README.org

@@ -0,0 +1,21 @@
+#+TITLE: nixos-config
+#+AUTHOR: materus
+#+DESCRIPTION: NixOS config and dotfiles
+#+OPTIONS: \n:t
+My NixOS and home-manager configs.
+Dotfiles and helper scripts.
+
+Part of it is encrypted by git-crypt, mostly just ips and names. Secrets are managed by sops.
+
+* Hosts
+[[./configurations/host/materusPC/][materusPC]] - my main PC
+
+[[./configurations/host/Old-materusPC/][Old-materusPC]] - my old PC, barely used
+
+[[./configurations/host/flamaster/][flamaster]] - my laptop, used mostly as server for games.
+
+[[./configurations/host/valkyrie/][valkyrie]] - VPS, my website and pleroma instance
+
+[[./configurations/host/waffentrager/][waffentrager]] - raspberry pi4, home server
+
+

config/shell/zsh/zshenv

@@ -1 +0,0 @@
-__MATERUS_HM_ZSH=1

config/shell/zsh/zshrc

@@ -1,110 +0,0 @@
-if [[ -r "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh" ]]; then
-  source "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh"
-fi
-
-bindkey -e
-if [ -n "$EAT_SHELL_INTEGRATION_DIR" ]; then
-    source "$EAT_SHELL_INTEGRATION_DIR/zsh";
-fi
-
-export ZSH_DATA_DIR="${XDG_CONFIG_HOME:-"$HOME/.config"}/zsh/data"
-export ZSH_CONFIG_DIR="${XDG_CONFIG_HOME:-"$HOME/.config"}/zsh/cfg"
-
-#Check if terminal is fullcolor
-if zmodload zsh/terminfo && (( "$terminfo[colors]" >= "256" )); then 
-    __MATERUS_ZSH_256COLORS="${__MATERUS_ZSH_256COLORS:-1}"; else
-    __MATERUS_ZSH_256COLORS="${__MATERUS_ZSH_256COLORS:-0}"; 
-fi
-
-
-#region Plugins
-# Clone plugins if not exists
-[ -d $ZSH_DATA_DIR/plugins/powerlevel10k ] || git clone https://github.com/romkatv/powerlevel10k $ZSH_DATA_DIR/plugins/powerlevel10k
-[ -d $ZSH_DATA_DIR/plugins/zsh-syntax-highlighting ] || git clone  https://github.com/zsh-users/zsh-syntax-highlighting.git $ZSH_DATA_DIR/plugins/zsh-syntax-highlighting
-[ -d $ZSH_DATA_DIR/plugins/zsh-history-substring-search ] || git clone  https://github.com/zsh-users/zsh-history-substring-search.git $ZSH_DATA_DIR/plugins/zsh-history-substring-search
-[ -d $ZSH_DATA_DIR/plugins/zsh-autosuggestions ] || git clone https://github.com/zsh-users/zsh-autosuggestions $ZSH_DATA_DIR/plugins/zsh-autosuggestions
-
-source ${ZSH_DATA_DIR}/plugins/powerlevel10k/powerlevel10k.zsh-theme
-source ${ZSH_CONFIG_DIR}/extra/zinputrc
-source ${ZSH_CONFIG_DIR}/extra/zshcompletion.zsh
-
-source ${ZSH_DATA_DIR}/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh
-source ${ZSH_DATA_DIR}/plugins/zsh-history-substring-search/zsh-history-substring-search.zsh
-source ${ZSH_DATA_DIR}/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh
-#endregion
-
-#region SUBSTRING SEARCH
-history-substring-search-up-prefixed(){
-    HISTORY_SUBSTRING_SEARCH_PREFIXED=1 history-substring-search-up
-}
-history-substring-search-down-prefixed(){
-    HISTORY_SUBSTRING_SEARCH_PREFIXED=1 history-substring-search-down
-}
-
-zle -N history-substring-search-up-prefixed
-zle -N history-substring-search-down-prefixed
-#endregion
-
-#region Init Variables
-export SAVEHIST=100000
-export HISTSIZE=$SAVEHIST
-export ZSH_PRIVATE=${ZSH_PRIVATE:-0}
-
-mkdir -p $ZSH_DATA_DIR
-mkdir -p $ZSH_DATA_DIR/plugins
-
-# Load config generated by nix
-[[ -f "$ZSH_DATA_DIR/nix.sh" ]] && source "$ZSH_DATA_DIR/nix.sh" 
-
-setopt HIST_SAVE_NO_DUPS
-setopt HIST_IGNORE_SPACE
-setopt HIST_IGNORE_DUPS
-setopt HIST_IGNORE_ALL_DUPS
-setopt EXTENDED_HISTORY
-
-# Private history mode
-if [[ $ZSH_PRIVATE == 1 ]] then 
-    export HISTFILE="/dev/null"; 
-    unsetopt SHARE_HISTORY;
-else 
-    export HISTFILE="$ZSH_DATA_DIR/zsh_history"; 
-    setopt SHARE_HISTORY;
-fi
-#endregion
-
-
-#region Bindings
-bindkey -r "^["
-bindkey "^[[1;5C" forward-word
-bindkey "^[[1;5D" backward-word
-bindkey "^[[1;5A" history-substring-search-up-prefixed
-bindkey "^[[1;5B" history-substring-search-down-prefixed
-bindkey "$key[Up]" history-substring-search-up
-bindkey "$key[Down]" history-substring-search-down
-bindkey '^[[3~' delete-char
-bindkey '^[[3;2~' delete-word
-#endregion
-
-#region Completions
-ZSH_COMPDUMP="${ZSH_COMPDUMP:-${XDG_CACHE_HOME:-${HOME}/.cache}/.zcompdump-${HOST}-${ZSH_VERSION}}"
-autoload -U compinit && compinit -d $ZSH_COMPDUMP
-#endregion
-
-#region Functions
-zsh-private() {
-    ZSH_PRIVATE=1 zsh
-}
-
-myip() {
-    wget -qO- https://wtfismyip.com/text
-}
-
-speedtest() {
-    curl -s https://raw.githubusercontent.com/sivel/speedtest-cli/master/speedtest.py | python3
-}
-#endregion
-
-
-if [[ "$__MATERUS_ZSH_256COLORS" = "1" ]] ; then [[ ! -f ${ZSH_CONFIG_DIR}/p10kcfg/fullcolor.zsh ]] || source ${ZSH_CONFIG_DIR}/p10kcfg/fullcolor.zsh;
-else [[ ! -f ${ZSH_CONFIG_DIR}/p10kcfg/compatibility.zsh ]]  || source ${ZSH_CONFIG_DIR}/p10kcfg/compatibility.zsh;
-fi

configurations/host/Old-materusPC/configuration.nix

@@ -0,0 +1,363 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{
+  config,
+  pkgs,
+  materusCfg,
+  materusArg,
+  ...
+}:
+let
+  unstable = import materusCfg.materusFlake.inputs.nixpkgs {
+    system = "x86_64-linux";
+    config = {
+      allowUnfree = true;
+      nvidia.acceptLicense = true;
+    };
+  };
+in
+{
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+    ./network.nix
+  ];
+  boot.supportedFilesystems = [ "ntfs" ];
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
+  nix.settings.auto-optimise-store = true;
+  nix.settings.substituters = [
+    "https://nix-community.cachix.org"
+    "https://cache.nixos.org/"
+  ];
+  nix.settings.trusted-public-keys = [
+    "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+  ];
+  nixpkgs.config.allowUnfree = true;
+
+  # Use the systemd-boot EFI boot loader.
+  boot.loader.grub = {
+    enable = true;
+    efiSupport = true;
+    device = "nodev";
+    gfxmodeEfi = "1920x1080";
+    gfxmodeBios = "1920x1080";
+    useOSProber = true;
+  };
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.efi.efiSysMountPoint = "/boot/efi";
+  boot.kernelPackages = unstable.linuxPackages_zen;
+  boot.tmp.useTmpfs = true;
+
+  services.flatpak.enable = true;
+  services.gvfs.enable = true;
+  programs.kdeconnect.enable = true;
+
+  # Set your time zone.
+  time.timeZone = "Europe/Warsaw";
+
+  services.syncthing = {
+    enable = true;
+    user = "materus";
+    dataDir = "/home/materus";
+  };
+  services.fstrim = {
+    enable = true;
+    interval = "weekly";
+  };
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "pl_PL.UTF-8";
+  console = {
+    font = "lat2-16";
+    #     keyMap = "pl";
+    useXkbConfig = true; # use xkbOptions in tty.
+  };
+
+  hardware.bluetooth.enable = true;
+  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+
+  hardware.opengl.enable = true;
+  hardware.opengl.driSupport32Bit = true;
+
+  materus.profile.steam.enable = false;
+
+  # Configure keymap in X11
+  services.xserver.xkb.layout = "pl";
+  # services.xserver.xkbOptions = {
+  #   "eurosign:e";
+  #   "caps:escape" # map caps to escape.
+  # };
+
+  # Enable CUPS to print documents.
+  services.printing.enable = true;
+
+  # Enable sound.
+  #sound.enable = true;
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    systemWide = true;
+    # If you want to use JACK applications, uncomment this
+    jack.enable = true;
+  };
+  hardware.pulseaudio.enable = false;
+  services.udev = {
+    extraRules = ''
+      KERNEL=="rtc0", GROUP="audio"
+      KERNEL=="hpet", GROUP="audio"
+      DEVPATH=="/devices/virtual/misc/cpu_dma_latency", OWNER="root", GROUP="audio", MODE="0660"
+    '';
+  };
+
+  virtualisation.podman = {
+    enable = true;
+    dockerCompat = true;
+    dockerSocket.enable = true;
+  };
+
+  users.users.materus = {
+    isNormalUser = true;
+    extraGroups = [
+      "wheel"
+      "networkmanager"
+      "kvm"
+      "input"
+      "libvirt"
+      "libvirtd"
+      "podman"
+      "audio"
+      "pipewire"
+    ];
+    shell = pkgs.zsh;
+    description = "Mateusz Słodkowicz";
+
+  };
+
+  virtualisation.libvirtd = {
+    enable = true;
+    onBoot = "ignore";
+    onShutdown = "shutdown";
+    qemu.ovmf.enable = true;
+    qemu.ovmf.packages = [ pkgs.OVMFFull.fd ];
+    qemu.runAsRoot = true;
+    qemu.swtpm.enable = true;
+    qemu.package = pkgs.qemu_full;
+  };
+  
+  environment.sessionVariables = rec {
+    XDG_CACHE_HOME = "\${HOME}/.cache";
+    XDG_CONFIG_HOME = "\${HOME}/.config";
+    XDG_BIN_HOME = "\${HOME}/.local/bin";
+    XDG_DATA_HOME = "\${HOME}/.local/share";
+
+    #SSH_ASKPASS_REQUIRE = "prefer";
+
+    STEAM_EXTRA_COMPAT_TOOLS_PATHS = "\${HOME}/.steam/root/compatibilitytools.d";
+
+    MOZ_USE_XINPUT2 = "1";
+    PATH = [ "\${XDG_BIN_HOME}" ];
+  };
+  environment.shellInit = ''
+    if ! [ -z "$DISPLAY" ]; then xhost +si:localuser:root &> /dev/null; fi;
+    if ! [ -z "$DISPLAY" ]; then xhost +si:localuser:$USER &> /dev/null; fi;
+  '';
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+
+  i18n.inputMethod.enabled = "fcitx5";
+  i18n.inputMethod.fcitx5.addons = [
+    pkgs.fcitx5-configtool
+    pkgs.fcitx5-lua
+    pkgs.fcitx5-mozc
+    pkgs.libsForQt5.fcitx5-qt
+  ];
+
+  environment.systemPackages = with pkgs; [
+
+    (vivaldi.overrideAttrs
+      (oldAttrs: {
+        dontWrapQtApps = false;
+        dontPatchELF = true;
+        nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [pkgs.kdePackages.wrapQtAppsHook];
+      }))
+
+    brave
+
+    glibc
+    patchelf
+    vim
+    wget
+    killall
+    xorg.xkill
+    xorg.xhost
+    nix-top
+    gitFull
+    curl
+    jdk
+    nss_latest
+    (aspellWithDicts (
+      ds: with ds; [
+        en
+        en-computers
+        en-science
+        pl
+      ]
+    ))
+    distrobox
+    p7zip
+    unrar
+    bzip2
+    rar
+    unzip
+    zstd
+    xz
+    zip
+    gzip
+    sops
+
+    tree
+    mc
+    lf
+    htop
+    nmon
+    iftop
+    iptraf-ng
+    mprocs
+
+    nix-du
+    git-crypt
+
+    wineWowPackages.stagingFull
+    winetricks
+    protontricks
+    openal
+    gnupg
+    ncurses
+    monkeysphere
+    gparted
+
+    inkscape
+    gimp
+
+    virt-manager
+    libguestfs
+
+    bubblewrap
+    bindfs
+
+    pulseaudio
+
+    binutils
+
+  ];
+
+  fonts.fontDir.enable = true;
+  fonts.enableDefaultPackages = true;
+  fonts.packages = with pkgs; [
+    dejavu_fonts
+    hack-font
+    noto-fonts
+    noto-fonts-extra
+    noto-fonts-emoji
+    noto-fonts-cjk-sans
+    noto-fonts-cjk-serif
+    ubuntu_font_family
+    wqy_zenhei
+    monocraft
+    nerd-fonts.fira-code
+    nerd-fonts.droid-sans-mono
+    nerd-fonts.meslo-lg
+    nerd-fonts.profont
+  ];
+  fonts.fontconfig.enable = true;
+  fonts.fontconfig.cache32Bit = true;
+  fonts.fontconfig.defaultFonts.sansSerif = [
+    "Noto Sans"
+    "DejaVu Sans"
+    "WenQuanYi Zen Hei"
+    "Noto Color Emoji"
+  ];
+  fonts.fontconfig.defaultFonts.serif = [
+    "Noto Serif"
+    "DejaVu Serif"
+    "WenQuanYi Zen Hei"
+    "Noto Color Emoji"
+  ];
+  fonts.fontconfig.defaultFonts.emoji = [
+    "Noto Color Emoji"
+    "OpenMoji Color"
+  ];
+  fonts.fontconfig.defaultFonts.monospace = [
+    "Hack Nerd Font"
+    "Noto Sans Mono"
+    "WenQuanYi Zen Hei Mono"
+  ];
+
+  environment.enableAllTerminfo = true;
+  environment.pathsToLink = [ "/share/zsh" ];
+  environment.shells = with pkgs; [ zsh ];
+  programs = {
+    steam = {
+      enable = false;
+      dedicatedServer.openFirewall = true;
+      remotePlay.openFirewall = true;
+    };
+    fish.enable = true;
+    java.enable = true;
+    java.package = pkgs.graalvmPackages.graalvm-oracle;
+    command-not-found.enable = false;
+    dconf.enable = true;
+  };
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  services.pcscd.enable = true;
+
+  /*
+    systemd.user.services.gpg-agent.serviceConfig.ExecStart = [
+    ""
+    ''
+    ${pkgs.gnupg}/bin/gpg-agent --supervised \
+    --pinentry-program ${pkgs.kwalletcli}/bin/pinentry-kwallet
+    ''
+    ];
+  */
+
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = false;
+    enableBrowserSocket = true;
+  };
+  programs.ssh.startAgent = true;
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  system.copySystemConfiguration = false;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.11"; # Did you read the comment?
+
+}

configurations/host/Old-materusPC/default.nix

@@ -0,0 +1,13 @@
+{ config, pkgs, lib, ... }:
+{
+  imports =
+    [
+      ./secrets
+      ./configuration.nix
+      ./nvidia.nix
+      ./plasma.nix
+    ];
+
+
+
+}

configurations/host/Old-materusPC/hardware-configuration.nix

@@ -0,0 +1,152 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ehci_pci"
+    "ahci"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [
+    "kvm-intel"
+    "vfio-pci"
+  ];
+  boot.extraModulePackages = [ ];
+  boot.kernel.sysctl = {
+    "vm.swappiness" = 10;
+  };
+  boot.kernelParams = [
+    "ibt=off"
+    "intel_iommu=on"
+    "iommu=pt"
+    "pcie_acs_override=downstream,multifunction"
+  ];
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/NixOS_Root";
+    fsType = "btrfs";
+    options = [
+      "subvol=@"
+      "noatime"
+      "ssd"
+      "space_cache=v2"
+    ];
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/NixOS_Root";
+    fsType = "btrfs";
+    options = [
+      "subvol=@boot"
+      "ssd"
+    ];
+  };
+
+  fileSystems."/materus" = {
+    device = "/dev/disk/by-label/NixOS_Root";
+    fsType = "btrfs";
+    options = [
+      "subvol=@materus"
+      "noatime"
+      "compress=zstd"
+      "ssd"
+      "space_cache=v2"
+    ];
+    neededForBoot = true;
+
+  };
+
+  fileSystems."/nix" = {
+    device = "/dev/disk/by-label/NixOS_Root";
+    fsType = "btrfs";
+    options = [
+      "subvol=@nix"
+      "noatime"
+      "compress=zstd"
+      "ssd"
+      "space_cache=v2"
+    ];
+  };
+
+  fileSystems."/home" = {
+    device = "/dev/disk/by-label/NixOS_Home";
+    fsType = "btrfs";
+    options = [
+      "subvol=@home"
+      "nossd"
+      "noatime"
+      "compress=zstd"
+      "space_cache=v2"
+      "autodefrag"
+    ];
+  };
+
+  fileSystems."/materus/data" = {
+    device = "/dev/disk/by-label/NixOS_Home";
+    fsType = "btrfs";
+    options = [
+      "subvol=@data"
+      "nossd"
+      "noatime"
+      "compress=zstd"
+      "space_cache=v2"
+      "autodefrag"
+    ];
+  };
+
+  fileSystems."/boot/efi" = {
+    device = "/dev/disk/by-uuid/A5C2-31D1";
+    fsType = "vfat";
+  };
+
+  zramSwap = {
+    enable = true;
+    memoryPercent = 50;
+    priority = 10;
+  };
+
+  swapDevices = [
+    {
+      device = "/var/lib/swapfile";
+      size = 32 * 1024;
+      priority = 5;
+    }
+    {
+      device = "/dev/disk/by-label/NixOS_Swap";
+      priority = 0;
+    }
+  ];
+
+  fileSystems."/etc/nixos" = {
+    device = "/materus/config/nixos-config";
+    fsType = "none";
+    options = [ "bind" ];
+    depends = [ "/materus" ];
+  };
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp3s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp6s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkForce true;
+}

configurations/host/Old-materusPC/home/materus/default.nix

@@ -0,0 +1,161 @@
+{ config, pkgs, materusArg, materusCfg, lib, ... }:
+{
+  home.stateVersion = "22.11";
+  home.homeDirectory = "/home/materus";
+  programs.wezterm.enable = true;
+  programs.git = {
+    userEmail = "materus@podkos.pl";
+    userName = "materus";
+    signing.signByDefault = true;
+    signing.key = "${materusArg.cfg.path}/extraFiles/keys/ssh/materus.pub";
+    extraConfig = {
+      commit.gpgsign = true;
+      gpg.format = "ssh";
+    };
+  };
+
+  programs.vscode.userSettings = {
+    "vscord.app.name" = "VSCodium";
+    "window.dialogStyle" = "custom";
+    "window.titleBarStyle" = "custom";
+    "editor.fontFamily" = "'Hack Nerd Font', 'monospace', monospace";
+    "workbench.colorTheme" = "Dracula Theme";
+    "workbench.productIconTheme" = "material-product-icons";
+    "workbench.iconTheme" = "material-icon-theme";
+
+    "d.aggressiveUpdate" = false;
+    "d.servedPath" = "${pkgs.serve-d}/bin/serve-d";
+
+    "direnv.path.executable" = "${pkgs.direnv}/bin/direnv";
+
+    "nix.enableLanguageServer" = true;
+    "nix.serverPath" = "${pkgs.nixd}/bin/nixd";
+    "nix.formatterPath" = "${pkgs.nixfmt-rfc-style}/bin/nixfmt";
+
+    "C_Cpp.clang_format_path" = "${pkgs.clang-tools}/bin/clang-format";
+    "C_Cpp.clang_format_fallbackStyle" = "Microsoft";
+    "clang-tidy.executable" = "${pkgs.clang-tools}/bin/clang-tidy";
+    
+    "typescript.tsserver.maxTsServerMemory" = 1024 * 8;
+    "typescript.tsserver.nodePath"= lib.mkDefault "${pkgs.nodejs}/bin/node";
+
+    "python.defaultInterpreterPath" = "${pkgs.python3Full}/bin/python";
+    "[cpp]" = {
+      "editor.defaultFormatter" = "xaver.clang-format";
+    };
+  };
+
+  materus.profile = {
+    fonts.enable = lib.mkDefault true;
+    nixpkgs.enable = lib.mkDefault false;
+    enableDesktop = lib.mkDefault true;
+    enableTerminal = lib.mkDefault true;
+    enableTerminalExtra = lib.mkDefault true;
+    enableNixDevel = lib.mkDefault true;
+    editor.code.fhs.enable = false;
+      
+    editor.code.fhs.packages = (ps: with ps; let llvmpkgs = llvmPackages_16; in [
+      llvmpkgs.clang
+      llvmpkgs.llvm
+      llvmpkgs.bintools
+      llvmpkgs.lld
+      llvmpkgs.lldb
+      llvmpkgs.libllvm
+      llvmpkgs.libllvm.dev
+
+
+      gcc
+      gdb
+
+      cmake
+      gnumake
+      ninja
+      binutils
+      coreutils
+      util-linux
+
+      dotnet-sdk_8
+      mono
+      mold
+      python3
+      lua
+      gtk4.dev
+      gtk4
+      miniaudio
+      SDL2.dev
+      SDL2
+      freeglut.dev
+      freeglut
+      boost.dev
+      boost
+      glew.dev
+      libGL.dev
+      libGLU.dev
+      vulkan-loader.dev
+
+      jdk
+
+
+      ldc
+      dmd
+      dub
+    ]);
+
+    editor.emacs.enable = true;
+
+  };
+  xdg.desktopEntries.brave-browser =
+    let
+      env = lib.concatStringsSep " " [
+        ''__NV_PRIME_RENDER_OFFLOAD="1"''
+        ''__NV_PRIME_RENDER_OFFLOAD_PROVIDER="NVIDIA-G0"''
+        ''__GLX_VENDOR_LIBRARY_NAME="nvidia"''
+        ''__VK_LAYER_NV_optimus="NVIDIA_only"''
+        ''NIXOS_OZONE_WL="1"''
+      ];
+      script = pkgs.writeShellScript "brave" ''
+        ${env} brave "$@"
+      '';
+
+    in
+    {
+      name = "Brave Web Browser";
+      genericName = "Przeglądarka WWW";
+      comment = "Skorzystaj z internetu";
+      exec = "${script} %U";
+      icon = "brave-browser";
+      terminal = false;
+      categories = [ "Application" "Network" "WebBrowser" ];
+      mimeType = [
+        "application/pdf"
+        "application/rdf+xml"
+        "application/rss+xml"
+        "application/xhtml+xml"
+        "application/xhtml_xml"
+        "application/xml"
+        "image/gif"
+        "image/jpeg"
+        "image/png"
+        "image/webp"
+        "text/html"
+        "text/xml"
+        "x-scheme-handler/http"
+        "x-scheme-handler/https"
+        "x-scheme-handler/ipfs"
+        "x-scheme-handler/ipns"
+      ];
+      actions.new-windows = {
+        exec = "${script}";
+        name = "Nowe okno";
+      };
+      actions.new-private-windows = {
+        exec = "${script} --incognito";
+        name = "Nowe okno incognito";
+      };
+    };
+  home.packages = [
+    pkgs.papirus-icon-theme
+    (materusArg.pkgs.polymc.wrap { extraJDKs = [ pkgs.graalvmPackages.graalvm-oracle pkgs.graalvmPackages.graalvm-oracle_17]; })
+  ];
+
+}

configurations/host/Old-materusPC/network.nix

@@ -0,0 +1,57 @@
+{ config, pkgs, lib, materusArg, ... }:
+{
+  sops.templates."networkmanager.env".content = ''
+    WIREGUARD_PRIVATEKEY="${config.sops.placeholder.wg-key}"
+  '';
+
+  networking.useDHCP = lib.mkDefault true;
+  networking.hostName = "Old-materusPC";
+  networking.wireless.iwd.enable = true;
+  networking.networkmanager.enable = true;
+  # Open ports in the firewall.
+  networking.firewall.allowedTCPPorts = [ 24800 5900 5357 4656 
+  22000 config.services.syncthing.relay.statusPort config.services.syncthing.relay.port # Syncthing
+  ];
+  networking.firewall.allowedUDPPorts = [ 24800 5900 3702 4656 
+  22000 21027 # Syncthing
+  ];
+  # Or disable the firewall altogether.
+  networking.firewall.enable = true;
+  networking.networkmanager.settings = {
+    connectivity = {
+      uri = "http://nmcheck.gnome.org/check_network_status.txt";
+    };
+  };
+
+  networking.networkmanager.ensureProfiles.environmentFiles = [
+    config.sops.templates."networkmanager.env".path
+  ];
+  networking.networkmanager.ensureProfiles.profiles = {
+    wg0 = {
+      connection = {
+        id = "wg0";
+        type = "wireguard";
+        interface-name = "wg0";
+      };
+      wireguard = {
+        private-key = "$WIREGUARD_PRIVATEKEY";
+      };
+      "wireguard-peer.${materusArg.wireguard.pubKeys.valkyrie}" = {
+        endpoint = "${materusArg.ips.valkyrie}:${materusArg.wireguard.port}";
+        allowed-ips = "${materusArg.ip-masks.wireguard.main};${materusArg.ip-masks.wireguard.guest};${materusArg.ip-masks.wireguard.asia};${materusArg.ips.wireguard.valkyrie}/32;";
+        persistent-keepalive = "20";
+      };
+      ipv4 = {
+        address1 = "${materusArg.ips.wireguard.Old-materusPC}/32";
+        dns = "${materusArg.ips.wireguard.valkyrie};";
+        method = "manual";
+        never-default = "true";
+      };
+      ipv6 = {
+        addr-gen-mode = "stable-privacy";
+        method = "disabled";
+      };
+      proxy = { };
+    };
+  };
+}

configurations/host/Old-materusPC/nvidia.nix

@@ -0,0 +1,29 @@
+{ config, pkgs, ... }:
+{
+  services.xserver.videoDrivers = [ "nvidia" ];
+  hardware.nvidia = {
+    package = config.boot.kernelPackages.nvidiaPackages.latest;
+    modesetting.enable = true;
+    nvidiaSettings = true;
+    open = true;
+
+  };
+  hardware.opengl.extraPackages = with pkgs; [
+    vaapiVdpau
+    nvidia-vaapi-driver
+    libvdpau-va-gl
+  ];
+
+  hardware.opengl.extraPackages32 = with pkgs.pkgsi686Linux; [
+    vaapiVdpau
+    nvidia-vaapi-driver
+    libvdpau-va-gl
+  ];
+  materus.profile.steam.extraEnv = {
+    VK_ICD_FILENAMES=''''$VK_ICD_FILENAMES:/run/opengl-driver/share/vulkan/icd.d/nvidia_icd.x86_64.json:/run/opengl-driver-32/share/vulkan/icd.d/nvidia_icd.i686.json'';
+    __NV_PRIME_RENDER_OFFLOAD="1";
+    __NV_PRIME_RENDER_OFFLOAD_PROVIDER="NVIDIA-G0";
+    __GLX_VENDOR_LIBRARY_NAME="nvidia";
+    __VK_LAYER_NV_optimus="NVIDIA_only";
+  };
+}

