cleanup: Formatting changes as well as removal of unused modules

Notable changes include:
- remove references to fly-agaric and dandelion hosts
- remove syncthing module
- remove binary-cache module
- remove unused development modules
- remove eturnal module
- remove kde module
- remove nfs module
- remove sss modules
- remove dendrite module
- remove dufs module
- remove ejabberd module
- remove libvirt module
- remove redundant smartd configuration from lily
- remove remove packages module from lily and lutea
- move flake management utilities into nix module
- remove unused patches and packages
- adjust domains we get certs for using cp-certs
- remove netbird firewall rule

.sops.yaml

···
 keys:
-  - &dandelion age1p5y7px4qnlgxgxd6j5vg4wtpzs24fnh4808ws7gah3x89j66muasxz7ck2
-  - &fly-agaric age1tmfn7f2j8rhlg0gz3hcfjrwta3f0ecctc4dhpp6y8thtgta97c7q2vxnyl
   - &lily age1amaa55e7nusv904a9ucfvtnjlw4srtet42suehey6u3yc4t2xc5sdldepj
   - &lutea age1p55em5e3uk3fprj2mpum7ulrslcqgly63pjsyw2yv6hx99trdsnsvvv9ex
 creation_rules:
   - path_regex: hidden/network.json$
     key_groups:
       - age:
-        - *dandelion
         - *lily
         - *lutea
-  - path_regex: hidden/syncthing.json$
-    key_groups:
-      - age:
-        - *dandelion
-        - *lily
-        - *lutea
-  - path_regex: secrets/dali.yaml$
-    key_groups:
-      - age:
-        - *dandelion
-        - *lily
-  - path_regex: secrets/dandelion.yaml$
-    key_groups:
-      - age:
-        - *dandelion
-  - path_regex: secrets/fly-agaric.yaml$
-    key_groups:
-      - age:
-        - *fly-agaric
   - path_regex: secrets/lily.yaml$
     key_groups:
       - age:

dandelion/config.nix

···
-{ ... }:
-{
-  imports = [
-    ./hardware.nix
-    ./packages.nix
-
-    ../modules/basic.nix
-    ../modules/caddy.nix
-    ../modules/development/nix.nix
-    ../modules/development/sh.nix
-    ../modules/editor.nix
-    ../modules/fail2ban.nix
-    ../modules/machine-id.nix
-    ../modules/machine-info.nix
-    ../modules/netbird.nix
-    ../modules/network-info.nix
-    ../modules/nfs.nix
-    ../modules/nix.nix
-    ../modules/remote-build-machines.nix
-
-    ../modules/services/caddy
-    ../modules/services/caddy/atproto-did.nix
-    ../modules/services/caddy/cp-certs.nix
-    # ../modules/services/caddy/matrix.nix
-    ../modules/services/caddy/nextcloud.nix
-    ../modules/services/caddy/pds.nix
-    ../modules/services/caddy/soju.nix
-    ../modules/services/caddy/tangled-knot.nix
-    ../modules/services/caddy/websites/boo-b77.nix
-    ../modules/services/caddy/websites/boo-y6d.nix
-    ../modules/services/caddy/websites/org-biotabit.nix
-    ../modules/services/caddy/websites/org-butwho.nix
-    ../modules/services/caddy/websites/pink-lilac.nix
-    ../modules/services/caddy/websites/pink-yemou.nix
-    ../modules/services/caddy/xmpp.nix
-    ../modules/services/eturnal.nix
-    ../modules/services/openssh.nix
-    ../modules/services/soju.nix
-  ];
-
-  sops = {
-    defaultSopsFile = ../secrets/dandelion.yaml;
-    defaultSopsFormat = "yaml";
-    age.keyFile = "/data/keys.txt";
-  };
-
-  networking.hostName = "dandelion";
-  nix.settings.max-jobs = 0;
-
-  garden = {
-    caddy.package = {
-      plugins = [
-        "github.com/mholt/caddy-events-exec@v0.1.0"
-        "github.com/mholt/caddy-l4@v0.0.0-20250530154005-4d3c80e89c5f"
-      ];
-      hash = "sha256-o6FTkx9u7Bds8FKuw1quT3lX4Kyc30s/XBkcKJkOVJY=";
-    };
-    info.host.vps = true;
-  };
-
-  # This option defines the first version of NixOS you have installed on this particular machine,
-  # and is used to maintain compatibility with application data (e.g. databases) created on older
-  # NixOS versions. Most users should NEVER change this value after the initial install, for any
-  # reason, even if you've upgraded your system to a new NixOS release. This value does NOT affect
-  # the Nixpkgs version your packages and OS are pulled from, so changing it will NOT upgrade your
-  # system. This value being lower than the current NixOS release does NOT mean your system is out
-  # of date, out of support, or vulnerable. Do NOT change this value unless you have manually
-  # inspected all the changes it would make to your configuration, and migrated your data
-  # accordingly. For more information, see `man configuration.nix` or
-  # https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
-  system.stateVersion = "24.05"; # Did you read the comment?
-}

dandelion/hardware.nix

···
-{
-  config,
-  lib,
-  modulesPath,
-  ...
-}:
-{
-  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-
-  boot = {
-    initrd = {
-      availableKernelModules = [
-        "ahci"
-        "xhci_pci"
-        "virtio_pci"
-        "virtio_scsi"
-        "sd_mod"
-        "sr_mod"
-      ];
-      kernelModules = [ ];
-    };
-    kernelModules = [ ];
-    loader = {
-      grub = {
-        enable = true;
-        configurationLimit = 50;
-        device = "/dev/sda";
-        copyKernels = true;
-      };
-      timeout = 0;
-    };
-    tmp.useTmpfs = true;
-  };
-
-  fileSystems = {
-    "/" = {
-      device = "none";
-      fsType = "tmpfs";
-      options = [
-        "defaults"
-        "mode=755"
-      ];
-    };
-    "/nix" = {
-      device = "/dev/disk/by-uuid/1b032448-bc11-4d13-9f5b-c6e980288325";
-      fsType = "btrfs";
-      options = [
-        "subvol=@nixos/nix"
-        "compress=zstd"
-      ];
-    };
-    "/config" = {
-      device = "/dev/disk/by-uuid/1b032448-bc11-4d13-9f5b-c6e980288325";
-      fsType = "btrfs";
-      options = [
-        "subvol=@nixos/config"
-        "compress=zstd"
-      ];
-    };
-    "/data" = {
-      device = "/dev/disk/by-uuid/1b032448-bc11-4d13-9f5b-c6e980288325";
-      fsType = "btrfs";
-      options = [
-        "subvol=@nixos/data"
-        "compress=zstd"
-      ];
-      neededForBoot = true;
-    };
-    "/home/mou" = {
-      device = "/dev/disk/by-uuid/1b032448-bc11-4d13-9f5b-c6e980288325";
-      fsType = "btrfs";
-      options = [
-        "subvol=@home/mou"
-        "compress=zstd"
-      ];
-    };
-    "/swap" = {
-      device = "/dev/disk/by-uuid/1b032448-bc11-4d13-9f5b-c6e980288325";
-      fsType = "btrfs";
-      options = [ "subvol=@swap" ];
-    };
-    "/boot" = {
-      device = "/dev/disk/by-uuid/5cde8da8-fe2c-4177-90b3-000c32874610";
-      fsType = "ext4";
-    };
-  };
-
-  swapDevices = [ { device = "/swap/swapfile"; } ];
-
-  # FIXME: A better solution may be coming soon: https://github.com/NixOS/nixpkgs/issues/119244
-  systemd.tmpfiles.settings."zswap" = {
-    "/sys/module/zswap/parameters/accept_threshold_percent"."w-".argument = "90";
-    "/sys/module/zswap/parameters/compressor "."w-".argument = "zstd";
-    "/sys/module/zswap/parameters/enabled"."w-".argument = "Y";
-    "/sys/module/zswap/parameters/max_pool_percent"."w-".argument = "50";
-    "/sys/module/zswap/parameters/shrinker_enabled"."w-".argument = "N";
-    "/sys/module/zswap/parameters/zpool"."w-".argument = "zsmalloc";
-  };
-
-  hardware.enableRedistributableFirmware = true;
-
-  networking.useDHCP = lib.mkDefault false;
-  systemd.network = {
-    enable = true;
-    networks."10-wan" = {
-      matchConfig.Name = "enp1s0";
-      networkConfig.DHCP = "ipv4";
-      address = [ "${config.garden.info.network.${config.networking.hostName}.ipv6}/64" ];
-      routes = [ { Gateway = "fe80::1"; } ];
-    };
-  };
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}

dandelion/home.nix

···
-{ ... }:
-{
-  imports = [
-    ../modules/dotfiles.nix
-    ../modules/home.nix
-  ];
-  home.stateVersion = "24.05";
-}

dandelion/packages.nix

···
-{ ... }:
-{
-  users.users.mou.packages = [ ];
-}

flake.lock

···
 {
   "nodes": {
+    "blender-bin": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "dir": "blender",
+        "lastModified": 1754037902,
+        "narHash": "sha256-d9hAFy/R8o5UM/mrgCBm+xE8NbtgkXYPHLVza07xGgE=",
+        "owner": "edolstra",
+        "repo": "nix-warez",
+        "rev": "e8b2b3214f07970e45ec3fc98d957b0507a3564a",
+        "type": "github"
+      },
+      "original": {
+        "dir": "blender",
+        "owner": "edolstra",
+        "repo": "nix-warez",
+        "type": "github"
+      }
+    },
     "flake-compat": {
       "flake": false,
       "locked": {
···
         ]
       },
       "locked": {
-        "lastModified": 1754263839,
-        "narHash": "sha256-ck7lILfCNuunsLvExPI4Pw9OOCJksxXwozum24W8b+8=",
+        "lastModified": 1754365350,
+        "narHash": "sha256-NLWIkn1qM0wxtZu/2NXRaujWJ4Y1PSZlc7h0y6pOzOQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "1d7abbd5454db97e0af51416f4960b3fb64a4773",
+        "rev": "c5d7e957397ecb7d48b99c928611c6e780db1b56",
         "type": "github"
       },
       "original": {
···
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1754284898,
-        "narHash": "sha256-wzM6HN0xxyooekXfl7p5P4Bn0LieOKOfsLg4DqY7XLk=",
+        "lastModified": 1733808091,
+        "narHash": "sha256-KWwINTQelKOoQgrXftxoqxmKFZb9pLVfnRvK270nkVk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "114484ca7213ac06fa7907e58dd8ef9d801d39f0",
+        "rev": "a0f3e10d94359665dba45b71b4227b0aeb851f8e",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "ref": "nixos-24.11",
+        "type": "indirect"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1754330460,
+        "narHash": "sha256-L5eUA2YptCeQn3IKcJXCKZ8Vb97BCG/SgxnHpNLSEi0=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "23c58a9c308f6652ab64a27595d75861a5f51fa6",
         "type": "github"
       },
       "original": {
···
         "type": "github"
       }
     },
-    "nixpkgs_2": {
+    "nixpkgs_3": {
       "locked": {
         "lastModified": 1722403750,
         "narHash": "sha256-tRmn6UiFAPX0m9G1AVcEPjWEOc9BtGsxGcs7Bz3MpsM=",
···
         "type": "github"
       }
     },
-    "nixpkgs_3": {
+    "nixpkgs_4": {
       "locked": {
         "lastModified": 1744868846,
         "narHash": "sha256-5RJTdUHDmj12Qsv7XOhuospjAjATNiTMElplWnJE9Hs=",
···
         "type": "github"
       }
     },
-    "nixpkgs_4": {
+    "nixpkgs_5": {
       "locked": {
         "lastModified": 1751984180,
         "narHash": "sha256-LwWRsENAZJKUdD3SpLluwDmdXY9F45ZEgCb0X+xgOL0=",
···
       "inputs": {
         "flake-compat": "flake-compat",
         "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs_3",
         "rust-overlay": "rust-overlay"
       },
       "locked": {
···
     },
     "root": {
       "inputs": {
+        "blender-bin": "blender-bin",
         "home-manager": "home-manager",
         "impermanence": "impermanence",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_2",
         "roc-lang": "roc-lang",
         "sops-nix": "sops-nix",
         "tangled-sh": "tangled-sh",
···
     },
     "sops-nix": {
       "inputs": {
-        "nixpkgs": "nixpkgs_3"
+        "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1752544651,
-        "narHash": "sha256-GllP7cmQu7zLZTs9z0J2gIL42IZHa9CBEXwBY9szT0U=",
+        "lastModified": 1754328224,
+        "narHash": "sha256-glPK8DF329/dXtosV7YSzRlF4n35WDjaVwdOMEoEXHA=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "2c8def626f54708a9c38a5861866660395bb3461",
+        "rev": "49021900e69812ba7ddb9e40f9170218a7eca9f4",
         "type": "github"
       },
       "original": {
···
         "indigo": "indigo",
         "inter-fonts-src": "inter-fonts-src",
         "lucide-src": "lucide-src",
-        "nixpkgs": "nixpkgs_4",
+        "nixpkgs": "nixpkgs_5",
         "sqlite-lib-src": "sqlite-lib-src"
       },
       "locked": {
···
     "yemou-dotfiles": {
       "flake": false,
       "locked": {
-        "lastModified": 1751154273,
-        "narHash": "sha256-UmSxoyPe7n5aga3e/nUbGRAiBPNL6Qx9ajBme3fwp7o=",
+        "lastModified": 1754330523,
+        "narHash": "sha256-K2VZlNCtPdYpirf8EFYNqbM3I226OfEH6VJZ/TVJinc=",
         "ref": "refs/heads/main",
-        "rev": "7c4b87bd891ed51ef7eb0630433424760a93f107",
-        "revCount": 99,
+        "rev": "e707438e1157ac7b085c48c44bab3948d07825a6",
+        "revCount": 102,
         "type": "git",
         "url": "https://tangled.sh/@yemou.pink/dotfiles"
       },

