porkbun-api".file = ../../../secrets/porkbun-api.age;
+}

modules/nixos/features/copyparty.nix

@@ -1,67 +1,70 @@
 {
+  # keep-sorted start
   config,
-  lib,
   inputs,
+  # keep-sorted end
   ...
 }:
 let
-  feature = "copyparty";
-  port = "5000";
+  port = 5000;
+  certloc = "/var/lib/acme/fi33.buzz";
+  hostname = "files.fi33.buzz";
+  url = "https://${hostname}";
 in
 {
   imports = [ inputs.copyparty.nixosModules.default ];
 
-  config = lib.mkIf config.${feature}.enable {
-    services = {
-      # service
-      copyparty = {
-        enable = true;
-        settings = {
-          z = true;
-          e2dsa = true;
-          e2ts = true;
-          e2vu = true;
-          p = lib.toInt port;
-        };
-
-        accounts = {
-          will = {
-            passwordFile = config.age.secrets.copyparty-will.path;
-          };
-        };
-
-        volumes = {
-          "/" = {
-            path = "/srv/copyparty";
-            access = {
-              r = "*";
-              A = [ "will" ];
-            };
-          };
-        };
+  services = {
+    copyparty = {
+      enable = true;
+      settings = {
+        z = true;
+        e2dsa = true;
+        e2ts = true;
+        e2vu = true;
+        p = port;
+        xff-hdr = "x-forwarded-for";
+        rproxy = 1;
       };
 
-      # reverse proxy
-      nginx = {
-        virtualHosts."${feature}.fi33.buzz" = {
-          forceSSL = true;
-          useACMEHost = "fi33.buzz";
-          locations."/" = {
-            proxyPass = "http://localhost:${port}";
-            # proxyWebsockets = true;
-          };
+      accounts.Impatient7119.passwordFile = config.age.secrets.copyparty.path;
+
+      volumes."/" = {
+        path = "/srv/copyparty";
+        access = {
+          A = [ "Impatient7119" ];
         };
       };
     };
 
-    # secrets
-    age.secrets."copyparty-will" = {
-      file = ../../../secrets/copyparty-will.age;
-      owner = "copyparty";
-    };
+    gatus.settings.endpoints = [
+      {
+        name = "copyparty";
+        group = "Private Services";
+        inherit url;
+        interval = "5m";
+        conditions = [
+          "[STATUS] == 200"
+          "[CONNECTED] == true"
+          "[RESPONSE_TIME] < 500"
+        ];
+        alerts = [ { type = "ntfy"; } ];
+      }
+    ];
 
-    nixpkgs.overlays = [ inputs.copyparty.overlays.default ];
+    caddy.virtualHosts.${hostname}.extraConfig = ''
+      reverse_proxy localhost:${toString port}
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
   };
 
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+  # secrets
+  age.secrets."copyparty" = {
+    file = ../../../secrets/copyparty.age;
+    owner = "copyparty";
+  };
+
+  nixpkgs.overlays = [ inputs.copyparty.overlays.default ];
 }

modules/nixos/features/couchdb.nix

@@ -1,60 +1,62 @@
-{
-  config,
-  lib,
-  ...
-}:
 let
-  feature = "couchdb";
-  port = "5984";
+  port = 5984;
+  certloc = "/var/lib/acme/fi33.buzz";
+  hostname = "couchdb.fi33.buzz";
+  url = "https://${hostname}";
 in
 {
-  config = lib.mkIf config.${feature}.enable {
-    services = {
-      # service
-      couchdb = {
-        enable = true;
-        databaseDir = "/srv/couchdb";
-        viewIndexDir = "/srv/couchdb";
-        configFile = "/srv/couchdb";
-        port = lib.toInt port;
-        extraConfig = {
-          chttpd = {
-            require_valid_user = true;
-            enable_cors = true;
-            max_http_request_size = 4294967296;
-          };
-
-          chttpd_auth.require_valid_user = true;
-
-          httpd = {
-            WWW-Authenticate = ''Basic realm="couchdb"'';
-            enable_cors = true;
-          };
-
-          couchdb.max_document_size = 50000000;
-
-          cors = {
-            credentials = true;
-            origins = ''
-              app://obsidian.md,capacitor://localhost,http://localhost,https://localhost,capacitor://couchdb.fi33.buzz,http://couchdb.fi33.buzz,https://couchdb.fi33.buzz
-            '';
-          };
+  services = {
+    couchdb = {
+      enable = true;
+      databaseDir = "/srv/couchdb";
+      viewIndexDir = "/srv/couchdb";
+      configFile = "/srv/couchdb";
+      inherit port;
+      extraConfig = {
+        chttpd = {
+          require_valid_user = true;
+          enable_cors = true;
+          max_http_request_size = 4294967296;
         };
-      };
 
-      # reverse proxy
-      nginx = {
-        virtualHosts."${feature}.fi33.buzz" = {
-          forceSSL = true;
-          useACMEHost = "fi33.buzz";
-          locations."/" = {
-            proxyPass = "http://localhost:${port}";
-            # proxyWebsockets = true;
-          };
+        chttpd_auth.require_valid_user = true;
+
+        httpd = {
+          WWW-Authenticate = ''Basic realm="couchdb"'';
+          enable_cors = true;
+        };
+
+        couchdb.max_document_size = 50000000;
+
+        cors = {
+          credentials = true;
+          origins = ''
+            app://obsidian.md,capacitor://localhost,http://localhost,https://localhost,capacitor://${hostname},http://${hostname},${url}
+          '';
         };
       };
     };
-  };
 
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+    gatus.settings.endpoints = [
+      {
+        name = "CouchDB";
+        group = "Private Services";
+        inherit url;
+        interval = "5m";
+        conditions = [
+          "[STATUS] == 401"
+          "[CONNECTED] == true"
+          "[RESPONSE_TIME] < 500"
+        ];
+        alerts = [ { type = "ntfy"; } ];
+      }
+    ];
+
+    caddy.virtualHosts.${hostname}.extraConfig = ''
+      reverse_proxy localhost:${toString port}
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
+  };
 }

modules/nixos/features/cryptpad.nix

@@ -0,0 +1,66 @@
+let
+  httpPort = 5022;
+  websocketPort = 5024;
+  certloc = "/var/lib/acme/fi33.buzz";
+  hostname = "cryptpad.fi33.buzz";
+  url = "https://${hostname}";
+in
+{
+  services = {
+    cryptpad = {
+      enable = true;
+      settings = {
+        inherit httpPort;
+        inherit websocketPort;
+        httpUnsafeOrigin = url;
+        httpSafeOrigin = "https://cryptpad-ui.fi33.buzz";
+        inactiveTime = 7;
+        archiveRetentionTime = 7;
+        accountRetentionTime = 7;
+      };
+    };
+
+    gatus.settings.endpoints = [
+      {
+        name = "CryptPad";
+        group = "Public Services";
+        inherit url;
+        interval = "5m";
+        conditions = [
+          "[STATUS] == 200"
+          "[CONNECTED] == true"
+          "[RESPONSE_TIME] < 500"
+        ];
+        alerts = [ { type = "ntfy"; } ];
+      }
+    ];
+
+    caddy.virtualHosts."${hostname} cryptpad-ui.fi33.buzz".extraConfig = ''
+      header Strict-Transport-Security "includeSubDomains; preload"
+
+      handle /cryptpad_websocket* {
+        reverse_proxy localhost:${toString websocketPort} {
+          header_up Host {host}
+          header_up X-Real-IP {remote_host}
+        }
+      }
+
+      handle {
+        reverse_proxy localhost:${toString httpPort} {
+          header_up Host {host}
+          header_up X-Real-IP {remote_host}
+        }
+      }
+
+      @register {
+        host ${hostname} 
+        path /register*
+      }
+      respond @register 403
+
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
+  };
+}

modules/nixos/features/external-speakers.nix

@@ -1,17 +1,5 @@
 {
-  config,
-  lib,
-  ...
-}:
-let
-  feature = "external-speakers";
-in
-{
-  config = lib.mkIf config.${feature}.enable {
-    boot.extraModprobeConfig = ''
-      options snd_hda_intel power_save=0
-    '';
-  };
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+  boot.extraModprobeConfig = ''
+    options snd_hda_intel power_save=0
+  '';
 }

modules/nixos/features/fi33.buzz.nix

@@ -0,0 +1,19 @@
+let
+  certloc = "/var/lib/acme/fi33.buzz";
+  hostname = "www.fi33.buzz";
+in
+{
+  # TODO why can't I serve content on fi33.buzz? dns propagation issue?
+  services.caddy.virtualHosts = {
+    "fi33.buzz".extraConfig = ''
+      redir https://www.fi33.buzz{uri} permanent
+    '';
+    ${hostname}.extraConfig = ''
+      root * /srv/fi33.buzz/public
+      file_server
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
+  };
+}

modules/nixos/features/firefly.nix

@@ -0,0 +1,50 @@
+{
+  config,
+  ...
+}:
+let
+  certloc = "/var/lib/acme/fi33.buzz";
+in
+{
+  services = {
+    firefly-iii = {
+      enable = true;
+      dataDir = "/srv/firefly";
+      group = config.services.caddy.group;
+      settings = {
+        # keep-sorted start
+        ALLOW_WEBHOOKS = "true";
+        APP_KEY_FILE = config.age.secrets.firefly.path;
+        APP_URL = "https://firefly.fi33.buzz";
+        DEFAULT_LANGUAGE = "en_GB";
+        REPORT_ERRORS_ONLINE = "false";
+        TRUSTED_PROXIES = "**";
+        TZ = "Australia/Melbourne";
+        # keep-sorted end
+      };
+    };
+
+    caddy.virtualHosts."firefly.fi33.buzz".extraConfig = ''
+      root * ${config.services.firefly-iii.package}/public
+      php_fastcgi unix//${config.services.phpfpm.pools.firefly-iii.socket}
+      try_files {path} {path}/ /index.php?{query}
+      file_server {
+        index index.php
+      }
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
+  };
+
+  age.secrets = {
+    firefly = {
+      file = ../../../secrets/firefly.age;
+      owner = "firefly-iii";
+    };
+    firefly-db = {
+      file = ../../../secrets/firefly-db.age;
+      owner = "firefly-iii";
+    };
+  };
+}