configurations/host/Old-materusPC/plasma.nix

@@ -0,0 +1,31 @@
+{ pkgs, ... }:
+{
+
+  services.displayManager.sddm.enable = true;
+  services.displayManager.sddm.wayland.enable = true;
+  services.displayManager.sddm.settings = {
+    General = {
+      InputMethod = "";
+    };
+    Theme = {
+      CursorTheme = "breeze_cursors";
+      CursorSize = "24";
+    };
+  };
+  environment.variables = {
+    QT_PLUGIN_PATH = [ "${pkgs.qt6.qtimageformats}/${pkgs.qt6.qtbase.qtPluginPrefix}" ];
+    XCURSOR_THEME = "breeze_cursors";
+  };
+  xdg.portal.enable = true;
+  xdg.portal.wlr.enable = true;
+  xdg.portal.xdgOpenUsePortal = true;
+  xdg.portal.extraPortals = [ pkgs.kdePackages.xdg-desktop-portal-kde ];
+  services.desktopManager.plasma6.enable = true;
+  services.desktopManager.plasma6.enableQt5Integration = true;
+  environment.plasma6.excludePackages = with pkgs.kdePackages; [ kwallet kwalletmanager kwallet-pam ];
+  environment.systemPackages = with pkgs.kdePackages; [
+    ark
+    kate
+  ];
+  materus.profile.steam.extraPkgs = [ pkgs.kdePackages.breeze pkgs.kdePackages.breeze-gtk pkgs.kdePackages.dolphin ];
+}

configurations/host/Old-materusPC/secrets/default.nix

@@ -0,0 +1,25 @@
+{ config, pkgs, lib, materusCfg, ... }:
+{
+  imports =
+    [
+
+    ] ++ (if (materusCfg.materusFlake.decrypted) then [ ./private ] else [ ]);
+
+  sops.age.generateKey = false;
+  sops.gnupg.home = null;
+  sops.gnupg.sshKeyPaths = [ ];
+  sops.defaultSopsFile = materusCfg.hostPath + "/secrets/secrets.yaml";
+  sops.secrets."wg-key" = { };
+  services.openssh.hostKeys = [
+    {
+      bits = 4096;
+      path = "/materus/root/ssh_host_rsa_key";
+      type = "rsa";
+    }
+    {
+      path = "/materus/root/ssh_host_ed25519_key";
+      type = "ed25519";
+    }
+  ];
+
+}

configurations/host/Old-materusPC/secrets/secrets.yaml

@@ -0,0 +1,33 @@
+wg-key: ENC[AES256_GCM,data:+z+Xxq6A1h5ceCOZry9PSz871zVZpd9Y6vtqpfoAulHCN03DjzZ/PLmRvYQ=,iv:7hdjnUuaRk30hFJ8rv4zXxI8v42RWC1iQb64LMNgBnQ=,tag:eUSTVygR+u9ERPU9gfhYIw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1el7zhjxkrlravpt7hw36fuac0xfgd42qkjjkvxzqmyl28u8csasqkd4a40
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsT2w4SCt2ZGdLYktHckMw
+            QVhza2tqU2M1Q3lsYnhld1dKcTdYUHcvSzFrCjMxT05yU01nUmFQK0FCUThUNDNN
+            V2EyTUhoVUNjNlNwTU9FeTlGRkxvVDgKLS0tIDBFYys1TmI0T0x0RnE2N3JCWWpq
+            VFVjMGUvRVBaY0JsR2lVcUFsdk4rYjQKEiiqEcTaQSVXSAm5c9uylaf2Tt/KJtPl
+            GDp+2YSBHHnVYjtYf7k9WqsIEe5/0AifDp3YA8jNhOXuZwZdvk+fLw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-03-30T18:21:12Z"
+    mac: ENC[AES256_GCM,data:0DMB+ukujc6PMU45n1QJGryGie25Bj2hXmia69QgYZNk2vgfO+nYmWSpmqK4Z00xXNtbsgejfDto5mrzU/OJ4FF3eOfwWfdIwxQLEQKoPF5U3niON3YO8FEA+JIn+/fNGF3fY1AgBfhberST5ikKnmff1Nwe5GOwQHSB3LU+CZE=,iv:V89EFUby3bwsoZKpoJRmJS9E/UheMBkKDq7j40IzBTA=,tag:aOJnFFGIuzQ3T7YrIFiWtw==,type:str]
+    pgp:
+        - created_at: "2024-03-30T18:20:23Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4D5fSX77p80GYSAQdAnUVLGsgIKd3EtSAGTPyXqSlsz1T8RnDvAtBz/XaH0y0w
+            pkp84zTe85FRZDnTO8a44WkpNIrUih0CYQSPPCZqSi/qnIxPWgx67HTC1bPAO9Iw
+            1GgBCQIQNcrKr4YNKSP5XxJqMXOyZD7rZ4g02Xdw5XplZ/y34m9c83S44XRgHwg4
+            0obXI1UlsqyHf/ZnTM1pbXO/kdTdFomWvWbfbuKDgDvyiJJ18mJ48GOsv/SBBJjJ
+            3877O+Ia5I8Chg==
+            =q58P
+            -----END PGP MESSAGE-----
+          fp: 28D140BCA60B4FD1
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

configurations/host/default.nix

@@ -0,0 +1,66 @@
+{ inputs, materusFlake }:
+
+let
+  profiles = import ../profile;
+
+  makeSystem = { host, arch ? "x86_64-linux", extraModules ? [ ], stable ? true, hmAsModule ? true, hmUsers ? [ "materus" ] }:
+    let
+      nixosSystem = if stable then inputs.nixpkgs-stable.lib.nixosSystem else inputs.nixpkgs.lib.nixosSystem;
+      hm = if stable then inputs.configInputs-stable.home-manager else inputs.configInputs.home-manager;
+      materusCfg = {
+        inherit stable;
+        inherit materusFlake;
+        inherit host;
+        inherit hm;
+        inherit hmAsModule;
+        inherit arch;
+        nixerus = if stable then inputs.configInputs-stable.nixerus else inputs.configInputs.nixerus;
+        configInputs = if stable then inputs.configInputs-stable else inputs.configInputs;
+        path = materusFlake.selfPath;
+        hostPath = materusFlake.selfPath + "/configurations/host/${host}";
+        isHm = false;
+      };
+    in
+    (nixosSystem {
+      specialArgs = { inherit materusCfg; };
+      system = arch;
+      modules = [
+        ./${host}
+        profiles.osProfile
+        materusCfg.configInputs.sops-nix.nixosModules.sops
+        (if hmAsModule then hm.nixosModules.home-manager else { })
+        (if hmAsModule then
+          {
+            home-manager.backupFileExtension = "hm-backup";
+            home-manager.useGlobalPkgs = true;
+            home-manager.useUserPackages = true;
+            home-manager.sharedModules = [
+              materusCfg.configInputs.plasma-manager.homeManagerModules.plasma-manager
+              materusCfg.configInputs.sops-nix.homeManagerModules.sops
+            ];
+            home-manager.users = (builtins.foldl' (a: b: a // b) { } (builtins.map
+              (user: {
+                ${user} = ({ ... }:
+                  {
+                    imports = [
+                      (materusFlake.selfPath + "/configurations/shared/home/${user}")
+                      (materusFlake.selfPath + "/configurations/host/${host}/home/${user}")
+                      profiles.homeProfile
+                    ];
+                  });
+              })
+              hmUsers));
+            home-manager.extraSpecialArgs = { materusCfg = materusCfg // { isHm = true; }; };
+          } else { })
+
+      ] ++ extraModules;
+    }) // { inherit materusCfg; };
+in
+{
+  materusPC = makeSystem { host = "materusPC"; stable = true; };
+  flamaster = makeSystem { host = "flamaster"; stable = true; };
+  valkyrie = makeSystem { host = "valkyrie"; stable = true; };
+  waffentrager = makeSystem { host = "waffentrager"; stable = true; arch = "aarch64-linux"; };
+
+  Old-materusPC = makeSystem { host = "Old-materusPC"; stable = true; };
+}

configurations/host/flamaster/configuration.nix

@@ -0,0 +1,196 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, lib, pkgs, materusArg, ... }:
+
+{
+  imports =
+    [
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+    ];
+
+  networking.wireless.iwd.enable = true;
+  services.logind.lidSwitch = "ignore";
+  services.logind.lidSwitchExternalPower = "ignore";
+  programs.steam = {
+    enable = true;
+    remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play
+    dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server
+  };
+
+  programs.tmux = {
+    enable = true;
+    clock24 = true;
+  };
+  programs.java = {
+    enable = true;
+    package = pkgs.graalvm-ce;
+    binfmt = true;
+  };
+  # Bootloader.
+  boot.loader.grub = {
+    enable = true;
+    efiSupport = true;
+    device = "nodev";
+    useOSProber = true;
+    gfxmodeEfi = pkgs.lib.mkDefault "1920x1080";
+    gfxmodeBios = pkgs.lib.mkDefault "1920x1080";
+    #efiInstallAsRemovable = true;	
+  };
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.efi.efiSysMountPoint = "/boot/efi";
+
+  networking.hostName = "flamaster"; # Define your hostname.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Enable networking
+  networking.networkmanager.enable = true;
+  networking.networkmanager.wifi.backend = "iwd";
+  # Set your time zone.
+  time.timeZone = "Europe/Warsaw";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "pl_PL.UTF-8";
+
+  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+
+  hardware.nvidia.open = false;
+  services.xserver.videoDrivers = [ "nvidia" ];
+  hardware.opengl.enable = true;
+  hardware.nvidia.prime = {
+    offload.enable = true;
+
+    # Bus ID of the Intel GPU. You can find it using lspci, either under 3D or VGA
+    intelBusId = "PCI:0:2:0";
+
+    # Bus ID of the NVIDIA GPU. You can find it using lspci, either under 3D or VGA
+    nvidiaBusId = "PCI:1:0:0";
+  };
+
+
+  # Enable the KDE Plasma Desktop Environment.
+  services.xserver.displayManager.sddm.enable = true;
+  services.xserver.desktopManager.plasma6.enable = true;
+
+  # Configure keymap in X11
+  services.xserver = {
+    layout = "pl";
+    xkbVariant = "";
+  };
+
+  # Configure console keymap
+  console.keyMap = "pl2";
+
+  # Enable CUPS to print documents.
+  services.printing.enable = true;
+
+  # Enable sound with pipewire.
+  #sound.enable = true;
+  hardware.pulseaudio.enable = false;
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    # If you want to use JACK applications, uncomment this
+    jack.enable = true;
+
+    # use the example session manager (no others are packaged yet so this is enabled by default,
+    # no need to redefine it in your config for now)
+    #media-session.enable = true;
+  };
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  services.libinput.enable = true;
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.materus = {
+    isNormalUser = true;
+    description = "Mateusz Słodkowicz";
+    extraGroups = [ "networkmanager" "wheel" ];
+    openssh.authorizedKeys.keyFiles = [ ("${materusArg.cfg.path}" + "/extraFiles/keys/ssh/materus.pub") ];
+    packages = with pkgs; [
+      kdePackages.kate
+    ];
+    shell = pkgs.zsh;
+  };
+
+  # Allow unfree packages
+  nixpkgs.config.allowUnfree = true;
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [
+    #  vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+    wget
+    util-linux
+    killall
+    pciutils
+    lshw
+    steamcmd
+    distrobox
+
+
+    firefox
+    config.programs.java.package
+
+
+  ];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+  services.openssh.settings.PermitRootLogin = "no";
+  services.openssh.settings.PasswordAuthentication = false;
+  services.openssh.openFirewall = true;
+  programs.ssh.startAgent = true;
+
+  # Open ports in the firewall.
+  networking.firewall.allowedTCPPorts = [ 22 27015 25565 25570 8123 8100 24800 ];
+  networking.firewall.allowedTCPPortRanges = [{ from = 16262; to = 16272; }];
+  networking.firewall.allowedUDPPorts = [ 22 16261 16262 8766 8767 25565 24454 8123 24800 ];
+  # Or disable the firewall altogether.
+  networking.firewall.enable = true;
+
+  networking.networkmanager.settings = {
+    connectivity = { uri = lib.mkDefault "http://nmcheck.gnome.org/check_network_status.txt"; };
+      };
+
+    # This value determines the NixOS release from which the default
+    # settings for stateful data, like file locations and database versions
+    # on your system were taken. It‘s perfectly fine and recommended to leave
+    # this value at the release version of the first install of this system.
+    # Before changing this value read the documentation for this option
+    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+    system.stateVersion = "23.05"; # Did you read the comment?
+
+
+    programs.neovim.enable = true;
+    programs.neovim.vimAlias = true;
+    programs.neovim.viAlias = true;
+
+    services.flatpak.enable = true;
+    xdg.portal.enable = true;
+
+    virtualisation.podman.enable = true;
+    virtualisation.podman.dockerCompat = true;
+    virtualisation.podman.enableNvidia = true;
+    virtualisation.podman.dockerSocket.enable = true;
+  }

configurations/host/flamaster/default.nix

@@ -0,0 +1,12 @@
+{ config, lib, pkgs, ... }:
+{
+  imports =
+    [
+      # Include the results of the hardware scan.
+      ./configuration.nix
+    ];
+  materus.profile.nix.enable = true;
+  #materus.profile.steam.enable = true;
+
+
+}

configurations/host/flamaster/hardware-configuration.nix

@@ -0,0 +1,78 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [
+      (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" "rtsx_usb_sdmmc" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    {
+      device = "/dev/disk/by-label/NixOS_Root_Laptop";
+      fsType = "btrfs";
+      options = [ "subvol=@" "noatime" "ssd" "space_cache=v2" "compress=zstd" ];
+    };
+  fileSystems."/nix" =
+    {
+      device = "/dev/disk/by-label/NixOS_Root_Laptop";
+      fsType = "btrfs";
+      options = [ "subvol=@nix" "noatime" "compress=zstd" "ssd" "space_cache=v2" ];
+    };
+    fileSystems."/data" =
+    {
+      device = "/dev/disk/by-label/HDD_DATA";
+      fsType = "btrfs";
+      options = [ "noatime" "compress=zstd" "nossd" "autodefrag" ];
+    };
+  fileSystems."/boot" =
+    {
+      device = "/dev/disk/by-label/NixOS_Root_Laptop";
+      fsType = "btrfs";
+      options = [ "subvol=@boot" "ssd" ];
+    };
+
+  fileSystems."/boot/efi" =
+    {
+      device = "/dev/disk/by-label/NixOS_EFI_L";
+      fsType = "vfat";
+    };
+
+
+  fileSystems."/etc/nixos" =
+    {
+      device = "/materus/config/nixos-config";
+      fsType = "none";
+      options = [ "bind" ];
+    };
+
+  swapDevices = [{
+    device = "/data/.swapfile";
+    size = 32 * 1024;
+  }];
+
+  zramSwap = {
+    enable = true;
+    memoryPercent = 50;
+  };
+
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp5s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlo1.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

configurations/host/flamaster/home/materus/default.nix

@@ -0,0 +1,87 @@
+{ config, pkgs, materusArg, lib, ... }:
+{
+  home.stateVersion = "23.05";
+  home.homeDirectory = "/home/materus";
+  
+  xdg.dataFile."java-runtimes/graalvm-oracle-17".source = pkgs.graalvmPackages.graalvm-oracle_17;
+  xdg.dataFile."java-runtimes/graalvm-oracle-latest".source = pkgs.graalvmPackages.graalvm-oracle;
+  xdg.dataFile."java-runtimes/openjdk21".source = pkgs.jdk21;
+
+  materus.profile = {
+    fonts.enable = lib.mkDefault true;
+    nixpkgs.enable = lib.mkDefault false;
+    enableDesktop = lib.mkDefault true;
+    enableTerminal = lib.mkDefault true;
+    enableTerminalExtra = lib.mkDefault true;
+    enableNixDevel = lib.mkDefault true;
+    
+    bash.enable = true;
+    zsh.enable = true;
+    editor.code.fhs.enable = true;
+    editor.code.fhs.packages = (ps: with ps; let llvmpkgs = llvmPackages_16; in [
+      llvmpkgs.clang
+      llvmpkgs.llvm
+      llvmpkgs.bintools
+      llvmpkgs.lld
+      llvmpkgs.lldb
+      llvmpkgs.libllvm
+      llvmpkgs.libllvm.dev
+
+      raylib
+      gcc
+      gdb
+      materusArg.unstable.nixd
+      nixfmt-rfc-style
+      nixpkgs-fmt
+      cmake
+      gnumake
+      ninja
+      binutils
+      coreutils
+      util-linux
+      openssl
+      openssl.dev
+      pkg-config
+      dotnet-sdk_8
+      mono
+      mold
+      python3
+      lua
+      gtk4.dev
+      gtk4
+      miniaudio
+      SDL2.dev
+      SDL2
+      freeglut.dev
+      freeglut
+      boost.dev
+      boost
+      glew.dev
+      libGL.dev
+      libGLU.dev
+      vulkan-loader.dev
+      xorg.xorgproto
+      xorg.libX11.dev
+      xorg.libXrandr.dev
+      xorg.libXrender.dev
+      rustup
+      freetype.dev
+
+      fpc
+      openjdk21
+      bison
+      flex
+
+      ldc
+      dmd
+      dub
+    ]);
+
+  };
+  
+  home.packages = [
+    pkgs.papirus-icon-theme
+    (materusArg.pkgs.polymc.wrap { extraJDKs = [ pkgs.graalvm-ce ]; })
+  ];
+
+}

configurations/host/materusPC/audio.nix

@@ -0,0 +1,90 @@
+{ pkgs, lib, ... }:
+{
+  #REGION test
+  #sound.enable = true;
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    audio.enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    systemWide = true;
+    jack.enable = true;
+  };
+  hardware.pulseaudio.enable = false;
+  environment.sessionVariables =
+    let
+      makePluginPath =
+        format:
+        "$HOME/.${format}:"
+        + (lib.makeSearchPath format [
+          "$HOME/.nix-profile/lib"
+          "/run/current-system/sw/lib"
+          "/etc/profiles/per-user/$USER/lib"
+        ]);
+    in
+    {
+      ALSOFT_DRIVERS = "pulse";
+
+      DSSI_PATH = makePluginPath "dssi";
+      LADSPA_PATH = makePluginPath "ladspa";
+      LV2_PATH = makePluginPath "lv2";
+      LXVST_PATH = makePluginPath "lxvst";
+      VST_PATH = makePluginPath "vst";
+      VST3_PATH = makePluginPath "vst3";
+
+    };
+
+  services.udev = let
+    script = pkgs.writeShellScript "arch-mknod" ''
+      ACTION=$1
+      KERNEL=$(basename $2)
+      MAJOR=$3
+      MINOR=$4
+
+
+      if (systemctl is-active --quiet systemd-nspawn@archlinux); then
+          if [[ $ACTION == "add" || "$ACTION" == "change"  ]]; then
+              machinectl shell root@archlinux /bin/bash -c "
+                  if ! [ -f /dev/$KERNEL ]; then
+                    mknod /dev/$KERNEL c $MAJOR $MINOR
+                    chmod 660 /dev/$KERNEL
+                    chown root:input /dev/$KERNEL
+                  fi
+              "
+          elif [[ $ACTION == "remove" ]]; then
+              machinectl shell root@archlinux /bin/rm /dev/$KERNEL
+          fi
+      fi
+
+    '';
+  in {
+    extraRules = ''
+      KERNEL=="rtc0", GROUP="audio"
+      KERNEL=="hpet", GROUP="audio"
+      DEVPATH=="/devices/virtual/misc/cpu_dma_latency", OWNER="root", GROUP="audio", MODE="0660"
+
+      
+      SUBSYSTEM=="hidraw", KERNEL=="hidraw*", RUN+="${script} ''$env{ACTION} ''$env{DEVNAME} ''$env{MAJOR} ''$env{MINOR}"
+    '';
+  };
+  environment.systemPackages = with pkgs; [
+    openal
+    pulseaudio
+
+    reaper
+
+    yabridge
+    yabridgectl
+
+    vital
+    odin2
+    surge
+    fire
+    decent-sampler
+    lsp-plugins
+
+  ];
+
+}

configurations/host/materusPC/containers/arch.nix

@@ -8,12 +8,13 @@ let
   mainMirror = "https://ftp.icm.edu.pl/pub/Linux/dist/archlinux";
   extraMirrors = [ ];
   getty = [
-    8
+    6
-    9
+    7
   ];
   ttys = [
+    6
+    7
     8
-    9
   ] ++ getty;
 
   startPkgs = lib.strings.concatStringsSep " " [
@@ -122,12 +123,12 @@ in
 
         "/tmp/.X11-unix"
 
-        /mkk
+        /materus
 
       ] ++ lib.lists.forEach ttys (x: "/dev/tty${builtins.toString x}");
     };
     networkConfig = {
-      Bridge = "br0";
+      Private = false;
     };
   };
   systemd.services."systemd-nspawn@archlinux" = {

configurations/host/materusPC/containers/default.nix

@@ -1,11 +1,12 @@
-{ ... }:
+{...}:
 {
   imports = [
-    ./nspawn/arch.nix
+    ./arch.nix
+    ./fedora.nix
   ];
-
   virtualisation.lxc.enable = true;
   virtualisation.lxc.lxcfs.enable = true;
+  virtualisation.lxd.enable = false;
 
   virtualisation.waydroid.enable = true;
   virtualisation.podman = {

configurations/host/materusPC/containers/fedora.nix

@@ -0,0 +1,75 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  ttys = [
+    9
+    10
+  ];
+
+in
+{
+  systemd.nspawn."fedora" = {
+    enable = true;
+    execConfig = {
+      Boot = true;
+      SystemCallFilter = [ "@known" ];
+      Timezone = "symlink";
+      Capability = "all";
+      PrivateUsers = "no";
+      ResolvConf = "off";
+    };
+
+    filesConfig = {
+      BindReadOnly = [
+        "/nix"
+
+        "/run/current-system"
+        "/run/booted-system"
+        "/run/opengl-driver"
+        "/run/opengl-driver-32"
+
+      ];
+      Bind = [
+        "/:/run/host-root"
+
+        "/run/udev"
+
+        "/dev/fuse"
+        "/dev/snd"
+        "/dev/input"
+        "/dev/shm"
+        "/dev/kfd"
+        "/dev/dri"
+        "/dev/tty"
+        "/dev/tty0"
+
+        "/var/lib/flatpak"
+
+        "/tmp/.X11-unix"
+
+        /materus
+
+      ] ++ lib.lists.forEach ttys (x: "/dev/tty${builtins.toString x}");
+    };
+    networkConfig = {
+      Bridge="br0";
+    };
+  };
+  systemd.services."systemd-nspawn@fedora" = {
+    enable = true;
+    overrideStrategy = "asDropin";
+    serviceConfig = {
+      ConditionPathExists="/var/lib/machines/fedora";
+      DeviceAllow = [
+        "char-tty rwm"
+        "char-input rwm"
+        "char-drm rwm"
+      ];
+      
+    };
+  };
+}

configurations/host/materusPC/default.nix

@@ -0,0 +1,35 @@
+{ config, pkgs, lib, ... }:
+{
+  imports =
+    [
+
+      ./hardware
+      ./vm
+      ./secrets
+      ./containers
+      ./other
+
+      ./scripts.nix
+      ./tmp.nix
+      ./network.nix
+
+      ./audio.nix
+    ];
+
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  system.copySystemConfiguration = false;
+  system.stateVersion = "23.05";
+
+
+  materus.profile.nix.enable = true;
+  materus.profile.nixpkgs.enable = true;
+  materus.profile.fonts.enable = true;
+  materus.profile.steam.enable = false;
+
+  services.logind.extraConfig  = ''
+    NAutoVTs=4
+    ReserveVT=4
+  '';
+
+}

configurations/host/materusPC/hardware/boot.nix

@@ -0,0 +1,82 @@
+{ config, pkgs, lib, materusArg, ... }:
+let
+  video = [
+
+    "video=HDMI-A-3:1920x1080@144"
+    "video=DP-3:1920x1080@240"
+
+
+    #"video=DP-1:1920x1080@240"
+    #"video=DP-2:1920x1080@240"
+    #"video=HDMI-A-1:1920x1080@240"
+    #"video=HDMI-A-2:1920x1080@240"
+
+
+  ];
+
+in
+{
+  #Kernel
+
+  boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_zen;
+
+  boot.kernelParams = [
+    "rcu_nocbs=${materusArg.materusPC.vmCores}"
+    "nohz_full=${materusArg.materusPC.vmCores}"
+    "vfio_iommu_type1.allow_unsafe_interrupts=1"
+    "pcie_acs_override=downstream,multifunction"
+    #''vfio-pci.ids="1002:744c"''
+    "nox2apic"
+    "nvme_core.default_ps_max_latency_us=0"
+    "nvme_core.io_timeout=255"
+    "nvme_core.max_retries=10"
+    "nvme_core.shutdown_timeout=10"
+    "amd_iommu=on"
+    "amdgpu.ppfeaturemask=0xffffffff"
+    #"amdgpu.runpm=0"
+    "iommu=pt"
+    "psi=1"
+    "i915.force_probe=!56a6" 
+    "xe.force_probe=56a6"
+  ] ++ video;
+  boot.kernelModules = [ "pci-stub" "amdgpu" "i2c_dev" "kvm_amd" "vfio" "vfio_iommu_type1" "vfio-pci" "kvmfr" "xe" ];
+  boot.extraModprobeConfig = ''
+    options kvm_amd nested=1 avic=1 npt=1 sev=0
+    options vfio_iommu_type1 allow_unsafe_interrupts=1
+    options kvmfr static_size_mb=64
+  '';
+  boot.kernel.sysctl = {
+    "vm.max_map_count" = 1000000;
+    "vm.swappiness" = 10;
+    "net.ipv4.ip_forward"=1;
+  };
+
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod" ];
+  boot.initrd.kernelModules = [ "vfio-pci" "amdgpu" ];
+  
+  boot.extraModulePackages = with config.boot.kernelPackages; [ v4l2loopback kvmfr ];
+
+
+  boot.supportedFilesystems = [ "ntfs" "btrfs" "vfat" "exfat" "ext4" ];
+
+  boot.tmp.useTmpfs = true;
+
+
+  #bootloader
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.efi.efiSysMountPoint = "/boot/efi";
+  boot.loader.grub = {
+    enable = true;
+    efiSupport = true;
+    device = "nodev";
+    gfxmodeEfi = pkgs.lib.mkDefault "1920x1080@240";
+    gfxmodeBios = pkgs.lib.mkDefault "1920x1080@240";
+    useOSProber = true;
+    memtest86.enable = true;
+  };
+
+  boot.plymouth.enable = true;
+
+  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
+}

configurations/host/materusPC/hardware/default.nix

@@ -0,0 +1,65 @@
+{ config, pkgs, lib, materusArg, ... }:
+{
+  imports =
+    [
+      ./filesystem.nix
+      ./boot.nix
+
+    ];
+  hardware.firmware = with pkgs; [
+    materusArg.pkgs.amdgpu-pro-libs.firmware.vcn
+    materusArg.pkgs.amdgpu-pro-libs.firmware
+    linux-firmware
+    alsa-firmware
+    sof-firmware
+  ];
+
+  environment.variables = {
+    DISABLE_LAYER_AMD_SWITCHABLE_GRAPHICS_1 = "1";
+    #VK_ICD_FILENAMES = "${pkgs.mesa.drivers}/share/vulkan/icd.d/radeon_icd.x86_64.json:${pkgs.driversi686Linux.mesa.drivers}/share/vulkan/icd.d/radeon_icd.i686.json";
+    AMD_VULKAN_ICD = "RADV";
+    RADV_PERFTEST = "gpl,rt,sam";
+    #OCL_ICD_VENDORS = "${pkgs.rocmPackages.clr.icd}/etc/OpenCL/vendors/";
+  };
+  hardware.cpu.amd.updateMicrocode = lib.mkForce true;
+
+  #extra
+  hardware.wooting.enable = true;
+  hardware.bluetooth.enable = true;
+  #Graphics
+  hardware.opengl.enable = true;
+  hardware.opengl.driSupport32Bit = true;
+  hardware.opengl.extraPackages = with pkgs; [
+    vaapiVdpau
+    vpl-gpu-rt
+    intel-media-driver 
+    libvdpau-va-gl
+    amdvlk
+    vkbasalt
+    rocmPackages.clr.icd
+    rocmPackages.clr
+    materusArg.pkgs.amdgpu-pro-libs.vulkan
+    materusArg.pkgs.amdgpu-pro-libs.amf
+  ];
+  hardware.opengl.extraPackages32 = with pkgs.pkgsi686Linux; [
+    vaapiVdpau
+    vkbasalt
+    pkgs.driversi686Linux.amdvlk
+    materusArg.pkgs.i686Linux.amdgpu-pro-libs.vulkan
+    libvdpau-va-gl
+  ];
+  /*services.udev.extraRules = ''
+
+    #GPU bar size
+    ACTION=="add", SUBSYSTEM=="pci", ATTR{vendor}=="0x1002", ATTR{device}=="0x744c", ATTR{resource0_resize}="15"
+    ACTION=="add", SUBSYSTEM=="pci", ATTR{vendor}=="0x1002", ATTR{device}=="0x744c", ATTR{resource2_resize}="8"
+  '';*/
+
+
+  #Trim
+  services.fstrim = {
+    enable = true;
+    interval = "weekly";
+  };
+
+}

