Set up PiGallery2

Flake lock file updates:

• Updated input 'determinate':
    'https://api.flakehub.com/f/pinned/DeterminateSystems/determinate/3.13.2/019a9b01-c0c6-7e1c-959e-98ac5b7675de/source.tar.gz' (2025-11-19)
  → 'https://api.flakehub.com/f/pinned/DeterminateSystems/determinate/3.15.0/019b3865-57a1-7d80-98c5-962fac29c404/source.tar.gz' (2025-12-19)
• Updated input 'determinate/determinate-nixd-aarch64-darwin':
    'https://install.determinate.systems/determinate-nixd/tag/v3.13.2/macOS'
  → 'https://install.determinate.systems/determinate-nixd/tag/v3.15.0/macOS'
• Updated input 'determinate/determinate-nixd-aarch64-linux':
    'https://install.determinate.systems/determinate-nixd/tag/v3.13.2/aarch64-linux'
  → 'https://install.determinate.systems/determinate-nixd/tag/v3.15.0/aarch64-linux'
• Updated input 'determinate/determinate-nixd-x86_64-linux':
    'https://install.determinate.systems/determinate-nixd/tag/v3.13.2/x86_64-linux'
  → 'https://install.determinate.systems/determinate-nixd/tag/v3.15.0/x86_64-linux'
• Updated input 'determinate/nix':
    'https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.13.2/019a9af6-3d7b-71bc-bccd-8b18e147ad77/source.tar.gz' (2025-11-19)
  → 'https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.15.0/019b3854-cca6-7298-a91c-0fd8551a7270/source.tar.gz' (2025-12-19)
• Updated input 'determinate/nixpkgs':
    'https://api.flakehub.com/f/pinned/DeterminateSystems/nixpkgs-weekly/0.1.897465%2Brev-8b6600824693a9c706ef09bd86711ca393703466/019a9577-b407-75dd-b18b-3308def1c215/source.tar.gz' (2025-11-17)
  → 'https://api.flakehub.com/f/pinned/DeterminateSystems/nixpkgs-weekly/0.1.911985%2Brev-09b8fda8959d761445f12b55f380d90375a1d6bb/019b25ab-7c11-79e0-a0b0-c94d455b7190/source.tar.gz' (2025-12-15)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/c97c47f' (2025-12-04)
  → 'github:NixOS/nixpkgs/b3aad46' (2025-12-20)

.gitignore

@@ -1,2 +0,0 @@
-secrets
-Timeline.org

LICENSE.md

@@ -0,0 +1,673 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type YYshow c' for details.
+
+The hypothetical commands Yshow c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<http://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<http://www.gnu.org/philosophy/why-not-lgpl.html>.
+

Makefile

@@ -0,0 +1,7 @@
+DIR=$(HOME)/Projects/zion
+
+switch:
+	nixos-rebuild switch --no-reexec --target-host root@zion \
+	--build-host root@zion --flake path://$(DIR)#zion
+
+.DEFAULT_GOAL := switch

README.org

@@ -0,0 +1,53 @@
+* NixOS Server
+
+ Configuration files for my personal server, powered by [[https://nixos.org/][NixOS]].
+
+** Modules
+
+ The configuration is sliced into different files, per category:
+
+ - ZFS pool configuration: hardware-configuration.nix
+ - Network configuration: networking.nix
+ - Synchronization and backup services: datasync.nix
+ - Web services and reverse proxy: webstack.nix
+ - Development tools: devops.nix
+ - Smartd: monitoring.nix
+ - Systemd services and timers: periodic.nix
+ - Curated articles: information.nix
+
+ All the modules are imported in *configuration.nix*
+
+** Installation
+
+1. Download the sdcard image
+2. Use initial config file
+
+#+begin_src shell
+cp install.nix configuration.nix
+#+end_src
+
+3. Move the repo to the server and the agenix key
+
+#+begin_src shell
+scp -r Projects/zion zion:/home/nixos/system
+scp .ssh/zion root@zion:/etc/ssh/id_ed25519
+#+end_src
+
+4. Mount the firmware partition
+
+#+begin_src shell
+mount /dev/mmcblk1p1 /boot
+#+end_src
+
+5. Rebuild the system using Flakes
+
+#+begin_src shell
+nix-shell -p git
+sudo nixos-rebuild switch --flake /home/nixos/system#zion
+#+end_src
+
+6. Restore the SQL databases
+
+#+begin_src shell
+gunzip -c /vault/backups/zion/databases/all.sql.gz | psql -U postgres
+#+end_src

configuration.nix

@@ -1,108 +1,283 @@
-{ config, pkgs, lib, ... }:
 {
-  # NixOS wants to enable GRUB by default
+  config,
-  boot.loader.grub.enable = false;
+  inputs,
-  # Enables the generation of /boot/extlinux/extlinux.conf
+  pkgs,
-  boot.loader.generic-extlinux-compatible.enable = true;
+  lib,
+  ...
+}:
 
-  # A bunch of boot parameters needed for optimal runtime on RPi 3B
+with pkgs;
-  boot.kernelParams = ["cma=32M"];
+
-  boot.loader.raspberryPi = {
+{
-    enable = true;
+  # Kernel configuration
-    version = 3;
+  boot = {
-    uboot.enable = true;
+    blacklistedKernelModules = [
-    firmwareConfig = ''
+      "btusb"
-        hdmi_force_hotplug=1
+      "bluetooth"
-      '';
+    ];
+    kernelParams = [
+      "zfs.zfs_arc_max=8589934592"
+      "zfs.zfs_arc_min=1073741824"
+    ];
+    supportedFilesystems = [ "zfs" ];
+    zfs = {
+      requestEncryptionCredentials = false;
+      extraPools = [ "vault" ];
+    };
   };
 
-  environment.systemPackages = with pkgs; [
+  # Secure boot using lanzaboote
-    raspberrypi-tools
+  boot.loader = {
-    git
+    efi.canTouchEfiVariables = true;
-    tmux
+    systemd-boot = {
-    htop
+      enable = true;
-    vim
+      configurationLimit = 50;
-  ];
+      editor = false;
+    };
+    timeout = 3;
+  };
 
-  # !!! Adding a swap file is optional, but strongly recommended!
+  # Declare system packages
-  swapDevices = [ { device = "/swapfile"; size = 1024; } ];
+  environment.systemPackages = [
+    libraspberrypi
+    htop
+    neovim
+    git
+    inputs.agenix.packages.${config.nixpkgs.localSystem.system}.default
+  ];
 
   # Configure basic SSH access
   services.openssh = {
     enable = true;
-    permitRootLogin = "yes";
+    settings = {
+      PermitRootLogin = "yes";
+      PasswordAuthentication = false;
+    };
   };
 
   # Cleanup tmp on startup
-  boot.cleanTmpDir = true;
+  boot.tmp.cleanOnBoot = true;
-
-  # Set hostname
-  networking.hostName = "zion";
 
   # Create coolneng user
   users.users.coolneng = {
     isNormalUser = true;
     home = "/home/coolneng";
-    extraGroups = [ "wheel" "lp" "scanner" ];
+    extraGroups = [
-    openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDG7JtfAqcbZV28wkNTfSWSqTOo5buH+dyT0w6SlTqq+KFh5DxREB0yGuM1UfjLpyLQ0XI7UbhCwNG28Li4yv/hwPGq63TF1kl+w4sjQKFn4bOUv1NvsfSN3oTamjfYoVsrapCiXqOvZkzEKMF47MSwOfPkqZ6ihU5V3INA0IZbl1Ri+r9MsIzvY76ZHBiF6rVqQJjdXVDbcLMViOrM56FpyK+ICo+uTkErsEbYFwevVTv9memOh778RRPesBobpZjggWOI4HXXxqk35myInYjHve9K4ox6YZMjwnwnEftONr2HyoBBcBNT+wWd1jtYxCoCWQ3vVkn4LGBDOQ3+HKb4rT3JxI66VfFyQWGJPdgJL5/ZNRlBqA7CpAtE7JaR6l7d3mCCoGW2B0atWiEXecwb8dz4CzzYm1r9Wz27L74OtPzUqcV7mQjCVDcnRsY/MtfhzyWzhB3tujVqnRtF3VrFSrm0YXS1ZWG4dltX1cfgud8s8XwwBKcFw5NdCrVxq3nRMNlGcSqbXC+RnrkK/i6ciAriZdXgFrmnBl+6qEmqIO15u2IPvDhnQs18DzRkHnPQegphhHhHix5aaqNbLfSRZNCTQaqE774X+0kuU/RWylI4muIyf4k9x+et4txeU2OC6l0W0LMpbsELzXIRr/ZBFrGHbE7/KLi8HNiAJ0KmAQ== coolneng@monolith" ];
+      "wheel"
-    shell = "/run/current-system/sw/bin/fish";
+      "docker"
+    ];
+    openssh.authorizedKeys.keys = [
+      # panacea
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFRqINHR7/zc+c3/PuR+NeSsBHXXzBiEtFWSK6QaxQTW coolneng@panacea"
+      # caravanserai
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIX0poiPhFLFh88fhpLFX7n1oCevVRyTxe9ZvGmjPq8n zion"
+    ];
+    shell = "${fish}/bin/fish";
   };
 
-  # Set vim as default editor
+  # Set neovim as default editor
-  programs.vim.defaultEditor = true;
+  programs.neovim = {
+    enable = true;
+    defaultEditor = true;
+  };
 
   # Set timezone and synchronize NTP
   time.timeZone = "Europe/Brussels";
   services.timesyncd.enable = true;
 
-  # Enable zfs support
-  networking.hostId = "bb26c304";
-  boot.supportedFilesystems = [ "zfs" ];
-  boot.zfs.extraPools = [ "vault" ];
-
   # Scrub zpool monthly
   services.zfs.autoScrub = {
     enable = true;
     interval = "monthly";
   };
 
