initial commit

.luarc.json

···
+{
+  "$schema": "https://raw.githubusercontent.com/LuaLS/vscode-lua/refs/heads/master/setting/schema.json",
+  "runtime.version": "LuaJIT",
+  "diagnostics.globals": [
+    "vim"
+  ],
+  "workspace": {
+    "checkThirdParty": false
+  }
+}

.sops.yaml

···
+keys:
+  - &diogo ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCTbCHJ0avif6MQ7izXlHHaubNsOhU2xf9lMvXKLyUQ
+
+creation_rules:
+  - path_regex: ^secrets/diogo\.yaml$
+    key_groups:
+      - age:
+          - *diogo
+
+  - path_regex: ^secrets/services/[^/]+\.yaml$
+    key_groups:
+      - age:
+          - *diogo

LICENSE

···
+zlib License
+
+(C) 2025 Diogo (https://bsky.app/profile/diogo.fi)
+
+This software is provided 'as-is', without any express or implied
+warranty.  In no event will the authors be held liable for any damages
+arising from the use of this software.
+
+Permission is granted to anyone to use this software for any purpose,
+including commercial applications, and to alter it and redistribute it
+freely, subject to the following restrictions:
+
+1. The origin of this software must not be misrepresented; you must not
+   claim that you wrote the original software. If you use this software
+   in a product, an acknowledgment in the product documentation would be
+   appreciated but is not required.
+2. Altered source versions must be plainly marked as such, and must not be
+   misrepresented as being the original software.
+3. This notice may not be removed or altered from any source distribution.

README.md

···
+# diogo's dotfiles
+
+> [!WARNING]
+> This is _highly_ opinionated and tailored for my own needs. I wouldn't recommend using this as-is on your machine unless you love debugging at 3 AM. Proceed with caution _(and maybe a backup)_.
+
+This is where I keep all my config, secrets, and sanity. It's **heavily** inspired by [isabelroses/dotfiles](https://github.com/isabelroses/dotfiles) _(go follow her, she's a legend)_, but with my own chaotic energy sprinkled on top.

flake.lock

···
+{
+  "nodes": {
+    "brew-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1761551821,
+        "narHash": "sha256-N3Zj73TAxclhLGgADbPVwcVrhYIBKUgAxjfQuOXre6s=",
+        "owner": "Homebrew",
+        "repo": "brew",
+        "rev": "8f6719274133c5bcc24c058c5a6bcbb3b0cd48b3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Homebrew",
+        "ref": "4.6.19",
+        "repo": "brew",
+        "type": "github"
+      }
+    },
+    "catppuccin": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1763110997,
+        "narHash": "sha256-S2vF+3D/9vna3/vBV7LHiGUbp+ltPsQhvccIyim6VQg=",
+        "owner": "catppuccin",
+        "repo": "nix",
+        "rev": "e6928cdd3dd20636326c2756d2bc8fd1cd825768",
+        "type": "github"
+      },
+      "original": {
+        "owner": "catppuccin",
+        "repo": "nix",
+        "type": "github"
+      }
+    },
+    "darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1763505477,
+        "narHash": "sha256-nJRd4LY2kT3OELfHqdgWjvToNZ4w+zKCMzS2R6z4sXE=",
+        "owner": "nix-darwin",
+        "repo": "nix-darwin",
+        "rev": "3bda9f6b14161becbd07b3c56411f1670e19b9b5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-darwin",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
+    "easy-hosts": {
+      "locked": {
+        "lastModified": 1755470564,
+        "narHash": "sha256-KB1ZryVDoQcbIsItOf4WtxkHhh3ppj+XwMpSnt/2QHc=",
+        "owner": "tgirlcloud",
+        "repo": "easy-hosts",
+        "rev": "d0422bc7b3db26268982aa15d07e60370e76ee1d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tgirlcloud",
+        "repo": "easy-hosts",
+        "type": "github"
+      }
+    },
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1762980239,
+        "narHash": "sha256-8oNVE8TrD19ulHinjaqONf9QWCKK+w4url56cdStMpM=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "52a2caecc898d0b46b2b905f058ccc5081f842da",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1763416652,
+        "narHash": "sha256-8EBEEvtzQ11LCxpQHMNEBQAGtQiCu/pqP9zSovDSbNM=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "ea164b7c9ccdc2321379c2ff78fd4317b4c41312",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager_2": {
+      "inputs": {
+        "nixpkgs": [
+          "zen-browser",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1762964643,
+        "narHash": "sha256-RYHN8O/Aja59XDji6WSJZPkJpYVUfpSkyH+PEupBJqM=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "827f2a23373a774a8805f84ca5344654c31f354b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "homebrew": {
+      "inputs": {
+        "brew-src": "brew-src"
+      },
+      "locked": {
+        "lastModified": 1761927470,
+        "narHash": "sha256-KsFDGRGD8j1R6TvJ4HkebKsh3HXLY0XazanLrhO3wqE=",
+        "owner": "zhaofengli",
+        "repo": "nix-homebrew",
+        "rev": "3cae36b3a17b09a66435291619dce8cf2c4728ca",
+        "type": "github"
+      },
+      "original": {
+        "owner": "zhaofengli",
+        "repo": "nix-homebrew",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1763464769,
+        "narHash": "sha256-mU85VDFRIgKGq1EhT71bLjhvjJ5yuMEe0Ip1kwCbR80=",
+        "rev": "6f374686605df381de8541c072038472a5ea2e2d",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-25.11pre898015.6f374686605d/nixexprs.tar.xz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"
+      }
+    },
+    "root": {
+      "inputs": {
+        "catppuccin": "catppuccin",
+        "darwin": "darwin",
+        "easy-hosts": "easy-hosts",
+        "flake-parts": "flake-parts",
+        "home-manager": "home-manager",
+        "homebrew": "homebrew",
+        "nixpkgs": "nixpkgs",
+        "sops": "sops",
+        "systems": "systems",
+        "zen-browser": "zen-browser"
+      }
+    },
+    "sops": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1763509310,
+        "narHash": "sha256-s2WzTAD3vJtPACBCZXezNUMTG/wC6SFsU9DxazB9wDI=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "3ee33c0ed7c5aa61b4e10484d2ebdbdc98afb03e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "zen-browser": {
+      "inputs": {
+        "home-manager": "home-manager_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1763521945,
+        "narHash": "sha256-Zcrafbe4niRJMbzaVOwg7+iedJhwBFttre2DpyCC6qA=",
+        "owner": "0xc000022070",
+        "repo": "zen-browser-flake",
+        "rev": "24d7381b9231c23daceec5d372cc28e877f7785d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "0xc000022070",
+        "repo": "zen-browser-flake",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

···
+{
+  description = "diogo's dotfiles";
+
+  inputs = {
+    nixpkgs.url = "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz";
+
+    darwin = {
+      type = "github";
+      owner = "nix-darwin";
+      repo = "nix-darwin";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    home-manager = {
+      type = "github";
+      owner = "nix-community";
+      repo = "home-manager";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    catppuccin = {
+      type = "github";
+      owner = "catppuccin";
+      repo = "nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    homebrew = {
+      type = "github";
+      owner = "zhaofengli";
+      repo = "nix-homebrew";
+    };
+
+    flake-parts = {
+      type = "github";
+      owner = "hercules-ci";
+      repo = "flake-parts";
+      inputs.nixpkgs-lib.follows = "nixpkgs";
+    };
+
+    easy-hosts = {
+      type = "github";
+      owner = "tgirlcloud";
+      repo = "easy-hosts";
+    };
+
+    systems = {
+      type = "github";
+      owner = "nix-systems";
+      repo = "default";
+    };
+
+    sops = {
+      type = "github";
+      owner = "Mic92";
+      repo = "sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    zen-browser = {
+      type = "github";
+      owner = "0xc000022070";
+      repo = "zen-browser-flake";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs =
+    inputs:
+    inputs.flake-parts.lib.mkFlake { inherit inputs; } {
+      imports = [
+        ./flake
+      ];
+    };
+}

flake/args.nix

···
+{ inputs, ... }:
+{
+  systems = import inputs.systems;
+
+  perSystem =
+    { system, ... }:
+    {
+      _module.args.pkgs = import inputs.nixpkgs {
+        inherit system;
+      };
+    };
+}

flake/default.nix

···
+{
+  imports = [
+    ../hosts
+    ./args.nix
+    ./formatter.nix
+    ./lib
+  ];
+}

flake/formatter.nix

···
+{
+  perSystem =
+    { pkgs, config, ... }:
+    {
+      formatter = pkgs.treefmt.withConfig {
+        runtimeInputs = with pkgs; [
+          nixfmt
+          shfmt
+          stylua
+        ];
+
+        settings = {
+          on-unmatched = "info";
+          tree-root-file = "flake.nix";
+
+          formatter = {
+            nixfmt = {
+              command = "nixfmt";
+              includes = [ "*.nix" ];
+            };
+
+            shfmt = {
+              command = "shfmt";
+              options = [
+                "-s"
+                "-w"
+                "-i"
+                "2"
+              ];
+              includes = [
+                "*.sh"
+              ];
+            };
+
+            stylua = {
+              command = "stylua";
+              includes = [ "*.lua" ];
+            };
+          };
+        };
+      };
+    };
+}

flake/lib/default.nix

···
+# original: https://github.com/isabelroses/dotfiles/blob/main/modules/flake/lib/default.nix
+{ lib, ... }:
+let
+  sysLib = lib.fixedPoints.makeExtensible (final: {
+    services = import ./services.nix { inherit lib; };
+
+    inherit (final.services) mkServiceOption;
+  });
+in
+{
+  flake.lib = sysLib;
+}

flake/lib/services.nix

···
+# original: https://github.com/isabelroses/dotfiles/blob/main/modules/flake/lib/services.nix
+{ lib, ... }:
+let
+  inherit (lib.types) str;
+  inherit (lib.options) mkOption mkEnableOption;
+
+  mkServiceOption =
+    name:
+    {
+      port ? 0,
+      host ? "127.0.0.1",
+      domain ? "",
+      extraConfig ? { },
+    }:
+    {
+      enable = mkEnableOption "Enable the ${name} service";
+
+      host = mkOption {
+        type = str;
+        default = host;
+        description = "Host where the ${name} service will run on";
+      };
+
+      port = mkOption {
+        type = lib.types.port;
+        default = port;
+        description = "Port where the ${name} service will run on";
+      };
+
+      domain = mkOption {
+        type = str;
+        default = domain;
+        defaultText = "networking.domain";
+        description = "Domain for the ${name} service";
+      };
+    }
+    // extraConfig;
+in
+{
+  inherit mkServiceOption;
+}