flake.nix

···
 {
   inputs = {
-    home-manager = {
-      url = "github:nix-community/home-manager";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
+    nixpkgs.url = "github:NixOS/nixpkgs?ref=nixos-unstable-small";
     impermanence.url = "github:nix-community/impermanence";
-    nixpkgs.url = "github:NixOS/nixpkgs?ref=nixos-unstable-small";
-    roc-lang.url = "github:roc-lang/roc";
     sops-nix.url = "github:Mic92/sops-nix";
-    tangled-sh.url = "git+https://tangled.sh/@tangled.sh/core?ref=refs/tags/v1.7.0-alpha";
-    # tangled-sh.url = "path:/data/local-flakes/tangled.sh";
+
     yemou-dotfiles = {
       url = "git+https://tangled.sh/@yemou.pink/dotfiles";
       flake = false;
···
       url = "git+https://tangled.sh/@yemou.pink/scripts";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    # nix-affine.url = "github:yemouu/nix-affine";
-    # nix-affine.url = "path:/data/local-flakes/nix-affine";
+    home-manager = {
+      url = "github:nix-community/home-manager";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    roc-lang.url = "github:roc-lang/roc";
+    tangled-sh.url = "git+https://tangled.sh/@tangled.sh/core?ref=refs/tags/v1.7.0-alpha";
   };
 
   outputs =
···
     }@inputs:
     let
       genSystemConfigs = nixpkgs.lib.genAttrs [
-        "dandelion"
-        "fly-agaric"
         "lily"
         "lutea"
       ];
-      supportedSystems = [ "x86_64-linux" ];
-      forSupportedSystems =
-        function: nixpkgs.lib.genAttrs supportedSystems (system: function (import nixpkgs { inherit system; }));
+      systems = [ "x86_64-linux" ];
+      forSystems = func: nixpkgs.lib.genAttrs systems (system: func (import nixpkgs { inherit system; }));
     in
     {
-      formatter = forSupportedSystems (pkgs: pkgs.nixfmt-tree.override { settings.formatter.nixfmt.options = [ "-w 120" ]; });
+      formatter = forSystems (p: p.nixfmt-tree.override { settings.formatter.nixfmt.options = [ "-w 120" ]; });
       nixosConfigurations = genSystemConfigs (
         hostname:
         nixpkgs.lib.nixosSystem {

fly-agaric/config.nix

···
-{ ... }:
-{
-  imports = [
-    ./hardware.nix
-    ./packages.nix
-
-    ../modules/basic.nix
-    ../modules/development
-    ../modules/editor.nix
-    ../modules/fail2ban.nix
-    ../modules/nix.nix
-    ../modules/remote-build-machines.nix
-
-    ../modules/services/openssh.nix
-  ];
-
-  sops = {
-    defaultSopsFile = ../secrets/fly-agaric.yaml;
-    defaultSopsFormat = "yaml";
-    age.keyFile = "/data/keys.txt";
-  };
-
-  networking.hostName = "fly-agaric";
-  nix.settings.max-jobs = 0;
-
-  # This option defines the first version of NixOS you have installed on this particular machine,
-  # and is used to maintain compatibility with application data (e.g. databases) created on older
-  # NixOS versions. Most users should NEVER change this value after the initial install, for any
-  # reason, even if you've upgraded your system to a new NixOS release. This value does NOT affect
-  # the Nixpkgs version your packages and OS are pulled from, so changing it will NOT upgrade your
-  # system. This value being lower than the current NixOS release does NOT mean your system is out
-  # of date, out of support, or vulnerable. Do NOT change this value unless you have manually
-  # inspected all the changes it would make to your configuration, and migrated your data
-  # accordingly. For more information, see `man configuration.nix` or
-  # https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
-  system.stateVersion = "24.05"; # Did you read the comment?
-}

fly-agaric/hardware.nix

···
-{ lib, modulesPath, ... }:
-{
-  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-
-  boot = {
-    initrd = {
-      availableKernelModules = [
-        "ahci"
-        "xhci_pci"
-        "virtio_pci"
-        "virtio_scsi"
-        "sd_mod"
-        "sr_mod"
-      ];
-      kernelModules = [ ];
-    };
-    kernelModules = [ ];
-    loader = {
-      grub = {
-        enable = true;
-        configurationLimit = 50;
-        device = "/dev/sda";
-        copyKernels = true;
-      };
-      timeout = 0;
-    };
-    tmp.useTmpfs = true;
-  };
-
-  zramSwap.enable = true;
-
-  fileSystems = {
-    "/" = {
-      device = "none";
-      fsType = "tmpfs";
-      options = [
-        "defaults"
-        "mode=755"
-      ];
-    };
-    "/nix" = {
-      device = "/dev/disk/by-uuid/e224cad1-1ea2-435b-b914-b16eb400cd36";
-      fsType = "btrfs";
-      options = [
-        "subvol=@nixos/nix"
-        "compress=zstd"
-      ];
-    };
-    "/config" = {
-      device = "/dev/disk/by-uuid/e224cad1-1ea2-435b-b914-b16eb400cd36";
-      fsType = "btrfs";
-      options = [
-        "subvol=@nixos/config"
-        "compress=zstd"
-      ];
-    };
-    "/data" = {
-      device = "/dev/disk/by-uuid/e224cad1-1ea2-435b-b914-b16eb400cd36";
-      fsType = "btrfs";
-      options = [
-        "subvol=@nixos/data"
-        "compress=zstd"
-      ];
-      neededForBoot = true;
-    };
-    "/home/mou" = {
-      device = "/dev/disk/by-uuid/e224cad1-1ea2-435b-b914-b16eb400cd36";
-      fsType = "btrfs";
-      options = [
-        "subvol=@home/mou"
-        "compress=zstd"
-      ];
-    };
-    "/boot" = {
-      device = "/dev/disk/by-uuid/00e4dfc3-8bf9-4075-92fa-3da33ef09704";
-      fsType = "ext4";
-    };
-  };
-
-  hardware.enableRedistributableFirmware = true;
-
-  swapDevices = [ ];
-
-  networking.useDHCP = lib.mkDefault false;
-  systemd.network = {
-    enable = true;
-    networks."10-wan" = {
-      matchConfig.Name = "enp1s0";
-      networkConfig.DHCP = "ipv4";
-      address = [ "2a01:4ff:f0:348a::1/64" ];
-      routes = [ { Gateway = "fe80::1"; } ];
-    };
-  };
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}

fly-agaric/home.nix

···
-{ ... }:
-{
-  imports = [ ../modules/home.nix ];
-  home.stateVersion = "24.05";
-}

fly-agaric/packages.nix

···
-{ ... }:
-{
-  users.users.mou.packages = [ ];
-}

hidden/network.json

···
 {
-	"dandelion": {
-		"ipv4": "ENC[AES256_GCM,data:6c22J7C4qIRimsRThw==,iv:eaqVkq6BirCXX6dzMck+iDyBu3PdGJa3KtNsV9rimvM=,tag:iAi/yPjBcDErOHvPTFm2/A==,type:str]",
-		"ipv6": "ENC[AES256_GCM,data:PVrT/MhkUmNBMyKj1LCFSGtlrA==,iv:zVGsawxhvT2Hms10eQdSLSee8QdImKoz1gaKe9CJaPg=,tag:QTBtumVVu6cfNWEHeBw8xg==,type:str]",
-		"netbird-ip": "ENC[AES256_GCM,data:z9HzINKJ/AYbswnmew==,iv:MpQs7cLJHSWd7vIUlslrPgxF0De055C41QciWZ/PIDs=,tag:/I6ZB/aXivFDcbqJTI0tNw==,type:str]"
-	},
 	"lily": {
 		"ipv4": "ENC[AES256_GCM,data:1tD7RqSMvuIUPDqT,iv:oAA4T3vt1nlgr+g8ftRCwsSF2/bZEEs9ECtDd/xlQOw=,tag:2LBddZVlRcvVs8aAxvXdUQ==,type:str]",
 		"ipv4-local": "ENC[AES256_GCM,data:19k/8bA6AoqrW1s0,iv:Mqpifh7/26ZjgtnJQO7dUf7/XpVicq2j6IdwlRlXei0=,tag:7jRfp/sDrNB4DBE/sfJOwQ==,type:str]",
···
 		"netbird-ip": "ENC[AES256_GCM,data:nnD509LlXnAEBJEibAo=,iv:fv+Onoy1wLaAqw+FXjAJyZIMywsbWvQ8/FlHN9YOwuw=,tag:hWQ5ZMGsDDxivRlYkgwmUA==,type:str]"
 	},
 	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
 		"age": [
 			{
 				"recipient": "age1p5y7px4qnlgxgxd6j5vg4wtpzs24fnh4808ws7gah3x89j66muasxz7ck2",
···
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRTERzaDRwK2hoVmJ1OGEy\nakVReWF0N3hNZWx4RUYwSmhOYzNCOXNxUEhFCkFtdWw3NzU1QXFDYXZ3clI0SVg5\nNHQrRjl4RHJ4cHZaSlFqS21SWEhHN00KLS0tIDFPZWJDOUdYbUxxQ2FhMGJ6T0xW\nT1pnblJXMHBaUEpQdTRXT1A1QTB4T1kKutihXIcitNESH57xnBUADl4kzYyWDrSG\nylakRRVBr+y2DsndV8UUkUnCXr5OCN5bpPpb82w3UTOV+yZ8s3wMMQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2025-03-17T01:36:54Z",
-		"mac": "ENC[AES256_GCM,data:nqh2y24GNSlkNOViW3DHHoYnB53ADRIKIF3n3CV0AK4ZFzcWN3zBQItEWMizIj4OwBtQVucqrO28YpNAuT6d0d1/5InaBDPRcMamdvOhGpF6s9CVWUkTZv1Jb/wvHV8kJh98utpLKC9VYPdG2noKTt7Wsh9SEIiDhVDFyowTs5g=,iv:+qQBNxdeVmd5/rXkf+0cW6rRDf5Eyq9NWQMjhZXHdEI=,tag:q9u29fU09YvhRefLtjowWQ==,type:str]",
-		"pgp": null,
+		"lastmodified": "2025-08-04T18:50:30Z",
+		"mac": "ENC[AES256_GCM,data:MGEbqF/n9jCoHIPryzfDIvu6UIuJdLixrCCbTls34qCrhtV6H4oQVNtUA8iifipoPwmhsFQlZgQ09+1pxiLGKZPpNAjDZimhQvX+0Dr3qAe2Xkk3eiccX0SJbYsopYjjt7UCzfu0aGkr8c/xwXZvcHTMS4qMMbEW0MHVjFEFFAE=,iv:nhpgohqagLJc9GN6sjqgjf+SxiEc0KYZ0MpGHJfMj2o=,tag:5fnj5LcxkDPVvyZEkxH8VQ==,type:str]",
 		"unencrypted_suffix": "_unencrypted",
-		"version": "3.9.4"
+		"version": "3.10.2"
 	}
-}
+}