modules/nixos/features/flaresolverr.nix

@@ -1,34 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-let
-  feature = "flaresolverr";
-  port = "5011";
-in
-{
-  config = lib.mkIf config.${feature}.enable {
-    services = {
-      # service
-      flaresolverr = {
-        enable = true;
-        port = lib.toInt port;
-      };
-
-      # reverse proxy
-      nginx = {
-        virtualHosts."${feature}.fi33.buzz" = {
-          forceSSL = true;
-          useACMEHost = "fi33.buzz";
-          locations."/" = {
-            proxyPass = "http://localhost:${port}";
-            # proxyWebsockets = true;
-          };
-        };
-      };
-    };
-  };
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
-}

modules/nixos/features/fonts.nix

@@ -1,21 +1,10 @@
 {
-  config,
-  lib,
   pkgs,
   ...
 }:
-let
-  feature = "fonts";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
-    fonts.packages = with pkgs; [
-      nerd-fonts.jetbrains-mono
-      inter-nerdfont
-    ];
-  };
-
-  imports = [ ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+  fonts.packages = with pkgs; [
+    nerd-fonts.jetbrains-mono
+    inter-nerdfont
+  ];
 }

modules/nixos/features/gaming.nix

@@ -1,44 +1,34 @@
 {
-  config,
-  lib,
   pkgs,
   ...
 }:
-let
-  feature = "gaming";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
-    environment.systemPackages = with pkgs; [
-      # keep-sorted start
-      heroic
-      lutris
-      mangohud
-      nexusmods-app
-      prismlauncher
-      protonup-qt
-      wine
-      wine64
-      winetricks
-      # keep-sorted end
-    ];
+  environment.systemPackages = with pkgs; [
+    # keep-sorted start
+    heroic
+    mangohud
+    prismlauncher
+    protonup-qt
+    wine
+    wine64
+    winetricks
+    # keep-sorted end
+  ];
 
-    programs = {
-      gamemode.enable = true;
-      steam = {
-        enable = true;
-        gamescopeSession.enable = true;
-      };
-    };
-
-    services.lact = {
+  programs = {
+    gamemode.enable = true;
+    gamescope.enable = true;
+    steam = {
       enable = true;
-      settings = { };
+      gamescopeSession.enable = true;
     };
-
-    # latest kernel
-    boot.kernelPackages = pkgs.linuxPackages_latest;
   };
 
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+  services.lact = {
+    enable = true;
+    settings = { };
+  };
+
+  # latest kernel
+  # boot.kernelPackages = pkgs.linuxPackages_latest;
 }

modules/nixos/features/gatus.nix

@@ -0,0 +1,55 @@
+{
+  config,
+  ...
+}:
+let
+  port = 5025;
+  certloc = "/var/lib/acme/fi33.buzz";
+  hostname = "status.fi33.buzz";
+  url = "https://${hostname}";
+in
+{
+  services = {
+    gatus = {
+      enable = true;
+      environmentFile = config.age.secrets.gatus.path;
+      settings = {
+        alerting = {
+          ntfy = {
+            topic = "services";
+            url = config.services.ntfy-sh.settings.base-url;
+            token = "$NTFY_TOKEN";
+            click = url;
+            default-alert = {
+              description = "Health Check Failed";
+              send-on-resolved = true;
+            };
+          };
+        };
+        connectivity.checker = {
+          target = "1.1.1.1:53";
+          interval = "60s";
+        };
+        ui = {
+          title = "Health Dashboard | Fi33Buzz";
+          description = "Fi33Buzz health dashboard";
+          dashboard-heading = "";
+          dashboard-subheading = "";
+          header = "Fi33Buzz Status";
+          link = "https://home.fi33.buzz/";
+          default-sort-by = "group";
+        };
+        web.port = port;
+      };
+    };
+
+    caddy.virtualHosts.${hostname}.extraConfig = ''
+      reverse_proxy localhost:${toString port}
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
+  };
+
+  age.secrets.gatus.file = ../../../secrets/gatus.age;
+}

modules/nixos/features/gnome.nix

@@ -1,59 +1,50 @@
 {
-  config,
-  lib,
   pkgs,
   ...
 }:
-let
-  feature = "gnome";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
-    services = {
-      desktopManager.gnome.enable = true;
-      displayManager.gdm.enable = true;
-    };
-
-    environment = {
-      # https://discourse.nixos.org/t/howto-disable-most-gnome-default-applications-and-what-they-are/13505
-      gnome.excludePackages = with pkgs; [
-        # keep-sorted start
-        # baobab # disk usage analyzer
-        # cheese # photo booth
-        # eog # image viewer
-        epiphany # web browser
-        evince # document viewer
-        # file-roller # archive manager
-        geary # email client
-        gedit # text editor
-        gnome-calculator
-        gnome-calendar
-        gnome-characters
-        gnome-clocks
-        # gnome-disk-utility
-        gnome-connections
-        gnome-contacts
-        gnome-font-viewer
-        gnome-logs
-        gnome-maps
-        gnome-music
-        gnome-photos
-        # gnome-screenshot
-        # gnome-system-monitor
-        gnome-terminal
-        gnome-weather
-        seahorse # password manager
-        # simple-scan # document scanner
-        totem # video player
-        yelp # help viewer
-        # keep-sorted end
-      ];
-      systemPackages = with pkgs; [
-        gnome-tweaks
-        bibata-cursors
-      ];
-    };
+  services = {
+    desktopManager.gnome.enable = true;
+    displayManager.gdm.enable = true;
   };
 
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+  environment = {
+    # https://discourse.nixos.org/t/howto-disable-most-gnome-default-applications-and-what-they-are/13505
+    gnome.excludePackages = with pkgs; [
+      # keep-sorted start
+      # baobab # disk usage analyzer
+      # cheese # photo booth
+      # eog # image viewer
+      epiphany # web browser
+      evince # document viewer
+      # file-roller # archive manager
+      geary # email client
+      gedit # text editor
+      gnome-calculator
+      gnome-calendar
+      gnome-characters
+      gnome-clocks
+      # gnome-disk-utility
+      gnome-connections
+      gnome-contacts
+      gnome-font-viewer
+      gnome-logs
+      gnome-maps
+      gnome-music
+      gnome-photos
+      # gnome-screenshot
+      # gnome-system-monitor
+      gnome-terminal
+      gnome-weather
+      seahorse # password manager
+      # simple-scan # document scanner
+      totem # video player
+      yelp # help viewer
+      # keep-sorted end
+    ];
+    systemPackages = with pkgs; [
+      gnome-tweaks
+      bibata-cursors
+    ];
+  };
 }