home/default.nix

···
+{
+  lib,
+  config,
+  self,
+  self',
+  inputs,
+  inputs',
+  ...
+}:
+{
+  home-manager = {
+    useUserPackages = true;
+    useGlobalPkgs = true;
+    backupFileExtension = "bak";
+
+    extraSpecialArgs = {
+      inherit
+        self
+        self'
+        inputs
+        inputs'
+        ;
+    };
+
+    users = lib.genAttrs config.sys.users (name: {
+      imports = [ ./${name} ];
+    });
+
+    sharedModules = [ (self + /modules/home/default.nix) ];
+  };
+}

home/diogo/catppuccin.nix

···
+{ inputs, ... }:
+{
+  imports = [ inputs.catppuccin.homeModules.catppuccin ];
+
+  catppuccin = {
+    enable = true;
+    flavor = "mocha";
+    accent = "mauve";
+    nvim.enable = false;
+  };
+}

home/diogo/default.nix

···
+{
+  home.file.".hushlogin".text = "";
+
+  imports = [
+    ./programs
+    ./catppuccin.nix
+    ./system
+  ];
+}

home/diogo/programs/btop.nix

···
+{
+  programs.btop = {
+    enable = true;
+    settings = {
+      vim_keys = true;
+      graph_symbol = "braille";
+      theme_background = false;
+    };
+  };
+}

home/diogo/programs/default.nix

···
+{ pkgs, ... }:
+{
+  imports = [
+    ./git.nix
+    ./fastfetch
+    ./zsh.nix
+    ./ohmyposh
+    ./btop.nix
+    ./neovim
+    ./tmux.nix
+    ./zen.nix
+    ./fzf.nix
+    ./ripgrep.nix
+    ./vesktop.nix
+    ./zed.nix
+    ./ghostty.nix
+  ];
+
+  sys.packages = {
+    inherit (pkgs)
+      nodejs
+      just
+      bun
+      age
+      sops
+      go
+      rustc
+      cargo
+      ;
+  };
+}

home/diogo/programs/fastfetch/default.nix

···
+{
+  programs.fastfetch = {
+    enable = true;
+    settings = builtins.fromJSON (builtins.readFile ./fasfetch.jsonc);
+  };
+}

home/diogo/programs/fastfetch/fasfetch.jsonc

···
+{
+  "$schema": "https://github.com/fastfetch-cli/fastfetch/raw/dev/doc/json_schema.json",
+  "display": {
+    "separator": "",
+    "constants": [
+      "\u001b[90m│                                                            │\u001b[60D\u001b[39m"
+    ]
+  },
+  "modules": [
+    {
+      "type": "custom",
+      "key": "{#90}╭ Keys ───────╮",
+      "format": "{#90}╭ Values ────────────────────────────────────────────────────╮"
+    },
+    {
+      "type": "title",
+      "key": "{#90}│ {#92}User        {#90}│",
+      "format": "{$1}{user-name} {#2}[{home-dir}]"
+    },
+    {
+      "type": "title",
+      "key": "{#90}│ {#93}Hostname    {#90}│",
+      "format": "{$1}{host-name}"
+    },
+    {
+      "type": "os",
+      "key": "{#90}│ {#93}OS          {#90}│",
+      "format": "{$1}{?pretty-name}{pretty-name}{?}{/pretty-name}{name}{/} {codename} {#2}[v{version}] [{arch}]"
+    },
+    {
+      "type": "kernel",
+      "key": "{#90}│ {#93}Kernel      {#90}│",
+      "format": "{$1}{sysname} {#2}[v{release}]"
+    },
+    {
+      "type": "packages",
+      "key": "{#90}│ {#93}Packages    {#90}│",
+      "format": "{$1}{all} {#2}[all]"
+    },
+    {
+      "type": "uptime",
+      "key": "{#90}│ {#93}Uptime      {#90}│",
+      "format": "{$1}{?days}{days}d + {?}{hours}h {minutes}m {seconds}s"
+    },
+    {
+      "type": "cpu",
+      "key": "{#90}│ {#91}CPU         {#90}│",
+      "showPeCoreCount": true,
+      "temp": true,
+      "format": "{$1}{name} {#2}[C:{core-types}] [{freq-max}]"
+    },
+    {
+      "type": "memory",
+      "key": "{#90}│ {#91}Memory      {#90}│",
+      "format": "{$1}{used} / {total} ({percentage})"
+    },
+    {
+      "type": "disk",
+      "key": "{#90}│ {#91}Disk        {#90}│",
+      "format": "{$1}{size-used} / {size-total} ({size-percentage})"
+    },
+    {
+      "type": "shell",
+      "key": "{#90}│ {#95}Shell       {#90}│",
+      "format": "{$1}{pretty-name} {#2}[v{version}] [PID:{pid}]"
+    },
+    {
+      "type": "localip",
+      "key": "{#90}│ {#94}Local IPv4  {#90}│",
+      "showPrefixLen": true,
+      "showIpv4": true,
+      "showIpv6": false,
+      "showMtu": true,
+      "format": "{$1}{ipv4} {#2}[{ifname}]"
+    },
+    {
+      "type": "publicip",
+      "key": "{#90}│ {#94}Public IPv4 {#90}│",
+      "ipv6": false,
+      "format": "{$1}{ip} {#2}[{location}]"
+    },
+    {
+      "type": "custom",
+      "key": "{#90}╰─────────────╯",
+      "format": "{#90}╰────────────────────────────────────────────────────────────╯"
+    },
+    "break",
+    {
+      "type": "custom",
+      "key": " ",
+      "format": "{#90}╭ Colors ───────────────────────────────────────────────────────────────────╮"
+    },
+    {
+      "type": "custom",
+      "format": "{#90}│ {#40}    {#41}    {#42}    {#43}    {#44}    {#45}    {#46}    {#47}    {#}                                          {#90}│"
+    },
+    {
+      "type": "custom",
+      "format": "{#90}│ {#100}    {#101}    {#102}    {#103}    {#104}    {#105}    {#106}    {#107}    {#}                                          {#90}│"
+    },
+    {
+      "type": "custom",
+      "format": "{#90}╰───────────────────────────────────────────────────────────────────────────╯"
+    }
+  ]
+}

home/diogo/programs/fzf.nix

···
+{
+  programs.fzf = {
+    enable = true;
+
+    enableZshIntegration = true;
+    tmux.enableShellIntegration = true;
+
+    defaultOptions = [
+      "--height=40%"
+      "--layout=reverse"
+      "--border"
+      "--preview-window=right:60%"
+      "--preview 'bat --color=always --style=numbers --line-range=:500 {}'"
+    ];
+  };
+}

home/diogo/programs/ghostty.nix

···
+{ pkgs, config, ... }:
+{
+  programs.ghostty = {
+    inherit (config.sys.profiles.graphical) enable;
+    package = pkgs.ghostty-bin;
+    enableZshIntegration = config.programs.zsh.enable;
+    installBatSyntax = config.programs.bat.enable;
+    settings = {
+      font-family = "Maple Mono";
+      font-size = 18;
+      font-thicken = true;
+      background-opacity = 0.95;
+      background-blur = true;
+      window-padding-x = 12;
+      window-padding-y = 12;
+      macos-titlebar-style = "tabs";
+      window-save-state = "always";
+      bell-features = "no-audio";
+      macos-option-as-alt = "left";
+    };
+  };
+}

home/diogo/programs/git.nix

···
+{ pkgs, config, ... }:
+{
+  programs.git = {
+    package = pkgs.gitMinimal;
+    enable = true;
+
+    signing = {
+      key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCTbCHJ0avif6MQ7izXlHHaubNsOhU2xf9lMvXKLyUQ";
+      format = "ssh";
+      signByDefault = true;
+    };
+
+    ignores = [
+      ".DS_Store"
+      "*~"
+      "*.swp"
+      "*.bak"
+      "*.tmp"
+      "*.log"
+      ".idea"
+      "changes.txt"
+      "*freeze.png"
+      ".crush"
+      "**/.terraform/*"
+      "*.tfvars"
+      "*.tfvars.json"
+      "*.tfstate"
+      "*.tfstate.*"
+      ".env*"
+    ];
+
+    attributes = [
+      "* text=auto"
+      "*.sh text eol=lf"
+      "tsconfig.json linguist-language=JSON-with-Comments"
+      "*.lock text -diff"
+    ];
+
+    settings = {
+      user = {
+        name = "Diogo";
+        email = "hello" + "@" + "diogo" + "." + "fi";
+      };
+
+      aliases = {
+        s = "status -s";
+        undo = "reset --soft HEAD^";
+        cleanup = ''
+          git fetch upstream; \
+          git checkout main; \
+          git pull upstream main; \
+          git push origin main; \
+          git branch -r --merged | grep -v main | grep origin | sed 's/origin\\///' | gxargs -r -n 1 git push --delete origin; \
+          git branch --merged | grep -v main | gxargs -r -n 1 git branch -d; \
+          git branch -vv | grep ': gone]'|  grep -v '\\*' | awk '{ print $1; }' | gxargs -r git branch -D; \
+          git fetch --all --prune; \
+          git prune; \
+          git gc --aggressive;
+        '';
+        wopsy = "commit -a --amend --no-edit";
+      };
+
+      init.defaultBranch = "main";
+
+      commit.verbose = true;
+
+      push.autoSetupRemote = true;
+
+      merge = {
+        stat = "true";
+        conflictstyle = "zdiff3";
+        tool = "meld";
+      };
+
+      rebase = {
+        updateRefs = true;
+        autoSquash = true;
+        autoStash = true;
+      };
+    };
+
+    lfs.enable = true;
+  };
+
+  programs.lazygit = {
+    enable = config.programs.git.enable && config.sys.profiles.graphical.enable;
+  };
+
+  programs.delta = {
+    enable = true;
+    enableGitIntegration = true;
+    options = {
+      line-numbers = true;
+      hyperlinks = true;
+      side-by-side = true;
+      navigate = true;
+    };
+  };
+}

home/diogo/programs/neovim/.vimrc

···
+let mapleader = " "
+
+set hlsearch
+set incsearch
+set ignorecase
+set smartcase
+
+set number
+set relativenumber
+set linebreak
+
+set noswapfile
+set nobackup
+set undodir=~/.vim/undodir
+set undofile
+
+set so=4
+
+set expandtab
+set tabstop=2 softtabstop=2
+set shiftwidth=2
+
+set hidden
+set noerrorbells
+set mouse="a"
+
+syntax on
+filetype plugin indent on
+set updatetime=500
+
+set spell
+set spelllang=en_gb
+
+inoremap <Esc> <Esc>
+
+nnoremap <leader>w :w<CR>
+nnoremap <leader>q :q<CR>
+nnoremap <leader>Q :q!<CR>