-  # Auto-upgrade the system and reboot if needed
+  # Run Nix garbage collector, while avoiding recompilation and enable flakes
-  system.autoUpgrade = {
+  nix = {
-    enable = true;
+    settings = {
-    allowReboot = true;
+      auto-optimise-store = true;
-  };
+      trusted-users = [
-
+        "root"
-  # Enable zeroconf
+        "coolneng"
-  services.avahi = {
+      ];
-    enable = true;
+      lazy-trees = true;
-    nssmdns = true;
+      eval-cores = 2;
-    publish = {
-      enable = true;
-      userServices = true;
     };
+    gc = {
+      automatic = true;
+      options = "--delete-older-than 14d";
+      dates = "Mon 03:00";
+    };
+    extraOptions = ''
+      keep-outputs = true
+      keep-derivations = true
+      gc-keep-outputs = true
+      experimental-features = nix-command flakes
+    '';
   };
 
-  # Run Nix garbage collector daily
+  # Use same version of nixpkgs for nix-shell
-  nix.gc = {
+  nix.nixPath =
-    automatic = true;
+    let
-    dates = "03:15";
+      path = toString ./.;
-  };
+    in
+    [
+      "nixpkgs=${inputs.nixpkgs}"
+      "nixos-config=${path}/configuration.nix"
+    ];
 
   # Configure fish shell
   programs.fish.enable = true;
-  users.users.root.shell = "/run/current-system/sw/bin/fish";
+  users.users.root = {
+    shell = "${fish}/bin/fish";
+    openssh.authorizedKeys.keys = config.users.users.coolneng.openssh.authorizedKeys.keys;
+  };
 
-  # Start a tmux session
+  # Keep logs for a month
-  #programs.tmux.enable = true;
+  services.journald.extraConfig = "MaxRetentionSec=4week";
+
+  # Increase inotify limits and maximum buffer size
+  boot.kernel.sysctl = {
+    "fs.inotify.max_user_watches" = 204800;
+    "net.core.rmem_max" = 2500000;
+    "net.core.wmem_max" = 2500000;
+  };
+
+  # MOTD message
+  programs.fish.interactiveShellInit = "${./scripts/motd.sh}";
+
+  # NixOS version
+  system.stateVersion = "24.11";
+
+  # Specify secrets
+  age = {
+    secrets.wireguard = {
+      file = secrets/wireguard.age;
+      owner = "systemd-network";
+      group = "systemd-network";
+    };
+    secrets.syncthing.file = secrets/syncthing.age;
+    secrets.msmtp.file = secrets/msmtp.age;
+    secrets.gitea = {
+      file = secrets/gitea.age;
+      owner = "gitea";
+      group = "gitea";
+    };
+    secrets.miniflux = {
+      file = secrets/miniflux.age;
+      owner = "miniflux";
+      group = "miniflux";
+    };
+    secrets.git = {
+      file = secrets/git.age;
+      owner = "coolneng";
+      group = "users";
+    };
+    # HACK The owner and group is set by systemd due to the use of DynamicUser
+    secrets.dendrite = {
+      file = secrets/dendrite.age;
+      owner = "63026";
+      group = "63026";
+    };
+    secrets.dendrite-postgres = {
+      file = secrets/dendrite-postgres.age;
+      owner = "63026";
+      group = "63026";
+    };
+    secrets.telegram = {
+      file = secrets/telegram.age;
+    };
+    secrets.mqtt-sender = {
+      file = secrets/mqtt-sender.age;
+      owner = "mosquitto";
+      group = "mosquitto";
+    };
+    secrets.mqtt-receiver = {
+      file = secrets/mqtt-receiver.age;
+      owner = "mosquitto";
+      group = "mosquitto";
+    };
+    secrets.facebook = {
+      file = secrets/facebook.age;
+    };
+    secrets.signal = {
+      file = secrets/signal.age;
+    };
+    secrets.inadyn-duckdns = {
+      file = secrets/inadyn-duckdns.age;
+      owner = "inadyn";
+      group = "inadyn";
+    };
+    secrets.inadyn-porkbun = {
+      file = secrets/inadyn-porkbun.age;
+      owner = "inadyn";
+      group = "inadyn";
+    };
+    secrets.inadyn-porkbun-secret = {
+      file = secrets/inadyn-porkbun-secret.age;
+      owner = "inadyn";
+      group = "inadyn";
+    };
+    secrets.acme-duckdns = {
+      file = secrets/acme-duckdns.age;
+      owner = "acme";
+      group = "nginx";
+    };
+    secrets.acme-porkbun = {
+      file = secrets/acme-porkbun.age;
+      owner = "acme";
+      group = "nginx";
+    };
+    secrets.microbin = {
+      file = secrets/microbin.age;
+      owner = "63026";
+      group = "63026";
+    };
+    secrets.readeck = {
+      file = secrets/readeck.age;
+      owner = "63026";
+      group = "63026";
+    };
+    identityPaths = [ "/etc/ssh/id_ed25519" ];
+  };
+
+  # Auto-upgrade the system
+  system.autoUpgrade = {
+    enable = true;
+    allowReboot = true;
+    flake = "/home/coolneng/system";
+    flags = [
+      "--update-input"
+      "nixpkgs"
+      "--commit-lock-file"
+    ];
+  };
+
+  # Configure git for auto-upgrade
+  programs.git = {
+    enable = true;
+    config = {
+      user.name = "coolneng";
+      user.email = "akasroua@gmail.com";
+      safe.directory = "/home/coolneng/system";
+      credential.helper = "store --file ${config.age.secrets.git.path}";
+    };
+  };
+
+  # Disable man pages
+  documentation.man.enable = false;
 
   # Import other configuration modules
   imports = [
-    ./modules/printing.nix
+    ./modules/hardware-configuration.nix
     ./modules/networking.nix
     ./modules/datasync.nix
-    ./modules/hardware-configuration.nix
     ./modules/webstack.nix
     ./modules/devops.nix
+    ./modules/monitoring.nix
+    ./modules/periodic.nix
+    ./modules/communication.nix
+    ./modules/information.nix
+    ./modules/containers.nix
   ];
 