modules/nixos/features/homepage-dashboard.nix

@@ -1,12 +1,13 @@
 {
+  # keep-sorted start
   config,
   lib,
   pkgs,
+  # keep-sorted end
   ...
 }:
 let
-  feature = "homepage-dashboard";
-  port = "5004";
+  port = 5004;
   genSecrets =
     secrets:
     lib.genAttrs secrets (secret: {
@@ -24,290 +25,441 @@ let
     # keep-sorted start
     "immich"
     "jellyfin"
+    "kavita-api"
     "lidarr"
+    "mealie"
     "miniflux"
+    "nzbget"
     "paperless"
     "prowlarr"
     "radarr"
+    "readarr"
     "sonarr"
+    "subtitles"
     # keep-sorted end
   ];
+  certloc = "/var/lib/acme/fi33.buzz";
+  hostname = "home.fi33.buzz";
+  url = "https://${hostname}";
 in
 {
-  config = lib.mkIf config.${feature}.enable {
-    services = {
-      # service
-      homepage-dashboard = {
-        enable = true;
-        listenPort = lib.toInt port;
-        allowedHosts = "homepage-dashboard.fi33.buzz";
-        services = [
-          # keep-sorted start block=yes
-          {
-            "Cloud Services" = [
-              {
-                "copyparty" = {
-                  "description" = "Cloud file manager";
-                  "icon" = "sh-copyparty.svg";
-                  "href" = "https://copyparty.fi33.buzz/";
-                };
-              }
-              {
-                "CouchDB" = {
-                  "description" = "Obsidian sync database";
-                  "icon" = "couchdb.svg";
-                  "href" = "https://couchdb.fi33.buzz/_utils/";
-                };
-              }
-              {
-                "ntfy" = {
-                  "description" = "Notification service";
-                  "icon" = "ntfy.svg";
-                  "href" = "https://ntfy-sh.fi33.buzz/";
-                };
-              }
-              {
-                "Syncthing" = {
-                  "description" = "Decentralised file synchronisation";
-                  "icon" = "syncthing.svg";
-                  "href" = "https://syncthing.fi33.buzz/";
-                };
-              }
-              {
-                "qBittorrent" = {
-                  "description" = "BitTorrent client";
-                  "icon" = "qbittorrent.svg";
-                  "href" = "https://qbittorrent.fi33.buzz/";
-                };
-              }
-              {
-                "Vaultwarden" = {
-                  "description" = "Password manager";
-                  "icon" = "vaultwarden.svg";
-                  "href" = "https://vaultwarden.fi33.buzz/";
-                };
-              }
-            ];
-          }
-          {
-            "Media Management" = [
-              {
-                "Lidarr" = {
-                  "description" = "Music collection manager";
-                  "icon" = "lidarr.svg";
-                  "href" = "https://lidarr.fi33.buzz/";
-                  "widget" = {
-                    "type" = "lidarr";
-                    "url" = "https://lidarr.fi33.buzz/";
-                    "key" = "@lidarr@";
-                    "enableQueue" = true;
-                  };
-                };
-              }
-              {
-                "Prowlarr" = {
-                  "description" = "Indexer management tool";
-                  "icon" = "prowlarr.svg";
-                  "href" = "https://prowlarr.fi33.buzz/";
-                  "widget" = {
-                    "type" = "prowlarr";
-                    "url" = "https://prowlarr.fi33.buzz/";
-                    "key" = "@prowlarr@";
-                  };
-                };
-              }
-              {
-                "Radarr" = {
-                  "description" = "Movie collection manager";
-                  "icon" = "radarr.svg";
-                  "href" = "https://radarr.fi33.buzz/";
-                  "widget" = {
-                    "type" = "radarr";
-                    "url" = "https://radarr.fi33.buzz/";
-                    "key" = "@radarr@";
-                    "enableQueue" = true;
-                  };
-                };
-              }
-              {
-                "Sonarr" = {
-                  "description" = "TV show collection manager";
-                  "icon" = "sonarr.svg";
-                  "href" = "https://sonarr.fi33.buzz/";
-                  "widget" = {
-                    "type" = "sonarr";
-                    "url" = "https://sonarr.fi33.buzz/";
-                    "key" = "@sonarr@";
-                    "enableQueue" = true;
-                  };
-                };
-              }
-            ];
-          }
-          {
-            "Media Streaming" = [
-              {
-                "Immich" = {
-                  "description" = "Photo backup";
-                  "icon" = "immich.svg";
-                  "href" = "https://immich.fi33.buzz/";
-                  "widget" = {
-                    "type" = "immich";
-                    "fields" = [
-                      "users"
-                      "photos"
-                      "videos"
-                      "storage"
-                    ];
-                    "url" = "https://immich.fi33.buzz/";
-                    "version" = 2;
-                    "key" = "@immich@";
-                  };
-                };
-              }
-              {
-                "Jellyfin" = {
-                  "description" = "Media streaming";
-                  "icon" = "jellyfin.svg";
-                  "href" = "https://jellyfin.fi33.buzz/";
-                  "widget" = {
-                    "type" = "jellyfin";
-                    "url" = "https://jellyfin.fi33.buzz/";
-                    "key" = "@jellyfin@";
-                    "enableBlocks" = true;
-                    "enableNowPlaying" = true;
-                    "enableUser" = true;
-                    "showEpisodeNumber" = true;
-                    "expandOneStreamToTwoRows" = false;
-                  };
-                };
-              }
-              {
-                "Miniflux" = {
-                  "description" = "RSS aggregator";
-                  "icon" = "miniflux.svg";
-                  "href" = "https://miniflux.fi33.buzz/";
-                  "widget" = {
-                    "type" = "miniflux";
-                    "url" = "https://miniflux.fi33.buzz/";
-                    "key" = "@miniflux@";
-                  };
-                };
-              }
-              {
-                "Paperless" = {
-                  "description" = "Digital filing cabinet";
-                  "icon" = "paperless.svg";
-                  "href" = "https://paperless.fi33.buzz/";
-                  "widget" = {
-                    "type" = "paperlessngx";
-                    "url" = "https://paperless.fi33.buzz/";
-                    "username" = "admin";
-                    "password" = "@paperless@";
-                  };
-                };
-              }
-            ];
-          }
-          {
-            "Utilities" = [
-              {
-                "NanoKVM" = {
-                  "description" = "Remote KVM switch";
-                  "icon" = "mdi-console.svg";
-                  "href" = "http://nano-kvm/";
-                };
-              }
-            ];
-          }
-          # keep-sorted end
-        ];
-        settings = {
-          title = "Mission Control";
-          theme = "dark";
-          color = "neutral";
-          headerStyle = "clean";
-          layout = [
+  services = {
+    homepage-dashboard = {
+      enable = true;
+      listenPort = port;
+      allowedHosts = hostname;
+      services = [
+        {
+          "Public Services" = [
             {
-              "Media Streaming" = {
-                style = "row";
-                columns = 4;
-                useEqualHeights = true;
+              CryptPad = {
+                description = "Collaborative office suite";
+                icon = "cryptpad.svg";
+                href = "https://cryptpad.fi33.buzz/";
+                siteMonitor = "https://cryptpad.fi33.buzz/";
               };
             }
             {
-              "Media Management" = {
-                style = "row";
-                columns = 4;
-                useEqualHeights = true;
+              LibreTranslate = {
+                description = "Machine Translation API";
+                icon = "libretranslate.svg";
+                href = "https://translate.fi33.buzz/";
+                siteMonitor = "https://translate.fi33.buzz/";
               };
             }
             {
-              "Cloud Services" = {
-                style = "row";
-                columns = 3;
-              };
-            }
-            {
-              "Utilities" = {
-                style = "row";
-                columns = 3;
+              Send = {
+                description = "Simple, private file sharing";
+                icon = "send.svg";
+                href = "https://send.fi33.buzz/";
+                siteMonitor = "https://send.fi33.buzz/";
               };
             }
           ];
-          quicklaunch.searchDescriptions = true;
-          disableUpdateCheck = true;
-          showStats = true;
-          statusStyle = "dot";
-        };
-        widgets = [
+        }
+        {
+          "Media Management" = [
+            {
+              Radarr = {
+                description = "Movie organizer/manager";
+                icon = "radarr.svg";
+                href = "https://movies.fi33.buzz/";
+                siteMonitor = "https://movies.fi33.buzz/";
+                widget = {
+                  type = "radarr";
+                  url = "https://movies.fi33.buzz/";
+                  key = "@radarr@";
+                  enableQueue = true;
+                };
+              };
+            }
+            {
+              Sonarr = {
+                description = "Smart PVR";
+                icon = "sonarr.svg";
+                href = "https://shows.fi33.buzz/";
+                siteMonitor = "https://shows.fi33.buzz/";
+                widget = {
+                  type = "sonarr";
+                  url = "https://shows.fi33.buzz/";
+                  key = "@sonarr@";
+                  enableQueue = true;
+                };
+              };
+            }
+            {
+              Lidarr = {
+                description = "Like Sonarr but made for music";
+                icon = "lidarr.svg";
+                href = "https://music.fi33.buzz/";
+                siteMonitor = "https://music.fi33.buzz/";
+                widget = {
+                  type = "lidarr";
+                  url = "https://music.fi33.buzz/";
+                  key = "@lidarr@";
+                  enableQueue = true;
+                };
+              };
+            }
+            {
+              Readarr = {
+                description = "Book Manager and Automation";
+                icon = "readarr.svg";
+                href = "https://books.fi33.buzz/";
+                siteMonitor = "https://books.fi33.buzz/";
+                widget = {
+                  type = "readarr";
+                  url = "https://books.fi33.buzz/";
+                  key = "@readarr@";
+                  enableQueue = true;
+                };
+              };
+            }
+            {
+              Bazarr = {
+                description = "Subtitle manager and downloader";
+                icon = "bazarr.svg";
+                href = "https://subtitles.fi33.buzz/";
+                siteMonitor = "https://subtitles.fi33.buzz/";
+                widget = {
+                  type = "bazarr";
+                  url = "https://subtitles.fi33.buzz/";
+                  key = "@subtitles@";
+                };
+              };
+            }
+            {
+              Prowlarr = {
+                description = "Indexer manager/proxy";
+                icon = "prowlarr.svg";
+                href = "https://prowlarr.fi33.buzz/";
+                siteMonitor = "https://prowlarr.fi33.buzz/";
+                widget = {
+                  type = "prowlarr";
+                  url = "https://prowlarr.fi33.buzz/";
+                  key = "@prowlarr@";
+                };
+              };
+            }
+            {
+              NZBget = {
+                description = "Usenet Downloader";
+                icon = "nzbget.svg";
+                href = "https://usenet.fi33.buzz/";
+                siteMonitor = "https://usenet.fi33.buzz/";
+                widget = {
+                  type = "nzbget";
+                  url = "https://usenet.fi33.buzz/";
+                  username = "nzbget";
+                  password = "@nzbget@";
+                };
+              };
+            }
+            {
+              qBittorrent = {
+                description = "BitTorrent client";
+                icon = "qbittorrent.svg";
+                href = "https://bittorrent.fi33.buzz/";
+                siteMonitor = "https://bittorrent.fi33.buzz/";
+              };
+            }
+          ];
+        }
+        {
+          "Private Services" = [
+            {
+              copyparty = {
+                description = "Portable file server";
+                icon = "sh-copyparty.svg";
+                href = "https://files.fi33.buzz/";
+                siteMonitor = "https://files.fi33.buzz/";
+              };
+            }
+            {
+              CouchDB = {
+                description = "Syncing database";
+                icon = "couchdb.svg";
+                href = "https://couchdb.fi33.buzz/_utils/";
+                siteMonitor = "https://couchdb.fi33.buzz/_utils/";
+              };
+            }
+            {
+              Mealie = {
+                description = "Recipe manager and meal planner";
+                icon = "mealie.svg";
+                href = "https://mealie.fi33.buzz/";
+                siteMonitor = "https://mealie.fi33.buzz/";
+                widget = {
+                  type = "mealie";
+                  url = "https://mealie.fi33.buzz/";
+                  version = 2;
+                  key = "@mealie@";
+                };
+              };
+            }
+            {
+              ntfy = {
+                description = "Send push notifications using PUT/POST";
+                icon = "ntfy.svg";
+                href = "https://notify.fi33.buzz/";
+                siteMonitor = "https://notify.fi33.buzz/";
+              };
+            }
+            {
+              Radicale = {
+                description = "A simple CalDAV (calendar) and CardDAV (contact) server";
+                icon = "radicale.svg";
+                href = "https://caldav.fi33.buzz";
+                siteMonitor = "https://caldav.fi33.buzz";
+              };
+            }
+            {
+              Syncthing = {
+                description = "Open Source Continuous File Synchronization";
+                icon = "syncthing.svg";
+                href = "https://sync.fi33.buzz/";
+                siteMonitor = "https://sync.fi33.buzz/";
+              };
+            }
+            {
+              Vaultwarden = {
+                description = "Unofficial Bitwarden compatible server";
+                icon = "vaultwarden.svg";
+                href = "https://vault.fi33.buzz/";
+                siteMonitor = "https://vault.fi33.buzz/";
+              };
+            }
+          ];
+        }
+        {
+          "Media Streaming" = [
+            {
+              Immich = {
+                description = "Photo and video management solution";
+                icon = "immich.svg";
+                href = "https://photos.fi33.buzz/";
+                siteMonitor = "https://photos.fi33.buzz/";
+                widget = {
+                  type = "immich";
+                  fields = [
+                    "users"
+                    "photos"
+                    "videos"
+                    "storage"
+                  ];
+                  url = "https://photos.fi33.buzz/";
+                  version = 2;
+                  key = "@immich@";
+                };
+              };
+            }
+            {
+              Jellyfin = {
+                description = "Media System";
+                icon = "jellyfin.svg";
+                href = "https://media.fi33.buzz/";
+                siteMonitor = "https://media.fi33.buzz/";
+                widget = {
+                  type = "jellyfin";
+                  url = "https://media.fi33.buzz/";
+                  key = "@jellyfin@";
+                  enableBlocks = true;
+                  enableNowPlaying = true;
+                  enableUser = true;
+                  showEpisodeNumber = true;
+                  expandOneStreamToTwoRows = false;
+                };
+              };
+            }
+            {
+              Kavita = {
+                description = "Reading server";
+                icon = "kavita.svg";
+                href = "https://library.fi33.buzz/";
+                siteMonitor = "https://library.fi33.buzz/";
+                widget = {
+                  type = "kavita";
+                  url = "https://library.fi33.buzz/";
+                  key = "@kavita-api@";
+                };
+              };
+            }
+            {
+              Miniflux = {
+                description = "Feed reader";
+                icon = "miniflux.svg";
+                href = "https://feeds.fi33.buzz/";
+                siteMonitor = "https://feeds.fi33.buzz/";
+                widget = {
+                  type = "miniflux";
+                  url = "https://feeds.fi33.buzz/";
+                  key = "@miniflux@";
+                };
+              };
+            }
+            {
+              Paperless = {
+                description = "Document management system";
+                icon = "paperless.svg";
+                href = "https://documents.fi33.buzz/";
+                siteMonitor = "https://documents.fi33.buzz/";
+                widget = {
+                  type = "paperlessngx";
+                  url = "https://documents.fi33.buzz/";
+                  username = "admin";
+                  password = "@paperless@";
+                };
+              };
+            }
+          ];
+        }
+        {
+          Utilities = [
+            {
+              Gatus = {
+                description = "Status page";
+                icon = "gatus.svg";
+                href = "https://status.fi33.buzz/";
+                siteMonitor = "https://status.fi33.buzz/";
+                widget = {
+                  type = "gatus";
+                  url = "https://status.fi33.buzz/";
+                };
+              };
+            }
+            {
+              NanoKVM = {
+                description = "Remote KVM switch";
+                icon = "mdi-console.svg";
+                href = "http://nano-kvm/";
+              };
+            }
+          ];
+        }
+      ];
+      settings = {
+        title = "Mission Control";
+        theme = "dark";
+        color = "neutral";
+        headerStyle = "clean";
+        hideVersion = true;
+        layout = [
           {
-            search = {
-              provider = [
-                "duckduckgo"
-                "brave"
-              ];
-              focus = true;
-              showSearchSuggestions = true;
-              target = "_blank";
+            "Public Services" = {
+              style = "row";
+              columns = 3;
+              useEqualHeights = true;
             };
           }
           {
-            resources = {
-              cpu = true;
-              memory = true;
-              disk = [
-                "/"
-                "/backup"
-              ];
-              cputemp = true;
-              tempmin = 0;
-              tempmax = 100;
-              units = "metric";
-              network = true;
-              uptime = true;
+            "Private Services" = {
+              style = "row";
+              columns = 3;
+              useEqualHeights = true;
+            };
+          }
+          {
+            "Media Streaming" = {
+              style = "row";
+              columns = 3;
+              useEqualHeights = true;
+            };
+          }
+          {
+            "Media Management" = {
+              style = "row";
+              columns = 3;
+              useEqualHeights = true;
+            };
+          }
+          {
+            Utilities = {
+              style = "row";
+              columns = 3;
+              useEqualHeights = true;
+              initiallyCollapsed = true;
             };
           }
         ];
+        quicklaunch.searchDescriptions = true;
+        disableUpdateCheck = true;
+        showStats = true;
       };
-
-      # reverse proxy
-      nginx = {
-        virtualHosts."${feature}.fi33.buzz" = {
-          forceSSL = true;
-          useACMEHost = "fi33.buzz";
-          locations."/" = {
-            proxyPass = "http://localhost:${port}";
-            # proxyWebsockets = true;
+      widgets = [
+        {
+          search = {
+            provider = [
+              "duckduckgo"
+              "brave"
+            ];
+            focus = true;
+            showSearchSuggestions = true;
+            target = "_blank";
           };
-        };
-      };
+        }
+        {
+          resources = {
+            cpu = true;
+            memory = true;
+            disk = [
+              "/"
+              "/mnt/external"
+            ];
+            cputemp = true;
+            tempmin = 0;
+            tempmax = 100;
+            units = "metric";
+            network = true;
+            uptime = true;
+          };
+        }
+      ];
     };
 