home/diogo/programs/neovim/default.nix

···
+{ pkgs, ... }:
+{
+  programs.neovim = {
+    enable = true;
+    defaultEditor = true;
+    viAlias = true;
+    vimAlias = true;
+    withNodeJs = true;
+    plugins = with pkgs.vimPlugins; [
+      catppuccin-nvim
+      nvim-cmp
+      cmp-buffer
+      cmp-nvim-lsp
+      cmp-path
+      conform-nvim
+      gitsigns-nvim
+      lualine-nvim
+      mini-nvim
+      nvim-lspconfig
+      nvim-navic
+      nvim-tree-lua
+      plenary-nvim
+      telescope-file-browser-nvim
+      telescope-fzf-native-nvim
+      telescope-nvim
+      which-key-nvim
+      nvim-treesitter.withAllGrammars
+      cord-nvim
+    ];
+    extraPackages = with pkgs; [
+      nixd
+      nil
+      vtsls
+      vue-language-server
+      # docker-language-server
+      # docker-compose-language-service
+      yaml-language-server
+      bash-language-server
+      lua-language-server
+      astro-language-server
+      tailwindcss-language-server
+      emmet-language-server
+      gopls
+      sourcekit-lsp
+    ];
+
+    extraLuaConfig = ''
+      ${builtins.readFile ./init.lua}
+      vim.cmd("colorscheme catppuccin")
+    '';
+  };
+
+  home.file = {
+    ".vimrc".text = builtins.readFile ./.vimrc;
+  };
+}

home/diogo/programs/neovim/init.lua

···
+vim.cmd("source ~/.vimrc")
+
+local cmp = require("cmp")
+
+cmp.setup({
+  mapping = {
+    ["<C-n>"] = cmp.mapping.select_next_item({ behavior = cmp.SelectBehavior.Select }),
+    ["<C-p>"] = cmp.mapping.select_prev_item({ behavior = cmp.SelectBehavior.Select }),
+
+    ["<Tab>"] = cmp.mapping(function(fallback)
+      if cmp.visible() then
+        cmp.confirm({ select = true })
+      else
+        fallback()
+      end
+    end, { "i", "s" }),
+  },
+
+  sources = cmp.config.sources({
+    {
+      name = "nvim_lsp",
+      ---@param entry cmp.Entry
+      ---@param ctx cmp.Context
+      entry_filter = function(entry, ctx)
+        if ctx.filetype ~= "vue" then
+          return true
+        end
+
+        local cursor_before_line = ctx.cursor_before_line
+        if cursor_before_line:sub(-1) == "@" then
+          return entry.completion_item.label:match("^@")
+        elseif cursor_before_line:sub(-1) == ":" then
+          return entry.completion_item.label:match("^:")
+            and not entry.completion_item.label:match("^:on%-")
+        else
+          return true
+        end
+      end,
+    },
+    { name = "buffer" },
+    { name = "path" },
+  }),
+
+  formatting = {
+    format = function(entry, item)
+      item.menu = ({
+        nvim_lsp = "[LSP]",
+        buffer = "[Buffer]",
+        path = "[Path]",
+      })[entry.source.name]
+      return item
+    end,
+  },
+})
+
+cmp.event:on("menu_closed", function()
+  local bufnr = vim.api.nvim_get_current_buf()
+  vim.b[bufnr]._vue_ts_cached_is_in_start_tag = nil
+end)
+
+require("conform").setup({
+  formatters_by_ft = {
+    lua = { "stylua" },
+    vue = { "prettierd", "prettier", stop_after_first = true },
+    typescript = { "prettierd", "prettier", stop_after_first = true },
+    javascript = { "prettierd", "prettier", stop_after_first = true },
+    javascriptreact = { "prettierd", "prettier", stop_after_first = true },
+    css = { "prettierd", "prettier", stop_after_first = true },
+  },
+  format_on_save = {
+    timeout_ms = 500,
+    lsp_format = "fallback",
+  },
+})
+
+vim.keymap.set({ "n", "v" }, "<leader>f", function()
+  require("conform").format({ timeout_ms = 500, lsp_format = "fallback" })
+end, { desc = "Format buffer or selection" })
+
+require("gitsigns").setup({
+  current_line_blame = true,
+  current_line_blame_opts = {
+    virt_text = true,
+    virt_text_pos = "eol",
+    delay = 100,
+    ignore_whitespace = false,
+  },
+  current_line_blame_formatter = "<author>, <author_time:%d-%m-%Y> - <summary>",
+})
+
+local navic = require("nvim-navic")
+
+navic.setup({
+  separator = " › ",
+  highlight = true,
+})
+
+vim.api.nvim_create_autocmd("LspAttach", {
+  callback = function(event)
+    local client = vim.lsp.get_client_by_id(event.data.client_id)
+    if client.server_capabilities.documentSymbolProvider then
+      navic.attach(client, event.buf)
+    end
+    vim.lsp.inlay_hint.enable(true, { bufnr = event.buf })
+  end,
+})
+
+local servers = {
+  lua_ls = {
+    settings = {
+      Lua = {
+        runtime = {
+          version = "LuaJIT",
+        },
+        diagnostics = {
+          globals = { "vim" },
+        },
+        hint = { enable = true },
+      },
+    },
+  },
+
+  yamlls = {
+    settings = {
+      yaml = {
+        completion = true,
+        validate = true,
+        suggest = {
+          parentSkeletonSelectedFirst = true,
+        },
+        schemas = {
+          ["https://www.schemastore.org/github-workflow.json"] = ".github/workflows/*",
+          ["https://raw.githubusercontent.com/compose-spec/compose-spec/master/schema/compose-spec.json"] = "docker-compose*.{yml,yaml}",
+        },
+      },
+      redhat = {
+        telemetry = {
+          enable = false,
+        },
+      },
+    },
+  },
+
+  jsonls = {
+    settings = {
+      json = {
+        validate = { enable = true },
+        schemas = {
+          {
+            fileMatch = { "package.json" },
+            url = "https://www.schemastore.org/package.json",
+          },
+          {
+            fileMatch = { "tsconfig*.json" },
+            url = "https://www.schemastore.org/tsconfig.json",
+          },
+        },
+      },
+    },
+  },
+
+  vtsls = {
+    settings = {
+      vtsls = {
+        tsserver = {
+          globalPlugins = {
+            {
+              name = "@vue/typescript-plugin",
+              location = "~/.bun/bin/vue-language-server",
+              languages = { "vue" },
+              configNamespace = "typescript",
+            },
+          },
+        },
+      },
+    },
+    filetypes = { "typescript", "javascript", "vue" },
+  },
+
+  vue_ls = {},
+
+  nil_ls = {
+    cmd = { "nil" },
+    settings = {
+      ["nil"] = {
+        diagnostics = {
+          bindingEndHintMinLines = 2,
+        },
+        nix = { maxMemoryMB = nil },
+      },
+    },
+  },
+
+  just = {},
+
+  -- dockerls = {},
+
+  astro = {},
+
+  emmet_language_server = {
+    filetypes = {
+      "vue",
+      "astro",
+      "css",
+      "html",
+      "javascript",
+      "javascriptreact",
+      "typescriptreact",
+    },
+  },
+
+  tailwindcss = {
+    filetypes = {
+      "vue",
+      "astro",
+      "javascriptreact",
+      "typescriptreact",
+      "html",
+      "css",
+    },
+  },
+
+  gopls = {},
+
+  sourcekit = {},
+}
+
+vim.diagnostic.config({
+  virtual_text = true,
+  signs = true,
+  underline = true,
+  update_in_insert = false,
+  float = {
+    focusable = false,
+    style = "minimal",
+    border = "rounded",
+    source = "if_many",
+    header = "",
+    prefix = "",
+  },
+})
+
+for server, config in pairs(servers) do
+  vim.lsp.config(server, config)
+  vim.lsp.enable(server)
+end
+
+vim.lsp.handlers["textDocument/hover"] = vim.lsp.with(vim.lsp.handlers.hover, {
+  border = "rounded",
+  max_width = 80,
+})
+
+vim.keymap.set("n", "<leader>rn", vim.lsp.buf.rename, { desc = "Rename symbol" })
+vim.keymap.set(
+  "n",
+  "K",
+  vim.lsp.buf.hover,
+  { noremap = true, silent = true, desc = "LSP Hover Documentation" }
+)
+
+require("lualine").setup({
+  options = {
+    icons_enabled = false,
+    theme = "auto",
+    globalstatus = true,
+    component_separators = "",
+    section_separators = "",
+    always_divide_middle = true,
+    ignore_focus = { "NvimTree" },
+    disabled_filetypes = {
+      statusline = { "NvimTree" },
+      winbar = { "NvimTree" },
+    },
+  },
+  sections = {
+    lualine_a = { "mode" },
+    lualine_b = {
+      { "branch" },
+      "diff",
+    },
+    lualine_c = { { "filename", path = 1, shorting_target = 40 } },
+    lualine_x = { "diagnostics" },
+    lualine_y = { "progress" },
+    lualine_z = { "location" },
+  },
+  inactive_sections = {
+    lualine_a = {},
+    lualine_b = {},
+    lualine_c = {},
+    lualine_x = {},
+    lualine_y = {},
+    lualine_z = {},
+  },
+  tabline = {},
+  winbar = {
+    lualine_c = {
+      {
+        "navic",
+        cond = function()
+          return require("nvim-navic").is_available()
+        end,
+      },
+    },
+  },
+  inactive_winbar = {},
+  extensions = {},
+})
+vim.opt.showmode = false
+vim.o.cmdheight = 0
+vim.o.laststatus = 3
+
+require("mini.pairs").setup()
+
+require("mini.notify").setup({
+  window = {
+    winblend = 0,
+    lsp_progress = {
+      enable = true,
+    },
+  },
+})
+
+vim.notify = require("mini.notify").make_notify()
+vim.api.nvim_create_autocmd("BufWritePost", {
+  callback = function(args)
+    local ft = vim.bo[args.buf].filetype
+    if ft == "" or vim.bo[args.buf].buftype ~= "" then
+      return
+    end
+
+    local fn = vim.fn.fnamemodify(args.file, ":t")
+    vim.notify("Saved " .. fn, vim.log.levels.INFO, { title = "File Written" })
+  end,
+})
+
+require("mini.move").setup({
+  mappings = {
+    left = "<M-h>",
+    right = "<M-l>",
+    down = "<M-j>",
+    up = "<M-k>",
+    line_left = "<M-h>",
+    line_right = "<M-l>",
+    line_down = "<M-j>",
+    line_up = "<M-k>",
+  },
+  options = {
+    reindent_linewise = true,
+  },
+})
+
+require("mini.comment").setup({
+  options = {
+    custom_commentstring = nil,
+    ignore_blank_line = false,
+    start_of_line = false,
+    pad_comment_parts = true,
+  },
+  mappings = {
+    comment = "gc",
+    comment_line = "gcc",
+  },
+})
+
+require("mini.surround").setup({
+  mappings = {
+    add = "S", -- Add surrounding in Normal and Visual modes
+    delete = "ds", -- Delete surrounding
+    find = "sf", -- Find surrounding (to the right)
+    find_left = "sF", -- Find surrounding (to the left)
+    highlight = "sh", -- Highlight surrounding
+    replace = "cs", -- Replace surrounding
+  },
+})
+
+require("telescope").setup({
+  defaults = {
+    file_ignore_patterns = { "bun.lock" },
+  },
+  extensions = {
+    fzf = {
+      fuzzy = true,
+      override_generic_sorter = true,
+      override_file_sorter = true,
+      case_mode = "smart_case",
+    },
+  },
+})
+
+require("telescope").load_extension("fzf")
+require("telescope").load_extension("file_browser")
+
+local opts = { noremap = true, silent = true }
+vim.api.nvim_set_keymap(
+  "n",
+  "<leader>ff",
+  "<cmd>lua require('telescope.builtin').find_files()<CR>",
+  opts
+)
+vim.api.nvim_set_keymap(
+  "n",
+  "<leader>fg",
+  "<cmd>lua require('telescope.builtin').live_grep()<CR>",
+  opts
+)
+vim.api.nvim_set_keymap(
+  "n",
+  "<leader>fl",
+  "<cmd>lua require('telescope.builtin').current_buffer_fuzzy_find()<CR>",
+  opts
+)
+vim.api.nvim_set_keymap(
+  "n",
+  "<leader>fr",
+  "<cmd>lua require('telescope.builtin').lsp_references()<CR>",
+  opts
+)
+vim.api.nvim_set_keymap(
+  "n",
+  "<leader>fd",
+  "<cmd>lua require('telescope.builtin').lsp_definitions()<CR>",
+  opts
+)
+vim.api.nvim_set_keymap(
+  "n",
+  "<leader>ft",
+  "<cmd>lua require('telescope.builtin').lsp_type_definitions()<CR>",
+  opts
+)
+vim.api.nvim_set_keymap("n", "<leader>fi", "<cmd>Telescope lsp_implementations<CR>", opts)
+vim.api.nvim_set_keymap("n", "<C-j>", "<cmd>Telescope lsp_document_symbols<CR>", opts)
+
+vim.g.loaded_netrw = 1
+vim.g.loaded_netrwPlugin = 1
+
+require("nvim-tree").setup({
+  renderer = {
+    icons = {
+      show = {
+        file = false,
+        folder = false,
+        folder_arrow = true,
+        git = false,
+        modified = true,
+      },
+    },
+  },
+  view = {
+    width = 30,
+    side = "right",
+  },
+  disable_netrw = true,
+  hijack_netrw = true,
+  update_focused_file = { enable = true },
+  filters = { dotfiles = false },
+  git = { enable = false },
+})
+
+vim.keymap.set("n", "<C-b>", ":NvimTreeToggle<CR>", { desc = "Toggle file explorer" })
+vim.keymap.set("n", "<leader>e", ":NvimTreeFocus<CR>", { desc = "Focus file explorer" })
+
+require("nvim-treesitter.configs").setup({
+  highlight = { enable = true, additional_vim_regex_highlighting = true },
+  indent = { enable = true },
+})
+
+vim.keymap.set("n", "<leader>?", function()
+  require("which-key").show({ global = false })
+end, { desc = "Buffer Local Keymaps (which-key)" })
+
+require("cord").setup({})
+
+require("catppuccin").setup({
+  flavour = "mocha",
+  transparent_background = true,
+})