hidden/syncthing.json

···
-{
-	"dandelion": {
-		"device-id": "ENC[AES256_GCM,data:9cQ0UcJPHf3cWT6ABbSGA7yXjFx259lY88ZNbwwJjzMLF2fg/O5wU3qV9zbhhvClTkOepDSYKT1vSSGUT2U6,iv:evUyvt0VfnE/7KWGjI5cwmf7sIODuU/xfozAJJV3qIk=,tag:oYZlKJuRDoEh6vzGJFkpNA==,type:str]"
-	},
-	"lily": {
-		"device-id": "ENC[AES256_GCM,data:QBoqthsC94CjSh5ZnmtkMJjdHVaNeop/rCfraEPMh4nGUqpy3PS2vRmPu3OfK4Avw02y3EPyoP8plqBXBRbc,iv:ZDCCequtiX9Bk0NF3hP4h/GGkbu6sBSKCXOFIcL3U/E=,tag:XZqzbasSBWo472YPIugklA==,type:str]"
-	},
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1p5y7px4qnlgxgxd6j5vg4wtpzs24fnh4808ws7gah3x89j66muasxz7ck2",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWa0JpcEhYTytSZEFMWnMr\nRXo1TGozd0o5MUpIZ2kyTXFneWszRVRoMVd3CkJYOUZhRzR5b3kzbmxHcVByalFP\nRzJlMG0yQjNYVHEydDAvQ2dvSUZwR2sKLS0tIGU3OFRYdml5YmNyK0hzZFRmWnpJ\nTGdnUW9MUTVBRmRSSVplMHVKSUUyVUkKt/qajgJ2+CSZexX9Syzpzuowl36Otk+F\nXOlD3LUEIciza6sCsTuIi6PSAt1Ro6GgSw128AegO2YUG3zEe5DFGA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1amaa55e7nusv904a9ucfvtnjlw4srtet42suehey6u3yc4t2xc5sdldepj",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUWE5aNkxFOE1ZdXRTNTVv\naXJmSkU4YXJ1SUQxQkZNQW1EWHFaR1dScGtRClhGc2VLUFA5T1NlMFMvU1VveC93\nb1AzSHNDVXNtMldHczQ4TG85dEV5dmMKLS0tIGh0SFdwbktxR25Ja2s0dTJaTnlM\nczZhTDhzWTNpRnQ3ZVhHQWtWbXpCWE0KEg9F/2NVATX1pQjmC1cNmJAtqVsIOhtl\n8jU2FuaBwukrlB92iAsJIgi0YTLiEC/y6KRLXfBW7Qmf1ePnvrqstw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1p55em5e3uk3fprj2mpum7ulrslcqgly63pjsyw2yv6hx99trdsnsvvv9ex",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzT3g4cXowbyt6UXZJa0Uw\nU2JmQWFFOGNGekcrcDVIWWM5azVnTHdnYUVjCnpXMmV3RXNQei9XaTcvamVDWlhR\neFZYbC9qM2dJS21UbHFaSnE2TXpUSjgKLS0tIDlDRzBaTjFQVXRsVXFXWng2VExu\nZUNzaVdnSG9qaE93cHNvZHg4OHJEaFEKBZ4+MAMbzu49WZfac0m0rvBGwjN5WKge\ncz0/GqBOjcHzOo1Bc0UkM4SMjD/7l7cUZxLw8IO1LiTx4kJgxk7OZw==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-05-14T11:07:45Z",
-		"mac": "ENC[AES256_GCM,data:NyH9pU3bAxOgeXxGOeGXGgchUZ4pNINVBznzCMv1WsfeIRORh/w7VmsflqPFZxkbE/XKtmPZG+wFB9QQaUcCIQB9SW1fqlnlpygHFpTcAjqz+gfGFYRtFmNKAaveuLYpA02wluXxSHZCzRW8JgqVVjyMsEBm5ifm8sq7NrtJt8k=,iv:Yq2LW3b1EKQtIFB/eUuOtuiEX6F7yZe2ZE7uCbreImY=,tag:jQxspW81i4Ysm8cnuaKYAA==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}

lily/config.nix

···
 {
   imports = [
     ./hardware.nix
-    ./packages.nix
     ./services/fail2ban.nix
 
     ../modules/basic.nix
···
   };
 
   networking.hostName = "lily";
-
-  services = {
-    smartd.enable = true;
-    thermald.enable = true;
-  };
+  services.thermald.enable = true;
 
   nix.settings = {
     cores = 6;

lily/packages.nix

···
-{ ... }:
-{
-  users.users.mou.packages = [ ];
-}

lutea/config.nix

···
 {
   imports = [
     ./hardware.nix
-    ./packages.nix
 
     ../modules/audio.nix
     ../modules/basic.nix
-    # ../modules/binary-cache.nix
     ../modules/browsers.nix
     ../modules/cloud-storage.nix
     ../modules/creation.nix
···
     ../modules/network-info.nix
     ../modules/nix.nix
     ../modules/printing.nix
-    # There isn't a way to prefer local builds yet, and my desktop is more powerful than my servers at the moment so
-    # disable this for now and revisit it later. It would also be cool if I could specify specific packages to be built
-    # on specific machines (I always want the linux kernel and firefox to be built on this machine if possible for
-    # example). Other machines will still be able to use my desktop to help compile packages
-    # ../modules/remote-build-machines.nix
     ../modules/remote-builder.nix
     ../modules/tools.nix
-    # ../modules/vpn.nix
   ];
 
   sops = {

lutea/packages.nix

···
-{ pkgs, ... }:
-{
-  users.users.mou.packages = with pkgs; [ intel-gpu-tools ];
-}

modules/basic.nix

···
       XDG_STATE_HOME = "$HOME/.local/state";
     };
     systemPackages = with pkgs; [
-      # general packages
       htop
       lsof
       magic-wormhole-rs
       man-pages
       man-pages-posix
-      thm # make colorschemes work properly
-
-      # flake management
-      age
-      git
-      sops
+      thm
     ];
   };
 

modules/binary-cache.nix

···
-{ config, lib, ... }:
-{
-  nix = {
-    settings = {
-      substituters = [
-        (lib.mkIf (
-          config.networking.hostName != "dandelion"
-        ) "ssh-ng://nix-ssh@${config.garden.info.network.dandelion.netbird-ip}")
-        (lib.mkIf (config.networking.hostName != "lily") "ssh-ng://nix-ssh@${config.garden.info.network.lily.netbird-ip}")
-        (lib.mkIf (config.networking.hostName != "lutea") "ssh-ng://nix-ssh@${config.garden.info.network.lutea.netbird-ip}")
-      ];
-    };
-    sshServe = {
-      enable = true;
-      keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAc3gwdLqoDPeAPLT8YuIamg0v6WHPFZIaQ4RWoCvt0K lily"
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFuJaCiwaXH6O7WDSmDsj1jRBzw+CJkRi1lBcdn7sON1 nixremote"
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGAMmyW1RafzNf5riuGeYlbMvv4iTgp8w3dc9r2/ESCe dandelion"
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIISgpNEPVjZUXydvTYrReIPVPxcN4vT87Yi+c7Q3bNcO root@lutea"
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKnyBRVRLKrlsAlMFXimvcF/mBjmSfixdzUX4yCZsYvE lutea"
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO/jmicQ5HZ2qGnw99PW14Gngv6fS2GM9ZtT+5zbGztN root@dandelion"
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO5oBFe2PeUMBOXmP/ON36CviNjPtD/iHS07k4TqrII2 root@lily"
-      ];
-      protocol = "ssh-ng";
-    };
-  };
-}

modules/browsers.nix

···
     "firefox-bin-unwrapped"
     "google-chrome"
   ];
+
   users.users.mou.packages = with pkgs; [
     firefox-bin
     google-chrome

modules/development/c.nix

···
-{ pkgs, ... }:
-{
-  users.users.mou.packages = with pkgs; [
-    bear
-    clang-tools
-    gdb
-  ];
-}

modules/development/default.nix

···
 { ... }:
 {
   imports = [
-    ./c.nix
-    ./go.nix
-    ./graphics.nix
-    ./nix.nix
-    ./python.nix
     ./roc.nix
     ./sh.nix
-    ./sqlite.nix
     ./typst.nix
-    ./zig.nix
   ];
 }

modules/development/go.nix

···
-{ pkgs, ... }:
-{
-  users.users.mou.packages = with pkgs; [ gopls ];
-}

modules/development/graphics.nix

···
-{ pkgs, ... }:
-{
-  users.users.mou.packages = with pkgs; [
-    apitrace
-    gfxreconstruct
-    renderdoc
-  ];
-}

modules/development/nix.nix

···
-{ pkgs, ... }:
-{
-  users.users.mou.packages = with pkgs; [
-    nixd
-    nixfmt-rfc-style
-  ];
-}

modules/development/python.nix

···
-{ pkgs, ... }:
-{
-  users.users.mou.packages = with pkgs; [
-    ruff
-    ty
-  ];
-}

modules/development/sqlite.nix

···
-{ pkgs, ... }:
-{
-  users.users.mou.packages = with pkgs; [ sqlitebrowser ];
-}

modules/development/zig.nix

···
-{ pkgs, ... }:
-{
-  users.users.mou.packages = with pkgs; [ zls ];
-}

modules/email.nix

···
 { pkgs, ... }:
 {
-
   nixpkgs.overlays = [
     (final: prev: {
       sieve-editor-gui = prev.sieve-editor-gui.override { electron = final.electron-bin; };

modules/eturnal.nix

···
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.services.eturnal;
-  settingsFormat = pkgs.formats.yaml { };
-  configurationYaml = settingsFormat.generate "eturnal.yml" cfg.settings;
-in
-{
-  options.services.eturnal = {
-    enable = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      description = "Enable eturnal";
-    };
-    package = lib.mkPackageOption pkgs "eturnal" { };
-    user = lib.mkOption {
-      type = lib.types.str;
-      default = "eturnal";
-      description = "User that runs the eturnal service";
-    };
-    group = lib.mkOption {
-      type = lib.types.str;
-      default = "eturnal";
-      description = "User that runs the eturnal service";
-    };
-    dataDir = lib.mkOption {
-      type = lib.types.path;
-      default = "/var/lib/eturnal";
-      description = "Path to store data";
-    };
-    settings = lib.mkOption {
-      type = lib.types.submodule {
-        freeformType = settingsFormat.type;
-      };
-      default = { };
-      description = "Path to the eturnal configuration file";
-    };
-    secret = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      default = null;
-      description = "Environment file containing the ETURNAL_SECRET variable";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    nixpkgs.overlays = [
-      (final: prev: {
-        eturnal = prev.beamPackages.rebar3Relx rec {
-          pname = "eturnal";
-          version = "1.12.2";
-
-          src = prev.fetchFromGitHub {
-            owner = "processone";
-            repo = "eturnal";
-            rev = version;
-            hash = "sha256-DEIYlryzkGVOTqel41STWGo7KCw3BEjEpVUboftbLHw=";
-          };
-
-          checkouts = prev.beamPackages.fetchRebar3Deps {
-            inherit version src;
-            name = "pname";
-            sha256 = "sha256-vc/gM2eKSDfr1XfsNRREA1Mo16wuZyGZXstnEmBKg6E=";
-          };
-
-          releaseType = "release";
-          profile = "prod";
-
-          buildInputs = [ prev.libyaml ];
-          buildPlugins = [ prev.beamPackages.pc ];
-
-          patchPhase = ''
-            runHook prePatch
-            substituteInPlace build.config \
-              --replace /opt/eturnal $out/rel/${pname} \
-              --replace /etc $out/rel/${pname}/etc \
-              --replace static dynamic
-            runHook postPatch
-          '';
-        };
-      })
-    ];
-
-    environment.systemPackages = [ cfg.package ];
-
-    users = {
-      users.${cfg.user} = {
-        isSystemUser = true;
-        group = cfg.group;
-        home = "/var/lib/eturnal";
-        createHome = true;
-      };
-      groups.${cfg.user} = { };
-    };
-
-    systemd.tmpfiles.settings."eturnal-config"."${cfg.dataDir}/eturnal.yml"."L+".argument = "${configurationYaml}";
-
-    systemd.services.eturnal = {
-      path = with pkgs; [ gawk ];
-      description = "eturnal STUN/TURN server";
-      after = [ "network.target" ];
-      environment.ETURNAL_ETC_DIR = cfg.dataDir;
-      serviceConfig = {
-        Type = "notify";
-        User = cfg.user;
-        Group = cfg.group;
-        ExecStart = "${cfg.package}/bin/eturnalctl foreground";
-        ExecReload = "${cfg.package}/bin/eturnalctl reload";
-        ExecStop = "${cfg.package}/bin/eturnalctl stop";
-        Restart = "on-failure";
-        RestartSec = 3;
-        WatchdogSec = 30;
-        LimitNOFILE = 50000;
-        RuntimeDirectory = "eturnal";
-        LogsDirectory = "eturnal";
-        ProtectSystem = "full";
-        NoNewPrivileges = true;
-        AmbientCapabilities = "CAP_NET_BIND_SERVICE";
-        EnvironmentFile = lib.mkIf (cfg.secret != null) cfg.secret;
-      };
-      wantedBy = [ "multi-user.target" ];
-      reloadTriggers = [ config.systemd.tmpfiles.settings."eturnal-config"."${cfg.dataDir}/eturnal.yml"."L+".argument ];
-    };
-
-    # [Unit]
-    # Wants=epmd.service
-    # After=epmd.service network.target
-  };
-}