-    # secrets
-    age.secrets = genSecrets secrets;
-    system.activationScripts = insertSecrets secrets;
+    gatus.settings.endpoints = [
+      {
+        name = "Homepage Dashboard";
+        group = "Utilities";
+        inherit url;
+        interval = "5m";
+        conditions = [
+          "[STATUS] == 200"
+          "[CONNECTED] == true"
+          "[RESPONSE_TIME] < 500"
+        ];
+        alerts = [ { type = "ntfy"; } ];
+      }
+    ];
+
+    caddy.virtualHosts.${hostname}.extraConfig = ''
+      reverse_proxy localhost:${toString port}
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
   };
 
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+  # secrets
+  age.secrets = genSecrets secrets;
+  system.activationScripts = insertSecrets secrets;
 }

modules/nixos/features/immich.nix

@@ -1,46 +1,37 @@
-{
-  config,
-  lib,
-  ...
-}:
 let
-  feature = "immich";
-  port = "2283";
+  port = 2283;
+  certloc = "/var/lib/acme/fi33.buzz";
+  hostname = "photos.fi33.buzz";
+  url = "https://${hostname}";
 in
 {
-  config = lib.mkIf config.${feature}.enable {
-    services = {
-      immich = {
-        enable = true;
-        port = builtins.fromJSON "${port}";
-        mediaLocation = "/srv/immich";
-      };
-
-      # database backup
-      borgmatic.settings = {
-        postgresql_databases = [
-          {
-            name = "immich";
-            hostname = "localhost";
-            username = "root";
-            password = "{credential systemd borgmatic-pg}";
-          }
-        ];
-      };
-
-      nginx = {
-        clientMaxBodySize = "50000M";
-        virtualHosts."${feature}.fi33.buzz" = {
-          forceSSL = true;
-          useACMEHost = "fi33.buzz";
-          locations."/" = {
-            proxyPass = "http://[::1]:${port}";
-            proxyWebsockets = true;
-          };
-        };
-      };
+  services = {
+    immich = {
+      enable = true;
+      inherit port;
+      mediaLocation = "/srv/immich";
     };
-  };
 
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+    gatus.settings.endpoints = [
+      {
+        name = "Immich";
+        group = "Media Streaming";
+        inherit url;
+        interval = "5m";
+        conditions = [
+          "[STATUS] == 200"
+          "[CONNECTED] == true"
+          "[RESPONSE_TIME] < 500"
+        ];
+        alerts = [ { type = "ntfy"; } ];
+      }
+    ];
+
+    caddy.virtualHosts.${hostname}.extraConfig = ''
+      reverse_proxy localhost:${toString port}
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
+  };
 }

modules/nixos/features/intel-gpu.nix

@@ -1,32 +1,21 @@
 {
-  config,
-  lib,
   pkgs,
   ...
 }:
-let
-  feature = "intel-gpu";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
-    hardware = {
-      enableAllFirmware = true;
-      graphics = {
-        enable = true;
-        extraPackages = with pkgs; [
-          # keep-sorted start 
-          intel-compute-runtime
-          intel-media-driver
-          intel-ocl
-          libva-vdpau-driver
-          vpl-gpu-rt
-          # keep-sorted end 
-        ];
-      };
+  hardware = {
+    enableAllFirmware = true;
+    graphics = {
+      enable = true;
+      extraPackages = with pkgs; [
+        # keep-sorted start
+        intel-compute-runtime
+        intel-media-driver
+        intel-ocl
+        libva-vdpau-driver
+        vpl-gpu-rt
+        # keep-sorted end
+      ];
     };
   };
-
-  imports = [ ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
 }

modules/nixos/features/jellyfin.nix

@@ -1,36 +1,43 @@
-{
-  config,
-  lib,
-  ...
-}:
 let
-  feature = "jellyfin";
-  port = "8096";
+  port = 8096;
+  certloc = "/var/lib/acme/fi33.buzz";
+  hostname = "media.fi33.buzz";
+  url = "https://${hostname}";
 in
 {
-  config = lib.mkIf config.${feature}.enable {
-    services = {
-      # service
-      jellyfin = {
-        enable = true;
-        dataDir = "/srv/jellyfin";
-        group = "media";
-      };
-
-      # reverse proxy
-      nginx.virtualHosts."${feature}.fi33.buzz" = {
-        forceSSL = true;
-        useACMEHost = "fi33.buzz";
-        locations."/".proxyPass = "http://localhost:${port}";
-      };
+  services = {
+    jellyfin = {
+      enable = true;
+      dataDir = "/srv/jellyfin";
+      group = "srv";
     };
 
-    # use intel iGP
-    systemd.services.jellyfin.environment.LIBVA_DRIVER_NAME = "iHD";
-    environment.sessionVariables = {
-      LIBVA_DRIVER_NAME = "iHD";
-    };
+    gatus.settings.endpoints = [
+      {
+        name = "Jellyfin";
+        group = "Media Streaming";
+        inherit url;
+        interval = "5m";
+        conditions = [
+          "[STATUS] == 200"
+          "[CONNECTED] == true"
+          "[RESPONSE_TIME] < 500"
+        ];
+        alerts = [ { type = "ntfy"; } ];
+      }
+    ];
+
+    caddy.virtualHosts.${hostname}.extraConfig = ''
+      reverse_proxy localhost:${toString port}
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
   };
 