configurations/host/materusPC/hardware/filesystem.nix

@@ -0,0 +1,68 @@
+{ config, pkgs, lib, ... }:
+{
+  zramSwap = {
+    enable = true;
+    memoryPercent = 50;
+  };
+
+  swapDevices = [
+    {
+      label = "NixOS_Swap";
+    }
+  ];
+
+
+  fileSystems."/etc/nixos" =
+    {
+      device = "/materus/config/nixos-config";
+      fsType = "none";
+      options = [ "bind" ];
+      depends = [ "/materus" ];
+    };
+
+
+  fileSystems."/materus" =
+    {
+      device = "/dev/disk/by-label/NixOS_Root";
+      fsType = "btrfs";
+      options = [ "subvol=@materus" "noatime" "compress=zstd" "ssd" "space_cache=v2" ];
+      neededForBoot = true;
+    };
+
+  fileSystems."/" =
+    {
+      device = "/dev/disk/by-label/NixOS_Root";
+      fsType = "btrfs";
+      options = [ "subvol=@" "noatime" "ssd" "space_cache=v2" "compress=zstd" ];
+    };
+
+  fileSystems."/nix" =
+    {
+      device = "/dev/disk/by-label/NixOS_Root";
+      fsType = "btrfs";
+      options = [ "subvol=@nix" "noatime" "compress=zstd" "ssd" "space_cache=v2" ];
+    };
+
+  fileSystems."/home" =
+    {
+      device = "/dev/disk/by-label/NixOS_Root";
+      fsType = "btrfs";
+      options = [ "subvol=@home" "noatime" "compress=zstd" "ssd" "space_cache=v2" ];
+    };
+
+  fileSystems."/boot" =
+    {
+      device = "/dev/disk/by-label/NixOS_Root";
+      fsType = "btrfs";
+      options = [ "subvol=@boot" "ssd" ];
+    };
+
+
+
+  fileSystems."/boot/efi" =
+    {
+      device = "/dev/disk/by-label/NixOS_EFI";
+      fsType = "vfat";
+    };
+
+}

configurations/host/materusPC/home/materus/default.nix

@@ -0,0 +1,188 @@
+{
+  pkgs,
+  materusArg,
+  lib,
+  config,
+  ...
+}:
+{
+  imports = [
+    ./plasma.nix
+  ];
+  home.stateVersion = "23.05";
+  home.homeDirectory = "/home/materus";
+  
+  materus.profile.wezterm.enable = true;
+  
+  programs.git.signing.signByDefault = true;
+  
+  xdg.userDirs.enable = true;
+  materus.profile = {
+
+    fonts.enable = lib.mkDefault true;
+    nixpkgs.enable = lib.mkDefault false;
+    enableDesktop = lib.mkDefault true;
+    enableTerminal = lib.mkDefault true;
+    enableTerminalExtra = lib.mkDefault true;
+    enableNixDevel = lib.mkDefault true;
+    editor.emacs.enable = true;
+    editor.code.fhs.enable = true;
+    editor.code.fhs.packages = (
+      ps:
+      with ps;
+      let
+        llvmpkgs = llvmPackages_18;
+      in
+      [
+        llvmpkgs.clang
+        llvmpkgs.llvm
+        llvmpkgs.bintools
+        llvmpkgs.lld
+        llvmpkgs.lldb
+        llvmpkgs.libllvm
+        llvmpkgs.mlir
+        llvmpkgs.libllvm.dev
+
+        fpc
+        xmake
+        raylib
+        gcc
+        gdb
+        materusArg.unstable.nixd
+        nixfmt-rfc-style
+        nixpkgs-fmt
+        cmake
+        gnumake
+        ninja
+        binutils
+        coreutils
+        util-linux
+        openssl
+        openssl.dev
+        pkg-config
+        dotnet-sdk_8
+        mono
+        mold
+        python3
+        lua
+        gtk4.dev
+        gtk4
+        glib
+        glib.dev
+        miniaudio
+        SDL2.dev
+        SDL2
+        freeglut.dev
+        freeglut
+        boost.dev
+        boost
+        glew.dev
+        libGL.dev
+        libGLU.dev
+        vulkan-loader.dev
+        vulkan-headers
+        xorg.xorgproto
+        xorg.libX11.dev
+        xorg.libXrandr.dev
+        xorg.libXrender.dev
+        rustup
+        freetype.dev
+
+        fpc
+        gradle
+        bison
+        flex
+
+        ldc
+        dmd
+        dub
+      ]
+    );
+
+  };
+
+  home.packages = [
+    (pkgs.ffmpeg-full)
+    (materusArg.pkgs.polymc.wrap {
+      extraJDKs = [ pkgs.graalvm-ce ];
+      extraLibs = [ ];
+    })
+    pkgs.git-crypt
+    pkgs.obsidian
+  ];
+
+  programs.obs-studio = {
+    enable = true;
+    plugins = with pkgs.obs-studio-plugins; [
+      wlrobs
+      input-overlay
+
+      obs-source-switcher
+      obs-tuna
+      obs-vaapi
+      obs-vkcapture
+      obs-gstreamer
+      obs-backgroundremoval
+      obs-multi-rtmp
+      obs-pipewire-audio-capture
+    ];
+  };
+
+  home.file.".gradle/gradle.properties".text = ''
+    org.gradle.java.installations.fromEnv=JAVA_8_HOME,JAVA_17_HOME,JAVA_21_HOME
+    org.gradle.home=${pkgs.jdk21}
+  '';
+  
+  xdg.dataFile."java-runtimes/graalvm-oracle-17".source = pkgs.graalvmPackages.graalvm-oracle_17;
+  xdg.dataFile."java-runtimes/graalvm-oracle-latest".source = pkgs.graalvmPackages.graalvm-oracle;
+  xdg.dataFile."java-runtimes/openjdk21".source = pkgs.jdk21;
+  
+  xdg.desktopEntries.brave-browser =
+    let
+      env = lib.concatStringsSep " " [
+      ];
+      script = pkgs.writeShellScript "brave" ''
+        ${env} brave "$@"
+      '';
+
+    in
+    {
+      name = "Brave Web Browser";
+      genericName = "Przeglądarka WWW";
+      comment = "Skorzystaj z internetu";
+      exec = "${script} %U";
+      icon = "brave-browser";
+      terminal = false;
+      categories = [
+        "Application"
+        "Network"
+        "WebBrowser"
+      ];
+      mimeType = [
+        "application/pdf"
+        "application/rdf+xml"
+        "application/rss+xml"
+        "application/xhtml+xml"
+        "application/xhtml_xml"
+        "application/xml"
+        "image/gif"
+        "image/jpeg"
+        "image/png"
+        "image/webp"
+        "text/html"
+        "text/xml"
+        "x-scheme-handler/http"
+        "x-scheme-handler/https"
+        "x-scheme-handler/ipfs"
+        "x-scheme-handler/ipns"
+      ];
+      actions.new-windows = {
+        exec = "${script}";
+        name = "Nowe okno";
+      };
+      actions.new-private-windows = {
+        exec = "${script} --incognito";
+        name = "Nowe okno incognito";
+      };
+    };
+}

configurations/host/materusPC/home/materus/plasma.nix

@@ -0,0 +1,139 @@
+{ pkgs, materusArg, ... }:
+{
+  home.packages = [
+    pkgs.papirus-icon-theme
+    pkgs.nerd-fonts.hack
+  ];
+
+  xdg.dataFile."konsole/materus-linux.keytab".source = ("${materusArg.cfg.path}" + "/extraFiles/config/plasma/materus-linux.keytab");
+  programs.konsole = {
+    enable = true;
+    profiles = {
+      materus = {
+        colorScheme = "Breeze";
+        font.name = "Hack Nerd Font";
+        extraConfig = {
+          Keyboard = {
+            KeyBindings="materus-linux";
+          };
+          Scrolling = {
+            HistoryMode = 2;
+          };
+        };
+      };
+    };
+    extraConfig = {
+      KonsoleWindow = {
+        RememberWindowSize = "false";
+      };
+      MainWindow = {
+        MenuBar = "Enabled";
+      };
+
+      "Desktop Entry" = {
+        DefaultProfile = "materus.profile";
+      };
+    };
+  };
+  programs.plasma = {
+    enable = true;
+    overrideConfig = false;
+
+
+    
+    workspace = {
+      lookAndFeel = "org.kde.breezedark.desktop";
+      iconTheme = "Papirus-Dark";
+    };
+
+    shortcuts = {
+      "kwin"."Grid View" = "Meta+Alt+Tab";
+      "kwin"."Overview" = "Meta+Tab";
+      "services/org.kde.kcalc.desktop"."_launch" = [ ];
+    };
+    spectacle.shortcuts = {
+      captureActiveWindow = "Meta+Print";
+      captureCurrentMonitor = "Print";
+      captureEntireDesktop = "Shift+Print";
+      captureRectangularRegion = "Meta+S";
+      launchWithoutCapturing = "Meta+Shift+S";
+      launch = "Meta+Alt+S";
+    };
+
+    kwin = {
+      effects = {
+        wobblyWindows.enable = true;
+      };
+    };
+
+    input = {
+      keyboard = {
+        options = [ "caps:none" ];
+      };
+    };
+    kscreenlocker = {
+      autoLock = false;
+    };
+
+    panels = [
+      {
+        location = "left";
+        screen = 0;
+        widgets = [
+          {
+            name = "org.kde.plasma.kickerdash";
+            config = {
+              General = {
+                icon = "nix-snowflake-white";
+                customButtonImage="nix-snowflake-white";
+                alphaSort = true;
+              };
+            };
+
+          }
+          "org.kde.plasma.icontasks"
+          "org.kde.plasma.marginsseparator"
+          "org.kde.plasma.systemtray"
+          {
+            name = "org.kde.plasma.digitalclock";
+            config = {
+              Appearance = {
+                showDate = "false";
+              };
+            };
+          }
+        ];
+
+      }
+
+    ];
+    configFile = {
+      "kwinrc"."Effect-overview"."BorderActivate" = 9;
+      
+      "klaunchrc"."BusyCursorSettings"."Timeout" = 1;
+      "klaunchrc"."FeedbackStyle"."TaskbarButton" = false;
+      
+      "kcminputrc"."Libinput/9610/46/SINOWEALTH Wired Gaming Mouse"."PointerAccelerationProfile" = 1;
+      "kcminputrc"."Libinput/9610/47/SINOWEALTH 2.4G Wireless Receiver"."PointerAccelerationProfile" = 1;
+
+      "spectaclerc"."ImageSave"."imageFilenameTemplate" = "<yyyy>-<MM>-<dd>.<hh>_<mm>_<ss>-<t>.materusPC";
+      "spectaclerc"."VideoSave"."videoFilenameTemplate" = "<yyyy>-<MM>-<dd>.<hh>_<mm>_<ss>-<t>.materusPC";
+      "spectaclerc"."ImageSave"."preferredImageFormat" = "WEBP";
+      "spectaclerc"."ImageSave"."translatedScreenshotsFolder" = "Zrzuty ekranu";
+      "spectaclerc"."VideoSave"."translatedScreencastsFolder" = "Nagranie ekranu";
+
+      "dolphinrc"."General"."RememberOpenedTabs" = false;
+
+      "kwalletrc"."Wallet"."Enabled" = true;
+
+    };
+    dataFile = {
+      "dolphin/view_properties/global/.directory"."Settings"."HiddenFilesShown" = true;
+    };
+
+    resetFiles = [
+      "spectaclerc"
+    ];
+
+  };
+}

configurations/host/materusPC/network.nix

@@ -0,0 +1,82 @@
+{ config, pkgs, lib, materusArg, ... }:
+{
+  sops.templates."networkmanager.env".content = ''
+    WIREGUARD_PRIVATEKEY="${config.sops.placeholder.wireguard}"
+  '';
+
+  networking.firewall = {
+   logReversePathDrops = false;
+   # wireguard trips rpfilter up
+   extraCommands = ''
+     ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --sport ${materusArg.wireguard.port} -j RETURN
+     ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --dport ${materusArg.wireguard.port} -j RETURN
+   '';
+   extraStopCommands = ''
+     ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --sport ${materusArg.wireguard.port} -j RETURN || true
+     ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --dport ${materusArg.wireguard.port} -j RETURN || true
+   '';
+  };
+
+  networking.useDHCP = lib.mkDefault true;
+  networking.hostName = "materusPC";
+  networking.wireless.iwd.enable = true;
+  networking.networkmanager.enable = true;
+  #networking.networkmanager.wifi.backend = "iwd";
+  networking.firewall.enable = true;
+  networking.firewall.allowedTCPPorts = [ 
+    24800 5900 5357 4656 8080 9943 9944 
+    22000 config.services.syncthing.relay.statusPort config.services.syncthing.relay.port # Syncthing
+    25565 25570 8100 # Minecraft + BlueMap + Velocity 
+  ];
+  networking.firewall.allowedUDPPorts = [ (lib.strings.toInt materusArg.wireguard.port) 
+    24800 5900 3702 4656 6000 9943 9944 
+    22000 21027 # Syncthing
+    17000 17001 # zomboid
+    24454 # Minecraft Voice Chat
+  ];
+  networking.networkmanager.settings = {
+    connectivity = {
+      uri = "http://nmcheck.gnome.org/check_network_status.txt";
+    };
+  };
+  
+
+  networking.networkmanager.ensureProfiles.environmentFiles = [
+    config.sops.templates."networkmanager.env".path
+  ];
+  networking.networkmanager.ensureProfiles.profiles = {
+    wg0 = {
+      connection = {
+        id = "wg0";
+        type = "wireguard";
+        interface-name = "wg0";
+      };
+      wireguard = {
+        private-key = "$WIREGUARD_PRIVATEKEY";
+      };
+      "wireguard-peer.${materusArg.wireguard.pubKeys.valkyrie}" = {
+        endpoint = "${materusArg.ips.valkyrie}:${materusArg.wireguard.port}";
+        allowed-ips = "${materusArg.ip-masks.wireguard.main};${materusArg.ip-masks.wireguard.guest};${materusArg.ip-masks.wireguard.asia};${materusArg.ips.wireguard.valkyrie}/32;";
+        persistent-keepalive = "20";
+      };
+      ipv4 = {
+        address1 = "${materusArg.ips.wireguard.materusPC}/32";
+        dns = "${materusArg.ips.wireguard.valkyrie};";
+        method = "manual";
+        never-default = "true";
+      };
+      ipv6 = {
+        addr-gen-mode = "stable-privacy";
+        method = "disabled";
+      };
+      proxy = { };
+    };
+  };
+      services = {
+        syncthing = {
+            enable = true;
+            user = "materus";
+            dataDir = "/home/materus";
+        };
+      };
+}

configurations/host/materusPC/other/apps.nix

@@ -0,0 +1,147 @@
+{
+  config,
+  pkgs,
+  materusArg,
+  ...
+}:
+{
+
+  #services.jackett.enable = true;
+  programs.nix-ld.enable = true;
+  programs.nix-ld.libraries = with pkgs; [
+
+  ];
+  programs.chromium.enable = true;
+  programs.chromium.enablePlasmaBrowserIntegration = true;
+
+  services.guix.enable = true;
+
+  
+  environment.systemPackages = with pkgs; [
+
+    vivaldi
+
+    #(pkgs.lutris.override { extraLibraries = pkgs: with pkgs;  [ pkgs.samba pkgs.jansson pkgs.tdb pkgs.libunwind pkgs.libusb1 pkgs.gnutls pkgs.gtk3 pkgs.pango ]; })
+    materusArg.pkgs.amdgpu-pro-libs.prefixes
+    (pkgs.bottles.override {
+      extraPkgs = pkgs: [
+        pkgs.libsForQt5.breeze-qt5
+        pkgs.kdePackages.breeze-gtk
+        pkgs.nss_latest
+      ];
+      extraLibraries = pkgs: [
+        pkgs.samba
+        pkgs.jansson
+        pkgs.tdb
+        pkgs.libunwind
+        pkgs.libusb1
+        pkgs.gnutls
+        pkgs.gtk3
+        pkgs.pango
+      ];
+    })
+    glibc
+    glib
+    gtk3
+    gtk4
+    gsettings-desktop-schemas
+    kdePackages.dolphin
+    vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+    vlc
+    vkbasalt-cli
+
+    patchelf
+    killall
+    util-linux
+    xorg.xhost
+    nix-top
+
+    gitFull
+    curl
+    wget
+
+    config.programs.java.package
+
+    nss_latest
+
+    pciutils
+
+    (aspellWithDicts (
+      ds: with ds; [
+        en
+        en-computers
+        en-science
+        pl
+      ]
+    ))
+    steamtinkerlaunch
+    distrobox
+    # WebP support
+    libwebp
+    webp-pixbuf-loader
+
+    # Compression
+    p7zip
+    unrar
+    bzip2
+    rar
+    unzip
+    zstd
+    xz
+    zip
+    gzip
+
+    tree
+    mc
+    lf
+    htop
+    nmon
+    iftop
+    iptraf-ng
+    mprocs
+    tldr
+    bat
+    ##config.materus.profile.packages.home-manager
+    gcr
+    # pgcli
+    # litecli
+    materusArg.pkgs.alvr
+    #zenmonitor
+
+    nix-du
+
+    kdePackages.kate
+    krusader
+
+    wineWowPackages.stagingFull
+    winetricks
+    protontricks
+    gnupg
+    pinentry
+    pinentry-gnome3
+    pinentry-curses
+    ncurses
+    monkeysphere
+    gparted
+
+    virt-viewer
+
+    inkscape
+    gimp
+
+    git-crypt
+
+    bubblewrap
+    bindfs
+
+    binutils
+
+    materusArg.unstable.qbittorrent
+    mkvtoolnix
+    nicotine-plus
+    picard
+    opusTools
+    aegisub
+    audacity
+  ];
+}

configurations/host/materusPC/other/default.nix

@@ -0,0 +1,10 @@
+{ ... }:
+{
+ imports = [
+  ./apps.nix
+  ./java.nix
+  ./users.nix
+  ./desktop
+ ];
+
+}

configurations/host/materusPC/other/desktop/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+ imports = [
+  ./kde.nix
+  ./sddm.nix
+
+ ];
+
+}

configurations/host/materusPC/other/desktop/gnome.nix

@@ -0,0 +1,38 @@
+{ config, pkgs, lib, ... }:
+{
+  services.displayManager.defaultSession = "gnome";
+  
+  services.xserver.desktopManager.gnome.enable = true;
+  services.xserver.desktopManager.gnome.sessionPath = [ pkgs.gnome.gpaste ];
+
+  services.gnome.gnome-online-accounts.enable = true;
+  services.gnome.gnome-browser-connector.enable = true;
+  services.gnome.core-utilities.enable = true;
+  services.gnome.core-shell.enable = true;
+  services.gnome.core-os-services.enable = true;
+
+  programs.gnupg.agent.pinentryPackage = lib.mkForce pkgs.pinentry-gnome3;
+
+
+  programs.gnome-terminal.enable = true;
+
+  services.udev.packages = with pkgs; [ gnome.gnome-settings-daemon ];
+  services.dbus.packages = with pkgs; [ gnome2.GConf ];
+
+  environment.systemPackages = with pkgs; [
+
+    gnome3.adwaita-icon-theme
+    gnome3.gnome-tweaks
+    gnome3.gnome-color-manager
+    gnome3.gnome-shell-extensions
+
+    gnomeExtensions.appindicator
+    gnomeExtensions.desktop-clock
+    gnomeExtensions.gtk4-desktop-icons-ng-ding
+    gnomeExtensions.compiz-windows-effect
+    gnomeExtensions.burn-my-windows
+    gnomeExtensions.user-themes
+    gnomeExtensions.gsconnect
+
+  ];
+}

configurations/host/materusPC/other/desktop/kde.nix

@@ -0,0 +1,40 @@
+{ config, pkgs, lib, ... }:
+{
+
+  xdg.portal.enable = true;
+  xdg.portal.wlr.enable = true;
+  xdg.portal.xdgOpenUsePortal = true;
+  xdg.portal.extraPortals = [ pkgs.kdePackages.xdg-desktop-portal-kde ];
+
+  services.desktopManager.plasma6.enable = true;
+  services.desktopManager.plasma6.enableQt5Integration = true;
+  #programs.gnupg.agent.pinentryPackage = lib.mkForce (pkgs.kwalletcli.overrideAttrs {meta.mainProgram = "pinentry-kwallet";});
+  #environment.plasma6.excludePackages = with pkgs.kdePackages; [ kwallet kwalletmanager kwallet-pam ];
+  environment.variables = {
+    # Old fix for black cursor on amdgpu, seems to work fine now
+    #KWIN_DRM_NO_AMS = "1";
+
+    #Fix for amdgpu crashes
+    KWIN_DRM_USE_MODIFIERS = "0";
+    KWIN_DRM_NO_DIRECT_SCANOUT = "1";
+    QT_PLUGIN_PATH = [
+      "${pkgs.qt6.qtimageformats}/${pkgs.qt6.qtbase.qtPluginPrefix}"
+      "${pkgs.kdePackages.ffmpegthumbs}/${pkgs.qt6.qtbase.qtPluginPrefix}"
+     ];
+    XCURSOR_THEME = "breeze_cursors";
+  };
+  environment.systemPackages = with pkgs; [
+    kdePackages.ark
+    kdePackages.kcalc
+  ];
+  programs.kdeconnect.enable = true;
+  materus.profile.steam.extraPkgs = [ pkgs.kdePackages.breeze pkgs.kdePackages.breeze-gtk pkgs.kdePackages.dolphin pkgs.vlc pkgs.vkbasalt-cli ];
+
+  programs.firefox = {
+    enable = true;
+    autoConfig = builtins.readFile(builtins.fetchurl {
+      url = "https://raw.githubusercontent.com/MrOtherGuy/fx-autoconfig/master/program/config.js";
+      sha256 = "1mx679fbc4d9x4bnqajqx5a95y1lfasvf90pbqkh9sm3ch945p40";
+    });
+  };
+}

configurations/host/materusPC/other/desktop/sddm.nix

@@ -0,0 +1,81 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  plasma-materus = pkgs.writeScript "plasma-materus" ''
+    export KWIN_DRM_DEVICES="/dev/dri/by-path/pci-0000\:53\:00.0-card"
+    ${pkgs.kdePackages.plasma-workspace}/libexec/plasma-dbus-run-session-if-needed ${pkgs.kdePackages.plasma-workspace}/bin/startplasma-wayland
+  '';
+  westonSddm =
+    let
+      xcfg = config.services.xserver;
+    in
+    pkgs.writeText "weston.ini" ''
+      [core]
+      xwayland=false
+      shell=fullscreen-shell.so
+
+      [keyboard]
+      keymap_model = ${builtins.toString xcfg.xkb.model};
+      keymap_layout = ${builtins.toString xcfg.xkb.layout};
+      keymap_variant = ${builtins.toString xcfg.xkb.variant};
+      keymap_options = ${builtins.toString xcfg.xkb.options};
+
+      [libinput]
+      enable-tap = ${builtins.toString xcfg.libinput.mouse.tapping};
+      left-handed = ${builtins.toString xcfg.libinput.mouse.leftHanded};
+
+      [output]
+      name=DP-3
+      mode=1920x1080@240
+
+      [output]
+      name=DP-4
+      mode=off
+
+      [output]
+      name=HDMI-A-3
+      mode=off
+
+    '';
+in
+{
+  services.displayManager.defaultSession = "plasma-materus";
+
+  services.displayManager.sddm.enable = true;
+  services.displayManager.sddm.wayland.enable = true;
+  services.displayManager.sddm.wayland.compositor = lib.mkForce "weston";
+  services.displayManager.sddm.wayland.compositorCommand = lib.concatStringsSep " " [
+    "${lib.getExe pkgs.weston}"
+    "--shell=kiosk"
+    "-c ${westonSddm}"
+  ];
+  services.displayManager.sessionPackages = [
+    (
+      (pkgs.writeTextDir "share/wayland-sessions/plasma-materus.desktop" ''
+        [Desktop Entry]
+        Name=Plasma (Wayland Materus)
+        Comment=Plasma Desktop with KWIN_DRM_DEVICES env
+        Exec=${plasma-materus}
+        DesktopNames=KDE
+        Type=Application
+      '').overrideAttrs
+      (_: {
+        passthru.providedSessions = [ "plasma-materus" ];
+      })
+    )
+  ];
+
+  services.displayManager.sddm.settings = {
+    General = {
+      InputMethod = "";
+    };
+    Theme = {
+      CursorTheme = "breeze_cursors";
+      CursorSize = "24";
+    };
+  };
+}

configurations/host/materusPC/other/java.nix

@@ -0,0 +1,14 @@
+{ pkgs, ... }:
+{
+  programs = {
+    java.enable = true;
+    java.package = pkgs.jdk;
+    java.binfmt = true;
+  };
+
+  environment.variables = { 
+    JAVA_8_HOME = "${pkgs.jdk8}/lib/openjdk/";
+    JAVA_17_HOME = "${pkgs.jdk17}/lib/openjdk/";
+    JAVA_21_HOME = "${pkgs.jdk21}/lib/openjdk/";
+  };
+}

configurations/host/materusPC/other/users.nix

@@ -0,0 +1,27 @@
+{ pkgs, materusArg, config, ... }:
+{
+
+users.users.materus = {
+    isNormalUser = true;
+    extraGroups = [
+      "audio"
+      "video"
+      "render"
+      "pipewire"
+      "wheel"
+      "networkmanager"
+      "input"
+      "kvm"
+      "libvirt-qemu"
+      "libvirt"
+      "libvirtd"
+      "podman"
+      "scanner"
+      "lp"
+    ];
+    shell = pkgs.zsh;
+    description = "Mateusz Słodkowicz";
+    openssh.authorizedKeys.keyFiles = [ ("${materusArg.cfg.path}" + "/extraFiles/keys/ssh/materus.pub") ];
+    #hashedPasswordFile = config.sops.secrets."users/materus".path;
+  };
+}