modules/fail2ban.nix

···
       rndtime = "1h";
     };
     ignoreIP = [
-      (lib.mkIf (config.networking.hostName != "dandelion") config.garden.info.network.dandelion.netbird-ip)
       (lib.mkIf (config.networking.hostName != "lily") config.garden.info.network.lily.netbird-ip)
       (lib.mkIf (config.networking.hostName != "lutea") config.garden.info.network.lutea.netbird-ip)
     ];

modules/games.nix

···
 { lib, pkgs, ... }:
 {
   imports = [ ./unfree.nix ];
+
   garden.unfree = [
     "modrinth-app"
     "modrinth-app-unwrapped"

modules/gui.nix

···
   };
 
   qt.enable = true;
-
   security.polkit.enable = true;
 
   services = {

modules/kde.nix

···
-{ pkgs, ... }:
-{
-  services = {
-    desktopManager.plasma6.enable = true;
-    xserver.enable = true; # Without this set plasma6 will fail to start even when using wayland
-  };
-
-  environment.plasma6.excludePackages = with pkgs.kdePackages; [
-    konsole
-    oxygen
-    pkgs.aha
-    plasma-browser-integration
-    plasma-workspace-wallpapers
-    qtvirtualkeyboard
-  ];
-
-  users.users.mou.packages = with pkgs; [ xwaylandvideobridge ];
-}

modules/nfs.nix

···
-{ config, lib, ... }:
-{
-  systemd.tmpfiles.settings."nfs" = lib.mkMerge [
-    (lib.mkIf (config.networking.hostName == "dandelion") {
-      "/nfs".d = {
-        user = "nobody";
-        group = "nogroup";
-        mode = "0755";
-      };
-    })
-    (lib.mkIf (config.networking.hostName == "lily") {
-      "/mnt/certs".d = {
-        user = "nobody";
-        group = "nogroup";
-        mode = "0755";
-      };
-    })
-  ];
-
-  boot.supportedFilesystems = [ "nfs" ];
-
-  fileSystems = lib.mkMerge [
-    # (lib.mkIf (config.networking.hostName == "dandelion") { })
-    (lib.mkIf (config.networking.hostName == "lily") {
-      "/mnt/certs" = {
-        device = "${config.garden.info.network.dandelion.netbird-ip}:/caddy-certs";
-        fsType = "nfs";
-      };
-    })
-  ];
-
-  networking.firewall.interfaces.${config.services.netbird.clients.homelab.interface}.allowedTCPPorts = lib.mkIf (
-    config.networking.hostName == "dandelion"
-  ) [ 2049 ];
-
-  services.nfs = lib.mkIf (config.networking.hostName == "dandelion") {
-    server = {
-      enable = true;
-      exports = ''
-        /nfs ${config.garden.info.network.lily.netbird-ip}(ro,fsid=0,no_subtree_check)
-      '';
-    };
-  };
-}

modules/nix.nix

···
     };
   };
 
-  users.users.mou.packages = [
-    # (pkgs.callPackage ./packages/nixos-rebuild-tmpdir.nix { })
-    (pkgs.callPackage ./packages/buildConfig { })
+  users.users.mou.packages = with pkgs; [
+    age
+    git
+    nixd
+    nixfmt-rfc-style
+    sops
+
+    (callPackage ./packages/buildConfig { })
   ];
 
   nix = {

modules/packages/kakoune/01-typst-kak.patch

···
-From 6a853716c98f8099c6c81cd706a29ff17aafad11 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Micha=C5=82=20Kruszewski?= <[e-mail]>
-Date: Thu, 23 May 2024 15:01:26 +0200
-Subject: [PATCH] typst: Add typst.kak for typst markup highlighting
-
----
- rc/filetype/typst.kak | 69 +++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 69 insertions(+)
- create mode 100644 rc/filetype/typst.kak
-
-diff --git a/rc/filetype/typst.kak b/rc/filetype/typst.kak
-new file mode 100644
-index 0000000000..5353ea6a6b
---- /dev/null
-+++ b/rc/filetype/typst.kak
-@@ -0,0 +1,69 @@
-+# Detection
-+# ‾‾‾‾‾‾‾‾‾
-+
-+hook global BufCreate .*[.](typ) %{
-+    set-option buffer filetype typst
-+}
-+
-+# Initialization
-+# ‾‾‾‾‾‾‾‾‾‾‾‾‾‾
-+
-+hook -group typst-highlight global WinSetOption filetype=typst %{
-+    require-module typst
-+
-+    add-highlighter window/typst ref typst
-+    hook -once -always window WinSetOption filetype=.* %{ remove-highlighter window/typst }
-+    hook window InsertChar \n -group typst typst-on-new-line
-+}
-+
-+provide-module typst %§
-+
-+# Highlighters
-+# ‾‾‾‾‾‾‾‾‾‾‾‾
-+
-+add-highlighter shared/typst group
-+
-+# Comments
-+add-highlighter shared/typst/ regex ^//(?:[^\n/][^\n]*|)$ 0:comment
-+
-+# Strings
-+add-highlighter shared/typst/ regex '"[^"]*"' 0:string
-+
-+# Headings
-+add-highlighter shared/typst/ regex ^=+\h+[^\n]+$ 0:header
-+
-+# Code blocks
-+# Raw with optional syntax highlighting
-+add-highlighter shared/typst/ regex '^```[^(```)]*```' 0:mono
-+# Multiline monospace
-+add-highlighter shared/typst/ regex '^`[^(`)]*`' 0:mono
-+
-+# Monospace text
-+add-highlighter shared/typst/ regex \B(`[^\n]+?`)\B 0:mono
-+add-highlighter shared/typst/ regex \B(```[^\n]+?```)\B 0:mono
-+
-+# Bold text
-+add-highlighter shared/typst/ regex \s\*[^\*]+\*\B 0:+b
-+
-+# Italic text
-+add-highlighter shared/typst/ regex \b_.*?_\b 0:+i
-+
-+# Code expressions: functions, variables
-+add-highlighter shared/typst/ regex (^|\h)#(\w|\.|-)+ 0:meta
-+
-+# Bold terms in term lists
-+add-highlighter shared/typst/ regex ^/\h[^:]*: 0:+b
-+
-+§
-+
-+# Commands
-+# ‾‾‾‾‾‾‾‾
-+
-+define-command -hidden typst-on-new-line %<
-+    evaluate-commands -draft -itersel %<
-+        # Preserve previous line indent
-+        try %{ execute-keys -draft <semicolon> K <a-&> }
-+        # Cleanup trailing whitespaces from previous line
-+        try %{ execute-keys -draft k x s \h+$ <ret> d }
-+    >
-+>

modules/packages/kakoune/02-typst-comments.patch

···
-From 15d4f7585fdac03e460e59b0508aecd636bd2660 Mon Sep 17 00:00:00 2001
-From: yemou <[e-mail]>
-Date: Sun, 15 Dec 2024 19:35:56 -0500
-Subject: [PATCH] typst: fix comment_line and comment_block* options for typst
-
----
- rc/tools/comment.kak | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/rc/tools/comment.kak b/rc/tools/comment.kak
-index 3521b82ca7..ae33b82a98 100644
---- a/rc/tools/comment.kak
-+++ b/rc/tools/comment.kak
-@@ -16,7 +16,7 @@ hook global BufSetOption filetype=asciidoc %{
-     set-option buffer comment_block_end '////'
- }
-
--hook global BufSetOption filetype=(c|cpp|dart|gluon|go|java|javascript|objc|odin|php|pony|protobuf|rust|sass|scala|scss|swift|typescript|groovy) %{
-+hook global BufSetOption filetype=(c|cpp|dart|gluon|go|java|javascript|objc|odin|php|pony|protobuf|rust|sass|scala|scss|swift|typescript|typst|groovy) %{
-     set-option buffer comment_line '//'
-     set-option buffer comment_block_begin '/*'
-     set-option buffer comment_block_end '*/'

modules/packages/mesa/opencl.patch

···
-diff --git a/meson.build b/meson.build
-index c150bff74ff..37fa7f0531b 100644
---- a/meson.build
-+++ b/meson.build
-@@ -1850,7 +1850,7 @@ endif
- 
- dep_clang = null_dep
- if with_clc
--  llvm_libdir = dep_llvm.get_variable(cmake : 'LLVM_LIBRARY_DIR', configtool: 'libdir')
-+  llvm_libdir = get_option('clang-libdir')
- 
-   dep_clang = cpp.find_library('clang-cpp', dirs : llvm_libdir, required : false)
- 
-diff --git a/meson.options b/meson.options
-index 82324617884..4bde97a8568 100644
---- a/meson.options
-+++ b/meson.options
-@@ -738,3 +738,10 @@ option(
-     'none', 'dri2'
-   ],
- )
-+
-+option(
-+  'clang-libdir',
-+  type : 'string',
-+  value : '',
-+  description : 'Locations to search for clang libraries.'
-+)
-diff --git a/src/gallium/targets/rusticl/meson.build b/src/gallium/targets/rusticl/meson.build
-index 35833dc7423..41a95927cab 100644
---- a/src/gallium/targets/rusticl/meson.build
-+++ b/src/gallium/targets/rusticl/meson.build
-@@ -63,7 +63,7 @@ configure_file(
-   configuration : _config,
-   input : 'rusticl.icd.in',
-   output : 'rusticl.icd',
--  install : true,
-+  install : false,
-   install_tag : 'runtime',
-   install_dir : join_paths(get_option('sysconfdir'), 'OpenCL', 'vendors'),
- )

modules/packages/nixos-rebuild-tmpdir.nix

···
-# TODO: If I am keeping this, it should be in nixpkgs.overlays
-# nixos-rebuild is a shellscript and inside that shellscript they create a tmpdir using mktemp.
-# This is fine, but TMPDIR environment variable isn't available at this point, so mktemp puts the
-# directory in the wrong place.
-{
-  makeWrapper,
-  nixos-rebuild,
-  symlinkJoin,
-}:
-symlinkJoin {
-  name = "nixos-rebuild-tmpdir";
-  paths = [ nixos-rebuild ];
-  buildInputs = [ makeWrapper ];
-  postBuild = ''
-    wrapProgram $out/bin/nixos-rebuild \
-      --set TMPDIR /nix/tmp
-  '';
-}

modules/remote-builder.nix

···
 
   nix.settings.trusted-users = [ "nixremote" ];
 