home/diogo/programs/ohmyposh/config.json

···
+{
+  "$schema": "https://raw.githubusercontent.com/JanDeDobbeleer/ohmyposh/main/themes/schema.json",
+  "secondary_prompt": {
+    "template": "~~> ",
+    "foreground": "magenta",
+    "background": "transparent"
+  },
+  "transient_prompt": {
+    "template": "~> ",
+    "background": "transparent",
+    "foreground_templates": [
+      "{{if gt .Code 0}}red{{end}}",
+      "{{if eq .Code 0}}magenta{{end}}"
+    ]
+  },
+  "upgrade": {
+    "source": "cdn",
+    "interval": "168h",
+    "auto": false,
+    "notice": false
+  },
+  "blocks": [
+    {
+      "type": "prompt",
+      "alignment": "left",
+      "segments": [
+        {
+          "properties": {
+            "cache_duration": "none",
+            "style": "full"
+          },
+          "template": "{{ .Path }} ",
+          "foreground": "blue",
+          "background": "transparent",
+          "type": "path",
+          "style": "plain"
+        },
+        {
+          "properties": {
+            "branch_icon": "",
+            "cache_duration": "none",
+            "commit_icon": "@",
+            "fetch_status": true
+          },
+          "template": "{{ .HEAD }}{{ if or (.Working.Changed) (.Staging.Changed) }}*{{ end }} <cyan>{{ if gt .Behind 0 }}\u21e3{{ end }}{{ if gt .Ahead 0 }}\u21e1{{ end }}</>",
+          "foreground": "p:grey",
+          "background": "transparent",
+          "type": "git",
+          "style": "plain"
+        }
+      ],
+      "newline": true
+    },
+    {
+      "type": "rprompt",
+      "overflow": "hidden",
+      "segments": [
+        {
+          "properties": {
+            "cache_duration": "none",
+            "threshold": 5000
+          },
+          "template": "{{ .FormattedMs }}",
+          "foreground": "yellow",
+          "background": "transparent",
+          "type": "executiontime",
+          "style": "plain"
+        }
+      ]
+    },
+    {
+      "type": "prompt",
+      "alignment": "left",
+      "segments": [
+        {
+          "properties": {
+            "cache_duration": "none"
+          },
+          "template": "~>",
+          "background": "transparent",
+          "type": "text",
+          "style": "plain",
+          "foreground_templates": [
+            "{{if gt .Code 0}}red{{end}}",
+            "{{if eq .Code 0}}magenta{{end}}"
+          ]
+        }
+      ]
+    }
+  ],
+  "version": 3,
+  "final_space": true
+}

home/diogo/programs/ohmyposh/default.nix

···
+{
+  programs.oh-my-posh = {
+    enable = true;
+    enableZshIntegration = true;
+    settings = builtins.fromJSON (builtins.readFile ./config.json);
+  };
+}

home/diogo/programs/ripgrep.nix

···
+{
+  programs.ripgrep = {
+    enable = true;
+
+    arguments = [
+      "--max-columns=150"
+      "--max-columns-preview"
+      "--glob=!.git/*"
+      "--smart-case"
+    ];
+  };
+}

home/diogo/programs/tmux.nix

···
+{ pkgs, ... }:
+{
+  programs.tmux = {
+    enable = true;
+    plugins = with pkgs.tmuxPlugins; [
+      catppuccin
+    ];
+    extraConfig = ''
+      set -g mouse on
+      set -s escape-time 0
+      set -g default-terminal "tmux-256color"
+      set -sa terminal-overrides ",xterm*:Tc"
+
+      unbind C-b
+      set -g prefix C-a
+      bind C-a send-prefix
+
+      bind r source-file ~/.tmux.conf \; display-message "tmux config reloaded!"
+
+      bind -n C-k send-keys C-l
+
+      bind -r h select-pane -L
+      bind -r j select-pane -D
+      bind -r k select-pane -U
+      bind -r l select-pane -R
+      bind v split-window -h
+      bind n split-window -v
+      bind x kill-pane
+
+      bind w new-window -c "#{pane_current_path}"
+      bind n next-window
+      bind p previous-window
+
+      set -g @catppuccin_flavor 'mocha'
+      set -g @catppuccin_window_status_style "basic"
+      set -g @catppuccin_window_number "#I"
+      set -g @catppuccin_window_text " #{pane_current_command}"
+      set -g @catppuccin_window_current_number "#[bold]#I"
+      set -g @catppuccin_window_current_text " #{pane_current_command}"
+
+      set -g status-right-length 100
+      set -g status-left-length 100
+      set -g status-style "bg=default"
+      set -g status-left ""
+      set -g status-right ""
+    '';
+  };
+}

home/diogo/programs/vesktop.nix

···
+{ config, ... }:
+{
+  programs.vesktop = {
+    inherit (config.sys.profiles.graphical) enable;
+    settings = {
+      discordBranch = "canary";
+      transparencyOption = "acrylic";
+      disableSmoothScroll = false;
+      hardwareAcceleration = true;
+      arRPC = true;
+      appBadge = true;
+    };
+    vencord.settings = {
+      plugins = {
+        AppleMusicRichPresence = {
+          enabled = true;
+          refreshInterval = 5;
+          largeImageType = "Album";
+          smallImageType = "Artist";
+          largeTextString = "{album}";
+          smallTextString = "{artist}";
+          enableButtons = false;
+          nameString = "Apple Music";
+          detailsString = "{name}";
+          stateString = "{artist} · {album}";
+          enableTimestamps = true;
+          activityType = 2;
+        };
+        FakeNitro.enabled = true;
+        FixYoutubeEmbeds.enabled = true;
+        FixSpotifyEmbeds.enabled = true;
+        FixImagesQuality.enabled = true;
+        FixCodeblockGap.enabled = true;
+        ForceOwnerCrown.enabled = true;
+        FriendsSince.enabled = true;
+        ImageZoom.enabled = true;
+        LastFMRichPresence = {
+          enabled = true;
+          hideWithActivity = false;
+          hideWithSpotify = true;
+          shareUsername = false;
+          shareSong = true;
+          statusName = "";
+          nameFormat = "artist";
+          useListeningStatus = true;
+          missingArt = "lastfmLogo";
+          showLastFmLogo = true;
+        };
+        MessageLogger = {
+          enabled = true;
+          collapseDeleted = true;
+          deleteStyle = "text";
+          ignoreBots = false;
+          ignoreSelf = true;
+          logEdits = true;
+          logDeletes = true;
+          inlineEdits = true;
+        };
+        NSFWGateBypass.enabled = true;
+        PlatformIndicators.enabled = true;
+        ReviewDB.enabled = true;
+        RoleColorEverywhere.enabled = true;
+        SecretRingToneEnabler.enabled = true;
+        ShikiCodeblocks.enabled = true;
+        ShowHiddenChannels.enabled = true;
+        ShowHiddenThings.enabled = true;
+        SpotifyControls = {
+          enabled = true;
+          hoverControls = true;
+        };
+        SpotifyCrack = {
+          enabled = true;
+          noSpotifyAutoPause = true;
+          keepSpotifyActivityOnIdle = false;
+        };
+        StreamerModeOnStream.enabled = true;
+        TextReplace = {
+          enabled = true;
+          stringRules = [
+            {
+              find = "://bsky.app/";
+              replace = "://fxbsky.app/";
+            }
+            {
+              find = "://instagram.com/";
+              replace = "://ddinstagram.com/";
+            }
+            {
+              find = "://www.instagram.com/";
+              replace = "://ddinstagram.com/";
+            }
+            {
+              find = "://reddit.com/";
+              replace = "://rxddit.com/";
+            }
+            {
+              find = "://www.reddit.com/";
+              replace = "://rxddit.com/";
+            }
+            {
+              find = "://tiktok.com/";
+              replace = "://tfxktok.com/";
+            }
+            {
+              find = "://vm.tiktok.com/";
+              replace = "://vm.vxtiktok.com/";
+            }
+            {
+              find = "://twitter.com/";
+              replace = "://fxtwitter.com/";
+            }
+            {
+              find = "://x.com/";
+              replace = "://fxtwitter.com/";
+            }
+          ];
+        };
+        TypingIndicator = {
+          enabled = true;
+          includeMutedChannels = false;
+          includeCurrentChannel = true;
+          indicatorMode = 3;
+        };
+        TypingTweaks = {
+          enabled = true;
+          alternativeFormatting = true;
+          showRoleColors = true;
+          showAvatars = true;
+        };
+        UserMessagesPronouns.enabled = true;
+        USRBG.enabled = true;
+        WhoReacted.enabled = true;
+        NoTrack = {
+          enabled = true;
+          disableAnalytics = true;
+        };
+        Settings.enabled = true;
+        ClearURLs.enabled = true;
+      };
+    };
+  };
+}