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+  # use intel iGP
+  systemd.services.jellyfin.environment.LIBVA_DRIVER_NAME = "iHD";
+  environment.sessionVariables = {
+    LIBVA_DRIVER_NAME = "iHD";
+  };
 }

modules/nixos/features/karakeep.nix

@@ -0,0 +1,22 @@
+let
+  port = 5014;
+  certloc = "/var/lib/acme/fi33.buzz";
+in
+{
+  services = {
+    karakeep = {
+      enable = true;
+      extraEnvironment = {
+        PORT = toString port;
+        DISABLE_NEW_RELEASE_CHECK = "true";
+      };
+    };
+
+    caddy.virtualHosts."karakeep.fi33.buzz".extraConfig = ''
+      reverse_proxy localhost:${toString port}
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
+  };
+}

modules/nixos/features/kavita.nix

@@ -0,0 +1,44 @@
+{
+  config,
+  ...
+}:
+let
+  port = 5015;
+  certloc = "/var/lib/acme/fi33.buzz";
+  hostname = "library.fi33.buzz";
+  url = "https://${hostname}";
+in
+{
+  services = {
+    kavita = {
+      enable = true;
+      dataDir = "/srv/kavita";
+      settings.Port = port;
+      tokenKeyFile = config.age.secrets.kavita.path;
+    };
+
+    gatus.settings.endpoints = [
+      {
+        name = "Kavita";
+        group = "Media Streaming";
+        inherit url;
+        interval = "5m";
+        conditions = [
+          "[STATUS] == 200"
+          "[CONNECTED] == true"
+          "[RESPONSE_TIME] < 500"
+        ];
+        alerts = [ { type = "ntfy"; } ];
+      }
+    ];
+
+    caddy.virtualHosts.${hostname}.extraConfig = ''
+      reverse_proxy localhost:${toString port}
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
+  };
+
+  age.secrets.kavita.file = ../../../secrets/kavita.age;
+}

modules/nixos/features/libretranslate.nix

@@ -0,0 +1,37 @@
+let
+  port = 5023;
+  certloc = "/var/lib/acme/fi33.buzz";
+  hostname = "translate.fi33.buzz";
+  url = "https://${hostname}";
+in
+{
+  services = {
+    libretranslate = {
+      enable = true;
+      inherit port;
+      updateModels = true;
+    };
+
+    gatus.settings.endpoints = [
+      {
+        name = "LibreTranslate";
+        group = "Public Services";
+        inherit url;
+        interval = "5m";
+        conditions = [
+          "[STATUS] == 200"
+          "[CONNECTED] == true"
+          "[RESPONSE_TIME] < 500"
+        ];
+        alerts = [ { type = "ntfy"; } ];
+      }
+    ];
+
+    caddy.virtualHosts.${hostname}.extraConfig = ''
+      reverse_proxy localhost:${toString port}
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
+  };
+}

modules/nixos/features/lidarr.nix

@@ -1,36 +1,40 @@
-{
-  config,
-  lib,
-  ...
-}:
 let
-  feature = "lidarr";
-  port = "5012";
+  port = 5012;
+  certloc = "/var/lib/acme/fi33.buzz";
+  hostname = "music.fi33.buzz";
+  url = "https://${hostname}";
 in
 {
-  config = lib.mkIf config.${feature}.enable {
-    services = {
-      # service
-      lidarr = {
-        enable = true;
-        dataDir = "/srv/lidarr";
-        settings.server.port = lib.toInt port;
-        group = "media";
-      };
-
-      # reverse proxy
-      nginx = {
-        virtualHosts."${feature}.fi33.buzz" = {
-          forceSSL = true;
-          useACMEHost = "fi33.buzz";
-          locations."/" = {
-            proxyPass = "http://localhost:${port}";
-            # proxyWebsockets = true;
-          };
-        };
+  services = {
+    lidarr = {
+      enable = true;
+      dataDir = "/srv/lidarr";
+      settings.server = {
+        inherit port;
       };
+      group = "srv";
     };
-  };
 
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+    gatus.settings.endpoints = [
+      {
+        name = "Lidarr";
+        group = "Media Management";
+        inherit url;
+        interval = "5m";
+        conditions = [
+          "[STATUS] == 200"
+          "[CONNECTED] == true"
+          "[RESPONSE_TIME] < 500"
+        ];
+        alerts = [ { type = "ntfy"; } ];
+      }
+    ];
+
+    caddy.virtualHosts.${hostname}.extraConfig = ''
+      reverse_proxy localhost:${toString port}
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
+  };
 }

modules/nixos/features/link2c.nix

@@ -1,17 +1,5 @@
 {
-  config,
-  lib,
-  ...
-}:
-let
-  feature = "link2c";
-in
-{
-  config = lib.mkIf config.${feature}.enable {
-    services.udev.extraRules = ''
-      ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="2e1a", ATTR{idProduct}=="4c03", TEST=="power/control", ATTR{power/control}="on"
-    '';
-  };
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+  services.udev.extraRules = ''
+    ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="2e1a", ATTR{idProduct}=="4c03", TEST=="power/control", ATTR{power/control}="on"
+  '';
 }

modules/nixos/features/llm.nix

@@ -0,0 +1,46 @@
+{
+  pkgs,
+  ...
+}:
+{
+  environment.systemPackages = [ pkgs.ollama-rocm ];
+
+  services = {
+    open-webui.enable = true;
+
+    ollama = {
+      enable = true;
+      package = pkgs.ollama-rocm;
+      loadModels = [
+        # small
+        # keep-sorted start
+        "deepseek-r1:1.5b"
+        "gemma3:1b"
+        "gemma3:270m"
+        "gemma3:4b"
+        "llama3.2:1b"
+        "llama3.2:3b"
+        "ministral-3:3b"
+        "qwen3:0.6b"
+        "qwen3:1.7b"
+        "qwen3:4b"
+        # keep-sorted end
+        # medium
+        # keep-sorted start
+        "deepseek-r1:7b"
+        "deepseek-r1:8b"
+        "llama3.1:8b"
+        "ministral-3:8b"
+        "qwen3:8b"
+        # keep-sorted end
+        # large
+        # keep-sorted start
+        "deepseek-r1:14b"
+        "gemma3:12b"
+        "ministral-3:14b"
+        "qwen3:14b"
+        # keep-sorted end
+      ];
+    };
+  };
+}

modules/nixos/features/localisation.nix

@@ -1,21 +1,12 @@
-{ config, lib, ... }:
-let
-  feature = "localisation";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
-    i18n = {
-      defaultLocale = "en_AU.UTF-8";
-      supportedLocales = [
-        "en_US.UTF-8/UTF-8"
-        "en_AU.UTF-8/UTF-8"
-      ];
-    };
-
-    time.timeZone = "Australia/Melbourne";
+  i18n = {
+    defaultLocale = "en_AU.UTF-8";
+    extraLocales = [
+      "en_GB.UTF-8/UTF-8"
+      "en_US.UTF-8/UTF-8"
+    ];
+    extraLocaleSettings.LC_ALL = "en_GB.UTF-8";
   };
 
-  imports = [ ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+  time.timeZone = "Australia/Melbourne";
 }

modules/nixos/features/mealie.nix

@@ -0,0 +1,53 @@
+{
+  pkgs,
+  ...
+}:
+let
+  port = 5026;
+  certloc = "/var/lib/acme/fi33.buzz";
+  hostname = "mealie.fi33.buzz";
+  url = "https://${hostname}";
+in
+{
+  services = {
+    mealie = {
+      enable = true;
+      inherit port;
+      settings = {
+        TZ = "Australia/Melbourne";
+        ALLOW_SIGNUP = "false";
+      };
+    };
+
+    gatus.settings.endpoints = [
+      {
+        name = "Mealie";
+        group = "Private Services";
+        inherit url;
+        interval = "5m";
+        conditions = [
+          "[STATUS] == 200"
+          "[CONNECTED] == true"
+          "[RESPONSE_TIME] < 500"
+        ];
+        alerts = [ { type = "ntfy"; } ];
+      }
+    ];
+
+    borgbackup.jobs = {
+      onsite = {
+        paths = [ "/var/lib/mealie" ];
+      };
+      offsite = {
+        paths = [ "/var/lib/mealie" ];
+      };
+    };
+
+    caddy.virtualHosts.${hostname}.extraConfig = ''
+      reverse_proxy localhost:${toString port}
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
+  };
+}

modules/nixos/features/miniflux.nix

@@ -1,54 +1,46 @@
 {
   config,
-  lib,
   ...
 }:
 let
-  feature = "miniflux";
-  port = "5010";
+  port = 5010;
+  certloc = "/var/lib/acme/fi33.buzz";
+  hostname = "feeds.fi33.buzz";
+  url = "https://${hostname}";
 in
 {
-  config = lib.mkIf config.${feature}.enable {
-    services = {
-      # service
-      miniflux = {
-        enable = true;
-        adminCredentialsFile = config.age.secrets.miniflux-creds.path;
-        config = {
-          BASE_URL = "https://miniflux.fi33.buzz";
-          LISTEN_ADDR = "localhost:${port}";
-        };
-      };
-
-      # database backup
-      borgmatic.settings = {
-        postgresql_databases = [
-          {
-            name = "miniflux";
-            hostname = "localhost";
-            username = "root";
-            password = "{credential systemd borgmatic-pg}";
-          }
-        ];
-      };
-
-      # reverse proxy
-      nginx = {
-        virtualHosts."${feature}.fi33.buzz" = {
-          forceSSL = true;
-          useACMEHost = "fi33.buzz";
-          locations."/" = {
-            proxyPass = "http://localhost:${port}";
-            # proxyWebsockets = true;
-          };
-        };
+  services = {
+    miniflux = {
+      enable = true;
+      adminCredentialsFile = config.age.secrets.miniflux-creds.path;
+      config = {
+        BASE_URL = url;
+        LISTEN_ADDR = "localhost:${toString port}";
       };
     };
 
-    # secrets
-    age.secrets."miniflux-creds".file = ../../../secrets/miniflux-creds.age;
+    gatus.settings.endpoints = [
+      {
+        name = "Miniflux";
+        group = "Media Streaming";
+        inherit url;
+        interval = "5m";
+        conditions = [
+          "[STATUS] == 200"
+          "[CONNECTED] == true"
+          "[RESPONSE_TIME] < 500"
+        ];
+        alerts = [ { type = "ntfy"; } ];
+      }
+    ];
 
+    caddy.virtualHosts.${hostname}.extraConfig = ''
+      reverse_proxy localhost:${toString port}
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
   };
 
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+  age.secrets."miniflux-creds".file = ../../../secrets/miniflux-creds.age;
 }

modules/nixos/features/network.nix

@@ -1,21 +1,11 @@
 {
-  config,
-  lib,
   hostName,
   ...
 }:
-let
-  feature = "network";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
-    networking = {
-      hostName = "${hostName}";
-      networkmanager.enable = true;
-    };
+  networking = {
+    hostName = "${hostName}";
+    networkmanager.enable = true;
+    firewall.enable = true;
   };
-
-  imports = [ ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
 }

modules/nixos/features/nginx.nix

@@ -1,48 +1,37 @@
 {
   config,
-  lib,
   ...
 }:
-let
-  feature = "nginx";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
-    services.nginx = {
-      enable = true;
+  services.nginx = {
+    enable = true;
 