-  services.openssh.settings.AllowUsers = [ "nixremote@${config.garden.info.network.dandelion.netbird-ip}" ];
 }

modules/services/caddy/cp-certs.nix

···
       certs_dir="/var/ssl"
 
       case $1 in
-        "proxy.butwho.org" | "pubsub.butwho.org" | "upload.butwho.org" | "muc.butwho.org" | "mumble.butwho.org" | "butwho.org" )
+        "mumble.butwho.org" )
           caddy_path="/var/lib/caddy/.local/share/caddy"
           printf '%s\n' "$prog_name: Copying certs for '$1' to $certs_dir/$1"
 

modules/services/caddy/matrix.nix

···
-{ config, ... }:
-{
-  services.caddy.virtualHosts = {
-    "butwho.org".extraConfig = ''
-      header /.well-known/matrix/* Access-Control-Allow-Origin *
-      header /.well-known/matrix/* Content-Type application/json
-      respond /.well-known/matrix/client <<JSON
-        {
-          "m.homeserver": { "base_url": "https://matrix.butwho.org" }
-        }
-        JSON
-      respond /.well-known/matrix/server `{"m.server": "matrix.butwho.org:443"}`
-    '';
-    "matrix.butwho.org".extraConfig = ''
-      encode
-      reverse_proxy ${config.garden.info.network.lily.netbird-ip}:8008
-    '';
-  };
-}

modules/services/caddy/mumble.nix

···
 { ... }:
 {
-  services.caddy.virtualHosts = {
-    "mumble.butwho.org".extraConfig = ''
-      encode
-      redir https://butwho.org{uri}
-    '';
-  };
+  services.caddy.virtualHosts."mumble.butwho.org".extraConfig = ''
+    encode
+    redir https://butwho.org{uri}
+  '';
 }

modules/services/caddy/xmpp.nix

···
-{ ... }:
-{
-  services.caddy.virtualHosts = {
-    "butwho.org".extraConfig = ''
-      header /.well-known/host-meta Access-Control-Allow-Origin *
-      header /.well-known/host-meta Content-Type text/xml
-      respond /.well-known/host-meta <<XML
-        <?xml version='1.0' encoding='utf-8'?>
-        <XRD xmlns='http://docs.oasis-open.org/ns/xri/xrd-1.0'>
-          <Link rel="urn:xmpp:alt-connections:xbosh" href="https://butwho.org:5443/bosh" />
-          <Link rel="urn:xmpp:alt-connections:websocket" href="wss://butwho.org:5443/ws" />
-        </XRD>
-        XML
-
-      header /.well-known/host-meta.json Access-Control-Allow-Origin *
-      header /.well-known/host-meta.json Content-Type application/json
-      respond /.well-known/host-meta.json <<JSON
-        {
-          "links": [
-            { "rel": "urn:xmpp:alt-connections:xbosh", "href": "https://butwho.org:5443/bosh" },
-            { "rel": "urn:xmpp:alt-connections:websocket", "href": "wss://butwho.org:5443/ws" }
-          ]
-        }
-        JSON
-    '';
-    "muc.butwho.org".extraConfig = ''
-      encode
-      redir https://butwho.org{uri}
-    '';
-    "proxy.butwho.org".extraConfig = ''
-      encode
-      redir https://butwho.org{uri}
-    '';
-    "pubsub.butwho.org".extraConfig = ''
-      encode
-      redir https://butwho.org{uri}
-    '';
-    "upload.butwho.org".extraConfig = ''
-      encode
-      redir https://butwho.org{uri}
-    '';
-  };
-}

modules/services/dendrite.nix

···
-{ config, ... }:
-{
-  imports = [ ./postgresql.nix ];
-
-  sops = {
-    secrets."dendrite/registration_shared_secret" = { };
-    templates.dendrite-env.content = ''
-      REGISTRATION_SHARED_SECRET=${config.sops.placeholder."dendrite/registration_shared_secret"}
-    '';
-  };
-
-  environment.persistence."/data/persistent".directories = [
-    {
-      directory = "/var/lib/private/dendrite";
-      mode = "0700";
-    }
-  ];
-
-  networking.firewall.interfaces.${config.services.netbird.clients.homelab.interface}.allowedTCPPorts = [ 8008 ];
-
-  services.postgresql = {
-    ensureDatabases = [ "dendrite" ];
-    ensureUsers = [
-      {
-        name = "dendrite";
-        ensureDBOwnership = true;
-      }
-    ];
-  };
-
-  systemd.services.dendrite.requires = [ "postgresql.service" ];
-
-  services.dendrite = {
-    enable = true;
-    environmentFile = config.sops.templates.dendrite-env.path;
-    settings = {
-      global = {
-        private_key = "$CREDENTIALS_DIRECTORY/private_key";
-        server_name = "butwho.org";
-        database.connection_string = "postgresql:///dendrite?host=/run/postgresql";
-        presence = {
-          enable_inbound = true;
-          enable_outbound = true;
-        };
-        dns_cache.enable = true;
-      };
-      app_service_api.database.connection_string = "";
-      client_api = {
-        registration_disabled = true;
-        guests_disabled = true;
-        registration_shared_secret = "$REGISTRATION_SHARED_SECRET";
-        enable_registration_captcha = false; # I need keys for this. Use hcaptcha?
-      };
-      federation_api.database.connection_string = "";
-      media_api = {
-        max_file_size_bytes = 104857600;
-        dynamic_thumbnails = true;
-        database.connection_string = "";
-      };
-      mscs = {
-        mscs = [ "msc2836" ];
-        database.connection_string = "";
-      };
-      sync_api = {
-        real_ip_header = "X-Forwarded-For";
-        search.enabled = true;
-        database.connection_string = "";
-      };
-      user_api = {
-        device_database.connection_string = "";
-        account_database.connection_string = "";
-      };
-      room_server.database.connection_string = "";
-      relay_api.database.connection_string = "";
-      key_server.database.connection_string = "";
-      logging = [
-        {
-          type = "std";
-          level = "warn";
-        }
-        {
-          type = "file";
-          level = "info";
-          params.path = "./logs";
-        }
-      ];
-    };
-    openRegistration = false;
-    loadCredential = [ "private_key:/var/lib/private/dendrite/matrix_key.pem" ];
-  };
-}

modules/services/dufs.nix

···
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  servePath = "/data/dufs";
-  dufsConfig = pkgs.writeText "config.yaml" (
-    lib.generators.toYAML { } {
-      allow-all = true;
-      compress = "high";
-      serve-path = "${servePath}";
-    }
-  );
-  startDufs = pkgs.writeShellScript "dufsStart" ''
-    export DUFS_AUTH="mou:$(${pkgs.coreutils}/bin/cat ${config.sops.secrets."dufs/mouPW".path})@/:rw"
-    exec ${pkgs.dufs}/bin/dufs -c ${dufsConfig}
-  '';
-in
-{
-  sops.secrets."dufs/mouPW".owner = "dufs";
-
-  users = {
-    users.dufs = {
-      description = "dufs service user";
-      isSystemUser = true;
-      group = "dufs";
-    };
-    groups.dufs = { };
-  };
-
-  networking.firewall.allowedTCPPorts = [ 5000 ];
-
-  system.activationScripts.dufsDir.text = ''
-    mkdir -p ${servePath}
-    chown -R dufs:dufs ${servePath}
-    chmod -R 760 ${servePath}
-  '';
-
-  systemd.services.dufs = {
-    enable = true;
-    after = [ "network.target" ];
-    serviceConfig = {
-      ExecStart = "${startDufs}";
-      User = "dufs";
-    };
-    wantedBy = [ "multi-user.target" ];
-  };
-}