home/diogo/programs/zed.nix

···
+{ config, ... }:
+{
+  programs.zed-editor = {
+    inherit (config.sys.profiles.graphical) enable;
+
+    userSettings = {
+      telemetry = {
+        diagnostics = false;
+        metrics = false;
+      };
+
+      vim_mode = true;
+
+      ui_font_size = 16;
+      buffer_font_family = "Maple Mono";
+      buffer_font_size = 18;
+
+      project_panel = {
+        dock = "right";
+      };
+    };
+    extensions = [
+      "git-firefly"
+      "vue"
+      # "dockerfile"
+      # "docker-compose"
+      "nix"
+      "discord-presence"
+      "astro"
+    ];
+  };
+}

home/diogo/programs/zen.nix

···
+{
+  inputs,
+  ...
+}:
+{
+  imports = [
+    inputs.zen-browser.homeModules.beta
+  ];
+
+  programs.zen-browser = {
+    enable = true;
+
+    policies = {
+      AppAutoUpdate = false;
+      DisableAppUpdate = true;
+      ManualAppUpdateOnly = true;
+      DisableFirefoxStudies = true;
+      DisablePocket = true;
+      DisableTelemetry = true;
+      DontCheckDefaultBrowser = true;
+      OfferToSaveLogins = false;
+      NoDefaultBookmarks = true;
+      Cookies = {
+        Allow = [
+          "https://bsky.app"
+          "https://bsky.social"
+          "https://tangled.org"
+          "https://github.com"
+          "https://steamcommunity.com"
+          "https://steampowered.com"
+          "https://google.com"
+          "https://youtube.com"
+          "https://bunny.net"
+          "https://twitch.tv"
+          "https://apple.com"
+          "https://icloud.com"
+          "https://instagram.com"
+          "https://porkbun.com"
+          "https://amazon.es"
+          "https://upcloud.com"
+          "https://chatgpt.com"
+          "https://openai.com"
+          "https://revolut.com"
+          "https://proton.me"
+          "https://bitwarden.com"
+          "https://bitwarden.eu"
+          "https://catsky.social"
+          "https://gandi.net"
+          "https://stripe.com"
+          "http://10.100.0.1"
+          "http://[fd00:1:1:1::1]"
+        ];
+      };
+      SanitizeOnShutdown = {
+        Cache = true;
+        Cookies = true;
+        FormData = true;
+      };
+      DisableFirefoxAccounts = true;
+      DNSOverHTTPS = {
+        Enabled = true;
+        ProviderURL = "https://dns.quad9.net/dns-query";
+        Fallback = true;
+        Locked = true;
+      };
+      EnableTrackingProtection = {
+        Value = true;
+        Locked = true;
+        Cryptomining = true;
+        Fingerprinting = true;
+        EmailTracking = true;
+      };
+      HttpsOnlyMode = "force_enabled";
+      SkipTermsOfUse = true;
+      Extensions = {
+        Install = [
+          "https://addons.mozilla.org/firefox/downloads/latest/bitwarden-password-manager/latest.xpi"
+          "https://addons.mozilla.org/firefox/downloads/latest/catppuccin-web-file-icons/latest.xpi"
+          "https://addons.mozilla.org/firefox/downloads/latest/clearurls/latest.xpi"
+          "https://addons.mozilla.org/firefox/downloads/latest/return-youtube-dislikes/latest.xpi"
+          "https://addons.mozilla.org/firefox/downloads/latest/sponsorblock/latest.xpi"
+          "https://addons.mozilla.org/firefox/downloads/latest/steam-database/latest.xpi"
+          "https://addons.mozilla.org/firefox/downloads/latest/styl-us/latest.xpi"
+          "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
+          "https://addons.mozilla.org/firefox/downloads/latest/refined-github-/latest.xpi"
+          "https://addons.mozilla.org/firefox/downloads/latest/web-scrobbler/latest.xpi"
+        ];
+      };
+      SearchEngines = {
+        Add = [
+          {
+            Name = "Qwant";
+            IconURL = "https://www.qwant.com/favicon.ico";
+            URLTemplate = "https://www.qwant.com/?q={searchTerms}";
+            Alias = "qwant";
+            SuggestURLTemplate = "https://api.qwant.com/api/suggest/?q={searchTerms}";
+          }
+        ];
+        Default = "Qwant";
+      };
+    };
+
+    profiles.default = rec {
+      settings = {
+        "zen.workspaces.continue-where-left-off" = true;
+        "zen.welcome-screen.seen" = true;
+        "zen.tabs.vertical.right-side" = true;
+        "zen.urlbar.behavior" = "float";
+        "zen.view.sidebar-expanded" = false;
+        "zen.view.use-single-toolbar" = false;
+      };
+
+      pinsForce = true;
+      pins = {
+        "YouTube" = {
+          id = "c1e24192-acf6-4454-a4e0-b57483e6fd49";
+          workspace = spaces."Personal".id;
+          url = "https://youtube.com";
+          position = 101;
+          isEssential = true;
+        };
+        "Tangled" = {
+          id = "c1d9c4f8-ec95-4f41-93fd-76a92f5fdf16";
+          workspace = spaces."Personal".id;
+          url = "https://tangled.org";
+          position = 102;
+          isEssential = true;
+        };
+        "Bluesky" = {
+          id = "f58aa4ce-5915-41c8-b117-b11c32531198";
+          workspace = spaces."Personal".id;
+          url = "https://catsky.social";
+          position = 103;
+          isEssential = true;
+        };
+
+        "GitHub" = {
+          id = "b3bf5dfd-f08b-4407-a9c3-8ce40eb53e74";
+          workspace = spaces."Personal".id;
+          url = "https://github.com";
+          position = 104;
+          isEssential = false;
+        };
+        "Codeberg" = {
+          id = "34db494e-0238-44b0-8836-b1cdfa82e677";
+          workspace = spaces."Personal".id;
+          url = "https://codeberg.org";
+          position = 105;
+          isEssential = false;
+        };
+        "Bunny" = {
+          id = "e82607e2-2f86-4d9a-9168-65d4cd766f5e";
+          workspace = spaces."Personal".id;
+          url = "https://dash.bunny.net";
+          position = 106;
+          isEssential = false;
+        };
+        "Porkbun" = {
+          id = "66a2c410-915f-4bb2-91a8-4fc83633382b";
+          workspace = spaces."Personal".id;
+          url = "https://porkbun.com/account/domainsSpeedy";
+          position = 107;
+          isEssential = false;
+        };
+        "UpCloud" = {
+          id = "95ee2678-e60d-4f2b-9b8b-4da2f246b197";
+          workspace = spaces."Personal".id;
+          url = "https://hub.upcloud.com";
+          position = 108;
+          isEssential = false;
+        };
+        "Gandi" = {
+          id = "53418beb-79a3-41d5-b0ba-75d3a48188b5";
+          workspace = spaces."Personal".id;
+          url = "https://admin.gandi.net";
+          position = 109;
+          isEssential = false;
+        };
+      };
+
+      containersForce = true;
+      containers = {
+        Shopping = {
+          color = "yellow";
+          icon = "dollar";
+          id = 2;
+        };
+      };
+
+      spacesForce = true;
+      spaces = {
+        "Personal" = {
+          id = "8abbe7cb-3f97-446f-b986-f2f598cd0bdc";
+          icon = "🌷";
+          position = 1000;
+          theme = {
+            type = "gradient";
+            colors = [
+              {
+                red = 216;
+                green = 204;
+                blue = 235;
+                algorithm = "floating";
+                type = "explicit-lightness";
+              }
+            ];
+            opacity = 0.8;
+            texture = 0.5;
+          };
+        };
+      };
+    };
+  };
+}

home/diogo/programs/zsh.nix

···
+{ pkgs, ... }:
+{
+  programs.zsh = {
+    enable = true;
+    enableCompletion = true;
+    autosuggestion.enable = true;
+    syntaxHighlighting.enable = true;
+
+    initContent = ''
+      source <(fzf --zsh)
+      echo -e "\e[35m"
+      /bin/cat <<'EOF'
+        ╱|、
+       (˚ˎ。7
+       |、˜〵
+       じしˍ,)ノ
+      EOF
+      echo -e "\e[0m"
+    '';
+
+    envExtra = ''
+      ${
+        if pkgs.stdenv.hostPlatform.isDarwin then
+          ''export SSH_AUTH_SOCK=~/Library/Containers/com.bitwarden.desktop/Data/.bitwarden-ssh-agent.sock''
+        else
+          ''''
+      }
+    '';
+
+    shellAliases = {
+      cat = "bat";
+      cd = "z";
+      cp = "cp -iv";
+      mv = "mv -iv";
+      rm = "rm -rfv";
+      mkdir = "mkdir -pv";
+      p = "cd ~/Developer/";
+      dl = "cd ~/Downloads/";
+      f = "open -a Finder";
+      ls = "eza";
+      g = "git";
+      lg = "lazygit";
+      grep = "rg";
+      find = "fd";
+    };
+  };
+
+  programs.zoxide = {
+    enable = true;
+    enableZshIntegration = true;
+  };
+
+  programs.bat.enable = true;
+
+  programs.eza = {
+    enable = true;
+    git = true;
+  };
+
+  programs.fd.enable = true;
+}