 }

flake.lock

@@ -0,0 +1,398 @@
+{
+  "nodes": {
+    "agenix": {
+      "inputs": {
+        "darwin": "darwin",
+        "home-manager": "home-manager",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1762618334,
+        "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "fcdea223397448d35d9b31f798479227e80183f6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
+    "darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1744478979,
+        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnl7",
+        "ref": "master",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
+    "determinate": {
+      "inputs": {
+        "determinate-nixd-aarch64-darwin": "determinate-nixd-aarch64-darwin",
+        "determinate-nixd-aarch64-linux": "determinate-nixd-aarch64-linux",
+        "determinate-nixd-x86_64-linux": "determinate-nixd-x86_64-linux",
+        "nix": "nix",
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "lastModified": 1766177528,
+        "narHash": "sha256-Bl+p766mM7qNCZtMqmTz13RuUbOMKsFa+/vnGYoxgPk=",
+        "rev": "b159c082f0f9bdefa6c386189a13c5fa0734d8d8",
+        "revCount": 317,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/determinate/3.15.0/019b3865-57a1-7d80-98c5-962fac29c404/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/DeterminateSystems/determinate/%2A"
+      }
+    },
+    "determinate-nixd-aarch64-darwin": {
+      "flake": false,
+      "locked": {
+        "narHash": "sha256-vDaEQ5T4eA7kEPREmm68IVWGR6zT0aDL5slZxA6dkSc=",
+        "type": "file",
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.15.0/macOS"
+      },
+      "original": {
+        "type": "file",
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.15.0/macOS"
+      }
+    },
+    "determinate-nixd-aarch64-linux": {
+      "flake": false,
+      "locked": {
+        "narHash": "sha256-Hf4JsIv5G3IR0Q0RHGLSNdmDzFv97sVQQKwzY6A0vV4=",
+        "type": "file",
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.15.0/aarch64-linux"
+      },
+      "original": {
+        "type": "file",
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.15.0/aarch64-linux"
+      }
+    },
+    "determinate-nixd-x86_64-linux": {
+      "flake": false,
+      "locked": {
+        "narHash": "sha256-J+J4E02XpEl0ZkpzMbUmGCf6S4yk0gYCYmiGzZ058ik=",
+        "type": "file",
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.15.0/x86_64-linux"
+      },
+      "original": {
+        "type": "file",
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.15.0/x86_64-linux"
+      }
+    },
+    "devshell": {
+      "locked": {
+        "lastModified": 1642188268,
+        "narHash": "sha256-DNz4xScpXIn7rSDohdayBpPR9H9OWCMDOgTYegX081k=",
+        "owner": "numtide",
+        "repo": "devshell",
+        "rev": "696acc29668b644df1740b69e1601119bf6da83b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "devshell",
+        "type": "github"
+      }
+    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1641205782,
+        "narHash": "sha256-4jY7RCWUoZ9cKD8co0/4tFARpWB+57+r1bLLvXNJliY=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "b7547d3eed6f32d06102ead8991ec52ab0a4f1a7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "determinate",
+          "nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1748821116,
+        "narHash": "sha256-F82+gS044J1APL0n4hH50GYdPRv/5JWm34oCJYmVKdE=",
+        "rev": "49f0870db23e8c1ca0b5259734a02cd9e1e371a1",
+        "revCount": 377,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/hercules-ci/flake-parts/0.1.377%2Brev-49f0870db23e8c1ca0b5259734a02cd9e1e371a1/01972f28-554a-73f8-91f4-d488cc502f08/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/hercules-ci/flake-parts/0.1"
+      }
+    },
+    "git-hooks-nix": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "gitignore": [
+          "determinate",
+          "nix"
+        ],
+        "nixpkgs": [
+          "determinate",
+          "nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1747372754,
+        "narHash": "sha256-2Y53NGIX2vxfie1rOW0Qb86vjRZ7ngizoo+bnXU9D9k=",
+        "rev": "80479b6ec16fefd9c1db3ea13aeb038c60530f46",
+        "revCount": 1026,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/cachix/git-hooks.nix/0.1.1026%2Brev-80479b6ec16fefd9c1db3ea13aeb038c60530f46/0196d79a-1b35-7b8e-a021-c894fb62163d/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/cachix/git-hooks.nix/0.1.941"
+      }
+    },
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1745494811,
+        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "nix": {
+      "inputs": {
+        "flake-parts": "flake-parts",
+        "git-hooks-nix": "git-hooks-nix",
+        "nixpkgs": "nixpkgs",
+        "nixpkgs-23-11": "nixpkgs-23-11",
+        "nixpkgs-regression": "nixpkgs-regression"
+      },
+      "locked": {
+        "lastModified": 1766174426,
+        "narHash": "sha256-0ZofAQZNgg5nfIKsVb7g4It6ufmIyLtfFRPOf+6WRkk=",
+        "rev": "15d6091194b5b90d292e8d6283db77f09c303b1e",
+        "revCount": 24285,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.15.0/019b3854-cca6-7298-a91c-0fd8551a7270/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/DeterminateSystems/nix-src/%2A"
+      }
+    },
+    "nix-matrix-appservices": {
+      "inputs": {
+        "devshell": "devshell",
+        "flake-compat": "flake-compat_2",
+        "nixlib": "nixlib",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1683490239,
+        "narHash": "sha256-QKzpvl2XrqbobWq/I/smDa9hEniwctjJybXPVILHP0w=",
+        "owner": "coffeetables",
+        "repo": "nix-matrix-appservices",
+        "rev": "e795d2fbc61da45d49802bb3e8f8d0c70ddc1e68",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "coffeetables",
+        "repo": "nix-matrix-appservices",
+        "type": "gitlab"
+      }
+    },
+    "nixlib": {
+      "locked": {
+        "lastModified": 1643502816,
+        "narHash": "sha256-Wrbt6Gs+hjXD3HUICPBJHKnHEUqiyx8rzHCgvqC1Bok=",
+        "owner": "divnix",
+        "repo": "nixpkgs.lib",
+        "rev": "ebed7ec5bcb5d01e298535989c6c321df18b631a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "divnix",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixos-hardware": {
+      "locked": {
+        "lastModified": 1764440730,
+        "narHash": "sha256-ZlJTNLUKQRANlLDomuRWLBCH5792x+6XUJ4YdFRjtO4=",
+        "owner": "NixOS",
+        "repo": "nixos-hardware",
+        "rev": "9154f4569b6cdfd3c595851a6ba51bfaa472d9f3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "master",
+        "repo": "nixos-hardware",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1761597516,
+        "narHash": "sha256-wxX7u6D2rpkJLWkZ2E932SIvDJW8+ON/0Yy8+a5vsDU=",
+        "rev": "daf6dc47aa4b44791372d6139ab7b25269184d55",
+        "revCount": 811874,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2505.811874%2Brev-daf6dc47aa4b44791372d6139ab7b25269184d55/019a3494-3498-707e-9086-1fb81badc7fe/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/NixOS/nixpkgs/0.2505"
+      }
+    },
+    "nixpkgs-23-11": {
+      "locked": {
+        "lastModified": 1717159533,
+        "narHash": "sha256-oamiKNfr2MS6yH64rUn99mIZjc45nGJlj9eGth/3Xuw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a62e6edd6d5e1fa0329b8653c801147986f8d446",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a62e6edd6d5e1fa0329b8653c801147986f8d446",
+        "type": "github"
+      }
+    },
+    "nixpkgs-regression": {
+      "locked": {
+        "lastModified": 1643052045,
+        "narHash": "sha256-uGJ0VXIhWKGXxkeNnq4TvV3CIOkUJ3PAoLZ3HMzNVMw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1765772535,
+        "narHash": "sha256-aq+dQoaPONOSjtFIBnAXseDm9TUhIbe215TPmkfMYww=",
+        "rev": "09b8fda8959d761445f12b55f380d90375a1d6bb",
+        "revCount": 911985,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nixpkgs-weekly/0.1.911985%2Brev-09b8fda8959d761445f12b55f380d90375a1d6bb/019b25ab-7c11-79e0-a0b0-c94d455b7190/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/DeterminateSystems/nixpkgs-weekly/0.1"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1766201043,
+        "narHash": "sha256-eplAP+rorKKd0gNjV3rA6+0WMzb1X1i16F5m5pASnjA=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b3aad468604d3e488d627c0b43984eb60e75e782",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-25.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "agenix": "agenix",
+        "determinate": "determinate",
+        "nix-matrix-appservices": "nix-matrix-appservices",
+        "nixos-hardware": "nixos-hardware",
+        "nixpkgs": "nixpkgs_3"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,50 @@
+{
+  description = "System configuration for zion";
+
+  nixConfig = {
+    extra-substituters = "https://install.determinate.systems";
+    extra-trusted-public-keys = ''
+      cache.flakehub.com-3:hJuILl5sVK4iKm86JzgdXW12Y2Hwd5G07qKtHTOcDCM=
+    '';
+  };
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+    determinate.url = "https://flakehub.com/f/DeterminateSystems/determinate/*";
+    agenix = {
+      url = "github:ryantm/agenix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    nixos-hardware.url = "github:NixOS/nixos-hardware/master";
+    nix-matrix-appservices = {
+      url = "gitlab:coffeetables/nix-matrix-appservices";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs =
+    { self, nixpkgs, ... }@inputs:
+    let
+      system = "x86_64-linux";
+
+      pkgs = import pkgs { inherit system; };
+
+      lib = nixpkgs.lib;
+
+    in
+    {
+      nixosConfigurations.zion = lib.nixosSystem {
+        inherit system;
+        modules = [
+          (import ./configuration.nix)
+          inputs.agenix.nixosModules.age
+          inputs.nixos-hardware.nixosModules.aoostar-r1-n100
+          inputs.determinate.nixosModules.default
+        ];
+        specialArgs = {
+          inherit inputs;
+        };
+      };
+
+    };
+}

modules/communication.nix

@@ -0,0 +1,103 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+with pkgs;
+
+# NOTE Reference the environment variable set in the corresponding agenix secret
+let
+  database = {
+    connection_string = "$DB_STRING";
+    max_open_conns = 100;
+    max_idle_conns = 5;
+    conn_max_lifetime = -1;
+  };
+
+in
+{
+  # Matrix server configuration
+  services.dendrite = {
+    enable = true;
+    httpPort = 8008;
+    environmentFile = config.age.secrets.dendrite-postgres.path;
+    loadCredential = [ "private_key:${config.age.secrets.dendrite.path}" ];
+    settings = {
+      global = {
+        server_name = "coolneng.duckdns.org";
+        private_key = config.age.secrets.dendrite.path;
+        inherit database;
+        dns_cache.enabled = true;
+      };
+      # HACK Inherit postgres connection string for the rest of the DBs
+      app_service_api = {
+        inherit database;
+      };
+      media_api = {
+        inherit database;
+      };
+      room_server = {
+        inherit database;
+      };
+      push_server = {
+        inherit database;
+      };
+      mscs = {
+        inherit database;
+        mscs = [
+          "msc2836"
+          "msc2946"
+        ];
+      };
+      sync_api = {
+        inherit database;
+      };
+      key_server = {
+        inherit database;
+      };
+      federation_api = {
+        inherit database;
+      };
+      user_api = {
+        account_database = database;
+        device_database = database;
+      };
+    };
+  };
+
+  # Start dendrite after config files are mounted
+  systemd.services.dendrite.unitConfig.RequiresMountsFor = [
+    /var/lib/matrix-as-facebook
+    /var/lib/matrix-as-signal
+    /var/lib/matrix-as-telegram
+  ];
+
+  # MQTT configuration
+  services.mosquitto = {
+    enable = true;
+    dataDir = "/vault/mosquitto";
+    logType = [
+      "websockets"
+      "error"
+      "warning"
+      "notice"
+      "information"
+    ];
+    logDest = [ "syslog" ];
+    listeners = [
+      {
+        users.homeostasis = {
+          acl = [ "write #" ];
+          hashedPasswordFile = config.age.secrets.mqtt-sender.path;
+        };
+        users.prometheus = {
+          acl = [ "read #" ];
+          hashedPasswordFile = config.age.secrets.mqtt-receiver.path;
+        };
+      }
+    ];
+  };
+
+}

modules/containers.nix

@@ -0,0 +1,68 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  # Podman setup
+  virtualisation = {
+    containers.enable = true;
+    podman = {
+      enable = true;
+      dockerCompat = true;
+      extraPackages = with pkgs; [ zfs ];
+    };
+
+    oci-containers = {
+      backend = "podman";
+      containers = {
+        # Openbooks configuration
+        openbooks = {
+          image = "evanbuss/openbooks@sha256:4fa9188885368c2303b7dc527d48b3159aaa7022010e29b3ed96842018793590";
+          ports = [ "127.0.0.1:9000:80" ];
+          cmd = [
+            "--name"
+            "bradar"
+            "--searchbot"
+            "searchook"
+            "--persist"
+            "--tls"
+            "false"
+          ];
+        };
+        # Prometheus MQTT integration
+        mqtt2prometheus = {
+          image = "hikhvar/mqtt2prometheus@sha256:8e166d36feaa5ddcad703eef3a2c5167a154d6eef306a40fe6509861580c0714";
+          ports = [ "127.0.0.1:9641:9641" ];
+          volumes = [ "/vault/mqtt2prometheus/config.yaml:/config.yaml" ];
+        };
+        # Podcast synchronization
+        opodsync = {
+          image = "ganeshlab/opodsync@sha256:32626b732fe38687a5dfd703d515136e413c4b16f286b38656718ad03f0d94c1";
+          ports = [ "127.0.0.1:9090:8080" ];
+          volumes = [ "/vault/opodsync:/var/www/server/data" ];
+        };
+        # Photo gallery
+        pigallery2 = {
+          image = "bpatrik/pigallery2@sha256:c936e4504cfe7158198542a8db794b24afb0301155d89e911f13bd04e0b406c2";
+          ports = [ "127.0.0.1:9191:80" ];
+          volumes = [
+            "/vault/pigallery2/config:/app/data/config"
+            "/vault/pigallery2/db:/app/data/db"
+            "/vault/pigallery2/tmp:/app/data/tmp"
+            "/vault/syncthing/Photos:/app/data/images"
+          ];
+          cmd = [
+            "-e"
+            "NODE_ENV=production"
+          ];
+        };
+      };
+    };
+  };
+
+  # Start services after ZFS mount
+  systemd.services.podman-mqtt2prometheus.unitConfig.RequiresMountsFor = [ /vault/mqtt2prometheus ];
+}

modules/datasync.nix

@@ -1,44 +1,114 @@
-# Syncthing and Radicale configuration
+{
-{ config, pkgs, lib, ... }:
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 {
 