configurations/host/materusPC/scripts.nix

@@ -0,0 +1,59 @@
+{ config, pkgs, lib, ... }:
+let
+  valkyrie-sync = pkgs.writeShellScriptBin "valkyrie-sync" ''
+    ${pkgs.rsync}/bin/rsync -avzrh --delete --exclude ".git*" --exclude "flake.lock" /materus/config/nixos-config materus@valkyrie:/materus/config/ && \
+      ${pkgs.rsync}/bin/rsync -avzrh --delete --exclude ".git*" /materus/config/private/valkyrie materus@valkyrie:/materus/config/private
+  '';
+
+  valkyrie-flakelock = pkgs.writeShellScriptBin "valkyrie-flakelock" ''
+    ${pkgs.openssh}/bin/ssh materus@valkyrie "nix flake update /materus/config/nixos-config --override-input nixpkgs github:NixOS/nixpkgs/23.05 \
+      --override-input home-manager github:nix-community/home-manager/release-23.05 \
+      --override-input private /materus/config/private/valkyrie/flake"
+  '';
+
+  valkyrie-rebuild-boot = pkgs.writeShellScriptBin "valkyrie-rebuild-boot" ''
+    ${pkgs.openssh}/bin/ssh -t materus@valkyrie "sudo nixos-rebuild boot --flake /materus/config/nixos-config#valkyrie \
+      --override-input private /materus/config/private/valkyrie/flake"
+  '';
+  valkyrie-rebuild-switch = pkgs.writeShellScriptBin "valkyrie-rebuild-switch" ''
+    ${pkgs.openssh}/bin/ssh -t materus@valkyrie "sudo nixos-rebuild switch --flake /materus/config/nixos-config#valkyrie \
+      --override-input private /materus/config/private/valkyrie/flake"
+  '';
+
+
+
+  flamaster-sync = pkgs.writeShellScriptBin "flamaster-sync" ''
+    ${pkgs.rsync}/bin/rsync -avzrh --delete --exclude ".git*" --exclude "flake.lock" /materus/config/nixos-config materus@flamaster:/materus/config/ && \
+      ${pkgs.rsync}/bin/rsync -avzrh --delete --exclude ".git*" /materus/config/private/flamaster materus@flamaster:/materus/config/private
+  '';
+
+  flamaster-flakelock = pkgs.writeShellScriptBin "flamaster-flakelock" ''
+    ${pkgs.openssh}/bin/ssh materus@flamaster "nix flake update /materus/config/nixos-config --override-input nixpkgs github:NixOS/nixpkgs/23.05 \
+      --override-input home-manager github:nix-community/home-manager/release-23.05 \
+      --override-input private /materus/config/private/flamaster/flake"
+  '';
+
+  flamaster-rebuild-boot = pkgs.writeShellScriptBin "flamaster-rebuild-boot" ''
+    ${pkgs.openssh}/bin/ssh -t materus@flamaster "sudo nixos-rebuild boot --flake /materus/config/nixos-config#flamaster \
+      --override-input private /materus/config/private/flamaster/flake"
+  '';
+  flamaster-rebuild-switch = pkgs.writeShellScriptBin "flamaster-rebuild-switch" ''
+    ${pkgs.openssh}/bin/ssh -t materus@flamaster "sudo nixos-rebuild switch --flake /materus/config/nixos-config#flamaster \
+      --override-input private /materus/config/private/flamaster/flake"
+  '';
+
+
+in
+{
+  environment.systemPackages = [
+    valkyrie-rebuild-boot
+    valkyrie-rebuild-switch
+    valkyrie-sync
+    valkyrie-flakelock
+
+    flamaster-rebuild-boot
+    flamaster-rebuild-switch
+    flamaster-sync
+    flamaster-flakelock
+  ];
+}

configurations/host/materusPC/secrets/default.nix

@@ -0,0 +1,27 @@
+{ config, pkgs, lib, materusCfg, ... }:
+{
+  imports =
+    [
+
+    ] ++ (if (materusCfg.materusFlake.decrypted) then [ ./private ] else [ ]);
+
+  sops.age.generateKey = false;
+  sops.gnupg.home = null;
+  sops.gnupg.sshKeyPaths = [ ];
+  sops.age.sshKeyPaths = [ "/materus/root/ssh_host_ed25519_key" ];
+  sops.defaultSopsFile = materusCfg.hostPath + "/secrets/secrets.yaml";
+  #sops.secrets."users/materus" = { neededForUsers = true; };
+  sops.secrets.wireguard = { };
+
+  services.openssh.hostKeys = [
+    {
+      bits = 4096;
+      path = "/materus/root/ssh_host_rsa_key";
+      type = "rsa";
+    }
+    {
+      path = "/materus/root/ssh_host_ed25519_key";
+      type = "ed25519";
+    }
+  ];
+}

configurations/host/materusPC/secrets/secrets.yaml

@@ -0,0 +1,36 @@
+users:
+    materus: ENC[AES256_GCM,data:okqSgMvdFq1BMAg+Gs725zaNbeAQIpJKSPB2Sa83i3EYimphZNBtrJLen+gQEGNq4yeTyAc9Ih/hcnr+3z+Tea/g9ffh/UC4YA==,iv:OhKoWLREAqCbtmS3Rw9nE9+PtcBLwEHimJXcj4oejRA=,tag:Ht/SQSwumnQR6E45Pl47AQ==,type:str]
+    root: ENC[AES256_GCM,data:vnPjK+xayk/Zk895rERYAeCzpjv5NJ7EAyK4MRDUzDbW++4Dy+UEI81v1v7w9dfpDeL+x5kOqUFO5zVVDUGfZ3yf/l8M8N8KcA==,iv:gGFGcy3K27nQxn0+7I/t0kg3nZyXeGWqysOl2auZJXo=,tag:N+LYhKpPCbI1EjEBwxuh1g==,type:str]
+wireguard: ENC[AES256_GCM,data:rBkftzBcdamhP0xZB3qxfLptL8bX1qc7SdcfPNpYV67TeQs6i79+5KB/da4=,iv:22J5SZbFtYco7iSHvD2GD1bcazfGWlyEJ2isa3Ab4bI=,tag:BeUn9Srl2vyoDgK5Xv0UCg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1fq9ckkwtgvm69w045rf9pgurnhch6ukdxejr8yxgrthn7j8vp48qvd9rkx
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEbHZZUVF1dVJSU1NvNXVk
+            N3VtTm00ZHRWb082T0FkNXJncUxCU3haVmpVCk9FQkJBZnVJVFNLOThjZzlxNVF1
+            b0phQ2daejRrdVhEZ2YvRHVRRU5BQlEKLS0tIGdQeDlOSzl4VDhGNURQditCWUFG
+            dWVzbzUyakxXUGpTQjNsYzcyVG1aRDgKXVa8tIAbmggw1vSt3NJYRLgXhbagpNrX
+            RNXyndPaeQXVPVXuJWmHgRCYbwPTcfAFpGwFlX2IxVLlmC914Zklhw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-04-19T15:58:46Z"
+    mac: ENC[AES256_GCM,data:BLa0G3ci8EWH43UkLI2OoFJp2F9YeuKDrg6+2I/bq/lLi/YUitkJvBkA9VSIbvCyYWs/5SlEL5MayX8iiVdJ7r9bCiw+LVsWNAdaYDCafbZRW5F7KiHS5WXV3v4c201kFok7rmnRhEfKfdDxLlQ/mFHqOhupHU/qCNMTuUzJBiA=,iv:EPRoXHVMB6I16lTFJdFVAuSnMD/B55fPYtSBOQddutE=,tag:gohg+BdRlMPAQmNpRdk8sg==,type:str]
+    pgp:
+        - created_at: "2024-03-02T22:10:50Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4D5fSX77p80GYSAQdAvGVUu56Pd2+DMHqgIcJokyh11952nQK2eVtQNj42CAUw
+            NQfulNRUHX5BonsLyvXPx74bVku6Wxr80loIWoz049/xbFj4S7FyftkakY8rOUGu
+            1GgBCQIQOoEFvTQB8qGbea/85fktuljXPou/WgUY6Mxd4n0dBz54f69B/NttnBGc
+            7eUDKfe79Omr0o/0CVC/6SGKoiS38suV903QHeF1MXFPeOG72k4TvfF9lVlBgK8H
+            k4DXtzC7wm3WWg==
+            =eh7Z
+            -----END PGP MESSAGE-----
+          fp: 28D140BCA60B4FD1
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

configurations/host/materusPC/tmp.nix

@@ -0,0 +1,168 @@
+{
+  config,
+  pkgs,
+  materusArg,
+  ...
+}:
+
+{
+  
+  programs.gamemode.enable = true;
+  programs.corectrl.enable = true;
+
+  services.teamviewer.enable = true;
+
+  systemd.tmpfiles.rules = [ "L+    /opt/rocm/hip   -    -    -     -    ${pkgs.rocmPackages.clr}" ];
+
+  # Gamepad
+  services.udev = {
+    packages = with pkgs; [
+      game-devices-udev-rules
+    ];
+  };
+  hardware.uinput.enable = true;
+  hardware.steam-hardware.enable = true;
+
+  nix.package = pkgs.nixVersions.nix_2_28;
+  programs.steam = {
+    enable = false;
+    remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play
+    dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server
+    localNetworkGameTransfers.openFirewall = true; # Open ports in the firewall for Steam Local Network Game Transfers
+  };
+  services.flatpak.enable = true;
+  services.gvfs.enable = true;
+
+  services.xserver.xkb.layout = "pl";
+
+  services.xserver.enable = true;
+  #services.xserver.videoDrivers = [ "amdgpu" "intel" ];
+  services.dbus.enable = true;
+  services.dbus.packages = [ pkgs.gcr ];
+
+  services.xserver.displayManager.startx.enable = false;
+
+  services.xserver.exportConfiguration = true;
+  services.xserver.extraConfig = pkgs.lib.mkDefault ''
+    Section "OutputClass"
+      Identifier "amd-options"
+      Option "TearFree" "True"
+      Option "SWCursor" "True"
+      Option "VariableRefresh" "true"
+      Option "AsyncFlipSecondaries" "true"
+      Option "DRI3" "1"
+      MatchDriver "amdgpu"
+    EndSection
+
+  '';
+
+  services.printing.enable = true;
+
+  services.libinput.enable = true;
+
+  environment.sessionVariables = {
+    XDG_CACHE_HOME = "\${HOME}/.cache";
+    XDG_CONFIG_HOME = "\${HOME}/.config";
+    XDG_BIN_HOME = "\${HOME}/.local/bin";
+    XDG_DATA_HOME = "\${HOME}/.local/share";
+    QT_XKB_CONFIG_ROOT = "\${XKB_CONFIG_ROOT}";
+    GTK_IM_MODULE = "fcitx";
+    QT_IM_MODULE = "fcitx";
+    XMODIFIERS = "@im=fcitx";
+    SDL_IM_MODULE = "fcitx";
+
+    MOZ_USE_XINPUT2 = "1";
+    PATH = [ "\${XDG_BIN_HOME}" ];
+  };
+  environment.shellInit = ''
+    if ! [ -z "$DISPLAY" ]; then xhost +si:localuser:root &> /dev/null; fi;
+    if ! [ -z "$DISPLAY" ]; then xhost +si:localuser:$USER &> /dev/null; fi;
+  '';
+
+  i18n.inputMethod.enabled = "fcitx5";
+  i18n.inputMethod.fcitx5.addons = [
+    pkgs.kdePackages.fcitx5-configtool
+    pkgs.fcitx5-lua
+    pkgs.fcitx5-mozc
+    pkgs.fcitx5-gtk
+    pkgs.kdePackages.fcitx5-qt
+  ];
+
+  services.pcscd.enable = true;
+
+  services.samba-wsdd.enable = true;
+  services.samba-wsdd.openFirewall = true;
+  services.samba = {
+    enable = true;
+    package = pkgs.sambaFull;
+    securityType = "user";
+    openFirewall = true;
+    settings = {
+      global = {
+        "workgroup" = "WORKGROUP";
+        "server string" = "smbmaterus";
+        "netbios name " = "smbmaterus";
+        "security" = "user";
+        "hosts allow" = "192.168.122. 127.0.0.1 localhost";
+        "hosts deny" = "0.0.0.0/0";
+        "guest account" = "nobody";
+        "map to guest" = "bad user";
+        "allow insecure wide links" = "yes";
+      };
+      windows = {
+        "path" = "/materus/data/VM/windows_shared";
+        "browseable" = "yes";
+        "read only" = "no";
+        "guest ok" = "no";
+        "create mask" = "0644";
+        "directory mask" = "0755";
+        "force user" = "materus";
+        "force group" = "users";
+        "follow symlinks" = "yes";
+        "wide links" = "yes";
+      };
+
+    };
+  };
+
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = false;
+    enableBrowserSocket = true;
+
+  };
+  programs.ssh.startAgent = true;
+  services.openssh.enable = true;
+  services.openssh.settings.PermitRootLogin = "no";
+  services.openssh.settings.PasswordAuthentication = false;
+  services.openssh.openFirewall = true;
+
+  services.sunshine = {
+    enable = true;
+    capSysAdmin = true;
+    openFirewall = true;
+    autoStart = false;
+  };
+
+  environment.enableAllTerminfo = true;
+  environment.pathsToLink = [
+    "/share/zsh"
+    "/share/bash-completion"
+    "/share/fish"
+  ];
+  environment.shells = with pkgs; [
+    zsh
+    bashInteractive
+    fish
+  ];
+  programs = {
+    fish.enable = true;
+    command-not-found.enable = false;
+    dconf.enable = true;
+  };
+
+  materus.profile.browser.enable = true;
+
+  services.davfs2.enable = true;
+
+}

configurations/host/materusPC/vm/default.nix

@@ -1,10 +1,45 @@
-{ pkgs, config, ... }:
+{ config, pkgs, ... }:
 {
+  imports = [
+    ./win-vfio
+  ];
+  materus.materusArg.materusPC = {
+    allCores = "0-31";
+    allCoresMask = "ffffffff";
+    hostCores = "0-7,16-23";
+    hostCoresMask = "00ff00ff";
+    vmCores = "8-15,24-31";
+    vmCoresMask = "ff00ff00";
+  };
+  systemd.mounts = [
+    {
+      where = "/dev/hugepages";
+      enable = false;
+    }
+    {
+      where = "/dev/hugepages/hugepages-2048kB";
+      enable = true;
+      what = "hugetlbfs";
+      type = "hugetlbfs";
+      options = "pagesize=2M";
+      requiredBy = [ "basic.target" ];
+    }
+    {
+      where = "/dev/hugepages/hugepages-1048576kB";
+      enable = true;
+      what = "hugetlbfs";
+      type = "hugetlbfs";
+      options = "pagesize=1G";
+      requiredBy = [ "basic.target" ];
+    }
+  ];
 
   virtualisation.libvirtd = {
     enable = true;
     onBoot = "ignore";
     onShutdown = "shutdown";
+    qemu.ovmf.enable = true;
+    qemu.ovmf.packages = [ pkgs.OVMFFull.fd ];
     qemu.runAsRoot = true;
     qemu.swtpm.enable = true;
     qemu.package = pkgs.qemu_full;
@@ -20,7 +55,6 @@
     libguestfs-with-appliance
   ];
 
-  # Packages for QEMU hooks
   systemd.services.libvirtd = {
     path =
       let
@@ -48,64 +82,4 @@
       in
       [ env ];
   };
-
-  # Shared qcow drive
-  systemd.services.windows-share-mount = {
-    wantedBy = [ "multi-user.target" ];
-    path = [
-      config.virtualisation.libvirtd.qemu.package
-      pkgs.util-linux
-      pkgs.kmod
-      pkgs.coreutils
-    ];
-    serviceConfig.Type = "oneshot";
-    serviceConfig.RemainAfterExit = true;
-    unitConfig.ConditionPathExists = "/mkk/data/vm/data.qcow2";
-    script = ''
-      modprobe nbd max_part=10
-      sleep 1
-      qemu-nbd -c /dev/nbd10 /mkk/data/vm/data.qcow2 --discard=unmap
-      sleep 1
-      mount /dev/nbd10p1 /mkk/data/mounts/windows -o uid=1000,gid=100
-    '';
-    preStop = ''
-      umount -r /dev/nbd10p1
-      qemu-nbd -d /dev/nbd10
-    '';
-  };
-
-  #Hugepages
-  systemd.mounts = [
-    {
-      where = "/dev/hugepages";
-      enable = false;
-    }
-    {
-      where = "/dev/hugepages/hugepages-2048kB";
-      enable = true;
-      what = "hugetlbfs";
-      type = "hugetlbfs";
-      options = "pagesize=2M";
-      requiredBy = [ "basic.target" ];
-    }
-    {
-      where = "/dev/hugepages/hugepages-1048576kB";
-      enable = true;
-      what = "hugetlbfs";
-      type = "hugetlbfs";
-      options = "pagesize=1G";
-      requiredBy = [ "basic.target" ];
-    }
-  ];
-
-  virtualisation.libvirtd.qemu.verbatimConfig = ''
-    cgroup_device_acl = [
-      "/dev/null", "/dev/full", "/dev/zero",
-      "/dev/random", "/dev/urandom",
-      "/dev/ptmx", "/dev/kvm", "/dev/kqemu",
-      "/dev/rtc","/dev/hpet", "/dev/vfio/vfio",
-      "/dev/kvmfr0"
-    ]
-  '';
-
 }

configurations/host/materusPC/vm/win-vfio/default.nix

@@ -1,16 +1,9 @@
-{ config, pkgs, ... }:
+{ config, pkgs, materusArg, ... }:
 let
-  bar0_guest = "15";
+  bar0_guest="15";
-  bar2_guest = "8";
+  bar2_guest="8";
-  bar0_host = "15";
+  bar0_host="15";
-  bar2_host = "8";
+  bar2_host="8";
-
-  allCores = "0-31";
-  allCoresMask = "ffffffff";
-  hostCores = "0-7,16-23";
-  hostCoresMask = "00ff00ff";
-  vmCores = "8-15,24-31";
-  vmCoresMask = "ff00ff00";
 
   VM_UUID = "ad2632db-0da0-4204-98b3-0592a185ebd0";
 
@@ -23,9 +16,8 @@ let
     done
     renice -n "-10" -p "$QEMU_PID";
   '';
-  startHook =
+  startHook = /*''
-    /*
+
-      ''
 
     # Debugging
       exec 19>/home/materus/startlogfile
@@ -36,18 +28,11 @@ let
       trap 'exec 2>&4 1>&3' 0 1 2 3
       exec 1>/home/materus/startlogfile.out 2>&1
     ''
-      +
+    +*/
-    */
     ''
       # Service for my shared qcow2 drive, it's mounted to host when VM not running
       systemctl stop windows-share-mount.service
-
+      systemctl stop systemd-nspawn@archlinux
-      # Stop arch container, script doesnt kill things in container so gpu will be in broken state without it
-      if [ $(systemctl is-active systemd-nspawn@archlinux) = "active" ]; then
-        systemctl stop systemd-nspawn@archlinux; 
-        sleep 5s;
-        while [ $(systemctl is-active systemd-nspawn@archlinux) = "active" ];do sleep 2s; done;
-      fi
       
       # Remember non symlink path to card and render, symlink might get deleted
       DRI_RENDER=$(readlink -f /dev/dri/by-path/pci-$VIRSH_GPU_VIDEO-render)
@@ -83,10 +68,10 @@ let
 
       
       # Set host cgroups and workqueue to use defined cpu cores (I'm using first half of cpu on host, second half on guest)
-      systemctl set-property --runtime -- user.slice AllowedCPUs=${hostCores}
+      systemctl set-property --runtime -- user.slice AllowedCPUs=${materusArg.materusPC.hostCores}
-      systemctl set-property --runtime -- system.slice AllowedCPUs=${hostCores}
+      systemctl set-property --runtime -- system.slice AllowedCPUs=${materusArg.materusPC.hostCores}
-      systemctl set-property --runtime -- init.scope AllowedCPUs=${hostCores}
+      systemctl set-property --runtime -- init.scope AllowedCPUs=${materusArg.materusPC.hostCores}
-      echo "${hostCoresMask}" > /sys/bus/workqueue/devices/writeback/cpumask
+      echo "${materusArg.materusPC.hostCoresMask}" > /sys/bus/workqueue/devices/writeback/cpumask
 
       # Set performance governor if not set
       echo performance | tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor
@@ -113,13 +98,6 @@ let
 
     #  echo performance | tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor
 
-    # Stop arch container, sometimes gpu doesnt return properly if it's active
-    if [ $(systemctl is-active systemd-nspawn@archlinux) = "active" ]; then
-        systemctl stop systemd-nspawn@archlinux; 
-        sleep 5s;
-        while [ $(systemctl is-active systemd-nspawn@archlinux) = "active" ]; do sleep 2s; done;
-    fi
-
     sysctl vm.stat_interval=1
 
         
@@ -142,16 +120,29 @@ let
 
     systemctl start windows-share-mount.service
 
-    systemctl set-property --runtime -- user.slice AllowedCPUs=${allCores}
+    systemctl set-property --runtime -- user.slice AllowedCPUs=${materusArg.materusPC.allCores}
-    systemctl set-property --runtime -- system.slice AllowedCPUs=${allCores}
+    systemctl set-property --runtime -- system.slice AllowedCPUs=${materusArg.materusPC.allCores}
-    systemctl set-property --runtime -- init.scope AllowedCPUs=${allCores}
+    systemctl set-property --runtime -- init.scope AllowedCPUs=${materusArg.materusPC.allCores}
-    echo "${allCoresMask}" > /sys/bus/workqueue/devices/writeback/cpumask
+    echo "${materusArg.materusPC.allCoresMask}" > /sys/bus/workqueue/devices/writeback/cpumask
 
   '';
 in
 {
-  services.udev.extraRules = ''
+
-    SUBSYSTEM=="kvmfr", OWNER="root", GROUP="kvm", MODE="0660"
+
+
+
+
+
+
+  virtualisation.libvirtd.qemu.verbatimConfig = ''
+  cgroup_device_acl = [
+    "/dev/null", "/dev/full", "/dev/zero",
+    "/dev/random", "/dev/urandom",
+    "/dev/ptmx", "/dev/kvm", "/dev/kqemu",
+    "/dev/rtc","/dev/hpet", "/dev/vfio/vfio",
+    "/dev/kvmfr0"
+  ]
   '';
   virtualisation.libvirtd.hooks.qemu = {
     "windows-vfio" = pkgs.writeShellScript "windows.sh" ''
@@ -175,4 +166,22 @@ in
       fi    
     '';
   };
+
+  systemd.services.windows-share-mount = {
+    wantedBy = [ "multi-user.target" ];
+    path = [ config.virtualisation.libvirtd.qemu.package pkgs.util-linux pkgs.kmod pkgs.coreutils ];
+    serviceConfig.Type = "oneshot";
+    serviceConfig.RemainAfterExit = true;
+    script = ''
+      modprobe nbd max_part=16
+      sleep 1
+      qemu-nbd -c /dev/nbd10 /materus/data/VM/data.qcow2 --discard=unmap
+      sleep 1
+      mount /dev/nbd10p1 /materus/data/Windows -o uid=1000,gid=100
+    '';
+    preStop = ''
+      umount -r /dev/nbd10p1
+      qemu-nbd -d /dev/nbd10
+    '';
+  };
 }

configurations/host/valkyrie/default.nix

@@ -0,0 +1,169 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running `nixos-help`).
+
+{ pkgs, materusArg, config, ... }:
+
+{
+  imports =
+    [
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+      ./services
+      ./secrets
+    ];
+
+  materus.profile.nix.enable = true;
+
+
+
+
+  # Use the GRUB 2 boot loader.
+  boot.loader.grub.enable = true;
+  # boot.loader.grub.efiSupport = true;
+  # boot.loader.grub.efiInstallAsRemovable = true;
+  # boot.loader.efi.efiSysMountPoint = "/boot/efi";
+  # Define on which hard drive you want to install Grub.
+  boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
+
+  networking.hostName = "valkyrie"; # Define your hostname.
+  # Pick only one of the below networking options.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+  networking.networkmanager.enable = false;
+
+  # Set your time zone.
+  time.timeZone = "Europe/Warsaw";
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "pl_PL.UTF-8";
+  console = {
+    font = "lat2-16";
+    keyMap = "pl";
+    useXkbConfig = false; # use xkbOptions in tty.
+  };
+
+  # Enable the X11 windowing system.
+  # services.xserver.enable = true;
+
+
+
+
+  # Configure keymap in X11
+  # services.xserver.layout = "us";
+  # services.xserver.xkbOptions = "eurosign:e,caps:escape";
+
+  # Enable CUPS to print documents.
+  # services.printing.enable = true;
+
+  # Enable sound.
+  # sound.enable = true;
+  # hardware.pulseaudio.enable = true;
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  services.libinput.enable = true;
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.materus = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+    packages = [
+    ];
+    openssh.authorizedKeys.keyFiles = [ ("${materusArg.cfg.path}" + "/extraFiles/keys/ssh/materus.pub") ];
+    shell = pkgs.zsh;
+  };
+  users.users.acme.openssh.authorizedKeys.keyFiles = [ ("${materusArg.cfg.path}" + "/extraFiles/keys/ssh/waffentrager.pub") ];
+  users.users.acme.shell = pkgs.scponly;
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [
+    vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+    wget
+    nano
+    git
+  ];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+  services.openssh.openFirewall = false;
+  services.openssh.settings.PermitRootLogin = "no";
+  services.openssh.settings.PasswordAuthentication = false;
+
+
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  networking.firewall.enable = true;
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It's perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
+
+
+  services.nginx = {
+    enable = true;
+    package = pkgs.tengine;
+    recommendedTlsSettings = true;
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+  };
+
+  services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_15;
+    enableTCPIP = true;
+    authentication = pkgs.lib.mkOverride 10 ''
+      local all all trust
+    '';
+  };
+
+
+  virtualisation.podman.autoPrune.enable = true;
+  virtualisation.podman.autoPrune.dates = "daily";
+  virtualisation.oci-containers.backend = "podman";
+
+
+  security.acme.acceptTerms = true;
+  security.acme.defaults.email = "materus+acme@podkos.pl";
+  security.acme.defaults.credentialsFile = config.sops.secrets.certs.path;
+  security.acme.defaults.dnsResolver = "9.9.9.9:53";
+  security.acme.certs."materus.pl" = {
+    domain = "materus.pl";
+    group = "nginx";
+    extraDomainNames = [ "*.materus.pl" ];
+    dnsProvider = "ovh";
+  };
+
+  security.acme.certs."podkos.pl" = {
+    domain = "podkos.pl";
+    group = "nginx";
+    extraDomainNames = [ "*.podkos.pl" ];
+    dnsProvider = "ovh";
+  };
+
+}
+

configurations/host/valkyrie/hardware-configuration.nix

@@ -0,0 +1,47 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [
+      (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "virtio_pci" "floppy" "sr_mod" "virtio_blk" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernel.sysctl = { "net.ipv4.ip_forward" = 1; "net.ipv6.conf.all.forwarding" = 1; };
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+  boot.tmp.useTmpfs = true;
+
+  fileSystems."/" =
+    {
+      device = "/dev/disk/by-uuid/924b1a69-2256-444f-baf6-d2d9405e451d";
+      fsType = "ext4";
+    };
+
+  fileSystems."/etc/nixos" =
+    {
+      device = "/materus/config/nixos-config";
+      fsType = "none";
+      options = [ "bind" ];
+    };
+
+  swapDevices = [
+    {
+      device = "/swapfile";
+      size = 4 * 1024;
+    }
+  ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = false;
+  networking.nameservers = [ "9.9.9.9" "1.1.1.1" "8.8.8.8" ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

configurations/host/valkyrie/home/materus/default.nix

@@ -0,0 +1,17 @@
+{ ... }:
+{
+  home.stateVersion = "23.05";
+  home.homeDirectory = "/home/materus";
+  materus.profile = {
+    fonts.enable = false;
+    nixpkgs.enable = false;
+    enableDesktop = false;
+    enableTerminal = false;
+    enableTerminalExtra = false;
+    enableNixDevel = false;
+
+    fish.enable = false;
+    bash.enable = true;
+    zsh.enable = true;
+  };
+}

configurations/host/valkyrie/secrets/default.nix

@@ -0,0 +1,35 @@
+{ materusCfg, ... }:
+{
+  imports =
+    [
+
+    ] ++ (if (materusCfg.materusFlake.decrypted) then [ ./private ] else [ ]);
+
+  sops.age.generateKey = false;
+  sops.gnupg.home = null;
+  sops.gnupg.sshKeyPaths = [ ];
+  sops.defaultSopsFile = materusCfg.hostPath + "/secrets/secrets.yaml";
+
+  sops.secrets.wireguard = { };
+  sops.secrets.discord-token = {};
+  sops.secrets.spotify-client-id = {};
+  sops.secrets.spotify-client-secret = {};
+  sops.secrets.youtube-api = {};
+  sops.secrets.certs = {};
+  sops.secrets.steamladder-api = {};
+  sops.secrets.webarchive-accesskey = {};
+  sops.secrets.webarchive-secretkey = {};
+  
+  services.openssh.hostKeys = [
+    {
+      bits = 4096;
+      path = "/materus/root/ssh_host_rsa_key";
+      type = "rsa";
+    }
+    {
+      path = "/materus/root/ssh_host_ed25519_key";
+      type = "ed25519";
+    }
+  ];
+
+}