modules/services/ejabberd.nix

···
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  imports = [ ./postgresql.nix ];
-
-  environment.persistence."/data/persistent".directories = [
-    {
-      directory = "/var/lib/ejabberd";
-      user = "ejabberd";
-      group = "ejabberd";
-      mode = "0700";
-    }
-  ];
-
-  networking.firewall = {
-    allowedTCPPorts = [
-      # 1883 # MQTT
-      5222 # Jabberd/XMPP client connections
-      5223 # Jabberd client SSL
-      5269 # Jabber/XMPP incoming server connections
-      5270 # Jabberd server SSL
-      # 5280 # HTTP for Web Admin
-      # NOTE: ejabberd doesn't support either HTTP/2 or HTTP/3, consider running caddy infront of ejabberd
-      5349 # STUN/TURN
-      5443 # HTTPS for Web Admin and File Upload
-      7777 # mod_proxy65
-    ];
-    allowedUDPPorts = [
-      3478 # STUN/TURN
-    ];
-    allowedUDPPortRanges = [
-      {
-        from = 49152;
-        to = 65535;
-      }
-    ];
-  };
-
-  services.postgresql = {
-    ensureDatabases = [ "ejabberd" ];
-    ensureUsers = [
-      {
-        name = "ejabberd";
-        ensureDBOwnership = true;
-      }
-    ];
-  };
-
-  services.ejabberd = {
-    enable = true;
-    package = pkgs.ejabberd.override {
-      withPgsql = true;
-      withImagemagick = true;
-      imagemagick = pkgs.imagemagickBig; # The captcha script require ghostscript
-    };
-    configFile = pkgs.writeText "ejabberd.yaml" (
-      lib.generators.toYAML { } {
-        hosts = [ "butwho.org" ];
-        include_config_file = [
-          # NOTE: When using the yaml generators provided by nixos, the numeric keys are strings (nix doesn't support
-          #       numeric keys). ejabberd doesn't attempt to convert the string to an integer so it doesn't recognize the
-          #       numeric key causing a configuration error.
-          #       TODO: Submit an issue to ejabberd
-          #       TODO: Look to see if there is some way I can tell the yaml generator that the key is an integer
-          (pkgs.writeText "ejabberd-shaper_rules.yaml" ''
-            shaper_rules:
-              c2s_shaper:
-                none: admin
-                normal: all
-              max_user_offline_messages:
-                2500: all
-                5000: admin
-              max_user_sessions: 10
-              s2s_shaper: fast
-          '')
-        ];
-        loglevel = "info";
-        hide_sensitive_log_data = true;
-        acme.auto = false;
-        certfiles = [
-          # butwho.org
-          "/var/ssl/butwho.org/butwho.org.crt"
-          "/var/ssl/butwho.org/butwho.org.key"
-
-          # muc.butwho.org
-          "/var/ssl/muc.butwho.org/muc.butwho.org.crt"
-          "/var/ssl/muc.butwho.org/muc.butwho.org.key"
-
-          # proxy.butwho.org
-          "/var/ssl/proxy.butwho.org/proxy.butwho.org.crt"
-          "/var/ssl/proxy.butwho.org/proxy.butwho.org.key"
-
-          # pubsub.butwho.org
-          "/var/ssl/pubsub.butwho.org/pubsub.butwho.org.crt"
-          "/var/ssl/pubsub.butwho.org/pubsub.butwho.org.key"
-
-          # upload.butwho.org
-          "/var/ssl/upload.butwho.org/upload.butwho.org.crt"
-          "/var/ssl/upload.butwho.org/upload.butwho.org.key"
-        ];
-        trusted_proxies = [ config.garden.info.network.dandelion.netbird-ip ];
-        listen = [
-          {
-            port = 5222;
-            ip = "::";
-            module = "ejabberd_c2s";
-            max_stanza_size = 262144;
-            shaper = "c2s_shaper";
-            access = "c2s";
-            starttls_required = true;
-          }
-          {
-            port = 5223;
-            ip = "::";
-            module = "ejabberd_c2s";
-            max_stanza_size = 262144;
-            shaper = "c2s_shaper";
-            access = "c2s";
-            allow_unencrypted_sasl2 = true;
-          }
-          {
-            port = 5269;
-            ip = "::";
-            module = "ejabberd_s2s_in";
-            max_stanza_size = 524288;
-            shaper = "s2s_shaper";
-          }
-          {
-            port = 5270;
-            ip = "::";
-            module = "ejabberd_s2s_in";
-            max_stanza_size = 524288;
-            shaper = "s2s_shaper";
-          }
-          {
-            port = 5280;
-            ip = "::";
-            module = "ejabberd_http";
-            request_handlers = {
-              "/admin" = "ejabberd_web_admin";
-            };
-          }
-          {
-            port = 5443;
-            ip = "::";
-            module = "ejabberd_http";
-            tls = true;
-            request_handlers = {
-              "/admin" = "ejabberd_web_admin";
-              "/api" = "mod_http_api";
-              "/bosh" = "mod_bosh";
-              "/captcha" = "ejabberd_captcha";
-              "/upload" = "mod_http_upload";
-              "/ws" = "ejabberd_http_ws";
-            };
-          }
-          {
-            port = 3478;
-            transport = "udp";
-            module = "ejabberd_stun";
-            use_turn = true;
-            turn_min_port = 49152;
-            turn_max_port = 65535;
-            turn_ipv4_address = config.garden.info.network.lily.ipv4;
-            turn_ipv6_address = config.garden.info.network.lily.ipv6;
-          }
-          {
-            port = 5349;
-            transport = "tcp";
-            module = "ejabberd_stun";
-            use_turn = true;
-            tls = true;
-            turn_min_port = 49152;
-            turn_max_port = 65535;
-            turn_ipv4_address = config.garden.info.network.lily.ipv4;
-            turn_ipv6_address = config.garden.info.network.lily.ipv6;
-          }
-          # NOTE: This (mqtt) may be more useful when I do more IoT stuff but it doesn't seem to have much use for
-          #       internet messaging at the moment
-          # {
-          #   port = 1883;
-          #   ip = "::";
-          #   module = "mod_mqtt";
-          #   backlog = 1000;
-          # }
-        ];
-        s2s_use_starttls = "optional";
-        acl = {
-          local.user_regexp = "";
-          loopback.ip = [
-            "127.0.0.0/8"
-            "::1/128"
-            "::ffff:127.0.0.1/128"
-          ];
-          admin.user = [ "[e-mail]" ];
-        };
-        access_rules = {
-          local.allow = "local";
-          c2s = {
-            deny = "blocked";
-            allow = "all";
-          };
-          announce.allow = "admin";
-          configure.allow = "admin";
-          muc_create.allow = "local";
-          mix_create.allow = "local";
-          pubsub_createnode.allow = "local";
-          trusted_network.allow = "loopback";
-        };
-        api_permissions = {
-          "console commands" = {
-            from = "ejabberd_ctl";
-            who = "all";
-            what = "*";
-          };
-          "webadmin commands" = {
-            from = "ejabberd_web_admin";
-            who = "admin";
-            what = "*";
-          };
-          "adhoc commands" = {
-            from = "mod_adhoc_api";
-            who = "admin";
-            what = "*";
-          };
-          "http access" = {
-            from = "mod_http_api";
-            who = {
-              access.allow = [
-                { acl = "lookback"; }
-                { acl = "admin"; }
-              ];
-              oauth = {
-                scope = "ejabberd:admin";
-                access.allow = [
-                  { acl = "loopback"; }
-                  { acl = "admin"; }
-                ];
-              };
-            };
-            what = [
-              "*"
-              "!stop"
-              "!start"
-            ];
-          };
-          "public commands" = {
-            who.ip = "127.0.0.1/8";
-            what = [
-              "status"
-              "connected_users_number"
-            ];
-          };
-        };
-        captcha_cmd = "${config.services.ejabberd.package}/lib/ejabberd-@VERSION@/priv/bin/captcha.sh";
-        # captcha_limit = 10;
-        auth_method = "sql";
-        auth_password_format = "scram";
-        auth_scram_hash = "sha512";
-        default_db = "sql";
-        default_ram_db = "mnesia";
-        update_sql_schema = true;
-        new_sql_schema = true;
-        sql_type = "pgsql";
-        sql_server = "unix:/run/postgresql/.s.PGSQL.5432";
-        # host_config."butwho.org" = { };
-        shaper = {
-          normal = {
-            rate = 3000;
-            burst_size = 20000;
-          };
-          fast = 100000;
-        };
-        # shaper_rules = {
-        #   max_user_sessions = 10;
-        #   max_user_offline_messages = {
-        #     "2500" = "all";
-        #     "5000" = "admin";
-        #   };
-        #   c2s_shaper = {
-        #     none = "admin";
-        #     normal = "all";
-        #   };
-        #   s2s_shaper = "fast";
-        # };
-        modules = {
-          mod_adhoc = { };
-          mod_adhoc_api = { };
-          mod_admin_extra = { };
-          mod_announce.access = "announce";
-          # mod_auth_fast = { }; # I don't think this is yet supported by any client, also I may need to setup SASL
-          mod_avatar = { };
-          # mod_block_strangers = { };
-          mod_blocking = { };
-          mod_bosh = { };
-          mod_caps = { };
-          mod_carboncopy = { };
-          mod_client_state = { };
-          mod_configure = { };
-          mod_disco = {
-            server_info = [
-              {
-                modules = "all";
-                name = "abuse-addresses";
-                urls = [
-                  "mailto:[e-mail]"
-                  "xmpp:[e-mail]"
-                ];
-              }
-              {
-                modules = [
-                  "mod_disco"
-                  "mod_vcard"
-                ];
-                name = "admin-addresses";
-                urls = [
-                  "mailto:[e-mail]"
-                  "xmpp:[e-mail]"
-                ];
-              }
-            ];
-          };
-          # The documentation for this module says that it shouldn't be used behind a reverse proxy, but the
-          # `trusted_proxies` option documentation says it can provide the real ip address to this module. I will leave
-          # this on for now but if it causes issues later I will disable it.
-          mod_fail2ban = { };
-          mod_http_api = { };
-          mod_http_upload = {
-            custom_headers = {
-              Access-Control-Allow-Origin = "https://@HOST@";
-              Access-Control-Allow-Methods = "GET,HEAD,PUT,OPTIONS";
-              Access-Control-Allow-Headers = "Content-Type";
-            };
-            docroot = "/var/lib/ejabberd/upload";
-            put_url = "https://@HOST@:5443/upload";
-            thumbnail = true;
-          };
-          # mod_http_upload_quota = { };
-          mod_last = { };
-          mod_mam = {
-            assume_mam_usage = true;
-            compress_xml = true;
-            default = "always";
-          };
-          # mod_matrix_gw = { }; # Once e2ee is implemented I may consider this
-          # mod_mix.access_create = "mix_create"; # This seems like it will replace MUC in the future
-          # mod_mix_pam = { };
-          # mod_mqtt = { };
-          # mod_mqtt_bridge = { };
-          mod_muc = {
-            access = [ "allow" ];
-            access_admin = [ { allow = "admin"; } ];
-            access_create = "muc_create";
-            access_persistent = "muc_create";
-            access_mam = [ "allow" ];
-            default_room_options = {
-              allow_subscription = true;
-              mam = true;
-              persistent = true;
-              public = false;
-            };
-            history_size = 50;
-            hosts = [ "muc.@HOST@" ];
-          };
-          mod_muc_admin = { };
-          # mod_muc_log = { };
-          mod_muc_occupantid = { };
-          mod_muc_rtbl = { };
-          # mod_multicast = { };
-          mod_offline.access_max_user_messages = "max_user_offline_messages";
-          mod_ping = { };
-          # mod_pres_counter = { };
-          mod_privacy = { };
-          mod_private = { };
-          mod_proxy65 = {
-            access = "local";
-            hostname = "proxy.@HOST@";
-            ip = "::";
-            # max_connections = 5;
-          };
-          mod_pubsub = {
-            access_createnode = "pubsub_createnode";
-            force_node_config."storage:bookmarks".access_model = "whitelist";
-            plugins = [
-              "flat"
-              "pep"
-            ];
-          };
-          mod_push = { };
-          mod_push_keepalive = { };
-          mod_register = {
-            ip_access = "trusted_network";
-            welcome_message = {
-              subject = "Welcome to the butwho XMPP server!";
-              body = ''
-                A public room is available at xmpp:[e-mail]?join
-                Have fun!
-
-                This server is managed by yemou.
-                If you need help with something you can reach me via email or xmpp.
-                mailto:[e-mail]
-                xmpp:[e-mail]
-              '';
-            };
-          };
-          # mod_register_web = { };
-          mod_roster = {
-            store_current_id = true;
-            versioning = true;
-          };
-          mod_s2s_bidi = { };
-          # NOTE: It looks like this module is only recomended for backwards compatibility. If I enable it, it should be
-          #       done for servers I've verified aren't compromised.
-          mod_s2s_dialback = { };
-          mod_scram_upgrade = {
-            offered_upgrades = [ "sha512" ];
-          };
-          # mod_service_log = { };
-          # mod_shared_roster = { };
-          # mod_shared_roster_ldap = { };
-          # TODO: Setup mod_sip
-          #       https://docs.ejabberd.im/admin/configuration/listen/#ejabberd_sip
-          #       https://docs.ejabberd.im/admin/configuration/modules/#mod_sip
-          #       NOTE: I cannot setup mod_sip since it doesn't support SCRAM passwords
-          # mod_sip = { };
-          mod_stream_mgmt.resend_on_timeout = "if_offline";
-          mod_stun_disco = {
-            services = [
-              {
-                host = config.garden.info.network.lily.ipv4;
-                port = 3478;
-                type = "stun";
-                transport = "udp";
-                restricted = false;
-              }
-              {
-                host = config.garden.info.network.lily.ipv4;
-                port = 3478;
-                type = "turn";
-                transport = "udp";
-                restricted = true;
-              }
-              {
-                host = config.garden.info.network.lily.ipv6;
-                port = 3478;
-                type = "stun";
-                transport = "udp";
-                restricted = false;
-              }
-              {
-                host = config.garden.info.network.lily.ipv6;
-                port = 3478;
-                type = "turn";
-                transport = "udp";
-                restricted = true;
-              }
-              {
-                host = config.garden.info.network.lily.ipv4;
-                port = 3478;
-                type = "stun";
-                transport = "tcp";
-                restricted = false;
-              }
-              {
-                host = config.garden.info.network.lily.ipv4;
-                port = 3478;
-                type = "turn";
-                transport = "tcp";
-                restricted = true;
-              }
-              {
-                host = config.garden.info.network.lily.ipv6;
-                port = 3478;
-                type = "stun";
-                transport = "tcp";
-                restricted = false;
-              }
-              {
-                host = config.garden.info.network.lily.ipv6;
-                port = 3478;
-                type = "turn";
-                transport = "tcp";
-                restricted = true;
-              }
-              {
-                host = "butwho.org";
-                port = 5349;
-                type = "stuns";
-                transport = "tcp";
-                restricted = false;
-              }
-              {
-                host = "butwho.org";
-                port = 5349;
-                type = "turns";
-                transport = "tcp";
-                restricted = true;
-              }
-            ];
-          };
-          mod_time = { };
-          mod_vcard = { };
-          mod_vcard_xupdate = { };
-          mod_version.show_os = false;
-        };
-      }
-    );
-    imagemagick = true;
-  };
-
-  systemd.services.ejabberd = {
-    path = with pkgs; [ inotify-tools ];
-    requires = [ "postgresql.service" ];
-  };
-}

modules/services/eturnal.nix

···
-{ config, ... }:
-{
-  imports = [ ../eturnal.nix ];
-
-  sops = {
-    secrets."eturnal/secret".sopsFile = ../../secrets/dali.yaml;
-    templates.eturnal-secret = {
-      owner = "eturnal";
-      group = "eturnal";
-      content = ''
-        ETURNAL_SECRET=${config.sops.placeholder."eturnal/secret"}
-      '';
-    };
-  };
-
-  networking.firewall.interfaces."enp1s0" = {
-    allowedTCPPorts = [
-      3478
-      5349
-    ];
-    allowedUDPPorts = [ 3478 ];
-    allowedUDPPortRanges = [
-      {
-        from = 49152;
-        to = 65535;
-      }
-    ];
-  };
-
-  services.eturnal = {
-    enable = true;
-    secret = config.sops.templates.eturnal-secret.path;
-    settings = {
-      eturnal = {
-        listen = [
-          {
-            ip = "::";
-            port = 3478;
-            transport = "udp";
-            enable_turn = true;
-          }
-          {
-            ip = "::";
-            port = 3478;
-            transport = "tcp";
-            enable_turn = true;
-          }
-          {
-            ip = "::";
-            port = 5349;
-            transport = "tls";
-            enable_turn = true;
-          }
-        ];
-        relay_ipv4_addr = config.garden.info.network.dandelion.ipv4;
-        relay_ipv6_addr = config.garden.info.network.dandelion.ipv6;
-        relay_min_port = 49152;
-        relay_max_port = 65535;
-        blacklist_peers = [ "recommended" ];
-        strict_expiry = false;
-        tls_crt_file = "/nfs/caddy-certs/butwho.org/butwho.org.crt";
-        tls_key_file = "/nfs/caddy-certs/butwho.org/butwho.org.key";
-        log_level = "info";
-        # log_rotate_size = 10485760;
-        # log_rotate_count = 10;
-        log_dir = "stdout";
-        modules = {
-          mod_log_stun = { };
-        };
-      };
-    };
-  };
-}

modules/services/libvirt.nix

···
-{ pkgs, ... }:
-{
-  hardware.graphics.enable = true;
-  users.users.mou.extraGroups = [
-    "libvirtd"
-    "kvm"
-  ];
-  environment.persistence."/data/persistent".directories = [ "/var/lib/libvirt" ];
-
-  virtualisation.libvirtd = {
-    enable = true;
-    qemu = {
-      swtpm.enable = true;
-      ovmf = {
-        enable = true;
-        packages = [
-          (pkgs.OVMF.override {
-            secureBoot = true;
-            tpmSupport = true;
-          }).fd
-        ];
-      };
-    };
-  };
-}

modules/services/openssh.nix

···
 {
   imports = [ ../openssh.nix ];
 