-      recommendedProxySettings = true;
-      recommendedTlsSettings = true;
-      recommendedGzipSettings = true;
-      recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
 
-      virtualHosts."*.fi33.buzz" = {
-        forceSSL = true;
-        useACMEHost = "fi33.buzz";
-        locations."/".index = "index.html";
-      };
+    virtualHosts."*.fi33.buzz" = {
+      forceSSL = true;
+      useACMEHost = "fi33.buzz";
+      locations."/".index = "index.html";
     };
-
-    security.acme = {
-      acceptTerms = true;
-      defaults.email = "wi11@duck.com";
-      certs."fi33.buzz" = {
-        domain = "fi33.buzz";
-        extraDomainNames = [ "*.fi33.buzz" ];
-        group = "nginx";
-        dnsProvider = "porkbun";
-        dnsPropagationCheck = true;
-        credentialsFile = config.age.secrets."porkbun-api".path;
-      };
-    };
-
-    # secrets
-    age.secrets."porkbun-api" = {
-      file = ../../../secrets/porkbun-api.age;
-    };
-
-    users.users.nginx.extraGroups = [ "acme" ];
   };
 
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "wi11@duck.com";
+    certs."fi33.buzz" = {
+      domain = "fi33.buzz";
+      extraDomainNames = [ "*.fi33.buzz" ];
+      group = "nginx";
+      dnsProvider = "porkbun";
+      dnsPropagationCheck = true;
+      credentialsFile = config.age.secrets."porkbun-api".path;
+    };
+  };
+
+  age.secrets."porkbun-api".file = ../../../secrets/porkbun-api.age;
+
+  users.users.nginx.extraGroups = [ "acme" ];
 }

modules/nixos/features/nh.nix

@@ -1,20 +1,11 @@
 {
-  config,
-  lib,
   userName,
   ...
 }:
-let
-  feature = "nh";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
-    programs.nh = {
-      enable = true;
-      # clean.enable = true;
-      flake = "/home/${userName}/.dots";
-    };
+  programs.nh = {
+    enable = true;
+    # clean.enable = true;
+    flake = "/home/${userName}/.dots";
   };
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
 }

modules/nixos/features/nix-settings.nix

@@ -1,34 +0,0 @@
-{ config, lib, ... }:
-let
-  feature = "nix-settings";
-in
-{
-  config = lib.mkIf config.${feature}.enable {
-    nix = {
-      gc = {
-        automatic = true;
-        dates = "weekly";
-        options = "--delete-older-than 20d";
-        persistent = true;
-      };
-      optimise = {
-        automatic = true;
-        persistent = true;
-      };
-      settings = {
-        experimental-features = [
-          "nix-command"
-          "flakes"
-        ];
-        trusted-users = [
-          "will"
-          "srv"
-        ];
-      };
-    };
-  };
-
-  imports = [ ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
-}

modules/nixos/features/nix.nix

@@ -0,0 +1,35 @@
+{
+  lib,
+  ...
+}:
+{
+  # rip out default packages
+  environment.defaultPackages = lib.mkForce [ ];
+
+  # allow packages with non-free licenses
+  nixpkgs.config.allowUnfree = true;
+
+  nix = {
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 20d";
+      persistent = true;
+    };
+    optimise = {
+      automatic = true;
+      persistent = true;
+    };
+    settings = {
+      allowed-users = [ "@wheel" ];
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+      trusted-users = [
+        "will"
+        "srv"
+      ];
+    };
+  };
+}

modules/nixos/features/nixpkgs.nix

@@ -1,13 +0,0 @@
-{ config, lib, ... }:
-let
-  feature = "nixpkgs";
-in
-{
-  config = lib.mkIf config.${feature}.enable {
-    nixpkgs.config.allowUnfree = true;
-  };
-
-  imports = [ ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
-}

modules/nixos/features/nixvim.nix

@@ -1,108 +1,102 @@
 {
-  config,
   inputs,
-  lib,
   ...
 }:
-let
-  feature = "nixvim";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
-    environment.variables.EDITOR = "nvim";
-    programs.nixvim = {
+  environment.variables.EDITOR = "nvim";
+  programs.nixvim = {
+    enable = true;
+    clipboard = {
+      providers.wl-copy.enable = true;
+      register = "unnamedplus";
+    };
+    colorschemes.catppuccin = {
       enable = true;
-      clipboard = {
-        providers.wl-copy.enable = true;
-        register = "unnamedplus";
-      };
-      colorschemes.catppuccin = {
+      settings.background.dark = "mocha";
+    };
+    dependencies = {
+      tree-sitter.enable = true;
+      gcc.enable = true;
+    };
+    diagnostic.settings.virtual_lines = true;
+    opts = {
+      # keep-sorted start
+      autoindent = true;
+      colorcolumn = "80";
+      expandtab = true;
+      number = true;
+      relativenumber = true;
+      shiftwidth = 2;
+      # get suggestions by typing z=
+      spell = true;
+      spelllang = "en_au";
+      tabstop = 2;
+      # keep-sorted end
+    };
+    plugins = {
+      # auto close brackets
+      autoclose.enable = true;
+
+      # completion window
+      cmp = {
         enable = true;
-        settings.background.dark = "mocha";
+        autoEnableSources = true;
+        settings = {
+          mapping = {
+            "<C-Space>" = "cmp.mapping.complete()";
+            "<C-d>" = "cmp.mapping.scroll_docs(-4)";
+            "<C-e>" = "cmp.mapping.close()";
+            "<C-f>" = "cmp.mapping.scroll_docs(4)";
+            "<CR>" = "cmp.mapping.confirm({ select = true })";
+            "<S-Tab>" = "cmp.mapping(cmp.mapping.select_prev_item(), {'i', 's'})";
+            "<Tab>" = "cmp.mapping(cmp.mapping.select_next_item(), {'i', 's'})";
+          };
+          sources = [
+            { name = "nvim_lsp"; }
+            { name = "path"; }
+            { name = "buffer"; }
+          ];
+        };
       };
-      dependencies = {
-        tree-sitter.enable = true;
-        gcc.enable = true;
-      };
-      diagnostic.settings.virtual_lines = true;
-      opts = {
-        autoindent = true;
-        expandtab = true;
-        number = true;
-        relativenumber = true;
-        shiftwidth = 2;
-        tabstop = 2;
-        colorcolumn = "80";
-      };
-      plugins = {
-        # autoclose brackets
-        autoclose.enable = true;
 
-        # completion window
-        cmp = {
-          enable = true;
-          autoEnableSources = true;
-          settings = {
-            mapping = {
-              "<C-Space>" = "cmp.mapping.complete()";
-              "<C-d>" = "cmp.mapping.scroll_docs(-4)";
-              "<C-e>" = "cmp.mapping.close()";
-              "<C-f>" = "cmp.mapping.scroll_docs(4)";
-              "<CR>" = "cmp.mapping.confirm({ select = true })";
-              "<S-Tab>" = "cmp.mapping(cmp.mapping.select_prev_item(), {'i', 's'})";
-              "<Tab>" = "cmp.mapping(cmp.mapping.select_next_item(), {'i', 's'})";
-            };
-            sources = [
-              { name = "nvim_lsp"; }
-              { name = "path"; }
-              { name = "buffer"; }
-            ];
+      # git changes in margin
+      gitsigns.enable = true;
+
+      # opens last edit position
+      lastplace.enable = true;
+
+      # lsp servers
+      lsp = {
+        enable = true;
+        inlayHints = true;
+        servers = {
+          nixd.enable = true;
+          rust_analyzer = {
+            enable = true;
+            installCargo = true;
+            installRustc = true;
+          };
+          hls = {
+            enable = true;
+            installGhc = true;
           };
         };
-
-        # git changes in margin
-        gitsigns.enable = true;
-
-        # opens last edit position
-        lastplace.enable = true;
-
-        # lsp servers
-        lsp = {
-          enable = true;
-          inlayHints = true;
-          servers = {
-            nixd.enable = true;
-          }
-          // lib.optionalAttrs config.dev.enable {
-            rust_analyzer = {
-              enable = true;
-              installCargo = true;
-              installRustc = true;
-            };
-            hls = {
-              enable = true;
-              installGhc = true;
-            };
-          };
-        };
-        lsp-format.enable = true;
-        lsp-lines.enable = true;
-        lsp-signature.enable = true;
-        lspkind.enable = true;
-
-        # status bar
-        lualine.enable = true;
-
-        # perform file system operations inside of neovim
-        oil.enable = true;
-
-        # syntax highlighting
-        treesitter.enable = true;
       };
+      lsp-format.enable = true;
+      lsp-lines.enable = true;
+      lsp-signature.enable = true;
+      lspkind.enable = true;
+
+      # status bar
+      lualine.enable = true;
+
+      # perform file system operations inside of neovim
+      oil.enable = true;
+
+      # syntax highlighting
+      treesitter.enable = true;
     };
   };
 
   imports = [ inputs.nixvim.nixosModules.nixvim ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
 }

modules/nixos/features/ntfy-sh.nix

@@ -1,38 +1,59 @@
 {
   config,
-  lib,
   ...
 }:
 let
-  feature = "ntfy-sh";
-  port = "5002";
+  port = 5002;
+  certloc = "/var/lib/acme/fi33.buzz";
+  hostname = "notify.fi33.buzz";
+  url = "https://${hostname}";
 in
 {
-  config = lib.mkIf config.${feature}.enable {
-    services = {
-      # service
-      ntfy-sh = {
-        enable = true;
-        settings = {
-          base-url = "https://ntfy-sh.fi33.buzz";
-          listen-http = ":${port}";
-          behind-proxy = true;
-        };
-      };
-
-      # reverse proxy
-      nginx = {
-        virtualHosts."${feature}.fi33.buzz" = {
-          forceSSL = true;
-          useACMEHost = "fi33.buzz";
-          locations."/" = {
-            proxyPass = "http://localhost:${port}";
-            proxyWebsockets = true;
-          };
-        };
+  services = {
+    ntfy-sh = {
+      enable = true;
+      environmentFile = config.age.secrets.ntfy.path;
+      settings = {
+        base-url = url;
+        listen-http = ":${toString port}";
+        behind-proxy = true;
+        auth-default-access = "deny-all";
+        auth-users = [
+          "Debit3885:$2a$12$ZeFimzdifNFSmf0W2oi.vuZfsqae75md9nhC/Q2BcKMyvDO8T.uEK:admin"
+          "gatus:$2a$12$OswG3sB8oDaB.KpawKM3P.78dID.Tj/0y5qeVD5BE6EH5bpGKe.na:user"
+        ];
+        auth-access = [
+          "gatus:services:wo"
+        ];
       };
     };
+
+    gatus.settings.endpoints = [
+      {
+        name = "ntfy";
+        group = "Private Services";
+        inherit url;
+        interval = "5m";
+        conditions = [
+          "[STATUS] == 200"
+          "[CONNECTED] == true"
+          "[RESPONSE_TIME] < 500"
+        ];
+      }
+    ];
+
+    borgbackup.jobs = {
+      onsite.paths = [ "/var/lib/ntfy-sh" ];
+      offsite.paths = [ "/var/lib/ntfy-sh" ];
+    };
+
+    caddy.virtualHosts.${hostname}.extraConfig = ''
+      reverse_proxy localhost:${toString port}
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
   };
 