configurations/host/valkyrie/secrets/secrets.yaml

@@ -0,0 +1,41 @@
+wireguard: ENC[AES256_GCM,data:i98U0ugxbNqWNuKR8u+mdWoSMLViHXfsWRBS1lvjb+hgGxveyzjBcagBIeY=,iv:/hF9oH2R6NSeHT/UQTlbmtx+gPX/3CJOLPNnxrzsY/g=,tag:2ub5w8uH2O1B2hoku8Kowg==,type:str]
+discord-token: ENC[AES256_GCM,data:JQ/6MJvBlJpKzs/L0hFB1LPpQSfJvDdEB6YerVZyDqGo7plA0S5wORACgA88Dei1x1NGsXhYtiwT4vE9jjeCOlWXZdl1mA==,iv:BsDu1De0qLX/8VDiZ5co1q1LXxkz/Som9+hvm/67/xU=,tag:YO0wQNF3/AXbifpeAa935Q==,type:str]
+spotify-client-id: ENC[AES256_GCM,data:WK7CJGw6mtIG3Jfp59cWx3ool4z1P09TvHcpbOQ2JV0=,iv:EaJ5ecXdmx0Ky+43xZITM811IOo4EisvPSyogXrJXng=,tag:NYTI4vLsWGa695CJ+TIgbw==,type:str]
+spotify-client-secret: ENC[AES256_GCM,data:TnR+zLLklTfzMdR4woaZWuMVJQ9VIYsFM588GRO6WCY=,iv:cYiqw8ZdMgLeug4ptwPV3L+MeY6xIldfUBfiYg1mFD8=,tag:YDLh6BXFcBHnpdgM7e87wg==,type:str]
+youtube-api: ENC[AES256_GCM,data:qmpFlFvudS9rXQfN+Th/UrPWCW0mg5GkpMucS/01AmOnlChqtojC,iv:q3bKwI2I6BNa3L9ezKCE1fWT/vZLiJ8uzug1z2z+TWA=,tag:gKG3HTz8jp2LAFh8e8O6sg==,type:str]
+steamladder-api: ENC[AES256_GCM,data:m30o5atqugwqn/WbXGkUq5GvqiIKQT0kSRQCtHc1Gxk/dC3YcbDvMw==,iv:duLKl1NvysD0XMaUOkl/6nclMQB6seXcQYkGMrm7K7Y=,tag:9dw+UH10uAdca5fVdlw1Mg==,type:str]
+webarchive-accesskey: ENC[AES256_GCM,data:jdKlHsZq2Dkk1BcBfUVv5g==,iv:BXCgPb/2W57PYXxRktInz1LxSEwlw6m3xnQU4TOPMeY=,tag:kK4+InaH7K4D4n1hyGaR+w==,type:str]
+webarchive-secretkey: ENC[AES256_GCM,data:t7lZ1aA72BrBxaE+jXmE3w==,iv:A8PF/MyRTIluqEzzt4uCw7eNCYDXAt4iB29PSrwlVyY=,tag:6HbtcrFeFcpagjzPXOANzA==,type:str]
+certs: ENC[AES256_GCM,data:ttmSNTTx51a3L2HTC8RnSphDLHO2OSyIgXQ0YpZGySTdu69mgEyhaiSi+IAXg/1AHKRjpFJgE4fhsLAiW78pNYb+Zg7aDL47YtABO99sTZrZnBxZo6k6itpZ3oClDch2ZALzoXChLroc0tUbZKwsfOwGe3pw9lOJZJT34AhV+BVoXDDLQcpQoxz23Baa8oxklecT6wpJ1u1nW+aAHw33gm41Vw==,iv:b0aNZwaRKBg+ipe5+19BowyFbCjZt52S738om6emYGo=,tag:lUqtcc4vVWKx/fnc19vj7A==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1wscr6kv8393wv0fjaux8juplaxq55znlzrp62qyteq0fauu3yg0s7d7k98
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSRXNLdUZaVU13alNhVGgz
+            aXdMb3IzNjNQcHJFV2JLNVM2SUVBa3VNZlRFCkxxd21CTWVDUkVXbzR6ZEkxbm5J
+            VGorSkp6a2xSdHRHcFk5T3VYVlJJa0UKLS0tIE1WdHo5eTlpNEEyN25oSjk1KzdS
+            d2dMUUh1RDB3UnpEdFJsNHpQRXFWemMKc41dlOapTsvH91QLNhdPbrzerPFakOiX
+            J/uoZDMIhsmQxgQM7Fqxr05NywhI/ZjOtJS2bayp73O57xjjMYcyNQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-11-18T09:01:39Z"
+    mac: ENC[AES256_GCM,data:CVsqff1qCcxyQ0e78ewottYKgqA2rG3j1m8X0Sb8If3qibAiBMMblc8T0doB+Fg4dVhPpbJSZdCx4JiV7sHopv2wNdguXd6Xe0L8iJqWtBeHTGTxSLvJ8UIHknak9c+JeQzZz8jAkbHYUXsc7VyeJaXoQptosz1BbE74D48Xjrg=,iv:0e+etjwabJx7PXgDUoh41Ha3aziQxBlH6QJZGG02ME0=,tag:oQIf503tmFlPoLE5d8Y24w==,type:str]
+    pgp:
+        - created_at: "2024-03-21T22:55:36Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4D5fSX77p80GYSAQdA667A9P/3ktuS2iEjxkv3aYMAGSu0oPGIX7dsC23VVgkw
+            OmcwhXxBnipcG+izbtNylXz5VonyyKHwdR2QIgkt9FEuC8lI17GHVyogTCFiP7Dj
+            1GgBCQIQN4EqFdiXqzJUeeE+PdOzVPs+1kStz+S1H22NjrJAFv67cbyIgwpItuXD
+            Sfao+MU1HWDY4iKZrcfWArUgpQj/pvsmUeJ72iXD3bkTTrK61g3GZA+g9lFewl/B
+            SORJMu9btS4GAw==
+            =aBMP
+            -----END PGP MESSAGE-----
+          fp: 28D140BCA60B4FD1
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

configurations/host/valkyrie/services/dcbot.nix

@@ -0,0 +1,38 @@
+{
+  config,
+  pkgs,
+  lib,
+  materusArg,
+  ...
+}:
+{
+  options.valkyrieService.dcbot.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable muse bot";
+
+  config =
+    let
+      cfg = config.valkyrieService.dcbot;
+    in
+    lib.mkIf cfg.enable {
+      sops.templates."muse.env".content = ''
+        CACHE_LIMIT=512MB
+        BOT_STATUS=online
+        BOT_ACTIVITY_TYPE=LISTENING
+        BOT_ACTIVITY=Coś
+        DISCORD_TOKEN=${config.sops.placeholder.discord-token}
+        YOUTUBE_API_KEY=${config.sops.placeholder.youtube-api}
+        SPOTIFY_CLIENT_ID=${config.sops.placeholder.spotify-client-id}
+        SPOTIFY_CLIENT_SECRET=${config.sops.placeholder.spotify-client-secret}
+      '';
+
+      systemd.tmpfiles.rules = [
+        "d    /var/lib/muse  0776    root    root     -"
+      ];
+      virtualisation.oci-containers.containers.dcbot = {
+        image = "ghcr.io/museofficial/muse:latest";
+        volumes = [ "/var/lib/muse:/data" ];
+        environmentFiles = [ config.sops.templates."muse.env".path ];
+      };
+
+    };
+
+}

configurations/host/valkyrie/services/default.nix

@@ -0,0 +1,17 @@
+{ config, pkgs, ... }:
+{
+  imports =
+    [
+      ./pleroma.nix
+      ./pihole.nix
+      ./dcbot.nix
+      ./secureyoursoul.nix
+    ];
+  services.adguardhome.enable = true;
+
+  valkyrieService.pihole.enable = false;
+  valkyrieService.pleroma.enable = false;
+  valkyrieService.dcbot.enable = true;
+  valkyrieService.secureyoursoul.enable = true;
+
+}

configurations/host/valkyrie/services/pihole.nix

@@ -0,0 +1,56 @@
+{ config, pkgs, lib, materusArg, ... }:
+{
+  options.valkyrieService.pihole.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable pihole";
+  options.valkyrieService.pihole.dnsIP = lib.mkOption { default = "127.0.0.1"; };
+  options.valkyrieService.pihole.webIP = lib.mkOption { default = "127.0.0.1"; };
+
+
+
+  config =
+    let
+      cfg = config.valkyrieService.pihole;
+      dnsmasqConf = pkgs.writeText "02-dnsmasq-custom.conf" ''
+        no-hosts
+      '';
+
+    in
+    lib.mkIf config.valkyrieService.pihole.enable {
+      systemd.tmpfiles.rules = [
+        "d    /var/lib/dnsmasq.d   0776    root    root     -"
+        "d    /var/lib/pihole   0776    root    root     -"
+        "L+   /var/lib/dnsmasq.d/02-dnsmasq-custom.conf  0776 root root - ${dnsmasqConf}"
+      ];
+
+      virtualisation.oci-containers.containers.pihole = {
+        image = "pihole/pihole:latest";
+        ports =
+          [
+            "${cfg.dnsIP}:53:53/tcp"
+            "${cfg.dnsIP}:53:53/udp"
+            "${cfg.webIP}:3000:80"
+          ];
+        environment = {
+          TZ = "Europe/Warsaw";
+          FTLCONF_LOCAL_IPV4 = "127.0.0.1";
+          DNSMASQ_USER = "root";
+          VIRTUAL_HOST = "pi.hole";
+          PROXY_LOCATION = "pi.hole";
+        };
+        volumes = [
+          "/var/lib/pihole/:/etc/pihole/"
+          "/var/lib/dnsmasq.d:/etc/dnsmasq.d/"
+          "/nix/store:/nix/store"
+        ];
+        extraOptions =
+          [
+            "--cap-add=NET_ADMIN"
+            "--dns=127.0.0.1"
+            "--dns=9.9.9.9"
+            "--hostname=pi.hole"
+          ];
+      };
+
+    };
+
+
+}

configurations/host/valkyrie/services/pleroma.nix

@@ -0,0 +1,149 @@
+{ config, pkgs, lib, materusArg, ... }:
+let
+
+  socketPath = "/run/pleroma/http.sock";
+
+
+  socketChmod = with pkgs; with lib; pkgs.writers.writeBashBin "pleroma-socket"
+    ''
+      coproc {
+          ${inotify-tools}/bin/inotifywait -q -m -e create ${escapeShellArg (dirOf socketPath)}
+        }
+
+        trap 'kill "$COPROC_PID"' EXIT TERM
+
+        until ${pkgs.coreutils}/bin/test -S ${escapeShellArg socketPath}
+          do read -r -u "''${COPROC[0]}"
+        done
+
+      ${pkgs.coreutils}/bin/chmod 0666 ${socketPath}
+    '';
+
+  soapbox = pkgs.stdenv.mkDerivation rec {
+    pname = "soapbox";
+    version = "v3.2.0";
+    dontBuild = true;
+    dontConfigure = true;
+    src = pkgs.fetchurl {
+      name = "soapbox";
+      url = "https://gitlab.com/soapbox-pub/soapbox/-/jobs/artifacts/${version}/download?job=build-production";
+      sha256 = "sha256-AdW6JK7JkIKLZ8X+N9STeOHqmGNUdhcXyC9jsQPTa9o=";
+    };
+    nativeBuildInputs = [ pkgs.unzip ];
+    unpackPhase = ''
+      unzip $src -d .
+    '';
+    installPhase = ''
+      mv ./static $out
+    '';
+
+  };
+
+in
+{
+  options.valkyrieService.pleroma.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable pleroma";
+  config = lib.mkIf config.valkyrieService.pleroma.enable {
+    systemd.tmpfiles.rules = [
+      "d    /var/lib/pleroma   0766    pleroma    pleroma     -"
+      "d    /var/lib/pleroma/static   0766    pleroma    pleroma     -"
+      "d    /var/lib/pleroma/uploads   0766    pleroma    pleroma     -"
+      "L+   /var/lib/pleroma/static/frontends/soapbox/${soapbox.version}  0766 pleroma pleroma - ${soapbox}"
+    ];
+
+   services.nginx.virtualHosts."podkos.xyz" = {
+      http2 = true;
+      useACMEHost = "podkos.xyz";
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://unix:${socketPath}";
+        extraConfig = ''
+          etag on;
+          gzip on;
+
+          add_header 'Access-Control-Allow-Origin' '*' always;
+          add_header 'Access-Control-Allow-Methods' 'POST, PUT, DELETE, GET, PATCH, OPTIONS' always;
+          add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, Idempotency-Key' always;
+          add_header 'Access-Control-Expose-Headers' 'Link, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining, X-Request-Id' always;
+          if ($request_method = OPTIONS) {
+            return 204;
+          }
+
+          add_header X-XSS-Protection "1; mode=block";
+          add_header X-Permitted-Cross-Domain-Policies none;
+          add_header X-Frame-Options DENY;
+          add_header X-Content-Type-Options nosniff;
+          add_header Referrer-Policy same-origin;
+          add_header X-Download-Options noopen;
+          proxy_http_version 1.1;
+          proxy_set_header Upgrade $http_upgrade;
+          proxy_set_header Connection "upgrade";
+          proxy_set_header Host $host;
+
+          client_max_body_size 8m;
+      
+      
+        '';
+      };
+
+    };
+    systemd.services.pleroma.serviceConfig = {
+      RuntimeDirectory = "pleroma";
+      RuntimeDirectoryPreserve = true;
+
+
+      ExecStartPost = "${socketChmod}/bin/pleroma-socket";
+      ExecStopPost = ''${pkgs.coreutils}/bin/rm -f ${socketPath}'';
+    };
+
+
+
+
+    services.pleroma = {
+      enable = true;
+      secretConfigFile = "/var/lib/pleroma/secrets.exs";
+      configs = [
+        ''
+          import Config
+
+          config :pleroma, Pleroma.Web.Endpoint,
+            url: [host: "podkos.xyz", scheme: "https", port: 443],
+            http: [ip: {:local, "${socketPath}"}, port: 0]
+
+          config :pleroma, :instance,
+            name: "Podziemia Kosmosu",
+            email: "admin@podkos.xyz",
+            notify_email: "noreply@podkos.xyz",
+            limit: 5000,
+            registrations_open: false
+
+          config :pleroma, :media_proxy,
+            enabled: false,
+            redirect_on_failure: true
+
+          config :pleroma, Pleroma.Repo,
+            adapter: Ecto.Adapters.Postgres,
+            socket: "/run/postgresql/.s.PGSQL.5432",
+            username: "pleroma",
+            database: "pleroma"
+          
+
+          # Configure web push notifications
+          config :web_push_encryption, :vapid_details,
+            subject: "mailto:admin@podkos.x yz"
+          config :pleroma, :frontends,
+            primary: %{
+              "name" => "soapbox",
+              "ref" => "${soapbox.version}"
+            }
+
+          config :pleroma, :database, rum_enabled: false
+          config :pleroma, :instance, static_dir: "/var/lib/pleroma/static"
+          config :pleroma, Pleroma.Uploaders.Local, uploads: "/var/lib/pleroma/uploads"
+
+          config :pleroma, configurable_from_database: true  
+          config :pleroma, Pleroma.Upload, filters: [Pleroma.Upload.Filter.AnonymizeFilename]
+        ''
+      ];
+    };
+  };
+}

configurations/host/valkyrie/services/secureyoursoul.nix

@@ -0,0 +1,141 @@
+{ config, pkgs, lib, materusArg, ... }:
+{
+  options.valkyrieService.secureyoursoul.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable secureyoursoul, web archive";
+
+
+
+
+  config =
+    let
+      cfg = config.valkyrieService.secureyoursoul;
+    in
+    lib.mkIf cfg.enable {
+      systemd.timers.secureyoursoul-steam = {
+        wantedBy = [ "timers.target" ];
+        timerConfig = {
+          OnCalendar = "*-*-1,7,14,21 3:00:00";
+          Persistent = true; 
+          Unit = "secureyoursoul-steam.service";
+        };
+      };
+      systemd.timers.secureyoursoul-p1 = {
+        wantedBy = [ "timers.target" ];
+        timerConfig = {
+          OnCalendar = "*-*-3,9,16,23 3:00:00";
+          Persistent = true; 
+          Unit = "secureyoursoul-p1.service";
+        };
+      };
+      systemd.timers.secureyoursoul-p2 = {
+        wantedBy = [ "timers.target" ];
+        timerConfig = {
+          OnCalendar = "*-*-5,11,18,25 3:00:00";
+          Persistent = true; 
+          Unit = "secureyoursoul-p2.service";
+        };
+      };
+
+      systemd.services.secureyoursoul-steam = {
+        description = "Make curl requests to archive steam related things";
+        path = [ pkgs.coreutils pkgs.util-linux pkgs.curl ];
+        serviceConfig.Type = "oneshot";
+        serviceConfig.RemainAfterExit = false;
+        script = ''
+          STEAM_IDS=( ${ builtins.foldl' (x: y:  x +"\""+ y + "\" ") "" materusArg.to_save.steamids })
+          EXTRA_LINKS=( ${ builtins.foldl' (x: y:  x +"\""+ y + "\" ") "" materusArg.to_save.extraLinks-steam  })
+
+          steamladder() {
+                  for id in ''${STEAM_IDS[@]}; do
+                          curl -X POST -H "Authorization: Token ''$(cat ${config.sops.secrets.steamladder-api.path})" \
+                          "https://steamladder.com/api/v1/profile/$id/"
+                  done;
+          }
+
+          webarchive(){
+          for id in ''${STEAM_IDS[@]}; do
+                  curl -X POST -H "Accept: application/json" \
+                          -H "Authorization: LOW ''$(cat ${config.sops.secrets.webarchive-accesskey.path}):''$(cat ${config.sops.secrets.webarchive-secretkey.path})" \
+                          -d"url=https://steamcommunity.com/profiles/$id" \
+                          -d"capture_outlinks=1" \
+                          -d"capture_screenshot=on" \
+                          -d"capture_all=on" \
+                          "https://web.archive.org/save";
+                  sleep 180;
+          done;
+
+
+          for link in ''${EXTRA_LINKS[@]}; do
+                  curl -X POST -H "Accept: application/json" \
+                          -H "Authorization: LOW ''$(cat ${config.sops.secrets.webarchive-accesskey.path}):''$(cat ${config.sops.secrets.webarchive-secretkey.path})" \
+                          -d"url=$link" \
+                          -d"capture_outlinks=1" \
+                          -d"capture_screenshot=on" \
+                          -d"capture_all=on" \
+                          "https://web.archive.org/save";
+                  sleep 180;
+          done;
+
+          }
+
+
+
+          steamladder &
+          webarchive
+          wait
+        '';
+      };
+
+
+       systemd.services.secureyoursoul-p1 = {
+        description = "Make curl requests to archive related things";
+        path = [ pkgs.coreutils pkgs.util-linux pkgs.curl ];
+        serviceConfig.Type = "oneshot";
+        serviceConfig.RemainAfterExit = false;
+        script = ''
+          EXTRA_LINKS=( ${ builtins.foldl' (x: y:  x +"\""+ y + "\" ") "" materusArg.to_save.extraLinks1  })
+          webarchive(){
+          for link in ''${EXTRA_LINKS[@]}; do
+                  curl -X POST -H "Accept: application/json" \
+                          -H "Authorization: LOW ''$(cat ${config.sops.secrets.webarchive-accesskey.path}):''$(cat ${config.sops.secrets.webarchive-secretkey.path})" \
+                          -d"url=$link" \
+                          -d"capture_outlinks=1" \
+                          -d"capture_screenshot=on" \
+                          -d"capture_all=on" \
+                          "https://web.archive.org/save";
+                  sleep 180;
+          done;
+
+          }
+          webarchive
+        '';
+      };
+
+      systemd.services.secureyoursoul-p2 = {
+        description = "Make curl requests to archive related things - part 2";
+        path = [ pkgs.coreutils pkgs.util-linux pkgs.curl ];
+        serviceConfig.Type = "oneshot";
+        serviceConfig.RemainAfterExit = false;
+        script = ''
+          EXTRA_LINKS=( ${ builtins.foldl' (x: y:  x +"\""+ y + "\" ") "" materusArg.to_save.extraLinks2  })
+          webarchive(){
+          for link in ''${EXTRA_LINKS[@]}; do
+                  curl -X POST -H "Accept: application/json" \
+                          -H "Authorization: LOW ''$(cat ${config.sops.secrets.webarchive-accesskey.path}):''$(cat ${config.sops.secrets.webarchive-secretkey.path})" \
+                          -d"url=$link" \
+                          -d"capture_outlinks=1" \
+                          -d"capture_screenshot=on" \
+                          -d"capture_all=on" \
+                          "https://web.archive.org/save";
+                  sleep 180;
+          done;
+
+          }
+          webarchive
+        '';
+      };
+
+
+    };
+
+
+}

configurations/host/waffentrager/configuration.nix

@@ -0,0 +1,154 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running `nixos-help`).
+
+{ config, pkgs, materusArg, ... }:
+
+{
+  imports =
+    [
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+    ];
+  networking.firewall.allowedTCPPorts = [ 1900 ];
+  networking.firewall.allowedUDPPorts = [ 1900 7359];
+  materus.profile.nixpkgs.enable = true;
+  environment.systemPackages = with pkgs; [
+    libraspberrypi
+    raspberrypi-eeprom
+    git
+
+    p7zip
+    unrar
+    bzip2
+    unzip
+    zstd
+    xz
+    zip
+    gzip
+
+  ];
+  
+  boot.tmp.useTmpfs = true;
+  services.xserver.enable = false;
+  networking.hostName = "waffentrager";
+
+  services.openssh.enable = true;
+  services.openssh.settings.PermitRootLogin = "no";
+
+  users.users.materus = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ];
+    openssh.authorizedKeys.keyFiles = [ ("${materusArg.cfg.path}" + "/extraFiles/keys/ssh/materus.pub") ];
+    hashedPasswordFile = config.sops.secrets."users/materus".path;
+    shell = pkgs.zsh;
+  };
+
+  nix = {
+    settings = {
+      auto-optimise-store = true;
+      experimental-features = [ "nix-command" "flakes" "no-url-literals" ];
+      trusted-users = [ "root" "@wheel" ];
+      substituters = [
+        "https://nix-community.cachix.org"
+        "https://cache.nixos.org/"
+        "https://nixerus.cachix.org/"
+      ];
+      trusted-public-keys = [ "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" "nixerus.cachix.org-1:2x7sIG7y1vAoxc8BNRJwsfapZsiX4hIl4aTi9V5ZDdE=" ];
+    };
+  };
+  # Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
+  boot.loader.grub.enable = false;
+  # Enables the generation of /boot/extlinux/extlinux.conf
+  boot.loader.generic-extlinux-compatible.enable = true;
+  # networking.hostName = "nixos"; # Define your hostname.
+  # Pick only one of the below networking options.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+  # networking.networkmanager.enable = true;  # Easiest to use and most distros use this by default.
+
+  # Set your time zone.
+  # time.timeZone = "Europe/Amsterdam";
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Select internationalisation properties.
+  # i18n.defaultLocale = "en_US.UTF-8";
+  # console = {
+  #   font = "Lat2-Terminus16";
+  #   keyMap = "us";
+  #   useXkbConfig = true; # use xkbOptions in tty.
+  # };
+
+  # Enable the X11 windowing system.
+  # services.xserver.enable = true;
+
+
+
+
+  # Configure keymap in X11
+  # services.xserver.layout = "us";
+  # services.xserver.xkbOptions = "eurosign:e,caps:escape";
+
+  # Enable CUPS to print documents.
+  # services.printing.enable = true;
+
+  # Enable sound.
+  # sound.enable = true;
+  # hardware.pulseaudio.enable = true;
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  services.libinput.enable = true;
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  # users.users.alice = {
+  #   isNormalUser = true;
+  #   extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+  #   packages = with pkgs; [
+  #     firefox
+  #     tree
+  #   ];
+  # };
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  # environment.systemPackages = with pkgs; [
+  #   vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+  #   wget
+  # ];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  # services.openssh.enable = true;
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It's perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.11"; # Did you read the comment?
+
+}
+

configurations/host/waffentrager/default.nix

@@ -0,0 +1,18 @@
+{ config, pkgs, materusCfg, ... }:
+{
+
+  imports = [
+    materusCfg.configInputs.nixos-hardware.nixosModules.raspberry-pi-4
+    ./configuration.nix
+    ./secrets
+    ./services
+  ];
+
+  virtualisation.podman.autoPrune.enable = true;
+  virtualisation.podman.autoPrune.dates = "daily";
+  virtualisation.podman.defaultNetwork.settings = {
+    default_subnet = "10.88.0.0/16";
+  };
+  virtualisation.oci-containers.backend = "podman";
+
+}

configurations/host/waffentrager/hardware-configuration.nix

@@ -0,0 +1,46 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [
+      (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+  boot.kernelPackages = pkgs.linuxPackages_rpi4;
+  boot.initrd.availableKernelModules = [ "xhci_pci" "usb_storage" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+  boot.kernel.sysctl = {
+    "vm.swappiness" = 10;
+  };
+  fileSystems."/" =
+    {
+      device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888";
+      fsType = "ext4";
+    };
+  fileSystems."/etc/nixos" =
+    {
+      device = "/materus/config/nixos-config";
+      fsType = "none";
+      options = [ "bind" ];
+    };
+
+  swapDevices = [{
+    device = "/var/.swapfile";
+    size = 8 * 1024;
+  }];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.end0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlan0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = "aarch64-linux";
+  powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand";
+}

configurations/host/waffentrager/home/materus/default.nix

@@ -0,0 +1,17 @@
+{ config, pkgs, lib, ... }:
+{
+  home.stateVersion = "23.11";
+  home.homeDirectory = "/home/materus";
+  materus.profile = {
+    fonts.enable = false;
+    nixpkgs.enable = false;
+    enableDesktop = false;
+    enableTerminal = false;
+    enableTerminalExtra = false;
+    enableNixDevel = false;
+
+    fish.enable = false;
+    bash.enable = true;
+    zsh.enable = true;
+  };
+}

configurations/host/waffentrager/secrets/default.nix

@@ -0,0 +1,38 @@
+{ materusCfg, ... }:
+{
+  imports =
+    [
+
+    ] ++ (if (materusCfg.materusFlake.decrypted) then [ ./private ] else [ ]);
+
+  sops.age.generateKey = false;
+  sops.gnupg.home = null;
+  sops.gnupg.sshKeyPaths = [ ];
+  sops.defaultSopsFile = materusCfg.hostPath + "/secrets/secrets.yaml";
+
+  services.openssh.hostKeys = [
+    {
+      bits = 4096;
+      path = "/materus/root/ssh_host_rsa_key";
+      type = "rsa";
+    }
+    {
+      path = "/materus/root/ssh_host_ed25519_key";
+      type = "ed25519";
+    }
+  ];
+  sops.secrets.wireguard = { };
+  sops.secrets."users/materus" = { neededForUsers = true; };
+  sops.secrets.elements = { };
+  sops.secrets.nextcloud-adminpass = { };
+  sops.secrets.maloja = { };
+  sops.secrets.maloja-api = { };
+  sops.secrets.spotify-client-id = {};
+  sops.secrets.spotify-client-secret = {};
+  sops.secrets.lastfm-user= {};
+  sops.secrets.lastfm-pass = {};
+  sops.secrets.lastfm-api = {};
+  sops.secrets.lastfm-secret = {};
+  sops.secrets.lastfm-token = {};
+  sops.secrets.listenbrainz-api = {};
+}