home/diogo/system/default.nix

···
+{
+  imports = [
+    ./secrets.nix
+    ./ssh.nix
+  ];
+}

home/diogo/system/secrets.nix

···
+{
+  sops.secrets = { };
+}

home/diogo/system/ssh.nix

···
+{
+  lib,
+  config,
+  ...
+}:
+{
+  programs.ssh = {
+    enable = true;
+    enableDefaultConfig = false;
+
+    matchBlocks = {
+      "*" = {
+        hashKnownHosts = true;
+        compression = true;
+        identityAgent = lib.mkIf config.sys.profiles.graphical.enable ''"~/Library/Containers/com.bitwarden.desktop/Data/.bitwarden-ssh-agent.sock"'';
+      };
+
+      "codeberg.org" = {
+        user = "git";
+        hostname = "codeberg.org";
+      };
+
+      "github.com" = {
+        user = "git";
+        hostname = "github.com";
+      };
+    };
+  };
+}

hosts/default.nix

···
+{ self, inputs, ... }:
+{
+  imports = [ inputs.easy-hosts.flakeModule ];
+
+  config.easy-hosts = {
+    perClass = class: {
+      modules = [ "${self}/modules/${class}" ];
+    };
+
+    hosts = {
+      violet = {
+        arch = "aarch64";
+        class = "darwin";
+      };
+    };
+  };
+}

hosts/violet/default.nix

···
+{
+  sys = {
+    profiles.graphical.enable = true;
+    services.yabai.enable = true;
+  };
+
+  system.primaryUser = "diogo";
+
+  security.pam.services.sudo_local.touchIdAuth = true;
+}

justfile

···
+flake_var := env_var_or_default("FLAKE", "")
+flake := if flake_var =~ '^\.*$' { justfile_directory() } else { flake_var }
+rebuild := if os() == "macos" { "sudo darwin-rebuild" } else { "nixos-rebuild" }
+system-args := if os() != "macos" { "--sudo --no-reexec" } else { "" }
+
+[private]
+default:
+    @just --list --unsorted
+
+[group('rebuild')]
+[private]
+builder goal *args:
+    {{ rebuild }} {{ goal }} \
+      --flake {{ flake }} \
+      {{ system-args }} \
+      {{ args }}
+
+[group('rebuild')]
+switch *args: (builder "switch" args)
+
+[group('rebuild')]
+[macos]
+provision host:
+    sudo nix run nix-darwin/master -- switch --flake {{ flake }}#{{ host }}
+
+[group('rebuild')]
+deploy host *args: (builder "switch" "--build-host " + host "--target-host " + host "--use-substitutes " + args)
+
+[group('utils')]
+clean:
+    nix-collect-garbage --delete-older-than 3d
+    nix store optimise
+
+[group('utils')]
+rotate:
+  /usr/bin/find secrets/ -name "*.yaml" | xargs -I {} sops rotate -i {}
+  /usr/bin/find secrets/ -name "*.yaml" | xargs -I {} sops updatekeys -y {}
+
+[group('utils')]
+update:
+  nix flake update \
+    --commit-lock-file \
+    --commit-lockfile-summary "flake: update inputs" \
+    --flake {{ flake }}

modules/darwin/brew.nix

···
+{
+  pkgs,
+  inputs,
+  config,
+  lib,
+  ...
+}:
+{
+  imports = [
+    inputs.homebrew.darwinModules.nix-homebrew
+    ./environment.nix
+  ];
+
+  config = {
+    nix-homebrew = {
+      enable = true;
+      taps = {
+        "homebrew/homebrew-core" = pkgs.fetchFromGitHub {
+          owner = "homebrew";
+          repo = "homebrew-core";
+          rev = "5b104d8d7a7b36f46d0b401d05b76223e4e563a0";
+          hash = "sha256-ounBeVA8dzrZ/K10CIa2zRkCPjGd+nWL6kqpETFAktk=";
+        };
+        "homebrew/homebrew-cask" = pkgs.fetchFromGitHub {
+          owner = "homebrew";
+          repo = "homebrew-cask";
+          rev = "247fe8e7eac947fd72d620ba30792925af93167d";
+          hash = "sha256-WnmrHLadWR1bxWpmcfziY62U5oQkNREweNqE0H5k1fw=";
+        };
+      };
+      mutableTaps = false;
+      user = "diogo";
+      autoMigrate = true;
+    };
+
+    homebrew = {
+      enable = true;
+
+      global.autoUpdate = true;
+
+      onActivation = {
+        upgrade = true;
+        cleanup = "zap";
+      };
+
+      taps = builtins.attrNames config.nix-homebrew.taps;
+
+      masApps = {
+        #   "TestFlight" = 899247664;
+        #   "WhatsApp" = 310633997;
+        #   "WireGuard" = 1451685025;
+        #   "Bitwarden" = 1352778147;
+      };
+
+      brews = [
+        "bitwarden-cli"
+      ];
+
+      casks = [
+        "1password"
+        "aldente"
+        "font-maple-mono"
+        "signal"
+        "raycast"
+        "sketch@beta"
+      ]
+      ++ lib.optionals config.sys.profiles.gaming.enable [
+        "steam"
+        "prismlauncher"
+      ];
+    };
+  };
+}

modules/darwin/default.nix

···
+{ inputs, ... }:
+{
+  _class = "darwin";
+
+  system.defaults.CustomUserPreferences."com.apple.AdLib".allowApplePersonalizedAdvertising = false;
+
+  imports = [
+    ../shared
+    inputs.home-manager.darwinModules.home-manager
+    ./preferences.nix
+    ./networking.nix
+    ./keyboard.nix
+    ./brew.nix
+    ./services
+  ];
+
+  system.stateVersion = 6;
+}

modules/darwin/environment.nix

···
+{ config, ... }:
+{
+  environment.variables = {
+    HOMEBREW_NO_ANALYTICS = "1";
+    HOMEBREW_NO_INSECURE_REDIRECT = "1";
+    HOMEBREW_NO_ENV_HINTS = "0";
+    systemPath = [ config.homebrew.brewPrefix ];
+  };
+}

modules/darwin/keyboard.nix

···
+{
+  system = {
+    keyboard = {
+      enableKeyMapping = true;
+      remapCapsLockToEscape = true;
+    };
+
+    defaults.NSGlobalDomain = {
+      ApplePressAndHoldEnabled = false;
+      KeyRepeat = 1;
+      InitialKeyRepeat = 13;
+    };
+  };
+}

modules/darwin/networking.nix

···
+{
+  networking = {
+    applicationFirewall = {
+      enable = true;
+      blockAllIncoming = false;
+      allowSignedApp = false;
+      allowSigned = true;
+      enableStealthMode = true;
+    };
+    knownNetworkServices = [
+      "Wi-Fi"
+    ];
+    dns = [
+      "9.9.9.9"
+      "1.1.1.2"
+      "2620:fe::fe"
+      "2606:4700:4700::1112"
+    ];
+  };
+}

modules/darwin/preferences.nix

···
+{
+  system.defaults = {
+    dock = {
+      autohide = true;
+      tilesize = 35;
+      orientation = "left";
+      show-recents = false;
+      minimize-to-application = true;
+      mru-spaces = false;
+      persistent-apps = [
+        {
+          app = "/nix/store/5f1ghi3sgdpv5m9d8jhi4i3434rqkp7w-zen-beta-1.17.6b/Applications/Zen Browser (Beta).app";
+        }
+        { app = "/System/Applications/Mail.app"; }
+        { app = "/nix/store/cb89wc26l0fzaywsr1y8ds0vwsxi9mr0-ghostty-bin-1.2.3/Applications/Ghostty.app"; }
+        { app = "/nix/store/xcwka2yvbvip4lmc1m15gyq99wfwbahn-vesktop-1.6.1/Applications/Vesktop.app"; }
+        { app = "/System/Applications/System Settings.app"; }
+      ];
+    };
+
+    NSGlobalDomain = {
+      AppleShowScrollBars = "WhenScrolling";
+      AppleShowAllExtensions = true;
+      AppleShowAllFiles = true;
+      NSAutomaticQuoteSubstitutionEnabled = false;
+      NSAutomaticDashSubstitutionEnabled = false;
+      NSAutomaticSpellingCorrectionEnabled = false;
+      NSAutomaticCapitalizationEnabled = false;
+      NSScrollAnimationEnabled = true;
+    };
+
+    WindowManager = {
+      EnableStandardClickToShowDesktop = false;
+    };
+
+    screensaver = {
+      askForPassword = true;
+      askForPasswordDelay = 0;
+    };
+
+    finder = {
+      ShowPathbar = true;
+      FXEnableExtensionChangeWarning = false;
+      AppleShowAllExtensions = true;
+      AppleShowAllFiles = true;
+      FXRemoveOldTrashItems = true;
+      ShowHardDrivesOnDesktop = true;
+    };
+
+    CustomUserPreferences."com.apple.finder" = {
+      ShowExternalHardDrivesOnDesktop = true;
+      ShowHardDrivesOnDesktop = true;
+      ShowMountedServersOnDesktop = true;
+      ShowRemovableMediaOnDesktop = true;
+      _FXSortFoldersFirst = true;
+      FXDefaultSearchScope = "SCcf";
+      WarnOnEmptyTrash = false;
+    };
+
+    loginwindow = {
+      GuestEnabled = false;
+      SHOWFULLNAME = false;
+    };
+
+    controlcenter = {
+      BatteryShowPercentage = true;
+      Bluetooth = false;
+      Display = false;
+      FocusModes = false;
+      NowPlaying = false;
+      Sound = false;
+    };
+  };
+
+  system.activationScripts.postActivate.text = ''
+    #!/usr/bin/env bash
+    set -e
+
+    sudo chflags nohidden /Volumes
+    chflags nohidden "$HOME/Library"
+    sudo dscacheutil -flushcache
+    sudo killall -HUP mDNSResponder
+
+    killall Dock Finder SystemUIServer WindowManager || true
+  '';
+}