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+  age.secrets.ntfy.file = ../../../secrets/ntfy.age;
 }

modules/nixos/features/nzbget.nix

@@ -0,0 +1,46 @@
+{
+  pkgs,
+  ...
+}:
+let
+  port = 5018;
+  certloc = "/var/lib/acme/fi33.buzz";
+  hostname = "usenet.fi33.buzz";
+  url = "https://${hostname}";
+in
+{
+  services = {
+    nzbget = {
+      enable = true;
+      settings = {
+        MainDir = "/srv/nzbget";
+        ControlPort = port;
+      };
+      group = "srv";
+    };
+
+    gatus.settings.endpoints = [
+      {
+        name = "NZBget";
+        group = "Media Management";
+        inherit url;
+        interval = "5m";
+        conditions = [
+          "[STATUS] == 401"
+          "[CONNECTED] == true"
+          "[RESPONSE_TIME] < 500"
+        ];
+        alerts = [ { type = "ntfy"; } ];
+      }
+    ];
+
+    caddy.virtualHosts.${hostname}.extraConfig = ''
+      reverse_proxy localhost:${toString port}
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
+  };
+
+  environment.systemPackages = with pkgs; [ unrar ];
+}

modules/nixos/features/paperless.nix

@@ -1,57 +1,51 @@
 {
   config,
-  lib,
   ...
 }:
 let
-  feature = "paperless";
-  port = "5013";
+  port = 5013;
+  certloc = "/var/lib/acme/fi33.buzz";
+  hostname = "documents.fi33.buzz";
+  url = "https://${hostname}";
 in
 {
-  config = lib.mkIf config.${feature}.enable {
-    services = {
-      # service
-      paperless = {
-        enable = true;
-        dataDir = "/srv/paperless";
-        database.createLocally = true;
-        passwordFile = config.age.secrets.paperless.path;
-        port = lib.toInt port;
-        settings = {
-          PAPERLESS_URL = "https://paperless.fi33.buzz";
-        };
+  services = {
+    paperless = {
+      enable = true;
+      dataDir = "/srv/paperless";
+      database.createLocally = true;
+      passwordFile = config.age.secrets.paperless.path;
+      inherit port;
+      settings = {
+        PAPERLESS_URL = url;
       };
+    };
 
-      # database backup
-      borgmatic.settings = {
-        postgresql_databases = [
-          {
-            name = "paperless";
-            hostname = "localhost";
-            username = "root";
-            password = "{credential systemd borgmatic-pg}";
-          }
+    gatus.settings.endpoints = [
+      {
+        name = "Paperless";
+        group = "Media Streaming";
+        inherit url;
+        interval = "5m";
+        conditions = [
+          "[STATUS] == 200"
+          "[CONNECTED] == true"
+          "[RESPONSE_TIME] < 500"
         ];
-      };
+        alerts = [ { type = "ntfy"; } ];
+      }
+    ];
 
-      # reverse proxy
-      nginx = {
-        virtualHosts."${feature}.fi33.buzz" = {
-          forceSSL = true;
-          useACMEHost = "fi33.buzz";
-          locations."/" = {
-            proxyPass = "http://localhost:${port}";
-            # proxyWebsockets = true;
-          };
-        };
-      };
-    };
-
-    age.secrets."paperless" = {
-      file = ../../../secrets/paperless.age;
-      owner = "paperless";
-    };
+    caddy.virtualHosts.${hostname}.extraConfig = ''
+      reverse_proxy localhost:${toString port}
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
   };
 
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+  age.secrets."paperless" = {
+    file = ../../../secrets/paperless.age;
+    owner = "paperless";
+  };
 }

modules/nixos/features/pipewire.nix

@@ -1,19 +1,11 @@
-{ config, lib, ... }:
-let
-  feature = "pipewire";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
-    security.rtkit.enable = true;
+  security.rtkit.enable = true;
 
-    services.pipewire = {
-      alsa.enable = true;
-      alsa.support32Bit = true;
-      enable = true;
-      jack.enable = true;
-      pulse.enable = true;
-    };
+  services.pipewire = {
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    enable = true;
+    jack.enable = true;
+    pulse.enable = true;
   };
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
 }

modules/nixos/features/plasma.nix

@@ -1,39 +1,27 @@
 {
-  config,
-  lib,
   pkgs,
   ...
 }:
-let
-  feature = "plasma";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
-    services = {
-      desktopManager.plasma6.enable = true;
-      displayManager.sddm = {
-        enable = true;
-        wayland.enable = true;
-      };
+  services = {
+    desktopManager.plasma6.enable = true;
+    displayManager.sddm = {
+      enable = true;
+      wayland.enable = true;
     };
-
-    environment.systemPackages =
-      with pkgs.kdePackages;
-      [
-        # keep-sorted start
-        kget
-        kontact
-        # TODO: replace with transmission
-        ktorrent
-        kzones
-        # keep-sorted end
-      ]
-      ++ (with pkgs; [
-        # keep-sorted start
-        haruna
-        # keep-sorted end
-      ]);
   };
 
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+  environment.systemPackages =
+    with pkgs.kdePackages;
+    [
+      # keep-sorted start
+      ktorrent
+      kzones
+      # keep-sorted end
+    ]
+    ++ (with pkgs; [
+      # keep-sorted start
+      haruna
+      # keep-sorted end
+    ]);
 }

modules/nixos/features/print-and-scan.nix

@@ -1,30 +1,21 @@
 {
-  config,
-  lib,
   pkgs,
   ...
 }:
-let
-  feature = "print-and-scan";
-in
 {
-  config = lib.mkIf config.${feature}.enable {
-    hardware.sane = {
+  hardware.sane = {
+    enable = true;
+    extraBackends = [ pkgs.hplip ];
+  };
+  services = {
+    avahi = {
       enable = true;
-      extraBackends = [ pkgs.hplip ];
+      nssmdns4 = true;
+      openFirewall = true;
     };
-    services = {
-      avahi = {
-        enable = true;
-        nssmdns4 = true;
-        openFirewall = true;
-      };
-      printing = {
-        enable = true;
-        drivers = [ pkgs.hplip ];
-      };
+    printing = {
+      enable = true;
+      drivers = [ pkgs.hplip ];
     };
   };
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
 }

modules/nixos/features/protonmail-bridge.nix

@@ -1,17 +1,3 @@
 {
-  config,
-  lib,
-  ...
-}:
-let
-  feature = "protonmail-bridge";
-in
-{
-  config = lib.mkIf config.${feature}.enable {
-    services.protonmail-bridge.enable = true;
-  };
-
-  imports = [ ];
-
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+  services.protonmail-bridge.enable = true;
 }

modules/nixos/features/prowlarr.nix

@@ -1,35 +1,51 @@
 {
-  config,
-  lib,
+  pkgs,
   ...
 }:
 let
-  feature = "prowlarr";
-  port = "5009";
+  port = 5009;
+  certloc = "/var/lib/acme/fi33.buzz";
+  hostname = "prowlarr.fi33.buzz";
+  url = "https://${hostname}";
 in
 {
-  config = lib.mkIf config.${feature}.enable {
-    services = {
-      # service
-      prowlarr = {
-        enable = true;
-        dataDir = "/srv/prowlarr";
-        settings.server.port = lib.toInt port;
-      };
-
-      # reverse proxy
-      nginx = {
-        virtualHosts."${feature}.fi33.buzz" = {
-          forceSSL = true;
-          useACMEHost = "fi33.buzz";
-          locations."/" = {
-            proxyPass = "http://localhost:${port}";
-            # proxyWebsockets = true;
-          };
-        };
+  services = {
+    prowlarr = {
+      enable = true;
+      settings.server = {
+        inherit port;
       };
     };
-  };
 
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+    gatus.settings.endpoints = [
+      {
+        name = "Prowlarr";
+        group = "Media Management";
+        inherit url;
+        interval = "5m";
+        conditions = [
+          "[STATUS] == 200"
+          "[CONNECTED] == true"
+          "[RESPONSE_TIME] < 500"
+        ];
+        alerts = [ { type = "ntfy"; } ];
+      }
+    ];
+
+    borgbackup.jobs = {
+      onsite = {
+        paths = [ "/var/lib/prowlarr" ];
+      };
+      offsite = {
+        paths = [ "/var/lib/prowlarr" ];
+      };
+    };
+
+    caddy.virtualHosts.${hostname}.extraConfig = ''
+      reverse_proxy localhost:${toString port}
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
+  };
 }

modules/nixos/features/qbittorrent.nix

@@ -1,37 +1,41 @@
-{ config, lib, ... }:
 let
-  feature = "qbittorrent";
-  port = "5005";
+  port = 5005;
+  certloc = "/var/lib/acme/fi33.buzz";
+  hostname = "bittorrent.fi33.buzz";
+  url = "https://${hostname}";
 in
 {
-  config = lib.mkIf config.${feature}.enable {
-    users.users.qbittorrent.extraGroups = [ "media" ];
-
-    services = {
-      # service
-      qbittorrent = {
-        enable = true;
-        webuiPort = lib.toInt port;
-        profileDir = "/srv";
-        group = "media";
-        extraArgs = [
-          "--confirm-legal-notice"
-        ];
-      };
-
-      # reverse proxy
-      nginx = {
-        virtualHosts."${feature}.fi33.buzz" = {
-          forceSSL = true;
-          useACMEHost = "fi33.buzz";
-          locations."/" = {
-            proxyPass = "http://localhost:${port}";
-            # proxyWebsockets = true;
-          };
-        };
-      };
+  services = {
+    qbittorrent = {
+      enable = true;
+      webuiPort = port;
+      profileDir = "/srv";
+      group = "srv";
+      extraArgs = [
+        "--confirm-legal-notice"
+      ];
     };
-  };
 