-  users.users = {
-    mou.openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKnyBRVRLKrlsAlMFXimvcF/mBjmSfixdzUX4yCZsYvE lutea"
-    ];
-    # TODO: Either move this somewhere into sss or just remove it completly along with sss
-    # seedling.openssh.authorizedKeys.keys = [
-    #   "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBZ1NlSJbQPkMxk+jW2Gh2DWBDGZ5mRvROqwbCrdrui seedling@dandelion"
-    #   "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDAyk3iOL/ax+EV1Ubo0SQy6kPwcjVCxwRQb9g0IKj6Z seedling@lily"
-    # ];
-  };
+  users.users.mou.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKnyBRVRLKrlsAlMFXimvcF/mBjmSfixdzUX4yCZsYvE lutea"
+  ];
 
   services.openssh.settings.AllowUsers = [
     "mou@${config.garden.info.network.lutea.netbird-ip}"

modules/services/pds.nix

···
       '';
   };
 
-  networking.firewall.interfaces.${config.services.netbird.clients.homelab.interface}.allowedTCPPorts = [ 3000 ];
-
   services.pds = {
     enable = true;
     pdsadmin.enable = true;

modules/sss-mount.nix

···
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-lib.mkIf (config.garden.info.host.sss-mount == true) {
-  environment.systemPackages = [ pkgs.rclone ];
-
-  fileSystems."/sss" = {
-    device = "sss:/data/sss";
-    fsType = "rclone";
-    depends = [ "/home/mou" ]; # Why does this depend on my home dir?
-    options = [
-      "allow_non_empty"
-      "allow_other"
-      "args2env"
-      "config=${pkgs.writeText "rclone-mnt.conf" ''
-        [sss]
-        type = sftp
-        host = ${config.garden.info.network.lily.netbird-ip}
-        port = 2222
-        user = seedling
-        key_file = /data/seedling/id_ed25519
-      ''}"
-      "dir_cache_time=1m"
-      "gid=1001"
-      "nodev"
-      "nofail"
-      "poll_interval=30s"
-      "sftp_md5sum_command=${pkgs.coreutils}/bin/md5sum"
-      "sftp_sha1sum_command=${pkgs.coreutils}/bin/sha1sum"
-      "uid=1000"
-      "vfs_cache_mode=full"
-    ];
-  };
-}

modules/sss.nix

···
-# TODO: replace this with a better solution that doesn't rely on ssh
-#   - Preferablly peer-to-peer
-{ config, ... }:
-{
-  imports = [ ./sss-mount.nix ];
-
-  services.openssh.settings.AllowUsers = [ "seedling@${config.garden.info.network.dandelion.netbird-ip}" ];
-
-  # TODO: seedling shouldn't be a "real" user
-  users = {
-    groups.seedling.gid = 1001;
-    users.seedling = {
-      isNormalUser = true;
-      uid = 1001;
-      group = "seedling";
-      extraGroups = [ "users" ];
-    };
-  };
-}

modules/syncthing.nix

···
-{ config, lib, ... }:
-{
-  options.garden.info.syncthing = lib.mkOption {
-    description = "Information about the syncthing network";
-    type =
-      with lib.types;
-      attrsOf (
-        submodule (
-          { name, ... }:
-          {
-            options = {
-              name = lib.mkOption {
-                type = str;
-                description = "Name of the device";
-              };
-              device-id = lib.mkOption {
-                type = str;
-                description = "Syncthing ID for the device";
-              };
-            };
-
-            config.name = name;
-          }
-        )
-      );
-  };
-
-  config = {
-    garden.info.syncthing = builtins.fromJSON (builtins.readFile ../hidden/syncthing.json);
-
-    environment.persistence."/data/persistent".directories = [
-      {
-        directory = "/var/lib/syncthing";
-        user = "syncthing";
-        group = "syncthing";
-        mode = "0750";
-      }
-    ];
-
-    sops.secrets = {
-      "syncthing/cert" = { };
-      "syncthing/key" = { };
-    };
-
-    networking.firewall.interfaces.${config.services.netbird.clients.homelab.interface} = {
-      allowedTCPPorts = [ 22000 ];
-      allowedUDPPorts = [ 22000 ];
-    };
-
-    services.syncthing = {
-      enable = true;
-      cert = config.sops.secrets."syncthing/cert".path;
-      key = config.sops.secrets."syncthing/key".path;
-      overrideFolders = true;
-      overrideDevices = true;
-      settings = {
-        devices = lib.mkMerge [
-          (lib.mkIf (config.networking.hostName != "dandelion") {
-            "dandelion" = {
-              id = config.garden.info.syncthing.dandelion.device-id;
-              addresses = [
-                "tcp://${config.garden.info.network.dandelion.netbird-ip}"
-                "quic://${config.garden.info.network.dandelion.netbird-ip}"
-              ];
-            };
-          })
-          (lib.mkIf (config.networking.hostName != "lily") {
-            "lily" = {
-              id = config.garden.info.syncthing.lily.device-id;
-              addresses = [
-                "tcp://${config.garden.info.network.lily.netbird-ip}"
-                "quic://${config.garden.info.network.lily.netbird-ip}"
-              ];
-            };
-          })
-        ];
-        options = {
-          urAccepted = -1;
-          relaysEnabled = false;
-          globalAnnounceEnabled = false;
-          localAnnounceEnabled = false;
-          startBrowser = false;
-          stunServer = "butwho.org:3478";
-        };
-      };
-    };
-
-    users.users.syncthing.homeMode = "750";
-  };
-}

readme.md

···
 
 | Hostname   | Machine Type |
 | ---------- | ------------ |
-| dandelion  | VPS          |
 | lily       | Home Server  |
 | lutea      | Desktop      |
 
···
 edit configuration files.
 
 # Services
-## dandelion
-This machine is mostly used to proxy into my home server.
-This gives me a stable IP with the added benefit that I don't need to open ports on my home router to expose services to
-the internet.
-
-This machine hosts:
+- [atproto-pds](https://github.com/bluesky-social/pds)
 - [Caddy](https://caddyserver.com)
-- [eturnal](https://eturnal.net)
-- [soju](https://soju.im)
-
-## lily
-This machine is where most of my services are hosted.
-
-This machine hosts:
-- [atproto-pds](https://github.com/bluesky-social/pds)
 - [ejabberd](https://www.ejabberd.im)
 - [Nextcloud](https://nextcloud.com)
+- [soju](https://soju.im)
 - [tangled-knot](https://tangled.sh/@tangled.sh/core)

secrets/dali.yaml

···
-eturnal:
-    secret: ENC[AES256_GCM,data:rC9/wYmR6N6Es5/0MdmGBIkWIxJMIJ8ULeOZ1foe8JHbRwhf7UeYzMJfSsbnS1Gg1Vq9RD5JuBO+tsQlA34I3w==,iv:MnDnY6jvzYvsgKz3vrV3bnvrAc0vJ/LFxC5hlCZgAL8=,tag:areKVtVopvpHWQVbCuAZQQ==,type:str]
-sops:
-    age:
-        - recipient: age1p5y7px4qnlgxgxd6j5vg4wtpzs24fnh4808ws7gah3x89j66muasxz7ck2
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaZVA3N3Ivc0V4Ukl5TE5I
-            NmdsRFB0Z1BicHFjWU55MFM4amZWa1l4NXpJCkVnemF0N0VSVzZXVEM4bUErQjlD
-            eXFtVXRmSnNFaVZ0NHNBZEhOSFFmMjQKLS0tIFREc2xIcmFIbWpXVG9OSzZEaGxT
-            Y2loSzVRZzc5d3M1Ti9xL1V0ekJEV2MKypKYYVVORwRuqTXF5jO+x2F2ENTJkhR+
-            UOXBeMqYM2tcXYjEGk1NvnZJBFyqEFK56TEUy/Gtn80HFO3G/pXTfQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1amaa55e7nusv904a9ucfvtnjlw4srtet42suehey6u3yc4t2xc5sdldepj
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0SmZSS1dPRitNOXp6S1lB
-            K2NvNzFWcWJ5REZOQ0tCbzFESlZwL1U3QWpVCmJBVDBwd3VBcCtjQ2JFWEdQU3Ni
-            M3NWanJHNjJ5K05oUWZBWGtqdVYvUHMKLS0tIDIxWnkwVG5MTTZrSmIrSnZTRXVT
-            VkVnMG5kZWVUZEVJRHJUU0hRcWZWV2cK22iJgZdKJlsrb8bnqbdsbBG6VP7Z4Nwv
-            MVsj271gk1wBN7PqBY8ttECAAt3fD0BqZLQ6BKxdpvy/DLEcCncfJg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-05-12T21:30:30Z"
-    mac: ENC[AES256_GCM,data:+yUDYdPP3qRis/qJSrAUL2Q6VHuhadvJ8zPkoBrXfkfAVErADXAk6htV4G0mL1CfCVN+5M6++s1HASWPr+Rx6mMxQLoJomHv1Wpr84lfwOnJUCFNreOCMzt8Q0ZwN4FURQHTz3VAAJXHoPPUmhFdw8BUXZDlB1KKJES33terHaU=,iv:xu6i90s0HweUrAp0qPBS99Eg1jqhtcxcHLWc/mp4X4s=,tag:Z3NrYk0SP1ojvZej4IszNg==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.10.2