-  environment.systemPackages = with pkgs; [
+  # Syncthing configuration
-    syncthing
-    radicale
-  ];
-
-  # Enable syncthingthing
   services.syncthing = {
     enable = true;
     openDefaultPorts = true;
     guiAddress = "0.0.0.0:8384";
     dataDir = "/vault/syncthing";
-    declarative = {
+    key = config.age.secrets.syncthing.path;
+    settings = {
+      extraOptions.options = {
+        maxFolderConcurrency = 4;
+        progressUpdateIntervalS = -1;
+      };
       devices = {
-        monolith = { id = "QGDGEZQ-INE7XDY-DNX2QI4-QI7ANQJ-57REEO2-FUMH545-FZS5RYU-ULF7HA2"; };
+        panacea.id = "VEGVHKF-P4FT3BD-4T3ML7J-65URQOU-3XKNMI5-6LGWSCI-BIQZOUE-RKQ6PQX";
-        roamer = { id = "DS3PJH3-J6SNMHM-XUJTDLO-DHGJL5U-J3RUMAG-4OSJWIK-VSJSDVJ-PIHZ2QP"; };
+        caravanserai.id = "XQAXYEU-FWLAFZM-GTZYDGH-AIRBEXI-4CZD365-JUBTHDA-GOXXOYV-E5LEYQE";
       };
       folders = {
-       "Documents" = { devices = [ "monolith" "roamer" ]; id = "wusdj-bfjkr"; };
+        Documents = {
-       "Notes" = { devices = [ "monolith" "roamer" ]; id = "2aqt7-vpprc"; };
+          id = "wusdj-bfjkr";
-       "Music" = { devices = [ "monolith" "roamer" ]; id = "kafhz-bfmzm"; };
+          type = "receiveonly";
-       "Photos" = { devices = [ "monolith" "roamer" ]; id = "mjibc-ustcg"; };
+          path = "/vault/syncthing/Documents";
-       "Security" = { devices = [ "monolith" "roamer" ]; id = "z4lpn-pmm3v"; };
+          devices = [
-       "Projects" = { devices = [ "monolith" ]; id = "cjhmu-avy9v"; };
+            "panacea"
+            "caravanserai"
+          ];
+        };
 
-        Documents.type = "receiveonly";
+        Notes = {
-        Notes.type = "receiveonly";
+          id = "kafhz-bfmzm";
-        Music.type = "receiveonly";
+          type = "receiveonly";
-        Photos.type = "receiveonly";
+          path = "/vault/syncthing/Notes";
-        Security.type = "receiveonly";
+          devices = [
-        Projects.type = "receiveonly";
+            "panacea"
+            "caravanserai"
+          ];
+        };
 
-        Documents.path = "/vault/syncthing/Documents";
+        Music = {
-        Notes.path = "/vault/syncthing/Notes";
+          id = "2aqt7-vpprc";
-        Music.path = "/vault/syncthing/Music";
+          type = "receiveonly";
-        Photos.path = "/vault/syncthing/Photos";
+          path = "/vault/syncthing/Music";
-        Security.path = "/vault/syncthing/Security";
+          devices = [
-        Projects.path = "/vault/syncthing/Projects";
+            "panacea"
+            "caravanserai"
+          ];
+        };
+
+        Photos = {
+          id = "mjibc-ustcg";
+          type = "receiveonly";
+          path = "/vault/syncthing/Photos";
+          devices = [
+            "panacea"
+            "caravanserai"
+          ];
+        };
+
+        Projects = {
+          id = "cjhmu-avy9v";
+          type = "receiveonly";
+          path = "/vault/syncthing/Projects";
+          devices = [ "panacea" ];
+        };
+
+        Phone = {
+          id = "m2007j20cg_vc7r-photos";
+          type = "receiveonly";
+          path = "/vault/syncthing/Photos/Phone";
+          devices = [
+            "panacea"
+            "caravanserai"
+          ];
+        };
+
+        Files = {
+          id = "tsk52-u6rbk";
+          type = "receiveonly";
+          path = "/vault/syncthing/Files";
+          devices = [
+            "panacea"
+            "caravanserai"
+          ];
+        };
+
+        Phone-screenshots = {
+          id = "pp70r-pbr70";
+          type = "receiveonly";
+          path = "/vault/syncthing/Photos/Phone-screenshots";
+          devices = [
+            "panacea"
+            "caravanserai"
+          ];
+        };
+
+        Audio = {
+          id = "tarrs-5mxck";
+          type = "receiveonly";
+          path = "/vault/syncthing/Audio";
+          devices = [
+            "panacea"
+            "caravanserai"
+          ];
+        };
       };
     };
   };
@@ -46,19 +116,30 @@
   # Enable Radicale
   services.radicale = {
     enable = true;
-    config = ''
+    settings = {
-      [server]
+      server.hosts = [ "127.0.0.1:5232" ];
-      hosts = 127.0.0.1:5232
+      auth = {
-      max_connections = 20
+        type = "htpasswd";
-      max_content_length = 100000000
+        htpasswd_filename = "/vault/radicale/users";
-      timeout = 30
+        htpasswd_encryption = "md5";
-
+        delay = 1;
-      [auth]
+      };
-      type = htpasswd
+      storage.filesystem_folder = "/vault/radicale/collections";
-      htpasswd_filename = /var/lib/radicale/users
+    };
-      htpasswd_encryption = plain
-      delay = 1
-    '';
   };
 
+  # ZFS automatic snapshots
+  services.zfs.autoSnapshot = {
+    enable = true;
+    frequent = 4;
+    hourly = 24;
+    daily = 7;
+    weekly = 4;
+    monthly = 12;
+  };
+
+  # Start services after ZFS mount
+  systemd.services.syncthing.unitConfig.RequiresMountsFor = [ /vault/syncthing ];
+  systemd.services.radicale.unitConfig.RequiresMountsFor = [ /vault/radicale ];
+
 }

modules/devops.nix

@@ -1,29 +1,35 @@
-# Software development configuration
-{ config, pkgs, lib, ... }:
 {
-  environment.systemPackages = with pkgs; [
+  config,
-    gitea
+  pkgs,
-    git-lfs
+  lib,
-  ];
+  ...
-
+}:
-  # Gitea setup with daily backup
+{
+  # Set up Gitea with LFS support
   services.gitea = {
     enable = true;
-    domain = "coolneng.duckdns.org";
-    rootUrl = "https://coolneng.duckdns.org/gitea";
     database = {
       type = "postgres";
-      passwordFile = "/var/keys/gitea/db";
+      passwordFile = config.age.secrets.gitea.path;
     };
-    cookieSecure = true;
-    disableRegistration = true;
     repositoryRoot = "/vault/git";
-    dump.enable = true;
+    appName = "Gitea";
-    useWizard = true;
+    lfs = {
-    extraConfig = ''
+      enable = true;
-      LFS_START_SERVER = true
+      contentDir = "${config.services.gitea.repositoryRoot}/data/lfs";
-      LFS_HTTP_AUTH_EXPIRY = 60m
+    };
-    '';
+    settings = {
+      server = {
+        DISABLE_SSH = true;
+        DOMAIN = "git.psydnd.org";
+        ROOT_URL = "https://git.psydnd.org";
+      };
+      service.DISABLE_REGISTRATION = true;
+      session.COOKIE_SECURE = true;
+      actions.ENABLED = true;
+    };
   };
 
+  # Start services after ZFS mount
+  systemd.services.gitea.unitConfig.RequiresMountsFor = [ /vault/git ];
 }

modules/hardware-configuration.nix

@@ -1,64 +1,58 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, modulesPath, ... }:
 
 {
   imports =
-    [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix>
+    [ (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
-  boot.initrd.availableKernelModules = [ "usb_storage" ];
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "sd_mod" ];
   boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888";
+    { device = "sysion/stateful/root";
-      fsType = "ext4";
-    };
-
-  fileSystems."/vault" =
-    { device = "vault";
       fsType = "zfs";
     };
 
-  fileSystems."/vault/git" =
+  fileSystems."/nix" =
-    { device = "vault/git";
+    { device = "sysion/ephemeral/nix";
       fsType = "zfs";
     };
 
-  fileSystems."/vault/syncthing" =
+  fileSystems."/tmp" =
-    { device = "vault/syncthing";
+    { device = "sysion/ephemeral/tmp";
       fsType = "zfs";
     };
 