configurations/host/waffentrager/secrets/secrets.yaml

@@ -0,0 +1,52 @@
+wireguard: ENC[AES256_GCM,data:fFQKj78HGLDmslDST+usAZxWDanHkUORBgIeOb7lQN4EPXdz6mQODHhn1ek=,iv:/BbbiFlfk8fMX4yFgVXuYkxitbRJqai5PHku2wZUFw4=,tag:cutoXkApljbB3bgSvaS1LQ==,type:str]
+nextcloud-adminpass: ENC[AES256_GCM,data:5vohRPEcJJ8gIRro38O73ufSYYEp1DXpBgjCPdPnMcg=,iv:STh3k5wUwx3AfSDTPCXhuXbPb3d+Vi1cAaQN2a9eW1w=,tag:Ef/Z2Idvl6575Jvs2GDJ8A==,type:str]
+jwt: ENC[AES256_GCM,data:1Qn7DaBZr8vEa8VZiv2BpwePPOBYRTdHEiDv0asUbvhCtfHvhG4mX5/plyRPlQok6FLEjEzKZTEdnvyyOtFEgA==,iv:kqfHkEr0jkKAro9gQup6CeopQnjfMGhEqbVL81wnDgc=,tag:gP/WACy5cOzzmQOh1v8wsQ==,type:str]
+lldap-database: ENC[AES256_GCM,data:rNLS4WwvqRd3TFWDXaf8UmDTRsHZNPPS,iv:URV4Oz4ik2vHb03+Zh7ND+AbozSmoXpxENpvad4yvRI=,tag:6TbuMCnHwtTaG5mMWVN/mQ==,type:str]
+authelia-storagekey: ENC[AES256_GCM,data:T5b5QWf6vlGHniuUic0tEFSJNNWaFbvi3emZOWEQz0AhNqDpxJZqO57KdjZ02NVMoxHN54c0ChWlHRCoAj234A==,iv:Rch5RQ0oblTTWXz0it7zZuYQNYhYMa0MsorAx9N4GV0=,tag:+GlwGnPXLukzDnW6BUf6Hg==,type:str]
+authelia-database: ENC[AES256_GCM,data:XZYk4clzLaMb3/plELOnEoy4bwu/YSQg,iv:TGDKjLdcdmwEI12XDDNGHTgYnJxB+vV6RaomKU+jwpY=,tag:c/p7X4tzPWWiLvAL7DJmYg==,type:str]
+ldap-master: ENC[AES256_GCM,data:jiinK8xzuKiTwB9k44okgj+sWWEgbeay,iv:Slvci3EBylIbP/I6NFIJTd3eitxVApXrORtnXY48eGg=,tag:OwaVYBNxNbQyIHrqOcUGhg==,type:str]
+elements: ENC[AES256_GCM,data:Kh6ueReXpj9h5yQ3P0qY8X1ow4RRZD9zyXZLS6DUIIVuthgqgu9dPzBc7ojnz6nXoYTHt1I2LJJKLOGQYZC+iVxXOk+QADJMPwY4NCyeZ3prgvYMghlD,iv:WFA/UQ0XDFjpbgaDEacrBxkteLitXv3CJP54ANVSJHM=,tag:M+tTpTR0alvQxvUiP2MWlA==,type:str]
+users:
+    materus: ENC[AES256_GCM,data:MhPrMJ4/0oxEsFZDUKcYb3WMUWLI2ZbRTgnh1fQZG1Ly2J781jcUWtA8vVAdMBedNfWky0mDq5+KEQ/2fJNGU4IkTBvLdAqnWw==,iv:Dpl+M+x1weNIVkEsf3I/uXpG0SM6bDz+d9w7AYwn/MY=,tag:yGc1D2ODp6Te/QAztOj7yA==,type:str]
+maloja: ENC[AES256_GCM,data:V/WV0181zupKLiDtf5pinwYFFzL1hg+j,iv:KmGHapsD7thnmgkHwnTYFP/fvBS6dft9ZmmFN4AZEXs=,tag:uEmZaFkvBIQfu+3+0gQFlg==,type:str]
+maloja-api: ENC[AES256_GCM,data:8vLC1a5pL8ldS7LWXqA/HOqtnyYFQk7/oisGgOOYH7TtnpBL93I2O3mWQIGCZUwWqMWFLvbOxIAnpoS0Qmg=,iv:swziHFypoh1YZkyEpDhqH2BhqUrWi0J63CqzORyY4s4=,tag:B9kkYHqyWP0KGPMD4S1I1A==,type:str]
+spotify-client-id: ENC[AES256_GCM,data:2vC2E7rHBrZ2VHTGqYRJp1fWNWprDaYq4J6gJ7tTfF0=,iv:KQJgzUiD70N2vQeTO9r8ucC96xc9mSW9VlU2IGmKT7Y=,tag:kWR+1Hhb4yGK/AAqxMCd3A==,type:str]
+spotify-client-secret: ENC[AES256_GCM,data:MKHo36AF1hHiXERltKdeMiuMhiGyyH8E3TqQfTf1tqc=,iv:/dPWUqjDtxZUOLZRx2lrHuU5Sf2fch2Fvnl+20KZ5dk=,tag:ZgsbCFBNHXSUuHbdSlrm4w==,type:str]
+lastfm-user: ENC[AES256_GCM,data:o/FUjIiB9PcFTQ==,iv:UtovNmHISz9jUj+HFZPIduZj6h3ayjA5RyVlh11k8LM=,tag:bS3ReGR2BRcs3lcutt95UQ==,type:str]
+lastfm-pass: ENC[AES256_GCM,data:g90kxN+HkSqN+B9XFH6AvbD376bHFPVI,iv:ZRxKxdKXIgKOm7TKKPLR1yLzTBjuCWQk4tTJN5d/0N4=,tag:soIJI75WAhoiXwVYlxkmQA==,type:str]
+lastfm-api: ENC[AES256_GCM,data:UxGOqFEsjDb5zBXjm6G+66zlr5M0pk/NdTad3a5MBVE=,iv:3v9Lg0bjmlAhcSOjCW44CN7FezSdNG3KVVLrk1G9Ies=,tag:amgDr25PYiB+E7+D/fVEOw==,type:str]
+lastfm-secret: ENC[AES256_GCM,data:z+XqodyRm9qnZwYwdON/KwAQ3E6hSI+mA0Nby0PQVT4=,iv:sY3Eqr7ZCx5lwjZaRFSghx/3OjuWlDQHQywgt7LpoIo=,tag:f7j1PFanHfLdDK+ASusCMA==,type:str]
+lastfm-token: ENC[AES256_GCM,data:X877lDOXtou5OF0KbkvuJ4rhJ+3IY5XnyXlqq4LuSb8=,iv:f8t36ut6zlHvBuKGmJabyc9nHViQvUcqNvCVy0YIeB8=,tag:0h9Jm1h2cxegUXXk6UTz9Q==,type:str]
+listenbrainz-api: ENC[AES256_GCM,data:eh03MPc5kn7CUDXXnEJTx4DXv9BpyabyRL+ENDFJw+kS66tV,iv:gerOaZ3gqM7ccLursFuCJrW1HcSjlTGk0wOLM8x4/2A=,tag:ZqxYNlgdqV0zRUUHm7VK3Q==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1j34lqh0z6ak2c94n564wgyjeykn9srma34f5e5e7xvf498fwk3rqxvwx0l
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvejRrcGVwZHNkTVB5dkYr
+            RnhVVjNEblFVd0xXSStqdjFhWVVNS3ljUTNZCnBFVmRRVVVENGhJUVg2L1lSM1NO
+            dkQydVhOaFVxd0p0aFhVcmp6eXdGeVEKLS0tIFIvRDlvZDdsbm1USEZUZ3FYMmla
+            eFN4VVdUMkVjcTVWNFdLM0xtbExLdncK6LYUufWzIcd2jFyEeZDypo0xkJQ4z91F
+            ULyGxJLLWl6/inYXtxHNdxIIPfwW+5yppBAbXaOgvABi1E7tf1JZcA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-09-13T18:29:55Z"
+    mac: ENC[AES256_GCM,data:djOmSpNrZoFgUK4JlueCUpZtvHldVEsH90ASO+strLJ7wd1MEFdQaYyNonvTaUUzJQkUncyX3cXdO9Aoj9B6CPSKAuSKE7LRScCCXn+OezwUB5d5m/jLy4KmRhtADO0QHap4+/3fXzOupsHyZpVMIjwUw4tJ9MZMT8iMtbaHv2A=,iv:x4RaxRelUOyyTWpTLFRik92TibE+2mFctz/OYHvBoZA=,tag:S9dIzTc7rVBSFXUISuEDAQ==,type:str]
+    pgp:
+        - created_at: "2024-03-21T18:15:00Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4D5fSX77p80GYSAQdAWetrf0jhs/b9qcQc4b21+PJUPdSjk372BjokfwJ2oXQw
+            4LaIaNB3LRmY4FF3UOqk28NwkwBw6n0AzYKC/k1G4ntaNBMI9eDtFJ1c1+KkxSl2
+            1GYBCQIQMCKcu2aBEMiIGOyG08vcRW2T23DUAfTQqQdRKD/SgSTqAZLSICVJ91xU
+            TBsdiPBKO2cRDfPc7DlVLbPNe/SUqVUX9N4GTGPUocXc1s6lvgx3NBP5cGoSNx+A
+            xCmXl373IDc=
+            =uSyc
+            -----END PGP MESSAGE-----
+          fp: 28D140BCA60B4FD1
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

configurations/host/waffentrager/services/auth/authelia.nix

@@ -0,0 +1,80 @@
+{ config, pkgs, lib, materusArg, ... }:
+{
+  options.waffentragerService.auth.authelia.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable authelia";
+  config =
+    let
+      cfg = config.waffentragerService.auth.authelia;
+      port = 9091;
+    in
+    lib.mkIf cfg.enable {
+      sops.secrets."authelia-storagekey" = { owner = "authelia"; };
+      sops.secrets."authelia-database" = { owner = "authelia"; };
+      sops.secrets."ldap-master" = { owner = "authelia"; };
+      users.users.authelia = {
+        group = "lldap";
+        isSystemUser = true;
+      };
+      services.authelia.instances.main = {
+        enable = true;
+        user = "authelia";
+        environmentVariables = {
+          AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE = config.sops.secrets."ldap-master".path;
+          AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE = config.sops.secrets."authelia-database".path;
+        };
+        secrets = {
+          jwtSecretFile = config.sops.secrets.jwt.path;
+          storageEncryptionKeyFile = config.sops.secrets."authelia-storagekey".path;
+        };
+        settings = {
+          access_control = {
+            default_policy = "one_factor";
+          };
+          authentication_backend = {
+            ldap.url = "ldap://127.0.0.1:3890";
+            ldap.implementation = "custom";
+            ldap.base_dn = config.services.lldap.settings.ldap_base_dn;
+            ldap.user = "CN=master,ou=people,DC=podkos,DC=pl";
+            ldap.additional_users_dn = "OU=people";
+            ldap.users_filter = "(&({username_attribute}={input})(objectClass=person))";
+            ldap.additional_groups_dn = "OU=groups";
+            ldap.groups_filter = "(&(member={dn})(objectClass=groupOfNames))";
+          };
+          storage = {
+            postgres.host = "/var/run/postgresql";
+            postgres.port = "5432";
+            postgres.database = "authelia";
+            postgres.username = "authelia";
+
+          };
+          notifier = {
+            disable_startup_check = false;
+            filesystem.filename = "/tmp/test_notification.txt";
+          };
+          session = {
+            name = "materus-session";
+            domain = "materus.pl";
+          };
+
+          default_redirection_url = "https://materus.pl";
+          server.port = port;
+        };
+      };
+      services.nginx.virtualHosts."gatekeeper.materus.pl" = {
+        forceSSL = true;
+        http3 = true;
+        sslTrustedCertificate = "/var/lib/mnt_acme/materus.pl/chain.pem";
+        sslCertificateKey = "/var/lib/mnt_acme/materus.pl/key.pem";
+        sslCertificate = "/var/lib/mnt_acme/materus.pl/fullchain.pem";
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:${builtins.toString port}";
+          extraConfig = ''
+            proxy_set_header    Host                $host;
+            proxy_set_header    X-Real-IP           $remote_addr;
+            proxy_set_header    X-Forwarded-Ssl     on;
+            proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
+            proxy_set_header    X-Forwarded-Proto   $scheme;
+          '';
+        };
+      };
+    };
+}

configurations/host/waffentrager/services/auth/default.nix

@@ -0,0 +1,13 @@
+{ config, materusArg, lib, pkgs, ... }:
+{
+  imports =
+    [
+      ./lldap.nix
+      ./authelia.nix
+    ];
+  config = 
+    {
+      waffentragerService.auth.lldap.enable = true;
+      waffentragerService.auth.authelia.enable = true;
+    };
+}

configurations/host/waffentrager/services/auth/lldap.nix

@@ -0,0 +1,71 @@
+{ config, pkgs, lib, materusArg, ... }:
+{
+  options.waffentragerService.auth.lldap.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable lldap";
+  config =
+    let
+      cfg = config.waffentragerService.auth.lldap;
+    in
+    lib.mkIf cfg.enable {
+      waffentragerService.elements.enable = true;
+      waffentragerService.nginx.enable = true;
+      services.nginx.virtualHosts."mamba.podkos.pl" = {
+        forceSSL = true;
+        http3 = true;
+        sslTrustedCertificate = "/var/lib/mnt_acme/mamba.podkos.pl/chain.pem";
+        sslCertificateKey = "/var/lib/mnt_acme/mamba.podkos.pl/key.pem";
+        sslCertificate = "/var/lib/mnt_acme/mamba.podkos.pl/fullchain.pem";
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:17170";
+          extraConfig = ''
+            proxy_set_header    Host                $host;
+            proxy_set_header    X-Real-IP           $remote_addr;
+            proxy_set_header    X-Forwarded-Ssl     on;
+            proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
+            proxy_set_header    X-Forwarded-Proto   $scheme;
+
+
+            allow ${materusArg.ip-masks.wireguard.main};
+            allow 192.168.100.0/24;
+            deny all;
+          '';
+        };
+      };
+
+      systemd.services.lldap = {
+        requires = [ "elements-mount.service" ];
+        after = [ "elements-mount.service" ];
+        serviceConfig = {
+          DynamicUser = lib.mkForce false;
+          WorkingDirectory = lib.mkForce config.waffentragerService.elements.lldapDir;
+        };
+      };
+      users.groups.lldap = { };
+      users.users.lldap = {
+        group = "lldap";
+        isSystemUser = true;
+      };
+      sops.secrets.jwt = { owner = "lldap"; group = "lldap"; mode = "0440"; };
+      sops.secrets."lldap-database" = { owner = "lldap"; group = "lldap"; };
+      services.lldap.enable = true;
+      services.lldap.environmentFile = config.sops.templates."lldap.env".path;
+      sops.templates."lldap.env" = {
+        content = ''
+          LLDAP_JWT_SECRET_FILE="${config.sops.secrets.jwt.path}"
+          LLDAP_DATABASE_URL="postgres://lldap:${config.sops.placeholder."lldap-database"}@%2Fvar%2Frun%2Fpostgresql/lldap"
+        '';
+        owner = "lldap";
+        group = "lldap";
+      };
+
+      services.lldap.settings = {
+        ldap_base_dn = "dc=podkos,dc=pl";
+
+        ldap_host = "127.0.0.1";
+        http_url = "https://mamba.podkos.pl";
+        ldap_user_dn = "master";
+        ldap_user_email = "materus@podkos.pl";
+        ldap_port = 3890;
+        key_seed = materusArg.waffentrager.lldap.seed;
+      };
+    };
+}

configurations/host/waffentrager/services/default.nix

@@ -0,0 +1,30 @@
+{ ... }:
+{
+  imports =
+    [
+      ./storage/elements.nix
+      ./storage/mount-acme.nix
+      ./storage/gitea.nix
+      ./storage/nextcloud.nix
+      ./storage/samba.nix
+      ./storage/syncthing.nix
+      ./multimedia/jellyfin.nix
+      ./multimedia/scrobbling.nix
+      ./monitoring.nix
+      ./nginx.nix
+      ./postgresql.nix
+      ./auth
+    ];
+  waffentragerService.elements.enable = true;
+  waffentragerService.postgresql.enable = true;
+  waffentragerService.mount-acme.enable = true;
+  waffentragerService.gitea.enable = true;
+  waffentragerService.nginx.enable = true;
+  waffentragerService.nextcloud.enable = true;
+  waffentragerService.samba.enable = true;
+  waffentragerService.jellyfin.enable = true;
+  waffentragerService.scrobbling.enable = true;
+
+  waffentragerService.syncthing.enable = true;
+  waffentragerService.monitoring.enable = true;
+}

configurations/host/waffentrager/services/monitoring.nix

@@ -0,0 +1,57 @@
+{ materusArg, config, lib, ... }:
+{
+  options.waffentragerService.monitoring.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable monitoring";
+  config =
+    let
+      cfg = config.waffentragerService.monitoring;
+    in
+    lib.mkIf cfg.enable {
+      services.grafana = {
+        dataDir = "${config.waffentragerService.elements.path}/services/grafana";
+        enable = true;
+        settings = {
+          server = {
+            http_addr = "127.0.0.1";
+            http_port = 3232;
+            
+            domain = "watchman.materus.pl";
+            serve_from_sub_path = true;
+          };
+        };
+      };
+      services.prometheus = {
+        enable = true;
+        port = 3233;
+        globalConfig.scrape_interval = "30s";
+        stateDir = "elements/services/prometheus";
+        scrapeConfigs = [
+          {
+            job_name = "node";
+            static_configs = [{
+              targets = [ "localhost:${toString config.services.prometheus.exporters.node.port}" ];
+            }];
+          }
+        ];
+      };
+      services.prometheus.exporters.node = {
+        enable = true;
+        port = 3234;
+        enabledCollectors = [ "systemd" ];
+        extraFlags = [ "--collector.ethtool" "--collector.softirqs" "--collector.tcpstat" "--collector.wifi" ];
+        
+      };
+      services.nginx.virtualHosts."watchman.materus.pl" = {
+        addSSL = true;
+        sslTrustedCertificate = "/var/lib/mnt_acme/materus.pl/chain.pem";
+        sslCertificateKey = "/var/lib/mnt_acme/materus.pl/key.pem";
+        sslCertificate = "/var/lib/mnt_acme/materus.pl/fullchain.pem";
+        http2 = false;
+        http3 = true;
+        locations."/" = {
+          proxyPass = "http://${toString config.services.grafana.settings.server.http_addr}:${toString config.services.grafana.settings.server.http_port}";
+          proxyWebsockets = true;
+          recommendedProxySettings = true;
+        };
+      };
+    };
+}

configurations/host/waffentrager/services/multimedia/jellyfin.nix

@@ -0,0 +1,150 @@
+{ lib, config, materusArg, ... }:
+{
+  options.waffentragerService.jellyfin.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable jellyfin";
+
+  config =
+    let
+      cfg = config.waffentragerService.jellyfin;
+    in
+    lib.mkIf cfg.enable {
+      services.jellyfin = rec {
+        enable = true;
+        openFirewall = true;
+        user = "materus";
+        group = "nextcloud";
+        dataDir = config.waffentragerService.elements.jellyfinDir;
+        cacheDir = "${dataDir}/cache";
+      };
+      /*
+      services.jellyseerr = {
+        enable = true;
+        openFirewall = true;
+      };*/
+
+      services.nginx = {
+        appendHttpConfig = ''
+          map $request_uri $h264Level { ~(h264-level=)(.+?)& $2; }
+          map $request_uri $h264Profile { ~(h264-profile=)(.+?)& $2; }
+        '';
+        proxyCachePath."jellyfin" = {
+          enable = true;
+          maxSize = "1g";
+          levels = "1:2";
+          keysZoneName = "jellyfin";
+          keysZoneSize = "100m";
+          inactive = "1d";
+          useTempPath = false;
+
+        };
+        virtualHosts = {
+          "noot.materus.pl" = {
+            extraConfig = ''
+              client_max_body_size 20M;
+              add_header X-Frame-Options "SAMEORIGIN";
+              add_header X-XSS-Protection "0"; # Do NOT enable. This is obsolete/dangerous
+              add_header X-Content-Type-Options "nosniff";
+              add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), battery=(), bluetooth=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), payment=(), publickey-credentials-get=(), serial=(), sync-xhr=(), usb=(), xr-spatial-tracking=()" always;
+            '';
+            sslTrustedCertificate = "/var/lib/mnt_acme/materus.pl/chain.pem";
+            sslCertificateKey = "/var/lib/mnt_acme/materus.pl/key.pem";
+            sslCertificate = "/var/lib/mnt_acme/materus.pl/fullchain.pem";
+            addSSL = true;
+            http2 = false;
+            http3 = true;
+            locations."~ /Items/(.*)/Images" = {
+              proxyPass = "http://127.0.0.1:8096";
+              extraConfig = ''
+                proxy_set_header Host $host;
+                proxy_set_header X-Real-IP $remote_addr;
+                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                proxy_set_header X-Forwarded-Proto $scheme;
+                proxy_set_header X-Forwarded-Protocol $scheme;
+                proxy_set_header X-Forwarded-Host $http_host;
+
+                proxy_cache jellyfin;
+                proxy_cache_revalidate on;
+                proxy_cache_lock on;
+              '';
+            };
+            locations."~ ^/web/htmlVideoPlayer-plugin.[0-9a-z]+.chunk.js$" = {
+              proxyPass = "http://127.0.0.1:8096";
+              extraConfig = ''
+                proxy_set_header Accept-Encoding "";
+
+                sub_filter_types *;
+                sub_filter 'return u=30' 'return u=600';
+                sub_filter 'return u=6' 'return u=60';
+                sub_filter 'maxBufferLength:u' 'maxBufferLength:u,maxBufferSize:180000000';
+                sub_filter_once on;
+              '';
+            };
+            locations."~* ^/Videos/(.*)/(?!live)" = {
+              proxyPass = "http://127.0.0.1:8096";
+              extraConfig = ''
+                # Set size of a slice (this amount will be always requested from the backend by nginx)
+                # Higher value means more latency, lower more overhead
+                # This size is independent of the size clients/browsers can request
+                slice 2m;
+
+                proxy_cache jellyfin;
+                proxy_cache_valid 200 206 301 302 30d;
+                proxy_ignore_headers Expires Cache-Control Set-Cookie X-Accel-Expires;
+                proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504;
+                proxy_connect_timeout 15s;
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                # Transmit slice range to the backend
+                proxy_set_header Range $slice_range;
+
+                # This saves bandwidth between the proxy and jellyfin, as a file is only downloaded one time instead of multiple times when multiple clients want to at the same time
+                # The first client will trigger the download, the other clients will have to wait until the slice is cached
+                # Esp. practical during SyncPlay
+                proxy_cache_lock on;
+                proxy_cache_lock_age 60s;
+
+                proxy_cache_key "jellyvideo$uri?MediaSourceId=$arg_MediaSourceId&VideoCodec=$arg_VideoCodec&AudioCodec=$arg_AudioCodec&AudioStreamIndex=$arg_AudioStreamIndex&VideoBitrate=$arg_VideoBitrate&AudioBitrate=$arg_AudioBitrate&SubtitleMethod=$arg_SubtitleMethod&TranscodingMaxAudioChannels=$arg_TranscodingMaxAudioChannels&RequireAvc=$arg_RequireAvc&SegmentContainer=$arg_SegmentContainer&MinSegments=$arg_MinSegments&BreakOnNonKeyFrames=$arg_BreakOnNonKeyFrames&h264-profile=$h264Profile&h264-level=$h264Level&slicerange=$slice_range";
+
+              '';
+            };
+            locations."/" = {
+              proxyPass = "http://127.0.0.1:8096";
+              extraConfig = ''
+                proxy_pass_request_headers on;
+
+                proxy_set_header Host $host;
+
+                proxy_set_header X-Real-IP $remote_addr;
+                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                proxy_set_header X-Forwarded-Proto $scheme;
+                proxy_set_header X-Forwarded-Host $http_host;
+
+                proxy_set_header Upgrade $http_upgrade;
+                proxy_set_header Connection $http_connection;
+                
+
+              '';
+            };
+            locations."/socket" = {
+              proxyPass = "http://127.0.0.1:8096";
+              extraConfig = ''
+                proxy_pass_request_headers on;
+
+                proxy_http_version 1.1;
+                proxy_set_header Upgrade $http_upgrade;
+                proxy_set_header Connection "upgrade";
+                proxy_set_header Host $host;
+                proxy_set_header X-Real-IP $remote_addr;
+                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                proxy_set_header X-Forwarded-Proto $scheme;
+                proxy_set_header X-Forwarded-Protocol $scheme;
+                proxy_set_header X-Forwarded-Host $http_host;
+
+
+              '';
+            };
+
+          };
+        };
+      };
+    };
+}

configurations/host/waffentrager/services/multimedia/scrobbling.nix

@@ -0,0 +1,240 @@
+{ config, pkgs, lib, materusArg, ... }:
+{
+  options.waffentragerService.scrobbling.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable scrobbling";
+
+
+
+
+  config =
+    let
+      cfg = config.waffentragerService.scrobbling;
+    in
+
+
+    #### MALOJA --------------------------------------------------------------------
+    lib.mkIf cfg.enable {
+      sops.templates."maloja.env".content = ''
+        MALOJA_DATA_DIRECTORY=/data
+        MALOJA_DIRECTORY_STATE=/data/state
+        MALOJA_DIRECTORY_CACHE=/data/cache
+        
+        MALOJA_SKIP_SETUP=yes
+        MALOJA_FORCE_PASSWORD=${config.sops.placeholder.maloja}
+        MALOJA_SPOTIFY_API_ID=${config.sops.placeholder.spotify-client-id}
+        MALOJA_SPOTIFY_API_SECRET=${config.sops.placeholder.spotify-client-secret}
+        
+        MALOJA_NAME=Melody
+
+        MALOJA_WEEK_OFFSET=1
+
+        PUID=${builtins.toString config.users.users.scrobbler.uid}
+        PGID=${builtins.toString config.users.groups.scrobbler.gid}
+        TC=Europe/Warsaw
+        TIMEZONE=Europe/Warsaw
+      '';
+      services.nginx.virtualHosts = {
+        "melody.materus.pl" = {
+          sslTrustedCertificate = "/var/lib/mnt_acme/materus.pl/chain.pem";
+          sslCertificateKey = "/var/lib/mnt_acme/materus.pl/key.pem";
+          sslCertificate = "/var/lib/mnt_acme/materus.pl/fullchain.pem";
+          addSSL = true;
+          http2 = false;
+          http3 = true;
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:42010";
+            extraConfig = ''
+              proxy_http_version 1.1;
+              proxy_set_header    Host                $host;
+              proxy_set_header    X-Real-IP           $remote_addr;
+              proxy_set_header    X-Forwarded-Ssl     on;
+              proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
+              proxy_set_header    X-Forwarded-Proto   $scheme;
+              
+            '';
+          };
+
+        };
+
+      };
+
+
+      virtualisation.oci-containers.containers.maloja =
+        {
+
+          image = "krateng/maloja:latest";
+          ports = [
+            "42010:42010"
+          ];
+          volumes = [
+            "${config.waffentragerService.elements.malojaDir}:/data"
+          ];
+          environmentFiles = [
+            config.sops.templates."maloja.env".path
+          ];
+        };
+      systemd.services."${config.virtualisation.oci-containers.backend}-maloja" =
+
+        let
+          malojaCfg = pkgs.writeText "settings.ini" ''[MALOJA]
+directory_config = /data
+lastfm_api_key = False
+audiodb_api_key = False
+spotify_api_id = False
+spotify_api_secret = False
+delimiters_feat = ["ft.","ft","feat.","feat","featuring","Ft.","Ft","Feat.","Feat","Featuring"]
+delimiters_informal = ["vs.","vs","&","with"]
+delimiters_formal = ["; ",";"]
+metadata_providers = ["spotify","deezer","lastfm","audiodb","musicbrainz"]
+
+'';
+        in
+        {
+          requires = [ "elements-mount.service" ];
+          after = [ "elements-mount.service" ];
+          preStart = ''cp --update=none ${malojaCfg} ${config.waffentragerService.elements.malojaDir}/settings.ini'';
+
+        };
+
+      #### MULTI SCROBBLER --------------------------------------------------------------------
+      users.groups.scrobbler = { gid = 3000; };
+      users.users.scrobbler = {
+        group = "scrobbler";
+        uid = 3000;
+        isSystemUser = true;
+      };
+      sops.templates."multi-scrobbler.env".content = ''
+        TC=Europe/Warsaw
+        CONFIG_DIR=/config
+        PUID=${builtins.toString config.users.users.scrobbler.uid}
+        PGID=${builtins.toString config.users.groups.scrobbler.gid}
+      '';
+      sops.templates."multi-scrobbler.json".owner = "scrobbler";
+      sops.templates."multi-scrobbler.json".group = "scrobbler";
+      sops.templates."multi-scrobbler.json".content = builtins.toJSON {
+        baseUrl = "https://scrobbler.materus.pl";
+        disableWeb = false;
+        debugMode = false;
+        sources = [
+          {
+            name = "materus-spotify";
+            enable = true;
+            clients = [ "maloja" ];
+            data = {
+              clientId = "${config.sops.placeholder.spotify-client-id}";
+              clientSecret = "${config.sops.placeholder.spotify-client-secret}";
+              redirectUri = "https://scrobbler.materus.pl/callback";
+              interval = 30;
+            };
+            type = "spotify";
+          }
+          {
+            name = "materus-jellyfin";
+            enable = true;
+            clients = [ "maloja" ];
+            data = {
+              users = [
+                "materus"
+              ];
+              servers = [
+                "waffentrager"
+              ];
+            };
+            options = {
+              logPayload = false;
+              logFilterFailure = "warn";
+            };
+            type = "jellyfin";
+          }
+        ];
+        clients = [
+          {
+            name = "maloja";
+            enable = true;
+            data = {
+              url = "https://melody.materus.pl/";
+              apiKey = "${config.sops.placeholder.maloja-api}";
+            };
+            type = "maloja";
+          }
+          {
+            name = "materus-brainz";
+            enable = true;
+            configureAs = "client";
+            data = {
+              token = "${config.sops.placeholder.listenbrainz-api}";
+              username = "materus";
+            };
+            type = "listenbrainz";
+          }
+          {
+            name = "materus-lastfm";
+            enable = true;
+            configureAs = "client";
+            data = {
+              apiKey = "${config.sops.placeholder.lastfm-api}";
+              secret = "${config.sops.placeholder.lastfm-secret}";
+              redirectUri = "https://scrobbler.materus.pl/lastfm/callback";
+            };
+            type = "lastfm";
+          }
+
+        ];
+
+      };
+
+
+
+
+      services.nginx.virtualHosts = {
+        "scrobbler.materus.pl" = {
+          sslTrustedCertificate = "/var/lib/mnt_acme/materus.pl/chain.pem";
+          sslCertificateKey = "/var/lib/mnt_acme/materus.pl/key.pem";
+          sslCertificate = "/var/lib/mnt_acme/materus.pl/fullchain.pem";
+          addSSL = true;
+          http2 = false;
+          http3 = true;
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:42011";
+            extraConfig = ''
+              allow ${materusArg.ip-masks.wireguard.main};
+              allow 192.168.100.0/24;
+              deny all;
+              proxy_http_version 1.1;
+              proxy_set_header    Host                $host;
+              proxy_set_header    X-Real-IP           $remote_addr;
+              proxy_set_header    X-Forwarded-Ssl     on;
+              proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
+              proxy_set_header    X-Forwarded-Proto   $scheme;
+
+            '';
+          };
+
+        };
+
+      };
+      systemd.services."${config.virtualisation.oci-containers.backend}-multi-scrobbler" =
+        {
+          preStart = ''cp -f ${config.sops.templates."multi-scrobbler.json".path} ${config.waffentragerService.elements.malojaDir}/multi-scrobbler/config.json'';
+          requires = [ "elements-mount.service" ];
+          after = [ "elements-mount.service" ];
+        };
+      virtualisation.oci-containers.containers.multi-scrobbler = {
+        image = "foxxmd/multi-scrobbler:latest";
+        ports = [
+          "127.0.0.1:42011:9078"
+        ];
+        volumes = [
+          "${config.waffentragerService.elements.malojaDir}/multi-scrobbler:/config"
+        ];
+        environmentFiles = [
+          config.sops.templates."multi-scrobbler.env".path
+        ];
+      };
+
+
+
+
+
+
+    };
+}