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+    gatus.settings.endpoints = [
+      {
+        name = "qBittorrent";
+        group = "Media Management";
+        inherit url;
+        interval = "5m";
+        conditions = [
+          "[STATUS] == 200"
+          "[CONNECTED] == true"
+          "[RESPONSE_TIME] < 500"
+        ];
+        alerts = [ { type = "ntfy"; } ];
+      }
+    ];
+
+    caddy.virtualHosts.${hostname}.extraConfig = ''
+      reverse_proxy localhost:${toString port}
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
+  };
 }

modules/nixos/features/qui.nix

@@ -0,0 +1,32 @@
+{
+  # keep-sorted start
+  lib,
+  pkgs,
+  # keep-sorted end
+  ...
+}:
+let
+  port = 5019;
+  certloc = "/var/lib/acme/fi33.buzz";
+in
+{
+  environment.systemPackages = [ pkgs.qui ];
+
+  systemd.user.services.qui = {
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig.ExecStart = "${lib.getExe pkgs.qui} serve";
+
+    environment = {
+      QUI__PORT = toString port;
+      QUI__DATA_DIR = "/srv/qui";
+    };
+  };
+
+  services.caddy.virtualHosts."qui.fi33.buzz".extraConfig = ''
+    reverse_proxy localhost:${toString port}
+    tls ${certloc}/cert.pem ${certloc}/key.pem {
+      protocols tls1.3
+    }
+  '';
+}

modules/nixos/features/radarr.nix

@@ -1,37 +1,40 @@
-{
-  config,
-  lib,
-  ...
-}:
 let
-  feature = "radarr";
-  port = "5007";
+  port = 5007;
+  certloc = "/var/lib/acme/fi33.buzz";
+  hostname = "movies.fi33.buzz";
+  url = "https://${hostname}";
 in
 {
-  config = lib.mkIf config.${feature}.enable {
-    services = {
-      # service
-      radarr = {
-        enable = true;
-        dataDir = "/srv/radarr";
-        settings.server.port = lib.toInt port;
-        group = "media";
-
-      };
-
-      # reverse proxy
-      nginx = {
-        virtualHosts."${feature}.fi33.buzz" = {
-          forceSSL = true;
-          useACMEHost = "fi33.buzz";
-          locations."/" = {
-            proxyPass = "http://localhost:${port}";
-            # proxyWebsockets = true;
-          };
-        };
+  services = {
+    radarr = {
+      enable = true;
+      dataDir = "/srv/radarr";
+      settings.server = {
+        inherit port;
       };
+      group = "srv";
     };
-  };
 
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+    gatus.settings.endpoints = [
+      {
+        name = "Radarr";
+        group = "Media Management";
+        inherit url;
+        interval = "5m";
+        conditions = [
+          "[STATUS] == 200"
+          "[CONNECTED] == true"
+          "[RESPONSE_TIME] < 500"
+        ];
+        alerts = [ { type = "ntfy"; } ];
+      }
+    ];
+
+    caddy.virtualHosts.${hostname}.extraConfig = ''
+      reverse_proxy localhost:${toString port}
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
+  };
 }

modules/nixos/features/radicale.nix

@@ -0,0 +1,61 @@
+{
+  config,
+  ...
+}:
+let
+  port = 5003;
+  certloc = "/var/lib/acme/fi33.buzz";
+  hostname = "caldav.fi33.buzz";
+  url = "https://${hostname}";
+in
+{
+  services = {
+    radicale = {
+      enable = true;
+      settings = {
+        server = {
+          hosts = [
+            "0.0.0.0:${toString port}"
+            "[::]:${toString port}"
+          ];
+        };
+        auth = {
+          type = "htpasswd";
+          htpasswd_filename = config.age.secrets.radicale.path;
+          htpasswd_encryption = "plain";
+        };
+        storage = {
+          filesystem_folder = "/srv/radicale";
+        };
+      };
+    };
+
+    gatus.settings.endpoints = [
+      {
+        name = "Radicale";
+        group = "Private Services";
+        inherit url;
+        interval = "5m";
+        conditions = [
+          "[STATUS] == 200"
+          "[CONNECTED] == true"
+          "[RESPONSE_TIME] < 500"
+        ];
+        alerts = [ { type = "ntfy"; } ];
+      }
+    ];
+
+    caddy.virtualHosts.${hostname}.extraConfig = ''
+      reverse_proxy localhost:${toString port}
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
+  };
+
+  # secrets
+  age.secrets."radicale" = {
+    file = ../../../secrets/radicale.age;
+    owner = "radicale";
+  };
+}

modules/nixos/features/readarr.nix

@@ -0,0 +1,40 @@
+let
+  port = 5016;
+  certloc = "/var/lib/acme/fi33.buzz";
+  hostname = "books.fi33.buzz";
+  url = "https://${hostname}";
+in
+{
+  services = {
+    readarr = {
+      enable = true;
+      dataDir = "/srv/readarr";
+      settings.server = {
+        inherit port;
+      };
+      group = "srv";
+    };
+
+    gatus.settings.endpoints = [
+      {
+        name = "Readarr";
+        group = "Media Management";
+        inherit url;
+        interval = "5m";
+        conditions = [
+          "[STATUS] == 200"
+          "[CONNECTED] == true"
+          "[RESPONSE_TIME] < 500"
+        ];
+        alerts = [ { type = "ntfy"; } ];
+      }
+    ];
+
+    caddy.virtualHosts.${hostname}.extraConfig = ''
+      reverse_proxy localhost:${toString port}
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
+  };
+}

modules/nixos/features/send.nix

@@ -0,0 +1,45 @@
+let
+  port = 5020;
+  certloc = "/var/lib/acme/fi33.buzz";
+  hostname = "send.fi33.buzz";
+  url = "https://${hostname}";
+in
+{
+  services = {
+    send = {
+      enable = true;
+      inherit port;
+      baseUrl = url;
+      environment = {
+        DEFAULT_EXPIRE_SECONDS = 360;
+        EXPIRE_TIMES_SECONDS = "360";
+        DOWNLOAD_COUNTS = "1";
+        MAX_DOWNLOADS = 1;
+        MAX_EXPIRE_SECONDS = 1024;
+        MAX_FILE_SIZE = 134217728;
+      };
+    };
+
+    gatus.settings.endpoints = [
+      {
+        name = "Send";
+        group = "Public Services";
+        inherit url;
+        interval = "5m";
+        conditions = [
+          "[STATUS] == 200"
+          "[CONNECTED] == true"
+          "[RESPONSE_TIME] < 500"
+        ];
+        alerts = [ { type = "ntfy"; } ];
+      }
+    ];
+
+    caddy.virtualHosts.${hostname}.extraConfig = ''
+      reverse_proxy localhost:${toString port}
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
+  };
+}

modules/nixos/features/sonarr.nix

@@ -1,37 +1,40 @@
-{
-  config,
-  lib,
-  ...
-}:
 let
-  feature = "sonarr";
-  port = "5006";
+  port = 5006;
+  certloc = "/var/lib/acme/fi33.buzz";
+  hostname = "shows.fi33.buzz";
+  url = "https://${hostname}";
 in
 {
-  config = lib.mkIf config.${feature}.enable {
-    services = {
-      # service
-      sonarr = {
-        enable = true;
-        dataDir = "/srv/sonarr";
-        settings.server.port = lib.toInt port;
-        group = "media";
-
-      };
-
-      # reverse proxy
-      nginx = {
-        virtualHosts."${feature}.fi33.buzz" = {
-          forceSSL = true;
-          useACMEHost = "fi33.buzz";
-          locations."/" = {
-            proxyPass = "http://localhost:${port}";
-            # proxyWebsockets = true;
-          };
-        };
+  services = {
+    sonarr = {
+      enable = true;
+      dataDir = "/srv/sonarr";
+      settings.server = {
+        inherit port;
       };
+      group = "srv";
     };
-  };
 
-  options.${feature}.enable = lib.mkEnableOption "enables ${feature}";
+    gatus.settings.endpoints = [
+      {
+        name = "Sonarr";
+        group = "Media Management";
+        inherit url;
+        interval = "5m";
+        conditions = [
+          "[STATUS] == 200"
+          "[CONNECTED] == true"
+          "[RESPONSE_TIME] < 500"
+        ];
+        alerts = [ { type = "ntfy"; } ];
+      }
+    ];
+
+    caddy.virtualHosts.${hostname}.extraConfig = ''
+      reverse_proxy localhost:${toString port}
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
+  };
 }

modules/nixos/features/star-citizen.nix

@@ -0,0 +1,23 @@
+{
+  # keep-sorted start
+  inputs,
+  system,
+  # keep-sorted end
+  ...
+}:
+{
+  nix.settings = {
+    substituters = [ "https://nix-citizen.cachix.org" ];
+    trusted-public-keys = [ "nix-citizen.cachix.org-1:lPMkWc2X8XD4/7YPEEwXKKBg+SVbYTVrAaLA2wQTKCo=" ];
+  };
+
+  environment.systemPackages = [
+    inputs.nix-citizen.packages.${system}.rsi-launcher
+  ];
+
+  zramSwap = {
+    enable = true;
+    memoryPercent = 100;
+    writebackDevice = "/dev/sda1";
+  };
+}

modules/nixos/features/sudo.nix

@@ -0,0 +1,6 @@
+{
+  ...
+}:
+{
+  security.sudo.execWheelOnly = true;
+}