-  fileSystems."/vault/backups" =
+  fileSystems."/home/coolneng" =
-    { device = "vault/backups";
+    { device = "sysion/stateful/home";
       fsType = "zfs";
     };
 
-  fileSystems."/vault/nextcloud" =
+  fileSystems."/boot" =
-    { device = "vault/nextcloud";
+    { device = "/dev/disk/by-uuid/C332-4650";
-      fsType = "zfs";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
     };
 
-  fileSystems."/vault/backups/monolith" =
+  swapDevices =
-    { device = "vault/backups/monolith";
+    [ { device = "/dev/disk/by-uuid/d388feef-a651-4dae-8161-f666136de240"; }
-      fsType = "zfs";
+    ];
-    };
 
-  fileSystems."/vault/backups/zion" =
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-    { device = "vault/backups/zion";
+  # (the default) this is the recommended approach. When using systemd-networkd it's
-      fsType = "zfs";
+  # still possible to use this option, but it's recommended to use it in conjunction
-    };
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp3s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wg0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp4s0.useDHCP = lib.mkDefault true;
 
-  fileSystems."/vault/backups/zion/databases" =
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-    { device = "vault/backups/zion/databases";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-      fsType = "zfs";
-    };
-
-  swapDevices = [ ];
-
-  nix.maxJobs = lib.mkDefault 4;
 }

modules/information.nix

@@ -0,0 +1,44 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  # Miniflux configuration
+  services.miniflux = {
+    enable = true;
+    adminCredentialsFile = config.age.secrets.miniflux.path;
+  };
+
+  # Microbin configuration
+  services.microbin = {
+    enable = true;
+    passwordFile = config.age.secrets.microbin.path;
+    settings = {
+      MICROBIN_PORT = 9091;
+      MICROBIN_PUBLIC_PATH = "https://bin.psydnd.org";
+      MICROBIN_QR = true;
+      MICROBIN_WIDE = true;
+    };
+  };
+
+  # Readeck configuration
+  services.readeck = {
+    enable = true;
+    settings = {
+      server = {
+        host = "127.0.0.1";
+        port = 9092;
+        allowed_hosts = [ "read.psydnd.org" ];
+        trusted_proxies = [ "127.0.0.1" ];
+        environmentFile = config.age.secrets.readeck.path;
+      };
+    };
+  };
+
+  # NOTE Load credentials using environment variables
+  systemd.services.readeck.serviceConfig.EnvironmentFile = config.age.secrets.readeck.path;
+
+}

modules/monitoring.nix

@@ -0,0 +1,92 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+with pkgs;
+
+{
+  # Notify when a disk starts going haywire
+  services.smartd = {
+    enable = true;
+    notifications.mail = {
+      enable = true;
+      sender = "akasroua+smartd@disroot.org";
+      recipient = "akasroua@disroot.org";
+      mailer = "${msmtp}/bin/msmtp -t --read-envelope-from";
+    };
+  };
+
+  # Notify about zpool problems
+  services.zfs.zed = {
+    enableMail = false;
+    settings = {
+      ZED_EMAIL_ADDR = "akasroua+smartd@disroot.org";
+      ZED_EMAIL_PROG = "mail";
+      ZED_EMAIL_OPTS = "-s '@SUBJECT@' @ADDRESS@";
+      ZED_NOTIFY_VERBOSE = false;
+    };
+  };
+
+  # Set up msmtp as notifier
+  programs.msmtp = {
+    enable = true;
+    defaults = {
+      port = 587;
+      tls = true;
+    };
+    accounts = {
+      default = {
+        auth = true;
+        host = "disroot.org";
+        user = "akasroua@disroot.org";
+        passwordeval = "${coreutils}/bin/cat ${config.age.secrets.msmtp.path}";
+      };
+    };
+  };
+
+  # Metrics collection
+  services.prometheus = {
+    enable = true;
+    port = 9001;
+    retentionTime = "10y";
+    extraFlags = [ "--web.enable-admin-api" ];
+    exporters = {
+      node = {
+        enable = true;
+        enabledCollectors = [ "systemd" ];
+        port = 9002;
+      };
+      postgres.enable = true;
+      smartctl.enable = true;
+    };
+    scrapeConfigs = [
+      {
+        job_name = "zion";
+        static_configs = [
+          {
+            targets = [
+              "localhost:${toString config.services.prometheus.exporters.node.port}"
+              "localhost:${toString config.services.prometheus.exporters.postgres.port}"
+              "localhost:${toString config.services.prometheus.exporters.smartctl.port}"
+              "localhost:9641" # MQTT2Prometheus
+            ];
+          }
+        ];
+      }
+    ];
+  };
+
+  # Grafana configuration
+  services.grafana = {
+    enable = true;
+    settings.server = {
+      domain = "grafana.psydnd.org";
+      http_port = 9009;
+      http_addr = "127.0.0.1";
+    };
+  };
+
+}

modules/networking.nix

@@ -1,34 +1,189 @@
-{ config, pkgs, lib, ... }:
-
-  let password = builtins.readFile /var/lib/ddclient/token;
-
-  in
 {
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
-  environment.systemPackages = with pkgs; [
+let
-    ddclient
+  wireguard_port = 1194;
-  ];
+
+in
+{
+  # Enable systemd-networkd
+  networking = {
+    hostName = "zion";
+    hostId = "760bfad7";
+    useDHCP = false;
+    useNetworkd = true;
+    dhcpcd.enable = false;
+  };
+  systemd.network.wait-online.enable = false;
+
+  # Assign a static IP
+  systemd.network.networks."24-home" = {
+    name = "enp2s0";
+    matchConfig.Name = "enp2s0";
+    address = [ "192.168.128.2/23" ];
+    gateway = [ "192.168.128.1" ];
+    dns = [
+      "127.0.0.1"
+      "::1"
+    ];
+    networkConfig.DNSSEC = "no";
+  };
 
   # Dynamic DNS configuration
-  services.ddclient = {
+  services.inadyn = {
     enable = true;
-    quiet = true;
+    interval = "*:0/30";
-    protocol = "duckdns";
+    settings.provider."duckdns" = {
-    domains = [ "coolneng.duckdns.org" ];
+      hostname = "coolneng.duckdns.org";
-    inherit password;
+      include = config.age.secrets.inadyn-duckdns.path;
+    };
+  };
+
+  # Dynamic DNS configuration for Porkbun
+  # NOTE Temporary workaround until Inadyn fixes the Porkbun module
+  services.oink = {
+    enable = true;
+    apiKeyFile = config.age.secrets.inadyn-porkbun.path;
+    secretApiKeyFile = config.age.secrets.inadyn-porkbun-secret.path;
+    settings.interval = 1800;
+    domains = [
+      {
+        domain = "psydnd.org";
+        subdomain = "";
+      }
+    ];
   };
 
   # Firewall configuration
   networking.firewall = {
     allowedTCPPorts = [
-      631 # Cups
+      80 # HTTP
-      6566 # SANE
+      443 # HTTPS
-      80
+      53 # DNS
-      443
+      8448 # Matrix
+      1883 # MQTT
     ];
-    autoLoadConntrackHelpers = true;
+    allowedUDPPorts = [
-    connectionTrackingModules = [ "sane" ];
+      wireguard_port # Wireguard
+      53 # DNS
+    ];
+    extraCommands = ''
+      iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o ${
+        config.systemd.network.networks."24-home".name
+      } -j MASQUERADE
+      ip6tables -t nat -A POSTROUTING -s fd00::0/128 -o ${
+        config.systemd.network.networks."24-home".name
+      } -j MASQUERADE
+    '';
+  };
+
+  # Wireguard setup
+  systemd.network.netdevs."wg0" = {
+    netdevConfig = {
+      Kind = "wireguard";
+      Name = "wg0";
+    };
+    wireguardConfig = {
+      ListenPort = wireguard_port;
+      PrivateKeyFile = config.age.secrets.wireguard.path;
+    };
+    wireguardPeers = [
+      # panacea
+      {
+        PublicKey = "XMkTztU2Y8hw6Fu/2o4Gszij+EmNacvFMXuZyHS1n38=";
+        AllowedIPs = [
+          "10.8.0.2/32"
+          "fd00::2/128"
+        ];
+      }
+      # caravanserai
+      {
+        PublicKey = "mCsTj09H7lfDDs8vMQkJOlItHtHQ6MPUyfGO5ZjBbVs=";
+        AllowedIPs = [
+          "10.8.0.3/32"
+          "fd00::3/128"
+        ];
+      }
+      # kathreftis
+      {
+        PublicKey = "qfHtv6LSZjtxvH46d8pysr+/yPo2tV9cZumgIpxBNF4=";
+        AllowedIPs = [
+          "10.8.0.4/32"
+          "fd00::4/128"
+        ];
+      }
+    ];
+  };
+
+  systemd.network.networks."wg0" = {
+    matchConfig.Name = "wg0";
+    networkConfig = {
+      Address = [
+        "10.8.0.1/24"
+        "fd00::1/128"
+      ];
+      IPv4Forwarding = true;
+      IPv6Forwarding = true;
+    };
+  };
+
+  # Disable systemd-resolved DNS stub
+  services.resolved = {
+    enable = true;
+    llmnr = "false";
+    extraConfig = ''
+      MulticastDNS=yes
+      DNSStubListener=no
+    '';
+  };
+
+  # DNS server with ad-block
+  services.dnsmasq = {
+    enable = true;
+    settings = {
+      domain-needed = true;
+      bogus-priv = true;
+      no-resolv = true;
+
+      listen-address = [
+        "127.0.0.1"
+        "192.168.128.2"
+        "10.8.0.1"
+        "::1"
+        "fd00::1"
+      ];
+      bind-interfaces = true;
+      server = [ "127.0.0.1#43" ];
+
+      cache-size = 10000;
+      local-ttl = 300;
+
+      conf-file = "${pkgs.dnsmasq}/share/dnsmasq/trust-anchors.conf";
+      dnssec = false;
+      address = "/psydnd.org/192.168.128.2";
+    };
+  };
+
+  # Encrypted DNS
+  services.dnscrypt-proxy = {
+    enable = true;
+    upstreamDefaults = true;
+    settings = {
+      listen_addresses = [
+        "127.0.0.1:43"
+        "[::1]:43"
+      ];
+      sources.public-resolvers = {
+        urls = [ "https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md" ];
+        cache_file = "/var/lib/dnscrypt-proxy2/public-resolvers.md";
+        minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
+      };
+      blocked_names.blocked_names_file = "/var/lib/dnscrypt-proxy/blocklist.txt";
+    };
   };
 