modules/darwin/services/default.nix

···
+{
+  imports = [
+    ./yabai.nix
+  ];
+}

modules/darwin/services/yabai.nix

···
+{
+  self,
+  lib,
+  config,
+  ...
+}:
+let
+  inherit (lib) mkIf;
+  inherit (self.lib) mkServiceOption;
+
+  cfg = config.sys.services.yabai;
+in
+{
+  options = {
+    sys.services.yabai = mkServiceOption "yabai" { };
+  };
+
+  config = mkIf cfg.enable {
+    services.yabai = {
+      enable = true;
+      config = {
+        mouse_follows_focus = "on";
+        split_ratio = 0.50;
+        layout = "bsp";
+        top_padding = 8;
+        bottom_padding = 8;
+        left_padding = 8;
+        right_padding = 8;
+        window_gap = 8;
+        external_bar = "main:0:0";
+      };
+      extraConfig = ''
+        yabai -m space 1 --label web
+        yabai -m rule --add app="Zen Browser (Beta)" space=web
+        yabai -m rule --add app="Safari" space=web
+
+        yabai -m space 2 --label dev
+        yabai -m rule --add app="Ghostty" space=dev
+        yabai -m rule --add app="Xcode" space=dev
+        yabai -m rule --add app="Zed" space=dev
+
+        yabai -m space 3 --label misc --layout stack
+        yabai -m rule --add app="Notes" space=misc
+        yabai -m rule --add app="Sketch Beta" space=misc
+        yabai -m rule --add app="Reminders" space=misc
+
+        yabai -m space 4 --label stack --layout stack
+        yabai -m rule --add app="Vesktop" space=stack
+        yabai -m rule --add app="Signal" space=stack
+        yabai -m rule --add app="Messages" space=stack
+        yabai -m rule --add app="Mail" space=stack
+        yabai -m rule --add app="WhatsApp" space=stack
+        yabai -m rule --add app="Podcasts" space=stack
+        yabai -m rule --add app="Music" space=stack
+        yabai -m rule --add app="Steam" space=stack
+
+        yabai -m rule --add label="System Settings" app="^System Settings$" manage=off
+        yabai -m rule --add label="About This Mac" app="^System Information$" title="About This Mac" manage=off
+        yabai -m rule --add label="Software Update" title="^Software Update$" manage=off
+        yabai -m rule --add label="Safari" app="^Safari$" title="^(General|(Tab|Website|Profile|Extension|Feature Flag)s|AutoFill|Se(arch|curity)|Privacy|Advanced|Developer)$" manage=off
+        yabai -m rule --add label="Finder" app="^Finder$" manage=off
+        yabai -m rule --add label="App Store" app="^App Store$" manage=off
+        yabai -m rule --add label="Activity Monitor" app="^Activity Monitor$" manage=off
+        yabai -m rule --add label="Calculator" app="^Calculator$" manage=off
+        yabai -m rule --add label="Dictionary" app="^Dictionary$" manage=off
+        yabai -m rule --add label="1Password" app="^1Password$" manage=off
+        yabai -m rule --add label="Bitwarden" app="^Bitwarden$" manage=off
+        yabai -m rule --add label="FaceTime" app="^FaceTime$" manage=off
+
+        yabai -m signal --add app='^Ghostty$' event=window_created action='yabai -m space --layout bsp'
+        yabai -m signal --add app='^Ghostty$' event=window_destroyed action='yabai -m space --layout bsp'
+
+      '';
+    };
+  };
+}

modules/home/default.nix

···
+{
+  _class = "homeManager";
+
+  imports = [
+    ../shared/packages.nix
+    ../shared/profiles.nix
+    ./home.nix
+    ./profiles.nix
+    ./secrets.nix
+  ];
+}

modules/home/home.nix

···
+{
+  home.stateVersion = "25.05";
+
+  programs.home-manager.enable = true;
+}

modules/home/profiles.nix

···
+{ osConfig, ... }:
+let
+  cfg = osConfig.sys.profiles;
+in
+{
+  sys.profiles = {
+    inherit (cfg)
+      graphical
+      headless
+      gaming
+      ;
+  };
+}

modules/home/secrets.nix

···
+{
+  self,
+  name,
+  config,
+  inputs,
+  ...
+}:
+{
+  imports = [ inputs.sops.homeManagerModules.sops ];
+
+  config = {
+    sops = {
+      defaultSopsFile = "${self}/secrets/${name}.yaml";
+      age.sshKeyPaths = [ "${config.home.homeDirectory}/.ssh/id_ed25519" ];
+    };
+  };
+}

modules/nixos/default.nix

···
+{ inputs, ... }:
+{
+  _class = "nixos";
+
+  imports = [
+    ../shared
+    inputs.home-manager.nixosModules.home-manager
+    ./headless.nix
+    ./networking
+    ./sudo.nix
+    ./secrets.nix
+    ./services
+    ./users
+  ];
+
+  nix = {
+    gc.dates = "Mon *-*-* 04:00";
+
+    optimise = {
+      automatic = true;
+      dates = [ "04:30" ];
+    };
+  };
+}

modules/nixos/headless.nix

···
+{ lib, config, ... }:
+{
+  config = lib.mkIf config.sys.profiles.headless.enable {
+    environment.variables.BROWSER = "echo";
+
+    systemd = {
+      enableEmergencyMode = false;
+    };
+  };
+}

modules/nixos/networking/default.nix

···
+{ config, ... }:
+{
+  imports = [
+    ./fail2ban.nix
+    ./firewall.nix
+    ./openssh.nix
+  ];
+
+  networking = {
+    hostId = builtins.substring 0 8 (builtins.hashString "md5" config.networking.hostName);
+
+    networkmanager.enable = true;
+
+    nameservers = [
+      "9.9.9.9"
+      "1.1.1.1"
+      "2620:fe::fe"
+      "2606:4700:4700::1111"
+    ];
+  };
+}

modules/nixos/networking/fail2ban.nix

···
+{
+  services.fail2ban = {
+    enable = true;
+    banaction = "iptables-multiport[blocktype=DROP]";
+    maxretry = 3;
+    ignoreIP = [
+      "127.0.0.0/8"
+      "10.0.0.0/8"
+      "192.168.0.0/16"
+    ];
+
+    bantime-increment = {
+      enable = true;
+      rndtime = "12m";
+      multipliers = "4 8 16 32 64 128 256 512 1024 2048";
+      maxtime = "192h";
+    };
+  };
+}

modules/nixos/networking/firewall.nix

···
+{ pkgs, config, ... }:
+{
+  config = {
+    networking.firewall = {
+      enable = true;
+      package = pkgs.iptables;
+
+      allowedTCPPorts = [
+        80
+        443
+      ];
+      allowedUDPPorts = [ ];
+
+      allowedTCPPortRanges = [ ];
+      allowedUDPPortRanges = [ ];
+
+      allowPing = config.sys.profiles.headless.enable;
+    };
+  };
+}

modules/nixos/networking/openssh.nix

···
+{
+  services.openssh = {
+    enable = true;
+
+    settings = {
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+      PermitRootLogin = "no";
+      AuthenticationMethods = "publickey";
+      PubkeyAuthentication = "yes";
+
+      ClientAliveCountMax = 5;
+      ClientAliveInterval = 60;
+    };
+
+    openFirewall = true;
+    ports = [ 22 ];
+  };
+}

modules/nixos/secrets.nix

···
+{ inputs, ... }:
+{
+  imports = [ inputs.sops.nixosModules.sops ];
+
+  sops = {
+    age = {
+      sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+    };
+    gnupg.sshKeyPaths = [ ];
+  };
+}

modules/nixos/services/caddy.nix

···
+{
+  self,
+  lib,
+  config,
+  ...
+}:
+let
+  inherit (lib) mkIf;
+  inherit (self.lib) mkServiceOption;
+
+  cfg = config.sys.services.caddy;
+in
+{
+  options = {
+    sys.services.caddy = mkServiceOption "caddy" {
+      domain = "diogo.fi";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    sops.secrets.bunny = {
+      sopsFile = "${self}/secrets/services/bunny.yaml";
+      key = "bunny";
+      owner = "caddy";
+      group = "caddy";
+    };
+
+    networking = { inherit (cfg) domain; };
+
+    security.acme = {
+      acceptTerms = true;
+      defaults.email = "hello@${cfg.domain}";
+      certs.${cfg.domain} = {
+        extraDomainNames = [ "*.${cfg.domain}" ];
+        dnsProvider = "bunny";
+        credentialsFile = config.sops.secrets.bunny.path;
+      };
+    };
+
+    users.users.caddy.extraGroups = [ "acme" ];
+
+    services.caddy.enable = true;
+  };
+}

modules/nixos/services/default.nix

···
+{
+  imports = [
+    ./caddy.nix
+    ./docker.nix
+    ./pds.nix
+  ];
+}

modules/nixos/services/docker.nix

···
+{
+  lib,
+  self,
+  config,
+  ...
+}:
+let
+  inherit (lib) mkIf;
+  inherit (self.lib) mkServiceOption;
+in
+{
+  options.sys.services.docker = mkServiceOption "docker" { };
+  config = mkIf config.sys.services.docker.enable {
+    virtualisation.docker.enable = true;
+  };
+}

modules/nixos/services/pds.nix

···
+# https://isabelroses.com/blog/nix-pds-guide/
+{
+  lib,
+  self,
+  config,
+  ...
+}:
+let
+  inherit (lib) mkIf concatStringsSep;
+  inherit (self.lib) mkServiceOption;
+
+  cfg = config.sys.services.pds;
+in
+{
+  options.sys.services.pds = mkServiceOption "pds" {
+    domain = "pds.${config.networking.domain}";
+    port = 3333;
+  };
+
+  config = mkIf cfg.enable {
+    sops.secrets.pds = {
+      sopsFile = "${self}/secrets/services/pds.yaml";
+      owner = "pds";
+      group = "pds";
+    };
+
+    services = {
+      bluesky-pds = {
+        enable = true;
+        pdsadmin.enable = true;
+
+        environmentFiles = [ config.sops.secrets.pds.path ];
+
+        settings = {
+          PDS_PORT = cfg.port;
+          PDS_HOSTNAME = cfg.domain;
+          PDS_ADMIN_EMAIL = "hello@" + config.networking.domain;
+
+          # https://compare.hose.cam
+          PDS_CRAWLERS = concatStringsSep "," [
+            "https://bsky.network"
+            "https://relay.cerulea.blue"
+            "https://relay.fire.hose.cam"
+            "https://relay2.fire.hose.cam"
+            "https://relay3.fr.hose.cam"
+            "https://relay.hayescmd.net"
+            "https://relay.xero.systems"
+            "https://relay.upcloud.world"
+            "https://relay.feeds.blue"
+            "https://atproto.africa"
+          ];
+
+          PDS_OAUTH_PROVIDER_NAME = config.networking.domain;
+        };
+      };
+
+      caddy.virtualHosts.${cfg.domain} = {
+        extraConfig = ''
+          reverse_proxy http://${cfg.host}:${toString cfg.port}
+
+          handle /xrpc/app.bsky.unspecced.getAgeAssuranceState {
+            header content-type "application/json"
+            header access-control-allow-headers "authorization,dpop,atproto-accept-labelers,atproto-proxy"
+            header access-control-allow-origin "*"
+            respond `{"lastInitiatedAt":"2025-07-14T14:22:43.912Z","status":"assured"}` 200
+          }
+        '';
+      };
+    };
+  };
+}

modules/nixos/sudo.nix

···
+{ lib, ... }:
+{
+  security = {
+    sudo = {
+      enable = true;
+      wheelNeedsPassword = lib.mkDefault false;
+      execWheelOnly = true;
+    };
+  };
+}