configurations/host/waffentrager/services/nginx.nix

@@ -0,0 +1,39 @@
+{ materusArg, config, lib, pkgs, ... }:
+{
+  options.waffentragerService.nginx.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable nginx";
+
+
+  config =
+    let
+      cfg = config.waffentragerService.nginx;
+    in
+    lib.mkIf cfg.enable {
+      networking.firewall.allowedTCPPorts = [ 80 443 ];
+      services.nginx = {
+        enable = true;
+        recommendedTlsSettings = true;
+        recommendedOptimisation = true;
+        recommendedGzipSettings = true;
+        package = pkgs.tengine;
+        virtualHosts."default" = {
+          sslTrustedCertificate = "/var/lib/mnt_acme/materus.pl/chain.pem";
+          sslCertificateKey = "/var/lib/mnt_acme/materus.pl/key.pem";
+          sslCertificate = "/var/lib/mnt_acme/materus.pl/fullchain.pem";
+          forceSSL = true;
+          http2 = false;
+          default = true;
+          locations."/" = { extraConfig = ''deny all;''; };
+        };
+      };
+
+      systemd.services.nginx = {
+        requires = [ "var-lib-mnt_acme.mount" ];
+        after = [ "var-lib-mnt_acme.mount" ];
+        serviceConfig = {
+          restart = "always";
+          restartSec = 60;
+        };
+      };
+    };
+
+}

configurations/host/waffentrager/services/postgresql.nix

@@ -0,0 +1,27 @@
+{ materusArg, config, lib, pkgs, ... }:
+{
+  options.waffentragerService.postgresql.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable postgresql";
+  options.waffentragerService.postgresql.version = lib.mkOption { default = "16"; };
+
+  config =
+    let
+      cfg = config.waffentragerService.postgresql;
+    in
+    lib.mkIf cfg.enable {
+      waffentragerService.elements.enable = true;
+
+      services.postgresql.enable = true;
+      services.postgresql.package = pkgs."postgresql_${cfg.version}";
+      services.postgresql.dataDir = "${config.waffentragerService.elements.postgresqlDir}/${cfg.version}";
+      services.postgresql.enableJIT = true;
+      services.postgresql.authentication = pkgs.lib.mkOverride 10 ''
+        local all all trust
+        host all all 127.0.0.1/32 scram-sha-256
+        host all all ::1/128 scram-sha-256
+      '';
+      systemd.services.postgresql = {
+        requires = [ "elements-mount.service" ];
+        after = [ "elements-mount.service" ];
+      };
+    };
+}

configurations/host/waffentrager/services/storage/elements.nix

@@ -0,0 +1,65 @@
+{ materusArg, config, lib, pkgs, ... }:
+{
+  options.waffentragerService.elements.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable elements drive";
+  options.waffentragerService.elements.path = lib.mkOption { default = "/var/lib/elements"; };
+  options.waffentragerService.elements.uuid = lib.mkOption { default = "e32039c6-e98d-44b0-8e7d-120994bf7be1"; };
+  options.waffentragerService.elements.postgresqlDir = lib.mkOption { default = "${config.waffentragerService.elements.path}/services/postgresql"; };
+  options.waffentragerService.elements.nextcloudDir = lib.mkOption { default = "${config.waffentragerService.elements.path}/services/nextcloud"; };
+  options.waffentragerService.elements.lldapDir = lib.mkOption { default = "${config.waffentragerService.elements.path}/services/lldap"; };
+  options.waffentragerService.elements.jellyfinDir = lib.mkOption { default = "${config.waffentragerService.elements.path}/services/jellyfin"; };
+  options.waffentragerService.elements.malojaDir = lib.mkOption { default = "${config.waffentragerService.elements.path}/services/maloja"; };
+
+  config =
+    let
+      cfg = config.waffentragerService.elements;
+    in
+    lib.mkIf cfg.enable {
+
+      systemd.services.elements-mount = {
+        description = "Decrypt and mount elements drive";
+        wantedBy = [ "multi-user.target" ];
+        path = [ pkgs.cryptsetup pkgs.coreutils pkgs.util-linux ];
+        serviceConfig.Type = "oneshot";
+        serviceConfig.RemainAfterExit = true;
+        script = ''
+          mkdir -p ${cfg.path}
+          cryptsetup luksOpen /dev/disk/by-uuid/${cfg.uuid} elements -d ${config.sops.secrets.elements.path}
+          mount /dev/mapper/elements ${cfg.path}
+        ''
+
+        ;
+        preStop = ''
+          umount ${cfg.path}
+          cryptsetup luksClose elements
+        '';
+      };
+
+      systemd.services.elements-dirmake = {
+        description = "Create dirs in elements drive";
+        path = [ pkgs.cryptsetup pkgs.coreutils pkgs.util-linux ];
+
+        serviceConfig.Type = "oneshot";
+        serviceConfig.RemainAfterExit = false;
+        script = lib.optionalString config.waffentragerService.postgresql.enable ''
+          mkdir -p ${cfg.postgresqlDir}/${config.waffentragerService.postgresql.version}
+          chown -R postgres:postgres ${cfg.postgresqlDir}
+        '' + lib.optionalString config.waffentragerService.nextcloud.enable ''
+          mkdir -p ${cfg.nextcloudDir}
+          chown -R nextcloud:nextcloud ${cfg.nextcloudDir}
+        '' + lib.optionalString config.waffentragerService.auth.lldap.enable ''
+          mkdir -p ${cfg.lldapDir}
+          chown -R lldap:lldap ${cfg.lldapDir}
+        '' + lib.optionalString config.waffentragerService.jellyfin.enable ''
+          mkdir -p ${cfg.jellyfinDir}
+          chown -R materus:nextcloud ${cfg.jellyfinDir}
+        '' + lib.optionalString config.waffentragerService.scrobbling.enable ''
+          mkdir -p ${cfg.malojaDir}/multi-scrobbler
+          chown -R scrobbler:scrobbler ${cfg.malojaDir}
+        ''
+
+
+        ;
+      };
+
+    };
+}

configurations/host/waffentrager/services/storage/gitea.nix

@@ -0,0 +1,62 @@
+{ materusArg, config, lib, ... }:
+{
+  options.waffentragerService.gitea.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable gitea";
+
+
+  config =
+    let
+      cfg = config.waffentragerService.gitea;
+    in
+    lib.mkMerge
+      [
+        (lib.mkIf cfg.enable {
+          waffentragerService.postgresql.enable = true;
+          waffentragerService.elements.enable = true;
+
+          services.gitea.enable = true;
+          services.gitea.lfs.enable = true;
+          services.gitea.stateDir = "${config.waffentragerService.elements.path}/services/gitea";
+          services.gitea.settings.service.DISABLE_REGISTRATION = true;
+          services.gitea.settings.server.DOMAIN = "baka.materus.pl";
+          services.gitea.settings.server.ROOT_URL = lib.mkForce "https://baka.materus.pl/";
+          services.gitea.settings.server.PROTOCOL = "fcgi+unix";
+          services.gitea.settings.cors = {
+            ENABLED = true;
+            X_FRAME_OPTIONS = "ALLOW-FROM https://*.materus.pl/";
+          };
+
+          services.gitea.database.type = "postgres";
+          services.gitea.database.socket = "/var/run/postgresql/";
+
+        })
+        (lib.mkIf (cfg.enable && config.waffentragerService.nginx.enable) {
+
+          services.nginx.virtualHosts = {
+            "baka.materus.pl" = {
+              sslTrustedCertificate = "/var/lib/mnt_acme/materus.pl/chain.pem";
+              sslCertificateKey = "/var/lib/mnt_acme/materus.pl/key.pem";
+              sslCertificate = "/var/lib/mnt_acme/materus.pl/fullchain.pem";
+              addSSL = true;
+              http2 = false;
+              locations."/" = {
+                extraConfig = ''
+                  client_max_body_size 2G;
+                  include ${config.services.nginx.package}/conf/fastcgi.conf;
+                  include ${config.services.nginx.package}/conf/fastcgi_params;
+                  proxy_http_version 1.1;
+                  proxy_set_header    Host                $host;
+                  proxy_set_header    X-Real-IP           $remote_addr;
+                  proxy_set_header    X-Forwarded-Ssl     on;
+                  proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
+                  proxy_set_header    X-Forwarded-Proto   $scheme;
+
+                  fastcgi_pass  unix:/var/run/gitea/gitea.sock;
+                '';
+              };
+
+            };
+          };
+        }
+        )
+      ];
+}

configurations/host/waffentrager/services/storage/mount-acme.nix

@@ -0,0 +1,20 @@
+{ materusArg, config, lib, pkgs, ... }:
+{
+  options.waffentragerService.mount-acme.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable mount-acme";
+
+  config =
+    let
+      cfg = config.waffentragerService.mount-acme;
+    in
+    lib.mkIf cfg.enable {
+      environment.systemPackages = with pkgs; [ sshfs ];
+      systemd.mounts = [{
+        description = "Mount remote acme dir from valkyrie";
+        what = "acme@valkyrie:/var/lib/acme";
+        where = "/var/lib/mnt_acme";
+        type = "fuse.sshfs";
+        options = "reconnect,gid=${builtins.toString config.ids.gids.nginx},_netdev,rw,nosuid,allow_other,default_permissions,follow_symlinks,idmap=user,compression=yes,identityfile=/materus/root/ssh_host_ed25519_key";
+        wantedBy = [ "multi-user.target" ];
+      }];
+    };
+}

configurations/host/waffentrager/services/storage/nextcloud.nix

@@ -0,0 +1,102 @@
+{ materusArg, config, lib, pkgs, ... }:
+{
+  options.waffentragerService.nextcloud.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable nextcloud";
+
+  config =
+    let
+      cfg = config.waffentragerService.nextcloud;
+    in
+    lib.mkIf cfg.enable {
+      waffentragerService.elements.enable = true;
+      waffentragerService.postgresql.enable = true;
+      waffentragerService.nginx.enable = true;
+      environment.systemPackages = [ pkgs.samba pkgs.exiftool pkgs.ffmpeg-headless ];
+      sops.secrets.nextcloud-adminpass.owner = config.users.users.nextcloud.name;
+      sops.secrets.nextcloud-adminpass.group = config.users.users.nextcloud.group;
+
+      services.postgresql.ensureDatabases = [ "nextcloud" ];
+      services.postgresql.ensureUsers = [{
+        name = "nextcloud";
+        ensureDBOwnership = true;
+      }];
+      services.nextcloud = {
+        enable = true;
+        notify_push.enable = true;
+        package = pkgs.nextcloud31;
+        hostName = "waffentrager.materus.pl";
+        home = config.waffentragerService.elements.nextcloudDir;
+        config.adminuser = "nextcloud-master";
+        config.adminpassFile = config.sops.secrets.nextcloud-adminpass.path;
+        config.dbtype = "pgsql";
+        extraAppsEnable = true;
+        maxUploadSize = "8G";
+        https = true;
+        enableImagemagick = true;
+        configureRedis = true;
+        webfinger = true;
+        appstoreEnable = true;
+        database.createLocally = true;
+        nginx.recommendedHttpHeaders = true;
+        extraApps = with pkgs.nextcloud31Packages.apps; {
+          inherit notify_push previewgenerator;
+        };
+        settings = {
+          log_type = "file";
+          "profile.enabled" = true;
+          default_phone_region = "PL";
+          trusted_proxies = [ materusArg.ips.valkyrie materusArg.ips.wireguard.valkyrie materusArg.ips.wireguard.waffentrager ];
+          mail_smtpmode = "sendmail";
+          mail_sendmailmode = "pipe";
+          enable_previews = true;
+          preview_format = "webp";
+          enabledPreviewProviders = [
+            ''OC\Preview\Movie''
+            ''OC\Preview\PNG''
+            ''OC\Preview\JPEG''
+            ''OC\Preview\GIF''
+            ''OC\Preview\BMP''
+            ''OC\Preview\XBitmap''
+            ''OC\Preview\MP3''
+            ''OC\Preview\OGG''
+            ''OC\Preview\OPUS''
+            ''OC\Preview\MP4''
+            ''OC\Preview\TXT''
+            ''OC\Preview\MarkDown''
+            ''OC\Preview\PDF''
+            ''OC\Preview\WebP''
+            ''OC\Preview\OpenDocument''
+            ''OC\Preview\Krita''
+            ''OC\Preview\AVIF''
+          ];
+          "overwrite.cli.url" = "https://${config.services.nextcloud.hostName}";
+        };
+
+        phpOptions = {
+          "opcache.memory_consumption" = "512";
+          "opcache.interned_strings_buffer" = "64";
+          "opcache.max_accelerated_files"="50000";
+          "opcache.jit" = "1255";
+          "opcache.jit_buffer_size" = "128M";
+          "opcache.validate_timestamps" = "0";
+          "opcache.revalidate_freq" = "0";
+          "opcache.fast_shutdown" = "1";
+          "opcache.save_comments" = "1";
+        };
+        phpExtraExtensions = ex: [ ex.zip ex.zlib ex.tidy ex.smbclient ex.sodium ];
+      };
+      services.nginx.virtualHosts.${config.services.nextcloud.hostName} = {
+        forceSSL = true;
+        http3 = true;
+        sslTrustedCertificate = "/var/lib/mnt_acme/materus.pl/chain.pem";
+        sslCertificateKey = "/var/lib/mnt_acme/materus.pl/key.pem";
+        sslCertificate = "/var/lib/mnt_acme/materus.pl/fullchain.pem";
+        extraConfig = ''
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          dav_methods PUT DELETE MKCOL COPY MOVE;
+          dav_ext_methods PROPFIND OPTIONS;
+          create_full_put_path on;
+          dav_access user:rw group:rw all:r;
+        '';
+      };
+    };
+}

configurations/host/waffentrager/services/storage/samba.nix

@@ -0,0 +1,57 @@
+{ lib, pkgs, materusArg, config, ... }:
+{
+  options.waffentragerService.samba.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable samba";
+
+  config =
+    let
+      cfg = config.waffentragerService.samba;
+    in
+    lib.mkIf cfg.enable {
+      waffentragerService.elements.enable = true;
+
+      systemd.services.samba-nmbd = {
+        requires = [ "elements-mount.service" ];
+        after = [ "elements-mount.service" ];
+      };
+      systemd.services.samba-wsdd = {
+        requires = [ "elements-mount.service" ];
+        after = [ "elements-mount.service" ];
+      };
+      services.samba-wsdd.enable = true;
+      services.samba-wsdd.openFirewall = true;
+      services.samba = {
+        enable = true;
+        package = pkgs.sambaFull;
+        securityType = "user";
+        openFirewall = true;
+        settings = 
+          {
+            global = {
+              "workgroup" = "WORKGROUP";
+              "server string" = "smbwaffentrager";
+              "netbios name" = "smbwaffentrager";
+              "security" = "user"; 
+              "hosts allow" = "${materusArg.wireguard.sambaIp} 192.168.100. 127.0.0.1 localhost";
+              "hosts deny" = "0.0.0.0/0";
+              "guest account" = "nobody";
+              "map to guest" = "bad user";
+              "mangled names" = "no";
+              "dos charset" = "CP850";
+              "unix charset" = "UTF-8";
+	          "display charset" = "UTF-8";
+              "catia:mappings" = "0x22:0xa8,0x2a:0xa4,0x2f:0xf8,0x3a:0xf7,0x3c:0xab,0x3e:0xbb,0x3f:0xbf,0x5c:0xff,0x7c:0xa6";
+            };
+            materus = {
+              "path" = "${config.waffentragerService.elements.path}/storage/materus";
+              "browseable" = "yes";
+              "read only" = "no";
+              "guest ok" = "no";
+              "create mask" = "0770";
+              "directory mask" = "0770";
+              "force user" = "materus";
+              "force group" = "nextcloud";   
+            };
+          };
+      };
+    };
+}

configurations/host/waffentrager/services/storage/syncthing.nix

@@ -0,0 +1,26 @@
+{ lib, pkgs, materusArg, config, ... }:
+{
+  options.waffentragerService.syncthing.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable syncthing";
+
+  config =
+    let
+      cfg = config.waffentragerService.syncthing;
+    in
+    lib.mkIf cfg.enable {
+      waffentragerService.elements.enable = true;      networking.firewall.allowedTCPPorts = [ 22000 config.services.syncthing.relay.statusPort config.services.syncthing.relay.port];
+      networking.firewall.allowedUDPPorts = [ 22000 21027 ];
+      systemd.services.syncthing = {
+        requires = [ "elements-mount.service" ];
+        after = [ "elements-mount.service" ];
+      };
+      services = {
+        syncthing = {
+            enable = true;
+            user = "materus";
+            group = "nextcloud";
+            dataDir = "${config.waffentragerService.elements.path}/storage/materus";
+            configDir = "${config.waffentragerService.elements.path}/storage/materus/Inne/Config/Syncthing/waffentrager/";  
+        };
+      };
+    };
+}

configurations/profile/common/default.nix

@@ -0,0 +1,28 @@
+{ config, pkgs, lib, materusCfg, ... }:
+let
+  materusArg = {
+    pkgs = (import materusCfg.nixerus { inherit pkgs; }) //
+      (if pkgs.system == "x86_64-linux" then { i686Linux = import materusCfg.nixerus { pkgs = pkgs.pkgsi686Linux; }; } else { });
+    cfg = materusCfg;
+    unstable = import materusCfg.materusFlake.inputs.nixpkgs { system = materusCfg.arch; config = { allowUnfree = true; nvidia.acceptLicense = true; }; };
+
+  };
+in
+{
+  imports = [
+    ./nixpkgs.nix
+    ./packages
+    ./private
+  ];
+  options.materus.materusArg = lib.mkOption { default = { }; };
+  config._module.args.materusArg = config.materus.materusArg // materusArg;
+  config.assertions = [
+    {
+      assertion = materusCfg.materusFlake.decrypted;
+      message = "Repository not decrypted, use crypt.sh to decrypt";
+    }
+  ];
+
+
+
+}

configurations/profile/common/nixpkgs.nix

@@ -0,0 +1,99 @@
+{ config, pkgs, lib, materusArg, materusCfg, ... }:
+let
+  mkBoolOpt = default: description: lib.mkOption {
+    inherit default;
+    inherit description;
+    type = lib.types.bool;
+    example = true;
+  };
+
+  cfg = config.materus.profile.nixpkgs;
+in
+{
+  options.materus.profile.nixpkgs.enable = mkBoolOpt false "Enable materus nixpkgs config";
+  options.materus.profile.nixpkgs.enableOverlays = mkBoolOpt (cfg.enable) "Enable materus overlays";
+  options.materus.profile.nix.enableRegistry = mkBoolOpt (!materusCfg.isHm) "Enable materus nix registry";
+
+  config.nixpkgs.config = lib.mkIf cfg.enable {
+    allowUnfree = lib.mkDefault true;
+    joypixels.acceptLicense = lib.mkDefault true;
+  };
+  config.nixpkgs.overlays = lib.mkIf cfg.enableOverlays [ materusArg.cfg.configInputs.emacs-overlay.overlay ];
+
+  config.nix.package = lib.mkDefault  pkgs.nixVersions.latest;
+  config.nix.registry = lib.mkIf config.materus.profile.nix.enableRegistry {
+    nixpkgs-stable = {
+      from = { type = "indirect"; id = "nixpkgs-stable"; };
+      flake = materusCfg.materusFlake.inputs.nixpkgs-stable;
+    };
+    nixpkgs-unstable = {
+      from = { type = "indirect"; id = "nixpkgs-unstable"; };
+      flake = materusCfg.materusFlake.inputs.nixpkgs;
+    };
+
+    nixpkgs = {
+      from = { type = "indirect"; id = "nixpkgs"; };
+      flake = materusCfg.configInputs.nixpkgs;
+    };
+
+    emacs-overlay = {
+      from = { type = "indirect"; id = "emacs-overlay"; };
+      flake = materusCfg.configInputs.emacs-overlay;
+    };
+
+    flake-utils = {
+      from = { type = "indirect"; id = "flake-utils"; };
+      flake = materusCfg.configInputs.flake-utils;
+    };
+
+    nixos-hardware = {
+      from = { type = "indirect"; id = "nixos-hardware"; };
+      flake = materusCfg.configInputs.nixos-hardware;
+    };
+
+    nixerus = {
+      from = { type = "indirect"; id = "nixerus"; };
+      flake = materusCfg.configInputs.nixerus;
+    };
+
+    devshell = {
+      from = { type = "indirect"; id = "devshell"; };
+      flake = materusCfg.configInputs.devshell;
+    };
+
+    home-manager = {
+      from = { type = "indirect"; id = "home-manager"; };
+      flake = materusCfg.configInputs.home-manager;
+    };
+
+    sops-nix = {
+      from = { type = "indirect"; id = "sops-nix"; };
+      flake = materusCfg.configInputs.sops-nix;
+    };
+
+    base16 = {
+      from = { type = "indirect"; id = "base16"; };
+      flake = materusCfg.configInputs.base16;
+    };
+
+    git-agecrypt = {
+      from = { type = "indirect"; id = "git-agecrypt"; };
+      flake = materusCfg.configInputs.git-agecrypt;
+    };
+
+    plasma-manager = {
+      from = { type = "indirect"; id = "plasma-manager"; };
+      flake = materusCfg.configInputs.plasma-manager;
+    };
+
+    nur = {
+      from = { type = "indirect"; id = "nur"; };
+      flake = materusCfg.configInputs.nur;
+    };
+    nix-vscode-extensions = {
+      from = { type = "indirect"; id = "nix-vscode-extensions"; };
+      flake = materusCfg.configInputs.nix-vscode-extensions;
+    };
+
+  };
+}

configurations/profile/common/packages/default.nix

@@ -0,0 +1,76 @@
+{
+  config,
+  pkgs,
+  lib,
+  materusArg,
+  ...
+}:
+with materusArg.pkgs.lib;
+{
+  imports = [ ./fonts.nix ];
+
+  #Single Packages
+  options.materus.profile.packages.home-manager =
+    mkPrivateVar
+      materusArg.cfg.configInputs.home-manager.packages.${pkgs.system}.home-manager;
+  options.materus.profile.packages.firefox = mkPrivateVar (
+    pkgs.firefox.override { nativeMessagingHosts = [ pkgs.plasma-browser-integration ]; }
+  );
+
+  #Package Lists
+  options.materus.profile.packages.list.nixRelated = mkPrivateVar (
+    with pkgs;
+    [
+      nix-prefetch
+      nix-prefetch-scripts
+      nix-prefetch-github
+      nix-prefetch-docker
+      nixfmt-rfc-style
+      nix-top
+      nix-tree
+      nix-diff
+      nix-ld
+      nixpkgs-fmt
+      nixpkgs-review
+    ]
+  );
+
+  options.materus.profile.packages.list.desktopApps = mkPrivateVar (
+    with pkgs;
+    [
+      (discord.override {
+        nss = nss_latest;
+        withOpenASAR = true;
+        withTTS = true;
+      })
+      tdesktop
+      syncplay
+      ani-cli
+      nextcloud-client
+      spotify
+      thunderbird
+      keepassxc
+      (aspellWithDicts (
+        ds: with ds; [
+          en
+          en-computers
+          en-science
+          pl
+        ]
+      ))
+      onlyoffice-bin
+      qalculate-qt
+    ]
+  );
+
+  options.materus.profile.packages.list.terminalApps = mkPrivateVar (
+    with pkgs;
+    [
+      neofetch
+      ripgrep
+      fd
+      micro
+    ]
+  );
+
+}

configurations/profile/common/packages/fonts.nix

@@ -0,0 +1,38 @@
+{ pkgs, lib, ... }:
+
+let
+  defaultFonts = [
+    pkgs.dejavu_fonts
+    pkgs.freefont_ttf
+    pkgs.gyre-fonts
+    pkgs.liberation_ttf
+    pkgs.unifont
+  ];
+  fonts = [
+    pkgs.noto-fonts
+    pkgs.noto-fonts-extra
+    pkgs.noto-fonts-emoji
+    pkgs.noto-fonts-cjk-sans
+    pkgs.noto-fonts-cjk-serif
+    pkgs.wqy_zenhei
+    pkgs.corefonts
+    pkgs.hack-font
+    pkgs.nerd-fonts.hack
+
+  ] ++ defaultFonts;
+
+  moreFonts = [
+    pkgs.ubuntu_font_family
+    pkgs.monocraft
+    pkgs.nerd-fonts.droid-sans-mono
+    pkgs.nerd-fonts.meslo-lg
+    pkgs.nerd-fonts.profont
+    pkgs.nerd-fonts.fira-code
+  ];
+in
+{
+
+  options.materus.profile.packages.list.fonts = lib.mkOption { default = fonts; readOnly = true; visible = false; };
+  options.materus.profile.packages.list.moreFonts = lib.mkOption { default = moreFonts; readOnly = true; visible = false; };
+
+}