 }
-

modules/periodic.nix

@@ -0,0 +1,51 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  stateDir = "/var/lib/dnscrypt-proxy";
+  blocklist = "${stateDir}/blocklist.txt";
+
+in
+{
+  # PostgreSQL daily backups
+  services.postgresqlBackup = {
+    enable = true;
+    backupAll = true;
+    location = "/vault/backups/zion/databases";
+    startAt = "*-*-* 05:15:00";
+  };
+
+  # Fetch hosts-blocklists daily
+  # TODO Download the list if the file doesn't exist the first time
+  systemd.services.download-dns-blocklist = {
+    description = "Download hosts-blocklists";
+    wantedBy = [ "default.target" ];
+    path = with pkgs; [
+      curl
+      coreutils
+    ];
+    script = ''
+      curl -L https://download.dnscrypt.info/blacklists/domains/mybase.txt -o ${blocklist}
+    '';
+    serviceConfig.Type = "oneshot";
+    startAt = "02:00:00";
+  };
+
+  # Push zion changes to git daily
+  systemd.user.services.zion-push = {
+    description = "Push zion changes to git";
+    wantedBy = [ "default.target" ];
+    path = with pkgs; [ git ];
+    script = ''
+      ${pkgs.git}/bin/git -C /home/coolneng/system pull
+      ${pkgs.git}/bin/git -C /home/coolneng/system push
+    '';
+    serviceConfig.Type = "oneshot";
+    startAt = "07:00:00";
+    after = [ "network-online.target" ];
+  };
+}

modules/printing.nix

@@ -1,36 +0,0 @@
-# CUPS and SANE configuration
-{ config, pkgs, lib, ... }:
-{
-
-  environment.systemPackages = with pkgs; [
-    cups
-    sane-backends
-  ];
-
-  # Enable CUPS with Zeroconf
-  services.printing = {
-    enable = true;
-    drivers = with pkgs; [ hplip_3_18_5 ];
-    browsing = true;
-    listenAddresses = [ "0.0.0.0:631" ];
-    defaultShared = true;
-  };
-
-  # Enable SANE
-  hardware.sane = {
-      enable = true;
-      extraBackends = with pkgs; [ hplip_3_18_5 ];
-  };
-
-  services.saned = {
-      enable = true;
-      extraConfig = ''
-      192.168.1.0/24
-      '';
-  };
-
-  users.users.scanner = {
-    extraGroups = [ "lp" ];
-  };
-
-}

modules/webstack.nix

@@ -1,19 +1,17 @@
-# LEPP stack configuration
+# Web services configuration
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 {
 
-  environment.systemPackages = with pkgs; [
+  # Reverse proxy configuration
-    nginx
-    postgresql_11
-    libressl
-    miniflux
-  ];
-
   services.nginx = {
     enable = true;
-    resolver.ipv6 = false;
     recommendedTlsSettings = true;
-    recommendedGzipSettings = true;
+    recommendedBrotliSettings = true;
     recommendedProxySettings = true;
     recommendedOptimisation = true;
     clientMaxBodySize = "0";
@@ -22,117 +20,219 @@
     sslDhparam = "/var/lib/dhparams/nginx.pem";
     commonHttpConfig = ''
       # Add HSTS header with preloading to HTTPS requests.
-      # Adding this header to HTTP requests is discouraged
+      add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";
-      map $scheme $hsts_header {
-          https   "max-age=31536000; includeSubdomains; preload";
-      }
-      add_header Strict-Transport-Security $hsts_header;
-
-      # Enable CSP for your services.
-      #add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
 
       # Minimize information leaked to other domains
-      add_header 'Referrer-Policy' 'origin-when-cross-origin';
+      add_header 'Referrer-Policy' 'strict-origin-when-cross-origin';
-
-      # Disable embedding as a frame
-      add_header X-Frame-Options DENY;
 
       # Prevent injection of code in other mime types (XSS Attacks)
       add_header X-Content-Type-Options nosniff;
-
-      # Enable XSS protection of the browser.
-      # May be unnecessary when CSP is configured properly (see above)
       add_header X-XSS-Protection "1; mode=block";
+      add_header X-Frame-Options SAMEORIGIN;
 
       # This might create errors
       proxy_cookie_path / "/; secure; HttpOnly; SameSite=strict";
     '';
     virtualHosts = {
+      # Old domain being redirected
       "coolneng.duckdns.org" = {
-        enableACME = true;
+        useACMEHost = "coolneng.duckdns.org";
         forceSSL = true;
-        sslCertificate = "/var/lib/acme/coolneng.duckdns.org/fullchain.pem";
+        locations = {
-        sslCertificateKey = "/var/lib/acme/coolneng.duckdns.org/key.pem";
+          "/".return = "301 https://psydnd.org$request_uri";
-        locations."/radicale/" = {
+          # Delegation for Matrix
+          "/.well-known/" = {
+            alias = "${../well-known}" + "/";
+            extraConfig = ''
+              ${config.services.nginx.commonHttpConfig}
+              default_type application/json;
+              add_header Access-Control-Allow-Origin * always;
+            '';
+          };
+        };
+      };
+      # Redirect subdomains
+      "~^(?<subdomain>.+)\.coolneng\.duckdns\.org$" = {
+        useACMEHost = "coolneng.duckdns.org";
+        forceSSL = true;
+        locations."/".return = "301 https://$subdomain.psydnd.org$request_uri";
+      };
+      # Current domain
+      "psydnd.org" = {
+        useACMEHost = "psydnd.org";
+        forceSSL = true;
+      };
+      "radicale.psydnd.org" = {
+        useACMEHost = "psydnd.org";
+        forceSSL = true;
+        locations."/" = {
           proxyPass = "http://localhost:5232/";
           extraConfig = ''
-            proxy_set_header     X-Script-Name /radicale;
+            proxy_set_header     X-Script-Name /;
             proxy_pass_header Authorization;
           '';
         };
-        locations."/syncthing/" = {
+      };
-          proxyPass = "http://localhost:8384/";
+      "sync.psydnd.org" = {
-        };
+        useACMEHost = "psydnd.org";
-        locations."/gitea/" = {
+        forceSSL = true;
+        locations."/".proxyPass = "http://localhost:8384/";
+      };
+      "git.psydnd.org" = {
+        useACMEHost = "psydnd.org";
+        forceSSL = true;
+        locations."/" = {
           proxyPass = "http://localhost:3000/";
+          extraConfig = ''
+            ${config.services.nginx.commonHttpConfig}
+            # Disable embedding as a frame, except from the same origin
+            add_header Content-Security-Policy "frame-src git.psydnd.org; frame-ancestors git.psydnd.org";
+          '';
         };
-        locations."/miniflux/" = {
+      };
-          proxyPass = "http://localhost:8080/miniflux/";
+      "rss.psydnd.org" = {
+        useACMEHost = "psydnd.org";
+        forceSSL = true;
+        locations."/".proxyPass = "http://localhost:8080/";
+      };
+      "matrix.psydnd.org" = {
+        useACMEHost = "psydnd.org";
+        forceSSL = true;
+        listen = [
+          # IPv4
+          {
+            addr = "0.0.0.0";
+            port = 8448;
+            ssl = true;
+          }
+          {
+            addr = "0.0.0.0";
+            port = 443;
+            ssl = true;
+          }
+          # IPv6
+          {
+            addr = "[::]";
+            port = 8448;
+            ssl = true;
+          }
+          {
+            addr = "[::]";
+            port = 443;
+            ssl = true;
+          }
+        ];
+        locations."~ ^(/_matrix|/_synapse/client)".proxyPass = "http://localhost:8008";
+      };
+      "element.psydnd.org" = {
+        useACMEHost = "psydnd.org";
+        forceSSL = true;
+        locations."/".root = pkgs.element-web.override {
+          conf.default_server_config = {
+            "m.homeserver"."base_url" = "https://matrix.psydnd.org";
+            "m.identity_server"."base_url" = "https://vector.im";
+          };
         };
-        locations."/wallabag/" = {
+      };
-          proxyPass = "http://localhost:8081/";
+      "books.psydnd.org" = {
+        useACMEHost = "psydnd.org";
+        forceSSL = true;
+        locations."/" = {
+          proxyPass = "http://localhost:9000/";
+          proxyWebsockets = true;
+          extraConfig = ''
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "Upgrade";
+          '';
         };
       };
+      "grafana.psydnd.org" = {
+        useACMEHost = "psydnd.org";
+        forceSSL = true;
+        locations."/" = {
+          proxyPass = "http://localhost:9009/";
+          proxyWebsockets = true;
+        };
+      };
+      "podcast.psydnd.org" = {
+        useACMEHost = "psydnd.org";
+        forceSSL = true;
+        locations."/".proxyPass = "http://localhost:9090/";
+      };
+      "bin.psydnd.org" = {
+        useACMEHost = "psydnd.org";
+        forceSSL = true;
+        locations."/".proxyPass = "http://localhost:9091/";
+      };
+      "read.psydnd.org" = {
+        useACMEHost = "psydnd.org";
+        forceSSL = true;
+        locations."/".proxyPass = "http://localhost:9092/";
+      };
+      "photos.psydnd.org" = {
+        useACMEHost = "psydnd.org";
+        forceSSL = true;
+        locations."/".proxyPass = "http://localhost:9191/";
+      };
     };
   };
 