modules/nixos/users/default.nix

···
+{
+  imports = [
+    ./diogo.nix
+  ];
+}

modules/nixos/users/diogo.nix

···
+{
+  lib,
+  config,
+  ...
+}:
+let
+  inherit (lib) elem mkIf;
+in
+{
+  config = mkIf (elem "diogo" config.sys.users) {
+    users.users.diogo.hashedPassword = "$6$h/hPw1aKAbw/WKxy$IEnxYGD/esK890EjR5i4TlrDj6ph4DfZpiUdQ2FZp/LqXAkNzSN2BXUlmL4QQWJHsvjlbzIvULeLigfATRzyC.";
+  };
+}

modules/shared/default.nix

···
+{
+  imports = [
+    ./packages.nix
+    ./profiles.nix
+    ../../home
+    ./nix.nix
+    ./users
+  ];
+}

modules/shared/nix.nix

···
+{
+  nix.settings = {
+    experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
+  };
+  nixpkgs.config.allowUnfree = true;
+}

modules/shared/packages.nix

···
+{
+  lib,
+  config,
+  _class,
+  ...
+}:
+{
+  options.sys.packages = lib.mkOption {
+    type = lib.types.attrsOf lib.types.package;
+    default = { };
+    description = ''
+      List of packages to install.
+    '';
+  };
+
+  config = lib.mergeAttrsList [
+    (lib.optionalAttrs (_class == "nixos" || _class == "darwin") {
+      environment.systemPackages = builtins.attrValues config.sys.packages;
+    })
+
+    (lib.optionalAttrs (_class == "homeManager") {
+      home.packages = builtins.attrValues config.sys.packages;
+    })
+  ];
+}

modules/shared/profiles.nix

···
+{ lib, ... }:
+let
+  inherit (lib) mkEnableOption;
+in
+{
+  options.sys.profiles = {
+    graphical.enable = mkEnableOption "Graphical Interface";
+    headless.enable = mkEnableOption "Headless";
+    gaming.enable = mkEnableOption "Gaming";
+  };
+}

modules/shared/users/default.nix

···
+{
+  imports = [
+    ./mkuser.nix
+    ./options.nix
+    ./diogo.nix
+  ];
+}

modules/shared/users/diogo.nix

···
+{
+  lib,
+  config,
+  ...
+}:
+let
+  inherit (lib) elem mkIf;
+in
+{
+  config = mkIf (elem "diogo" config.sys.users) {
+    users.users.diogo.openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCTbCHJ0avif6MQ7izXlHHaubNsOhU2xf9lMvXKLyUQ"
+    ];
+  };
+}

modules/shared/users/mkuser.nix

···
+{
+  lib,
+  _class,
+  config,
+  ...
+}:
+let
+  inherit (lib)
+    mkDefault
+    mergeAttrsList
+    optionalAttrs
+    genAttrs
+    ;
+in
+{
+  users.users = genAttrs config.sys.users (
+    name:
+    mergeAttrsList [
+      (optionalAttrs (_class == "darwin") {
+        home = "/Users/${name}";
+      })
+
+      (optionalAttrs (_class == "nixos") {
+        home = "/home/${name}";
+        uid = mkDefault 1000;
+        isNormalUser = true;
+        extraGroups = [ "wheel" ] ++ (if config.sys.services.docker.enable then [ "docker" ] else [ ]);
+      })
+    ]
+  );
+}

modules/shared/users/options.nix

···
+{ lib, config, ... }:
+let
+  inherit (lib) mkOption optional;
+  inherit (lib.types) listOf str;
+in
+{
+  options.sys.users = mkOption {
+    type = listOf str;
+    default = [ "diogo" ];
+    description = ''
+      A list of users that the host will have.
+    '';
+  };
+
+  config = {
+    warnings = optional (config.sys.users == [ ]) ''
+      You have not configured any users.
+
+      Please set {option}`config.sys.users` in your host configuration.
+    '';
+  };
+}

secrets/diogo.yaml

···
+uwu: ENC[AES256_GCM,data:icu0,iv:zRILxhD8FDMHam2fKaRGZTucmazwogB53SAmn4Vk7bE=,tag:M7K0E+N/5s11FofKxc//2w==,type:str]
+sops:
+    age:
+        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCTbCHJ0avif6MQ7izXlHHaubNsOhU2xf9lMvXKLyUQ
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEZnTXFHQSBuOWk5
+            ckR4RzMzNkFuc05HSTBBSEwzaFczSUlmY1BqRHp5R25NMndEVEdFClVEK3hMRFcv
+            K2ZqQkkraHZWdWJQaVpFYzdSUSt4Mnl6VGdjUnVEVWZRcmsKLS0tIGRIczhvaUk2
+            SHRJcjA2MjFLcVVwZTZtUGs0OWZnbzYra0drVzVwT1hjYU0KYf38Vm1666GeDYaA
+            ljNh7adAMf6YW80B8e+xtaL4eCNnogdLdmITVduAsxij0k/UloC1ZILF5w9g+lR0
+            duLznQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-11-19T14:59:40Z"
+    mac: ENC[AES256_GCM,data:J9rjve5UkkZhkHLX828S8EksCnQqHtsAy2/4jOBxSh6uvjG82JlHQ5ok2rcRSAWxHU6I/QvpzqsVJXAd2r60uJyWdNf+gBxIppC+0q5oLL7BB0DVMxzthy60RPKpV0rTy0T1kjHglqXwTb0q6SxyoAhYHLW4ZpD5wXB0qFIC/d4=,iv:FKOjqkVq8mpeyz6RVOTOioJehN2FUb58wNWE77ZnEAo=,tag:ohyZJlug3hC0yFp0HjwbZQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.10.2

secrets/services/bunny.yaml

···
+bunny: ENC[AES256_GCM,data:SZlpwyvlWNCCV0Q0VEop8MUg/pSlDdWPGC/EfPiX2dEq+LA8iB0mV3QgJlX/eJEJrjSkIU1Wk8TN5Cjc7N54CnUk+1aYgnxGwUu1vbrep8TodKpxDSNR,iv:9irGAPMiQcHHpcjo+Ho660oiyAV4PdJnzsZEhpAmQ8k=,tag:mCpQvv3wMYNb8n1Rwi6TiA==,type:str]
+sops:
+    age:
+        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCTbCHJ0avif6MQ7izXlHHaubNsOhU2xf9lMvXKLyUQ
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEZnTXFHQSBqOURG
+            eXlNaitjYUcydkdaRlRLK1NGeDIvcnpBR2VkbGZHR3ZxSGhDd0c0CjBtU1JMc0ZK
+            YzBwVm9LTHZkcTR6elFNcDMvTHgxTlJrNDlwSmtGNUNzU28KLS0tIEMraXYvMUFu
+            d0JUcXMzL0liY3RZNEsrNTRWUE4vUWtwOERmMHZFc2gwWWMKSAaqC1tzow+dgUlS
+            9IHX8AxaX6bmWsoaU5+/+0gOmFkjvvfp2bb0/dd6eHtgJJWXgaw85jsD0v55wOb/
+            U+qB8Q==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-11-19T14:59:40Z"
+    mac: ENC[AES256_GCM,data:AiBNKPGULJfY20YgoJIy8Y9OTOaq9cSjnnMOIIGLHl7Db3Fa73ft7mgSxwR35tVP+F7UdxFNOnUXjewh0AigodgEYtGfGGgoI97/KKPiW9u5T9/RGVKw3MdBwHjxkanZdOw8u52n23DvvEqKsDwefoQslzBZpnA9V8V7hIaruH0=,iv:lb/P/XACYgX9PhMF7Sd+pEg4nG7KYZv1e5pXviyDTAs=,tag:9QNB4Ujgj81vwKJCA8qFcg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0

secrets/services/pds.yaml

···
+pds: ENC[AES256_GCM,data:x/WhLcfbMCcrGjpsmebR2upQQN3A6/7Q8EvGruN3HKi1YdWY6rYNP8I7/hz0atRMm5DyU6kvWPaaDZgSmxVfLb820ZMRl7EExI9XH+7MnvSuosbVOMhnZ7YbjraL7yZZNd8/5oCYPXX6BKyuLvKuWgycXlMFMfPb+7gFOMu8hNv+EzYSHKYbrjSj3ZC1vpiVfderCrW1iJWZaR4YHcQQtxQVds4o17yb2yNGaXrngpCxb8JLkSmDgHqfiDWXAMV27/0aagrwQL/crTmHFskyWQVlPchG39bF+Dt5H06ifJZGSV3jXsKVxCldZTxhYHEMrU6eHQVVEIawHvjixJLLipy3jO28wK6k7zGCPKFCeKZA9GEwMdR5Y7BQ7kG3YfKFbRpXtz73yL/E36FSL3r2frFyTHi4slYEcO/A1noqxpP26zibFFHl8TA=,iv:bC9e4zNogCZRsVD9roa+YkTEFH0YGvhNIdLZPi955JM=,tag:EJbh+3uSevdRlr7N3PupWg==,type:str]
+sops:
+    age:
+        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCTbCHJ0avif6MQ7izXlHHaubNsOhU2xf9lMvXKLyUQ
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEZnTXFHQSA5dHN3
+            UFNFdWFrTUxnQzdZdkdqSDhOT0FmSzQ1eFhiUnkyT2U5NnNGSXljCnNzYnJyMHJv
+            WXVxam5rTVZiRmNwRFRSMTNJbHVDYy95dlhvSzdUdmRVelkKLS0tIDF3Ulc0TkZM
+            Mmc2dUoxUDNRTE84SEVoakxvVUlnY3k0N3JEZHhlcUpoODAK9KTcrjauhWLVHExY
+            na54ehUSBCXmFwv0pUhNXVBmY1o7bmWcxqoYjVAfvqrMHAWCMYinEvcVN+EzY8fB
+            XXfPmg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-11-19T14:59:40Z"
+    mac: ENC[AES256_GCM,data:Hsd21Z896TSmeJ/0ufX1grzAdnk11odYjg2T9qvkZ8OQyPY7+17tEUcd6R2GyLC5TsMxqoLWR21iFN+nHR0Z0RVlpElQtC2/vTUdOLLbUW2eeZfBCMYwxWJKxlUQiOM2rRADpIhNmbPqB53n8i4idqUVKw5kC19+zGTT+BixROE=,iv:/OjthGKQQEI5mToTtlzMZulWpuj45j6XxkFCEgxQNM8=,tag:Wr+M9P4qg7/IbKW5id2sjQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0

stylua.toml

···
+indent_type = "Spaces"
+indent_width = 2
+column_width = 100
+line_endings = "Unix"
+quote_style = "AutoPreferDouble"
+call_parentheses = "Always"
+
+[sort_requires]
+enabled = true