secrets/dandelion.yaml

···
-machine-id: ENC[AES256_GCM,data:wIOxj262TN2DlMcbaa1FrjV1VUWfOol61DCwDMFAZk0=,iv:GwWgBhmzX0QiDx7i8GqccdRO3gpO0DaSQUUgoDwTEv0=,tag:0NYsxLXlGrn3gnXbVQaW1w==,type:str]
-passwordHashes:
-    root: ENC[AES256_GCM,data:Sd7brLDa9QLKBUrPMPMDDMG1rZc1jklLXjDprhK/X27ZPg/T6hDFvfc0buWoY8Rbidw9WoT3oA8Me9SQF6U70Mr1HNUHYlT2zA==,iv:1z2SgWdghTk5dp+OCWdj1h5KWMXgO8gjDKoG1FljMy8=,tag:T4nkg2jJudq8JOsf8w06zA==,type:str]
-    mou: ENC[AES256_GCM,data:xKNnwWsLSh41U7n8aGa7kkO8ylo2hcCpuZ7tptZKm132eyH5rUk1poVqqqoxQSMdiWQKrTlLAXZuQJM/lG9xr62Yfvy4mhz1sA==,iv:UL1+u/Beilym5sL5AeqVky/o7q332Hm0nDJ9CJ1lVec=,tag:LuO4dqTERugIap6oOsNokA==,type:str]
-syncthing:
-    cert: ENC[AES256_GCM,data:o7yV7nSqMKqpJ5zZ9s6CmQYgm4L8KyntdlJ2gQedmSocR3UYjkwJkQflrEORiTOJR6DJGjdyFhg37k8cfNApIK2aDyVD8pKbH6iUcFF0asg+aUlkr0X6MZh6B+NAOfz1qHpFDrE8hbn2rqMNC1+eanV85ROYVrEuWNDo1u4G1jLhRzqi4gzKNCOl0D6+3ol8sgkaZAPtRO0IBh3UUmgrGwmVGQMyavpS2tcqlJ3E6icjSWepX0UzRYUBmSermQeIZDO5W+BpU4hkmrPfWrMGeEWEumIBPxxLuWHMoossOq10NVJ6FjS5z9ud2AwXMngWZ5p9p6+f1azWqSp6cLh8rD03ZnfztJQw9/J/nEsF9O1OqDRIG1uhEOD7URrvhRl51hDbwOm6lFNonmbKFi2JUyxKLK/uVQABx7zsslcGuCU/xPgi3XFngYgYwnj9rNAfD+ImaogPmIW7XMU/NTgG/P3+9eMjR0XEzeZXMT0MVk/RT3+XWzOjTePCC7fOUCoAcN0CFT3vx/HsOLX/h4HpLLVmqz9u7qjG3/6GcNA2NRx9AOkjsLd8BcTzoTfwX/hYrQXpMyOHIjmI1Y29bWEmeecbiz+kZpnI0BsXYpCICqvPGxoMQo/T3hYDLdTDIAmtsUTgqjPbudGKeM/fxjDY8kOpmcOjf2GEBGLfe8w500vb/QYlbALXD+PpuwQgS6sPtsXdEnw7d5Sw6+9AEPPGzeTe6U2xONS6H+aTwpfWqS1RwwJCXZpc9sP5I4AQzaVUk/j6uLmyOKGwXdbt+T5G7yUD/PRnYPriDi4ruKj5jtHEEAQdhDLnUqCZGfX+3/qwB9BTyQdx13bNaYmOPrkfy9MY4mMoBVnkk1M3wFtv+XTXKMkDk2CbRPH2t7ifnkVxKYWnwWSdGR4MC+1VC7YvutMZB5/pE26BA685IVGxNjyQ/cF0x0Bw3To5ft4edS/89V3k46ty9XTnjDsPJZwrj+SJ586EzX9Pzlo9s4zCW7xjry7OxB81ZMLlI6WOivd2umZNomL2hl/ld0sFEkl2CIiQahBDA/l2HA==,iv:GGQrllOl1zM3euq+Lffq/BrEM+D/Xso2AfKBGMDSPIk=,tag:PYp0THpNq9ZQhxmrB/WNyw==,type:str]
-    key: ENC[AES256_GCM,data:PsOpgifBULla8rCdxFPzujl0YHYY8s+r/Pd7GYMZqe+Jybni9roHlVsfqGChBPBvvHhE4EDFGo+vfncjGGUjlhGGIIuJstyepoYaU7k2t480NdJ5j1lDH/ualuzD4Vvvo3gqRS9SMYxes1bKOP9a8PJ1m1zEcBCH6qn4DvI0yqsZhf53km46b/EBTZjeLrt/p0tSM6WdRP8wArDsn3Myb15bwVF4Qs4oPlS5Dm8K+dYbksphxe/Exod0b2ZRIiDuSF6bLwdM6nEBC46oF7qUsD/3XpzmmbRCGY/3UrbOzRhyuhDB4ze3baEjeNwJQVzgBsJMSE8bX7vDcWGBD3S/hqSrp3BCrnKTN38Dw+y4baaMSpIAsQx7Wy3Q2GCBorg=,iv:5OrV6odFEreWrUjczCGI4r2kUuG+FumqqiybeAeoV2c=,tag:+DXZ/0RcoqeIbew3S/MDXA==,type:str]
-sops:
-    age:
-        - recipient: age1p5y7px4qnlgxgxd6j5vg4wtpzs24fnh4808ws7gah3x89j66muasxz7ck2
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0YzlrS0wyUm5EcEFycVFQ
-            cjE5dGh1eXFtSE9kRXpldW5id1kvbWNpc0drCkRVZk14ZlJCaTlxNng5M3NPTzBl
-            Q1BjNldnM2JpdTRDTmtnWXJ1MWx5VDAKLS0tIFdzemhWeHlOVjNiWGxIRXlrRk8r
-            bFpBYWRMYi9wcXlvSkExNVEzNldMZ2MKSfrbClrpiSz4ZPlScIY3EpTyZMa9aiaY
-            6UhOvLwesOKm7TCFyKbSR+xFmro6kOCt0VpcxXtRBQ6Je0bo6HvuSA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-05-14T10:44:55Z"
-    mac: ENC[AES256_GCM,data:iUYApCuh0T3vzhn4oebX1NaGgMsQF+U7q3mSdx5/IAPLxnv2++0w1+hZ3Yv4S8ij1OyL9sAedOsEt/3kCwXf3GblxofstbTO0srhQRvRjF16URmzjGj18ts8OdDDSUWdwRktGYEqlDeGetA75KAo/S2Zewx72MJCq0mOLyIqH8A=,iv:Mn+qTHaVQDFDbrykVUmPkjPjjfTXWoTZ0IF3KOskC6g=,tag:E5bO9sIsomAPfEB3PWziKQ==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.10.2

secrets/fly-agaric.yaml

···
-passwordHashes:
-    root: ENC[AES256_GCM,data:yZ1irRkBL0HEM/fPxIA7KrG3HM4WhYeGzY4G/HFa5CejB6Z2fN3TVKrCuw347FCHMKEEIUsB7+ihStMrDYI14bQ1TuKG4x+rUA==,iv:fK9cru+Hsxlg17ipcIaCfuW6WrB4AB/Ccy+63BVD5dk=,tag:ibH08f6Tpo8DsB17WhPT1A==,type:str]
-    mou: ENC[AES256_GCM,data:pRdU6/M4W5CnvmT86tTxJs/nRg4opmD3LQ1XTCmhZWZu7ErdRzpZmHg7tjOkITFBQ8J+nzZJ92RLeIVGadb3XoH/XE2TE2Y5EQ==,iv:iZIkcRKrly9SDbX2yXXt6bMdd4oIgUo79jANYPXUKGg=,tag:BKBcBJU58KcfWK9AIWNDPA==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1tmfn7f2j8rhlg0gz3hcfjrwta3f0ecctc4dhpp6y8thtgta97c7q2vxnyl
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZTEJnbTFZTForU0djK2dt
-            U0tUMVgvY1FEME5TUWtuNFRUZExwaHQ0SWdVCnBCRUpxT2tRTzYyVFRmT0h4dXpP
-            OEQ5TVlHdjIyM2QyMlA2SmE1QS9XZzgKLS0tIExwSXNIaUZEYnZvdXRnZzR5S2pu
-            WE5FS3JGM3I4MWM3anNqUUYxRlFtdW8KH7OgurKrAmCgWpzsC+WPGSQ/hJ2kbEp9
-            ZVqxDtQk6jk07T7jy0anoOKvXM1dE1dJ5/rUKemPOyO5khCZN/f39g==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-06-16T03:12:40Z"
-    mac: ENC[AES256_GCM,data:e5R7iBd+GZKt+UmdEHLK/BLJjJwRXGMTvgbU5p2Vl08mB/aq/s/4BmoiSWL1NPoNUDmtmU7l+8P3XnvwgYrOexSGi1XXaRVFZ34/F1NQU9YIaBeRMTpjfTQudibdkyrDH9lLq6vz4nGX9ckbHC8GXyBbHAB5K8SGkVOJbcpigy0=,iv:kJ0Qrgok7EI/CEYuS4awbWC6LcwyIIjGmyC9/5iJMO4=,tag:qqBxaBJIALhCF6jrC2kueg==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.8.1

secrets/lily.yaml

···
     plcRotationKeyK256PrivateKeyHex: ENC[AES256_GCM,data:2tpAI5RGc2fz09KoOeMr9OVheo34zhttaiYwhQHVPKvRz9p/PLtSxnkSHdiKyeqPT046kgq0+GJphxATRDweGA==,iv:ETfC1h10k2QS9tCO2t0874UNw57kJIwECJp8AH0bWWI=,tag:Chd1nRVE75jakFL2Uw/frA==,type:str]
 tangled-knot:
     secret: ENC[AES256_GCM,data:nFvN+4cXheWJwczJEQGBFpk92qjG8HaYrA2hN2w1VIV8rMiUCqypfTIJ904FE7Hq7AyewvcYYIBKMel+hpx2hA==,iv:jQ9JI+Jc57W+me6Q/ZLLmsif0Dovz/WQuUsXmJ6G4pk=,tag:54xtX8T9XzNCx4w7HzSrhg==,type:str]
-syncthing:
-    cert: ENC[AES256_GCM,data:Ipu/5wCYgC/6uKVVGy+MudPJjG2mmoxnfkOEFzEAzqfK67w4se6dfGzd0CQ4fWvornKEX5lUb/O484tKyyq1Go/Z10HiZdbyyxYJGR3H16HietiK+X5RB3Asj9v6YcvTBoV9bTmaIzaWJKDOTgflapRDwnIy48fIVTSBeKCbugiiByY4cO2f30ygyoHky5BVVrYJF+fzAGwpzDgzO16rrdNfMVNxtpLWRa9l5SmmiIWUsEjs/exNu/QZm7O35ynBU2EAtUaP3zL6DocBsWNqLwzQo1Ym3g470P3nBTVHrMNoioblo9rliFiB6UtUyofIPdr9K0qIZJgfna/oufLJqR3OLTFx1OOOx20YlJJDHZbW2XaMS2ikQSOsH9R7vAxvuf1m/mJZ0261+exV+ArEIr12AeW+3eQG8CzSy8e4bzGClOpI9GttZzUiK4ZS/jrgRj6i+Qnj2XFn7gIs9ruzMVdSmI4UVkr44cH65/y6aS6q4h0pDXQGakgwCBmRZH9p7PVkR43x5mmedxfJPVQZs1idgv6RDry3r9iXWx7rkhFa1XuOYPhNL6LKrgCu3E6YhrdoPlZnMolY3LBys5u12mvMbwyaqA9de/Jb5e+LxDfglIp9iEGuh53WBSCEVZRXta1sqbPvlJgYZQY0oJTpJOfcFj4E43nwfG8JD9SLrKK/QH5Ji/vyc1UVYZGQRBnd0h0p5LfnEMXr2Vu87UjfDBAqS9MpfgW8r1CgErOCU9GlygxXv81pgbO4RVdq4SNFpjIOby4bg4bwSYF4EPTsTEc90zDygzqZTiNYTHRhqcQrp1NmjzqluPRmKykGELFZwAOuHT0rNwlNTsFY5myB9I7QP2fQkyiecTWZApKauR8GTEWi7/5tQH9F0sMDaPMq3Wf5up+K0UGaurPB8exXNiOXe21hej0yd8WJsytVN8lT6Ff0xhra1zcTVe3Iitgxht10rcsZbxfLJm+CKiUTDGTt9U9867FcBHawj0bPp55iP4Q5gxcP0eDuOs9Gq4ZT9xZvfVa656ipYw7Ze6XG7l/vAqVpSGX7ig==,iv:jiT/ElmxZzjLNN1wmb8503Gue37Ki/icIjnGdvI/Z9w=,tag:EzHFlozw937NLIGxX1e2Ng==,type:str]
-    key: ENC[AES256_GCM,data:6pn7Mo65P3D29l0KPtngIZ17xNkpXO4UpdMdx0EFBX3AipfYYJ5Em2dUCrGEc3Ggm1WMCh96mmEJMiZU3Cvoyj31vKovx4CHQDsDR4whgbWBRm5ThMP4u6+XHtrak+coZreNS4uOLWvslbt4LOVQ2fkJddVRt3/Jb3p7gzvVHh6x/2lUcEGOqEc4ighAuqN6SXQrdP1uugTd+Fco/MuLYY/XQHCOT7TXCeHg6jSncOub2FiPWzh7oV+tB6LbWs5EK4vMa3yDg9I6xEnVBaNWn4jnKDNhX3FygBKc7C8GRzCzozWj21+ceJixY7EFIW+iElC9D63KnzK9mpoyBBUcKIJpSBEmOAM7sB9qINtm4C9TR6tUh9xWgdU+q0YkCkE=,iv:Mg6UwacV9NBCobk75lcklL7XBDHyL90Bh9wJiqsvdME=,tag:r4KubPJNqdJ93Hg+R4Ib1Q==,type:str]
 sops:
     age:
         - recipient: age1amaa55e7nusv904a9ucfvtnjlw4srtet42suehey6u3yc4t2xc5sdldepj
···
             cHlWQjF3ZkU5NUs0Y1hodUlabkxpdzAK91EV34EhJMrxxdVrRCwZlGKuRs7AU7v3
             dU8XRhjAzJs2Vu5UnCVOGB5Zl6w7FkXICYY0IP2dA0b477dI5rXNBg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-05-15T08:35:06Z"
-    mac: ENC[AES256_GCM,data:WKQjyG6H7dA/OpY7UesET2mlWyBhZr0jLJ72SL4N2p/5QM0YiJQgybgzqwE1cc5368KMrJilAci4YkYdIZLcGun0M8ku0ataWZBfzbFkO88XbDfM8O+wehNpYUwSfWzySJV/3QharBIEJvDh1Ov86RTu0/mffS/VaaXWCo8kMF4=,iv:QHYwkEM+LEkBUJ+pXqY0PgmzJKDpEvHImgTH7Poqzzc=,tag:oR508w0XSq79n/pjlS++7A==,type:str]
+    lastmodified: "2025-08-04T19:37:42Z"
+    mac: ENC[AES256_GCM,data:fa975Ma/nOLbw5VRiTFlHikz6xsWJWCzRmd7MbySrOUIzoE59BokUQuiiA4Rg803nN2rB3wL8EP7lBZgoDSKfiYmkOm71Fi60n+qAsUW6Ryt8RqGqYYyKNPwrQlHfGAlh2Ag92kGa+X9noZgVquQdsGxQahxe3Q5nKPiIgr+ZTk=,iv:zaEuNYyNcmlfDsM6Qns+yoUGWiCj1Ji75SRE1fclvJ8=,tag:u+OyJrzswB/NjY16UILKQQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.10.2