   # ACME certs configuration
-  security.acme.certs = {
+  security.acme = {
-    "coolneng.duckdns.org" = {
+    acceptTerms = true;
-      email = "akasroua@gmail.com";
+    defaults = {
-      postRun = "systemctl reload nginx.service";
+      email = "akasroua@disroot.org";
+      group = "nginx";
+    };
+    certs = {
+      "coolneng.duckdns.org" = {
+        domain = "*.coolneng.duckdns.org";
+        dnsProvider = "duckdns";
+        environmentFile = config.age.secrets.acme-duckdns.path;
+      };
+      "psydnd.org" = {
+        domain = "psydnd.org";
+        extraDomainNames = [ "*.psydnd.org" ];
+        dnsProvider = "porkbun";
+        environmentFile = config.age.secrets.acme-porkbun.path;
+      };
     };
   };
 
   # Generate dhparams
   security.dhparams = {
     enable = true;
-    params = { nginx.bits = 2048; };
+    defaultBitSize = 4096;
+    params.nginx.bits = 4096;
   };
 
   # PostgreSQL databases configuration
   services.postgresql = {
     enable = true;
-    package = pkgs.postgresql_11;
+    package = pkgs.postgresql_16;
-    ensureDatabases = [ "gitea" "wallabag" ];
-    ensureUsers = [
-      {
-      name = "gitea";
-      ensurePermissions = {"DATABASE gitea" = "ALL PRIVILEGES";};
-      }
-      {
-      name = "wallabag";
-      ensurePermissions = {"DATABASE wallabag" = "ALL PRIVILEGES";};
-      }
-    ];
     authentication = lib.mkForce ''
-    # Generated file; do not edit!
+      # Generated file; do not edit!
-    # TYPE  DATABASE        USER            ADDRESS                 METHOD
+      # TYPE  DATABASE        USER            ADDRESS                 METHOD
-    local   all             all                                     trust
+      local   all             all                                     trust
-    host    all             all             127.0.0.1/32            trust
+      host    all             all             127.0.0.1/32            trust
-    host    all             all             ::1/128                 trust
+      host    all             all             ::1/128                 trust
     '';
-    identMap = ''
+    settings = {
-            gitea-users gitea gitea
+      max_connections = "300";
-    '';
+      shared_buffers = "1024MB";
-  };
-
-  # PostgreSQL daily backups
-  services.postgresqlBackup = {
-      enable = true;
-      backupAll = true;
-      location = "/vault/backups/zion/databases";
-      startAt = "*-*-* 05:15:00";
-  };
-
-
-  # Miniflux configuration
-  services.miniflux = {
-    enable = true;
-    adminCredentialsFile = "/var/keys/miniflux/admin";
-    config = {
-      BASE_URL = "https://coolneng.duckdns.org/miniflux/";
     };
   };
 
+  # Restart reverse proxy after services startup
+  systemd.services.nginx.after = [
+    "gitea.service"
+    "syncthing.service"
+    "miniflux.service"
+    "radicale.service"
+    "dendrite.service"
+    "grafana.service"
+    "podman-openbooks.service"
+    "podman-mqtt2prometheus.service"
+    "podman-opodsync.service"
+  ];
 }

scripts/install.sh

@@ -0,0 +1,66 @@
+#!/bin/sh
+
+partition_disk() {
+    parted "$DISK" -- mklabel gpt
+    parted "$DISK" -- mkpart ESP fat32 1MiB 1025MiB
+    parted "$DISK" -- mkpart linux-swap 1025MiB 17409MiB
+    parted "$DISK" -- mkpart primary 17409MiB 100%
+    parted "$DISK" -- set 1 boot on
+    mkfs.fat -F32 -n BOOT "$DISK"p1
+    mkswap "$DISK"p2
+    swapon "$DISK"p2
+}
+
+zfs_setup() {
+    zpool import -f vault
+    zpool create -f -o ashift=12 -o autotrim=on -O acltype=posixacl -O relatime=on \
+        -O xattr=sa -O dnodesize=legacy -O normalization=formD -O mountpoint=none \
+        -O canmount=off -O devices=off -R /mnt -O compression=zstd "$POOL_NAME" "$DISK"p3
+    zfs create -o mountpoint=legacy -o com.sun:auto-snapshot=false "$POOL_NAME"/ephemeral
+    zfs create -o mountpoint=legacy -o com.sun:auto-snapshot=false "$POOL_NAME"/ephemeral/nix
+    zfs create -o mountpoint=legacy -o com.sun:auto-snapshot=false -o sync=disabled -o setuid=off "$POOL_NAME"/ephemeral/tmp
+    zfs create -o mountpoint=legacy -o com.sun:auto-snapshot=false "$POOL_NAME"/stateful
+    zfs create -o mountpoint=legacy -o com.sun:auto-snapshot=true "$POOL_NAME"/stateful/home
+    zfs create -o mountpoint=legacy -o com.sun:auto-snapshot=false "$POOL_NAME"/stateful/root
+}
+
+mount_datasets() {
+    mount -t zfs sysion/stateful/root /mnt
+    mkdir -p /mnt/boot
+    mount "$DISK"p1 /mnt/boot
+    mkdir -p /mnt/home/coolneng
+    mount -t zfs sysion/stateful/home /mnt/home/coolneng
+    mkdir -p /mnt/nix
+    mount -t zfs sysion/ephemeral/nix /mnt/nix
+    mkdir -p /mnt/tmp
+    mount -t zfs sysion/ephemeral/tmp /mnt/tmp
+}
+
+install_system() {
+    nixos-generate-config --root /mnt
+    mv /mnt/etc/nixos/hardware-configuration.nix modules/hardware-configuration.nix
+    nix-shell -p git --command "nixos-install --root /mnt --flake .#zion"
+}
+
+usage() {
+    echo "Usage: install.sh <disk>"
+    echo "disk: full path to the disk (e.g. /dev/sda)"
+    exit 1
+}
+
+if [ $# != 1 ]; then
+    usage
+fi
+
+DISK="$1"
+POOL_NAME="sysion"
+
+echo "Let's start by partitioning the disk"
+partition_disk
+echo "Starting up the ZFS machinery"
+zfs_setup
+echo "Mounting the horse"
+mount_datasets
+echo "Lift off to the NixOS planet"
+install_system
+echo "All ready, time to rejoice"

scripts/motd.sh

@@ -0,0 +1,50 @@
+#!/run/current-system/sw/bin/bash
+# Kernel information
+LINUX=$(uname -rs | cut -d " " -f2)
+
+# System uptime
+uptime=$(cut -f1 -d. </proc/uptime)
+upDays=$((uptime / 60 / 60 / 24))
+upHours=$((uptime / 60 / 60 % 24))
+upMins=$((uptime / 60 % 60))
+upSecs=$((uptime % 60))
+
+# System load
+MEMORY=$(free -m | awk 'NR==2{printf "%s/%sMB (%.2f%%)\n", $3,$2,$3*100/$2 }')
+CPU_LOAD=$(uptime | cut -d: -f5)
+
+echo "============================================================
+ - Kernel..............: $LINUX
+ - System load.........:$CPU_LOAD
+ - Memory used.........: $MEMORY
+ - System uptime.......: $upDays days $upHours hours $upMins minutes $upSecs seconds
+============================================================"
+services=(
+    "syncthing.service"
+    "radicale.service"
+    "miniflux.service"
+    "gitea.service"
+    "dendrite.service"
+    "nginx.service"
+    "dnsmasq.service"
+    "dnscrypt-proxy.service"
+    "podman-openbooks.service"
+    "mosquitto.service"
+    "podman-mqtt2prometheus.service"
+    "prometheus.service"
+    "grafana.service"
+)
+
+for var in "${services[@]}"; do
+    if [[ -z $var ]]; then
+        printf "\n"
+    else
+        if systemctl -q is-active "${var}"; then
+            printf "%-40s [\e[32mOK\e[39m]\n" "$var"
+        else
+            printf "%-40s [\e[31mFAIL\e[39m]\n" "$var"
+        fi
+    fi
+done
+
+echo "============================================================"

secrets/acme-porkbun.age

@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 iUaRGg 7JImhL2Wo/eJEwUGP+NhEf36yq5gHO9q1GYhY2HaMAY
+eAMhD0sqHQS+aayBpOsY8+081i72QAhJCFbBe0//uwU
+--- 4K8cXsDuWZrmWNJ+rz166ej9o/gLFc7CfJuzAsG0BxA
+|.<2E><><EFBFBD>	f<><66>f<EFBFBD>=<1D>-<2D>X$P<>:

secrets/git.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 iUaRGg MMf85MfBRho4AAWRJW6WlGxG4Drnuz9qqBlTzpOKiRc
+tZSl7z0wkSO0K0mJ44q9Ix3yVCMp3LMh/jllNAOK5+E
+-> n5p-grease .1Sb)yr iCEC
+lXYS70Iag6qiAErdO8kSpaTqeBwXTWszUTCT1M3Uy4VxFY17
+--- iWFH19Fd0y8eP9rkWjHt4xqFXqVC/S6dNEfczvRkGwY
+txE	<09>Rͫ$Y<><0F><><EFBFBD><EFBFBD>j`<60>n<EFBFBD><6E>j<EFBFBD><6A><EFBFBD><13><14><><EFBFBD>RI<18>P$$Ag
<01>]볷<>2<EFBFBD><32>gF
+t<EFBFBD>[u<06><><EFBFBD><EFBFBD>M<EFBFBD><1E>nG<6E><47><17><><07>q<07><>;xa<78>š<EFBFBD>qe

secrets/gitea.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 iUaRGg qr3AoWBF4bx+2bK0STPQtBRDjU6HW5SfXIIUE8GJfxE
+mr9m+Le1RrMFumNjSEXpkqbqK9e6jbT4ltWvx/hRplE
+-> !W;iA-grease 343tk
+f2Fn5fkaYHB/X9wKx/Fa5pJN
+--- RynMspwxpbATQ4tCuRoyB9d62IhnADztJu58ohN7mkw
+e<EFBFBD>E<EFBFBD><EFBFBD><EFBFBD><EFBFBD>'+<2B><>(Ϙ<><0F><>.0O<EFBFBD><EFBFBD>+$%@YWw|<1A><>v2<76>Ri-<2D>ոi<D5B8><69><18>f<07><>f<1A><>i<EFBFBD><69><EFBFBD>vO<0F>܆<><DC86>w!<1F><><EFBFBD><EFBFBD><EFBFBD>Q<EFBFBD><1D>7<EFBFBD>H<EFBFBD>O<EFBFBD>i<EFBFBD><69>0d9<64>!G-<2D>CY<43>+ẖyOB<1C>?<3F><>)<29>Ю1<D0AE><31>뒚iK<><4B>z-~M<>_|#a<>Z<03>4I<><49>(<28>g<02><><EFBFBD><EFBFBD>o<EFBFBD>

secrets/inadyn-duckdns.age

@@ -0,0 +1,6 @@
+age-encryption.org/v1
+-> ssh-ed25519 iUaRGg XMrsd1RQcDq/SpFtqpB4Gj1keCvJsMB+VA58qZirYA4
+tf8NQzoEYJXlKBjtX4ZplaPQv51RCW9yHulvKZB8c8g
+--- 5wZntAZCQ4pGYrgDFd63w6Y+Taaatcw5z0tDSvShi30
+<EFBFBD><EFBFBD>4<EFBFBD><EFBFBD><EFBFBD>Ɖq3<EFBFBD>&
+><0E>4<EFBFBD><34>J<EFBFBD>?<3F><0F><>QW<51>jZ<:'<<16>x(<28>Y<16>i<EFBFBD>ZDO#<23>w<7F><77>R<EFBFBD><52><EFBFBD>O@2<>cAj	(f<><66><EFBFBD><EFBFBD>M<EFBFBD><4D><EFBFBD>

secrets/inadyn-porkbun-secret.age

@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 iUaRGg paS5BxWWicriSLAZyCBKd2xylLAp4/LcHmogO7me8yQ
+MWW/Pkvn+4G4YeYXY9ZPXC92TbcFXQMyHJ2ltFzXpZs
+--- ZdFfQ7tHfEo+u/0MmigCNh6OIxkd2bimRN30rMUs1ks
+<EFBFBD>9<EFBFBD>7Y<EFBFBD>$B<>sX<0E>ʽb<CABD>O'J<><4A>S
'<27>5!<21><>UMʯ-v<>m<EFBFBD><6D><EFBFBD><EFBFBD><EFBFBD>8%|R,<2C>~I<><14><>G<EFBFBD><47>VQE<0E>0D<30>:Qv<<1E><>)<29><0B><>%fc<66><63>XZչ 7+yB

secrets/mqtt-receiver.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 iUaRGg JT+as1Cl66qOy5yY3WJNs0bh51DWaCe/+XZLR8m1L0A
+/6CyRX6Ks7Wr/ySlJhdfkabcy4N5rQ0VzGtlbxL8RCs
+-> L$l;-grease uU_g`a
+N00Z5C8AKzdnGZuFUHqY6uZBiMryyT3IXkdNlYW2fVJLOSfkfFdXssIK9hcMObyi
+sQENGphUf1Sk16Vo9p4emOL5mtzU
+--- flb9q0/Q608TJ6K9fsGULVwi2Pk860Cz750d5DBSfMM
+1<EFBFBD>%<25><>=<3D>Lڮ<4C><DAAE>s<EFBFBD>c/<2F>Iy<49><79>oT!<21>ڏ<EFBFBD>&X<0F><><EFBFBD>WՒZ̋<5A><CC8B><0E>8Z<38><5A><EFBFBD><EFBFBD><EFBFBD>æ<19><><EFBFBD><EFBFBD><06>	<09><0B>tw<74>'<27><> i<>e’<65>_<EFBFBD>}-<2D>V<EFBFBD>$<24>S<EFBFBD><53><EFBFBD><EFBFBD><EFBFBD>خA<D8AE><41><EFBFBD>h<EFBFBD><68><EFBFBD><04><>!<21><>9Z<39><5A><05><>hqіIa<49><61>,

secrets/msmtp.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 iUaRGg +E0/YCwuUtJNFQHtniQyN+xU/1s0phXNMd5YYbOGGFA
+Xfht0XPm+oflQLicH5MWGF2nLzu44p/DgahpZa2K70k
+-> NlBVK_)-grease SRaB^ jo >B#rtU zoC-H]
+lAQL9zTNvGOmJv7FhQaYKd9Ac+MdQSKAhN8hgOTzyh4
+--- 0ox9Q/KOAhuHxkDHIwj6ab6rzie4T/mU9GIT8p4x+0g
+<12>UC<55><43>8<EFBFBD><38>^<5E>UK<55><4B><EFBFBD>x<EFBFBD>U<EFBFBD>^<5E>=<3D>)<29>d<EFBFBD>l<><6C><EFBFBD><12><><EFBFBD><EFBFBD>Q<EFBFBD>ҫpQH<51><48><EFBFBD><EFBFBD>1<EFBFBD><31>x<EFBFBD><78>;K<>U;<3B>lb<><62>K9<4B>*`<60><>:I<>:<3A><><13><>t<EFBFBD><74>SF<53><46>f<EFBFBD>yGU

secrets/secrets.nix

@@ -0,0 +1,25 @@
+let
+  zion = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFRqINHR7/zc+c3/PuR+NeSsBHXXzBiEtFWSK6QaxQTW";
+in
+{
+  "wireguard.age".publicKeys = [ zion ];
+  "syncthing.age".publicKeys = [ zion ];
+  "msmtp.age".publicKeys = [ zion ];
+  "gitea.age".publicKeys = [ zion ];
+  "miniflux.age".publicKeys = [ zion ];
+  "git.age".publicKeys = [ zion ];
+  "dendrite.age".publicKeys = [ zion ];
+  "dendrite-postgres.age".publicKeys = [ zion ];
+  "telegram.age".publicKeys = [ zion ];
+  "mqtt-sender.age".publicKeys = [ zion ];
+  "mqtt-receiver.age".publicKeys = [ zion ];
+  "facebook.age".publicKeys = [ zion ];
+  "signal.age".publicKeys = [ zion ];
+  "inadyn-duckdns.age".publicKeys = [ zion ];
+  "inadyn-porkbun.age".publicKeys = [ zion ];
+  "inadyn-porkbun-secret.age".publicKeys = [ zion ];
+  "acme-duckdns.age".publicKeys = [ zion ];
+  "acme-porkbun.age".publicKeys = [ zion ];
+  "microbin.age".publicKeys = [ zion ];
+  "readeck.age".publicKeys = [ zion ];
+}

secrets/signal.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 iUaRGg J/gZDBtDsIzjCzO1y2vXgxl8YuvWJgcpk+8KMOp63kg
+1XF9JFAIscHWFJMTctZOxVIBYhYliUFays5gwjZt6hs
+-> vM4\2y\'-grease
+bj9VKIuH0l1v5X8N2v4p+u3VySDKjj3WAyVZ7f+wmy16wncrNyMtiUZ+ELBWfqXd
+XOyeGZoKBHwd8lOgkZ+va0BEkBJs9piX
+--- K2uN9JxuqPQpAxjQ+6dgsqhsq50nTkLsw8QGJprE5hQ
+H<EFBFBD><EFBFBD><EFBFBD>S<>:<3A>eJ4}'<27><><EFBFBD>T<EFBFBD><54>˦<0B><>[<5B>'<27>M<EFBFBD><4D><EFBFBD>9<><07><>E6_<36><12><><EFBFBD><1D><><EFBFBD>_<EFBFBD><5F><EFBFBD><EFBFBD>yPM8''<27>'<15>F<><46><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Rڡ"<22>ݏ<EFBFBD>X<EFBFBD><58><EFBFBD><EFBFBD>;<3B><>4<EFBFBD>J/>k<1C>5<EFBFBD><<15><>:<3A>M<EFBFBD>lK$<24>ӟq<D39F>S<EFBFBD><53><EFBFBD><EFBFBD>#<23>Ō<04>j<EFBFBD>X)<29><>v<EFBFBD><76><EFBFBD>–<EFBFBD>Ou<4F><75>J<>P<EFBFBD><12><>~

secrets/wallabag-postgres.age

@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 iUaRGg zWm4+j3/IRqd3uZqGzXVcHvs+urNrvDMOceWKbpl018
+HlIKCFYt7n3iKZav5i0YiB4awRMJML0XUowX8sKKH2c
+--- ysvYVxgK1OeqCk8KdNF+uWsaQ9EzVRku7nw37aUAW3A
+c<EFBFBD><EFBFBD>b<EFBFBD>W|bU<62>B"<22><04>Ե<EFBFBD><D4B5><EFBFBD><EFBFBD><EFBFBD><03><>U<EFBFBD>

well-known/matrix/client

@@ -0,0 +1,5 @@
+{
+    "m.homeserver": {
+        "base_url": "https://matrix.psydnd.org"
+    }
+}

well-known/matrix/server

@@ -0,0 +1 @@
+{ "m.server": "matrix.psydnd.org:443" }