configurations/profile/default.nix

@@ -0,0 +1,16 @@
+{
+  osProfile = {
+    imports = [
+      ./os
+      ./common
+    ];
+  };
+
+  homeProfile = {
+    imports = [
+      ./common
+      ./home
+    ];
+  };
+
+}

configurations/profile/home/browser.nix

@@ -0,0 +1,25 @@
+{ config, lib, pkgs, materusArg, ... }:
+let
+  cfg = config.materus.profile.browser;
+  osConfig = (if (builtins.hasAttr "osConfig" config._module.args) then config._module.args.osConfig else null);
+in
+{
+
+  options = let mkBoolOpt = materusArg.pkgs.lib.mkBoolOpt; in {
+    materus.profile.browser.firefox.enable = mkBoolOpt false "Enable Firefox with materus cfg";
+    materus.profile.browser.vivaldi.enable = mkBoolOpt false "Enable Vivaldi with materus cfg";
+    materus.profile.browser.brave.enable = mkBoolOpt false "Enable Brave with materus cfg";
+
+  };
+  #TODO: Make some config
+  config = lib.mkMerge [{
+      home.packages = [
+      (lib.mkIf cfg.firefox.enable config.materus.profile.packages.firefox)
+      (lib.mkIf cfg.vivaldi.enable pkgs.vivaldi)
+      (lib.mkIf cfg.brave.enable pkgs.brave)
+    ] ++ [ (lib.mkIf (osConfig != null && osConfig.materus.profile.browser.enable) osConfig.materus.profile.browser.package)];
+  }
+  ];
+
+
+}

configurations/profile/home/default.nix

@@ -0,0 +1,85 @@
+{ config, lib, pkgs, materusArg, ... }:
+let
+  packages = cfg.packages;
+  cfg = config.materus.profile;
+in
+{
+  imports = [
+    ./fonts.nix
+    ./browser.nix
+    ./xdg.nix
+
+    ./shell
+    ./editor
+    ./terminal
+
+  ];
+  options.materus.profile.enableDesktop = materusArg.pkgs.lib.mkBoolOpt false "Enable settings for desktop";
+  options.materus.profile.enableTerminal = materusArg.pkgs.lib.mkBoolOpt true "Enable settings for terminal";
+  options.materus.profile.enableTerminalExtra = materusArg.pkgs.lib.mkBoolOpt false "Enable extra settings for terminal";
+  options.materus.profile.enableNixDevel = materusArg.pkgs.lib.mkBoolOpt false "Enable settings for nix devel";
+
+  config =
+    {
+
+      home.packages = (if cfg.enableDesktop then packages.list.desktopApps else [ ]) ++
+        (if cfg.enableNixDevel then packages.list.nixRelated else [ ]) ++
+        (if cfg.enableTerminal then packages.list.terminalApps else [ ]);
+      #Desktop
+      programs.feh.enable = lib.mkDefault cfg.enableDesktop;
+      programs.mpv = lib.mkIf cfg.enableDesktop {
+        enable = true;
+        config = {
+          ytdl-format = "bestvideo+bestaudio";
+          slang="pl,pol,Polish,Polski,en,eng,English";
+          alang="ja,jp,jpn,Japanese,pl,pol,Polski,en,eng,English";
+          demuxer-max-bytes="500MiB";
+          demuxer-max-back-bytes="150MiB";
+          cache="yes";
+          cache-pause-wait="10";
+          cache-pause-initial="yes";
+          keep-open="yes";
+        };
+      };
+
+      #Terminal
+      programs.git = {
+        enable = lib.mkDefault cfg.enableTerminal;
+        package = lib.mkDefault pkgs.gitFull;
+        delta.enable = lib.mkDefault cfg.enableTerminal;
+        lfs.enable = lib.mkDefault cfg.enableTerminal;
+      };
+      programs.gitui.enable = cfg.enableTerminalExtra;
+
+      programs.nix-index = {
+        enable = lib.mkDefault cfg.enableTerminal;
+        enableBashIntegration = lib.mkDefault config.programs.bash.enable;
+        enableFishIntegration = lib.mkDefault config.programs.fish.enable;
+        enableZshIntegration = lib.mkDefault config.programs.zsh.enable;
+      };
+
+      programs.direnv = {
+        enable = lib.mkDefault (cfg.enableTerminalExtra || cfg.enableNixDevel);
+        nix-direnv.enable = lib.mkDefault (cfg.enableNixDevel && (config.programs.direnv.enable == true));
+        enableBashIntegration = lib.mkDefault config.programs.bash.enable;
+        #enableFishIntegration = lib.mkDefault config.programs.fish.enable;
+        enableZshIntegration = lib.mkDefault config.programs.zsh.enable;
+      };
+
+
+
+      programs.fzf = {
+        enable = lib.mkDefault cfg.enableTerminalExtra;
+        enableBashIntegration = lib.mkDefault config.programs.bash.enable;
+        enableFishIntegration = lib.mkDefault config.programs.fish.enable;
+        enableZshIntegration = lib.mkDefault config.programs.zsh.enable;
+      };
+
+      programs.eza.enable = lib.mkDefault cfg.enableTerminalExtra;
+
+      programs.yt-dlp.enable = lib.mkDefault cfg.enableTerminalExtra;
+
+    };
+
+
+}

configurations/profile/home/editor/code.nix

@@ -0,0 +1,159 @@
+{ config, lib, pkgs, materusArg, materusCfg, ... }:
+let
+  cfg = config.materus.profile.editor.code;
+  ext = let
+    market =
+      (materusCfg.configInputs.nix-vscode-extensions.extensions."${materusCfg.arch}".forVSCodeVersion
+        config.programs.vscode.package.version);
+    marketNv =
+      (materusCfg.configInputs.nix-vscode-extensions.extensions."${materusCfg.arch}");
+  in with market;
+  with pkgs; [
+    #Cpp
+    open-vsx.twxs.cmake
+    vscode-extensions.ms-vscode.cpptools
+    vscode-marketplace.ms-vscode.cmake-tools
+    vscode-marketplace.cs128.cs128-clang-tidy
+
+    #Python
+    #vscode-marketplace.ms-python.python
+    #vscode-marketplace.ms-python.vscode-pylance
+    #vscode-marketplace.ms-python.debugpy
+
+    # CSharp
+    open-vsx.muhammad-sammy.csharp
+
+    #Java
+    vscode-marketplace.redhat.java
+    vscode-marketplace.vscjava.vscode-java-debug
+    vscode-marketplace.vscjava.vscode-java-test
+    vscode-marketplace.vscjava.vscode-gradle
+    vscode-marketplace.vscjava.vscode-java-dependency
+
+    #JS 
+    vscode-marketplace.angular.ng-template
+    #DLang
+    open-vsx.webfreak.code-d
+
+    #Nix
+    open-vsx.jnoortheen.nix-ide
+
+    #Web
+    open-vsx.ecmel.vscode-html-css
+    open-vsx.formulahendry.auto-close-tag
+
+    #Lua
+    open-vsx.sumneko.lua
+
+    #YAML, XML
+    open-vsx.redhat.vscode-yaml
+    open-vsx.redhat.vscode-xml
+
+    #Git
+    open-vsx.donjayamanne.githistory
+    #open-vsx.mhutchie.git-graph
+    open-vsx.eamodio.gitlens
+
+    #Other 
+    #open-vsx.asciidoctor.asciidoctor-vscode
+    open-vsx.ms-azuretools.vscode-docker
+    open-vsx.webfreak.debug
+    open-vsx.mkhl.direnv
+    #vscode-marketplace.ms-vscode-remote.remote-wsl
+    #vscode-marketplace.ms-vscode-remote.remote-containers
+    open-vsx.esbenp.prettier-vscode
+    open-vsx.formulahendry.code-runner
+    open-vsx.leonardssh.vscord
+    open-vsx.ms-vscode.hexeditor
+    open-vsx.alefragnani.project-manager
+    vscode-marketplace.cantonios.project-templates
+    vscode-marketplace.betterthantomorrow.joyride
+
+    #Icons
+    open-vsx.pkief.material-icon-theme
+    open-vsx.pkief.material-product-icons
+    #Themes
+    open-vsx.dracula-theme.theme-dracula
+    open-vsx.ahmadawais.shades-of-purple
+
+    #Languages
+    marketNv.vscode-marketplace.ms-ceintl.vscode-language-pack-pl
+
+  ];
+  set = {
+    "vscord.app.name" = lib.mkDefault "VSCodium";
+    "window.dialogStyle" = lib.mkDefault "custom";
+    "window.titleBarStyle" = lib.mkDefault "custom";
+    "editor.fontFamily" =
+      lib.mkDefault "'Hack Nerd Font', 'monospace', monospace";
+    "workbench.colorTheme" = lib.mkDefault "Shades of Purple";
+    "workbench.productIconTheme" = lib.mkDefault "material-product-icons";
+    "workbench.iconTheme" = lib.mkDefault "material-icon-theme";
+
+    "d.aggressiveUpdate" = lib.mkDefault false;
+    "d.servedPath" = lib.mkDefault "${pkgs.serve-d}/bin/serve-d";
+
+    "direnv.path.executable" = lib.mkDefault "${pkgs.direnv}/bin/direnv";
+
+    "nix.enableLanguageServer" = lib.mkDefault true;
+    "nix.serverPath" = lib.mkDefault "${pkgs.nixd}/bin/nixd";
+    "nix.formatterPath" = lib.mkDefault "${pkgs.nixfmt-rfc-style}/bin/nixfmt";
+    "nix.serverSettings" = {
+      "nixd" = { "formatting" = { "command" = lib.mkDefault [ "nixfmt" ]; }; };
+    };
+
+    "C_Cpp.clang_format_path" =
+      lib.mkDefault "${pkgs.clang-tools}/bin/clang-format";
+    "C_Cpp.clang_format_fallbackStyle" = lib.mkDefault "Microsoft";
+    "clang-tidy.executable" =
+      lib.mkDefault "${pkgs.clang-tools}/bin/clang-tidy";
+    "redhat.telemetry.enabled" = lib.mkDefault false;
+    "python.defaultInterpreterPath" =
+      lib.mkDefault "${pkgs.python3Full}/bin/python";
+    "[cpp]" = {
+      "editor.defaultFormatter" = lib.mkDefault "xaver.clang-format";
+    };
+    "[javascript]" = {
+      "editor.defaultFormatter" = lib.mkDefault "esbenp.prettier-vscode";
+    };
+    "typescript.tsserver.maxTsServerMemory" = 1024 * 8;
+    "typescript.tsserver.nodePath"= lib.mkDefault "${pkgs.nodejs}/bin/node";
+    "cmake.showOptionsMovedNotification" = false;
+    "cmake.pinnedCommands" = [
+      "workbench.action.tasks.configureTaskRunner"
+      "workbench.action.tasks.runTask"
+    ];
+
+  };
+in {
+  options.materus.profile.editor.code.enable =
+    materusArg.pkgs.lib.mkBoolOpt config.materus.profile.enableDesktop
+    "Enable VSCodium with materus cfg";
+  options.materus.profile.editor.code.fhs.enable =
+    materusArg.pkgs.lib.mkBoolOpt false "Use fhs vscodium";
+  options.materus.profile.editor.code.fhs.packages =
+    lib.mkOption { default = (ps: [ ]); };
+  options.materus.profile.editor.code.extensions =
+    lib.mkOption { default = [ ]; };
+  options.materus.profile.editor.code.settings =
+    lib.mkOption { default = { }; };
+  config = lib.mkIf cfg.enable {
+    materus.profile.editor.code.extensions = ext;
+    materus.profile.editor.code.settings = set;
+    programs.vscode = {
+      enable = lib.mkDefault true;
+      package = lib.mkDefault (if (cfg.fhs.enable) then
+        (pkgs.vscodium.fhsWithPackages cfg.fhs.packages)
+      else
+        pkgs.vscodium);
+      mutableExtensionsDir =
+        lib.mkDefault config.materus.profile.editor.code.fhs.enable;
+      extensions = lib.mkDefault config.materus.profile.editor.code.extensions;
+      enableExtensionUpdateCheck =
+        lib.mkDefault config.materus.profile.editor.code.fhs.enable;
+      enableUpdateCheck = lib.mkDefault false;
+      userSettings = lib.mkDefault config.materus.profile.editor.code.settings;
+    };
+    materus.profile.fonts.enable = lib.mkDefault true;
+  };
+}

configurations/profile/home/editor/default.nix

@@ -0,0 +1,8 @@
+{ config, lib, pkgs, ... }:
+{
+  imports = [
+    ./code.nix
+    ./neovim.nix
+    ./emacs
+  ];
+}

configurations/profile/home/editor/emacs/default.nix

@@ -0,0 +1,296 @@
+{
+  config,
+  lib,
+  pkgs,
+  materusArg,
+  materusCfg,
+  ...
+}: let
+  emacs-pkg = materusCfg.configInputs.emacs-overlay.packages.x86_64-linux.emacs-git;
+
+  materus-nix = e:
+    e.trivialBuild {
+      pname = "materus-nix";
+      src = pkgs.writeText "materus-nix.el" ''
+        (when (file-exists-p "${config.programs.emacs.package}/opt/emacs/buildtime")
+        (setq emacs-build-time (decode-time (seconds-to-time (string-to-number (with-temp-buffer
+        (insert-file-contents "${config.programs.emacs.package}/opt/emacs/buildtime")
+        (buffer-string)))))))
+
+
+
+
+        (defvar lsp-java-configuration-runtimes nil)
+        (setq dap-lldb-debug-program '("${pkgs.llvmPackages.lldb}/bin/lldb-vscode"))
+        (setq lsp-java-configuration-runtimes '[(:name "JavaSE-1.8"
+                                                      :path "${pkgs.jdk8}/lib/openjdk/")
+                                                (:name "JavaSE-17"
+                                                      :path "${pkgs.jdk17}/lib/openjdk/")
+                                                (:name "JavaSE-21"
+                                                      :path "${pkgs.jdk21}/lib/openjdk/"
+                                                      :default t)])
+
+        (setq lsp-nix-nixd-nixos-options-expr (concat "(builtins.getFlake \"/etc/nixos\").nixosConfigurations." (system-name) ".options"))
+        (setenv "JAVA_HOME" "${pkgs.jdk21}/lib/openjdk")
+        (setenv "PATH" (concat "${emacsEnv}/bin:" (getenv "PATH")))
+        (setq exec-path (append '("${emacsEnv}/bin") exec-path))
+
+
+        (call-process-shell-command "${pkgs.xorg.xmodmap}/bin/xmodmap -e \"keycode 148 = Hyper_L\" -e \"remove Mod4 = Hyper_L\" -e \"add Mod3 = Hyper_L\" &" nil 0)
+        (call-process-shell-command "${pkgs.xorg.xmodmap}/bin/xmodmap -e \"keycode 66 = Hyper_L\" -e \"remove Mod4 = Hyper_L\" -e \"add Mod3 = Hyper_L\" &" nil 0)
+
+        (provide 'materus-nix)
+      '';
+      version = "1.0.0";
+    };
+
+  packages = epkgs:
+    with epkgs; [
+      treesit-grammars.with-all-grammars
+      use-package
+      elcord
+      dashboard
+      magit
+      git-timemachine
+      avy
+      vterm
+      direnv
+      projectile
+      clipetty
+      which-key
+      iedit
+      hideshowvis
+      perspective
+      treemacs
+      treemacs-perspective
+      treemacs-nerd-icons
+      treemacs-icons-dired
+      treemacs-magit
+      treemacs-projectile
+      tree-edit
+      nerd-icons
+      nerd-icons-completion
+      minions
+      rainbow-delimiters
+      rainbow-mode
+      cmake-mode
+      lsp-mode
+      lsp-java
+      lsp-jedi
+      lsp-haskell
+      lsp-pascal
+      lsp-pyright
+      lsp-ui
+      lsp-treemacs
+      dap-mode
+      flycheck
+      gradle-mode
+      groovy-mode
+      kotlin-mode
+      d-mode
+      lua-mode
+      multiple-cursors
+      org
+      org-contrib
+      org-ql
+      org-rainbow-tags
+      org-roam
+      org-roam-ui
+      org-review
+      org-present
+      org-modern
+      org-auto-tangle
+      ox-pandoc
+      visual-fill-column
+      csharp-mode
+      markdown-mode
+      json-mode
+      nix-mode
+      nixfmt
+      nix-ts-mode
+      no-littering
+      right-click-context
+      dracula-theme
+      doom-themes
+      doom-modeline
+      popper
+      undo-tree
+      bash-completion
+      eldoc-box
+      yasnippet
+      yasnippet-capf
+      async
+      request
+      markdown-ts-mode
+      llvm-ts-mode
+      treesit-fold
+      treesit-auto
+      tree-sitter-langs
+      eat
+      vlf
+      edit-indirect
+      zones
+      sudo-edit
+      toc-org
+      #empv
+      volatile-highlights
+      highlight
+      elfeed
+      elfeed-goodies
+      drag-stuff
+      dirvish
+      rg
+      shfmt
+      mermaid-mode
+      ob-mermaid
+      visual-replace
+      scroll-restore
+      highlight-indent-guides
+      diff-hl
+      transient
+      embark
+      embark-consult
+      ef-themes
+      pdf-tools
+      minimap
+      geiser-guile
+      fennel-mode
+      paredit
+      # Completions & Minibuffer
+      corfu
+      corfu-terminal
+      kind-icon
+      cape
+      orderless
+      vertico
+      marginalia
+    ];
+
+  emacsEnv = pkgs.buildEnv {
+    name = "emacs-env";
+    paths = with pkgs; [
+      jdk21
+
+      luaformatter
+      pandoc
+      (luajit.withPackages (p: [
+        p.fennel
+        p.lua-lsp
+      ]))
+      fennel-ls
+      fnlfmt
+      sbcl
+      silver-searcher
+      guile
+      plantuml
+      mermaid-cli
+      pyright
+      shfmt
+      ripgrep
+      cmake
+      gnumake
+      nixfmt-rfc-style  
+      (python3.withPackages (python-pkgs: with python-pkgs; [
+        matplotlib
+        pandas
+        requests
+      ]))
+      multimarkdown
+      git
+      emacs-lsp-booster
+      llvmPackages.clang-tools
+      llvmPackages.clang
+      llvmPackages.lldb
+      (hiPrio gcc)
+      gdb
+      materusArg.unstable.nixd
+      jdt-language-server
+      gradle
+      fpc
+      nodejs
+      omnisharp-roslyn
+      texlive.combined.scheme-full
+    ];
+  };
+
+  cfg = config.materus.profile.editor.emacs;
+in {
+  options.materus.profile.editor.emacs.enable =
+    materusArg.pkgs.lib.mkBoolOpt false "Enable emacs with materus cfg";
+
+  config = lib.mkIf cfg.enable {
+    home.activation.emacsSetup = lib.hm.dag.entryAfter ["linkGeneration"] '''';
+
+    #Emacsclient with COLORTERM env variable, without it display in "-nw" client is broken
+    xdg.desktopEntries.emacs = {
+      name = "Emacs";
+      genericName = "Edytor tekstu";
+      comment = "Edytuj tekst";
+      exec = ''env COLORTERM=truecolor emacsclient -a "" -r %F'';
+      icon = "emacs";
+      terminal = false;
+      type = "Application";
+      categories = [
+        "Development"
+        "TextEditor"
+      ];
+      mimeType = [
+        "text/english"
+        "text/plain"
+        "text/x-makefile"
+        "text/x-c++hdr"
+        "text/x-c++src"
+        "text/x-chdr"
+        "text/x-csrc"
+        "text/x-java"
+        "text/x-moc"
+        "text/x-pascal"
+        "text/x-tcl"
+        "text/x-tex"
+        "application/x-shellscript"
+        "text/x-c"
+        "text/x-c++"
+        "x-scheme-handler/org-protocol"
+      ];
+      actions.new-window = {
+        exec = ''env COLORTERM=truecolor emacsclient -a "" -c %F'';
+        name = "Nowe okno";
+      };
+      actions.no-daemon = {
+        exec = "env COLORTERM=truecolor emacs %F";
+        name = "Instancja samodzielna";
+      };
+    };
+
+    programs.emacs = {
+      enable = true;
+      extraPackages = epkgs: [(materus-nix epkgs) epkgs.vterm epkgs.treesit-grammars.with-all-grammars];
+      package = lib.mkDefault (
+        (emacs-pkg.override {
+          withSQLite3 = true;
+          withWebP = true;
+          withX = true;
+          #withXwidgets = true;
+          withGTK3 = true;
+          withAlsaLib = true;
+
+          #withGconf = true;
+          withImageMagick = true;
+        })
+        .overrideAttrs
+        (
+          f: p: {
+            #Remove .desktop files, will use my own. Add file with buildtime in case of using elpaca
+            postInstall =
+              p.postInstall
+              + ''
+                rm -fr $out/share/applications/*
+                mkdir -p $out/opt/emacs
+                date +%s | tr -d '\n' > $out/opt/emacs/buildtime
+              '';
+          }
+        )
+      );
+    };
+  };
+}

configurations/profile/home/editor/emacs/lsp-mode.patch

@@ -0,0 +1,22 @@
+From 75e41ae5bd1c0879b323ed0ddc4bac29badb29ff Mon Sep 17 00:00:00 2001
+From: fanshi1028 <jackychany321@gmail.com>
+Date: Fri, 1 Nov 2024 14:41:26 +0000
+Subject: [PATCH] fix lsp-org breaks with org 9.7 (#4300)
+
+---
+ lsp-mode.el | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lsp-mode.el b/lsp-mode.el
+index f5c700dbf3..a149d6d2c7 100644
+--- a/lsp-mode.el
++++ b/lsp-mode.el
+@@ -9668,7 +9668,7 @@ defaults to `progress-bar."
+                          (save-excursion
+                            (funcall goto-buffer)
+                            (funcall f))))))
+-              ((&plist :begin :end :post-blank :language) (cl-second (org-element-context)))
++              ((begin end post-blank language) (--map (org-element-property it (org-element-context) nil t) '(:begin :end :post-blank :language)))
+               ((&alist :tangle file-name) (cl-third (org-babel-get-src-block-info 'light)))
+ 
+               (file-name (if file-name

configurations/profile/home/editor/neovim.nix

@@ -0,0 +1,40 @@
+{ config, lib, pkgs, materusArg, ... }:
+let
+  cfg = config.materus.profile.editor.neovim;
+in
+{
+  options.materus.profile.editor.neovim.enable = materusArg.pkgs.lib.mkBoolOpt config.materus.profile.enableTerminalExtra "Enable neovim with materus cfg";
+  config = lib.mkIf cfg.enable {
+    programs.neovim = {
+      enable = true;
+      package = pkgs.neovim-unwrapped;
+      coc.enable = true;
+      coc.package = pkgs.vimPlugins.coc-nvim;
+      viAlias = true;
+      vimAlias = true;
+      vimdiffAlias = true;
+      defaultEditor = lib.mkDefault false;
+
+
+      extraConfig = ''
+        set number
+      '';
+      extraLuaConfig = ''
+      '';
+
+      extraPackages = with pkgs;[
+      ];
+
+      plugins = with pkgs.vimPlugins;[
+        syntastic
+        vim-fugitive
+        vim-airline
+        vim-nix
+        nvim-fzf
+        nvim-treesitter.withAllGrammars
+
+      ];
+    };
+  };
+
+}

configurations/profile/home/fonts.nix

@@ -0,0 +1,13 @@
+{ config, pkgs, lib, materusArg, ... }:
+let
+  packages = config.materus.profile.packages;
+  cfg = config.materus.profile.fonts;
+in
+{
+  options.materus.profile.fonts.enable = materusArg.pkgs.lib.mkBoolOpt config.materus.profile.enableDesktop "Enable materus font settings";
+
+  config = lib.mkIf cfg.enable {
+    fonts.fontconfig.enable = lib.mkDefault true;
+    home.packages = packages.list.fonts;
+  };
+}

configurations/profile/home/shell/bash.nix

@@ -0,0 +1,26 @@
+{ config, pkgs, lib, materusArg, ... }:
+let
+  cfg = config.materus.profile.bash;
+in
+{
+  options.materus.profile.bash.enable = materusArg.pkgs.lib.mkBoolOpt config.materus.profile.enableTerminal "Enable materus bash config";
+
+
+  config = lib.mkIf cfg.enable {
+
+    programs.bash = {
+      
+      enable = true;
+      enableCompletion = lib.mkDefault true;
+      enableVteIntegration = lib.mkDefault true;
+      historyControl = lib.mkDefault [ "erasedups" "ignorespace" ];
+      shellOptions = lib.mkDefault [ "autocd" "checkwinsize" "cmdhist" "expand_aliases" "extglob" "globstar" "checkjobs" "nocaseglob" ];
+      initExtra = ''
+      if [ -n "$EAT_SHELL_INTEGRATION_DIR" ]; then
+          source "$EAT_SHELL_INTEGRATION_DIR/bash";
+      fi
+      '';
+    };
+  };
+
+}

configurations/profile/home/shell/default.nix

@@ -0,0 +1,18 @@
+{config, pkgs, lib, ...}:
+{
+
+  imports = [
+    ./zsh.nix
+    ./bash.nix
+    ./fish.nix
+    ./starship.nix
+  ];
+  home.sessionVariables = {
+    EDITOR = lib.mkDefault (if (config.materus.profile.editor.emacs.enable) then 
+    lib.getBin (pkgs.writeShellScript "editor" ''${config.programs.emacs.finalPackage}/bin/emacsclient --alternate-editor= -c  -nw $@'') 
+    else "${pkgs.micro}/bin/micro");
+    VISUAL = lib.mkDefault (if (config.materus.profile.editor.emacs.enable) then 
+    lib.getBin (pkgs.writeShellScript "editor-visual" ''exec env COLORTERM=truecolor ${config.programs.emacs.finalPackage}/bin/emacsclient --alternate-editor= -c $@'')
+    else "${pkgs.micro}/bin/micro");
+  };
+}

configurations/profile/home/shell/fish.nix

@@ -0,0 +1,12 @@
+{ config, pkgs, lib, materusArg, ... }:
+let
+  cfg = config.materus.profile.fish;
+in
+{
+  options.materus.profile.fish.enable = materusArg.pkgs.lib.mkBoolOpt config.materus.profile.enableTerminalExtra "Enable materus fish config";
+  config = lib.mkIf cfg.enable {
+    programs.fish = {
+      enable =  true;
+    };
+  };
+}

configurations/profile/home/shell/starship.nix

@@ -0,0 +1,48 @@
+{ config, pkgs, lib, materusArg, ... }:
+let
+  profile = config.materus.profile;
+  cfg = config.materus.profile.starship;
+in
+{
+  options.materus.profile.starship.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable materus starship config";
+
+  config = lib.mkIf cfg.enable {
+    programs.starship.enable = true;
+
+    programs.starship.settings = {
+
+      python = {
+        symbol = " ";
+      };
+
+      format = "$username@$hostname$all";
+      right_format = "$cmd_duration $time";
+
+      time = {
+        disabled = false;
+        style = "bold bright-black";
+        format = "[$time]($style)";
+      };
+
+      line_break = { disabled = true; };
+      shell = {
+        disabled = false;
+        fish_indicator = "fish";
+        bash_indicator = "bash";
+        zsh_indicator = "zsh";
+        style = "blue bold";
+      };
+
+      hostname = {
+        ssh_only = false;
+      };
+      username = {
+        disabled = false;
+        show_always = true;
+        format = "[$user]($style)";
+        style_user = "white bold";
+        style_root = "black bold";
+      };
+    };
+  };
+}

configurations/profile/home/shell/zsh.nix

@@ -0,0 +1,202 @@
+{
+  config,
+  pkgs,
+  lib,
+  materusArg,
+  ...
+}:
+let
+
+  relToDotDir =
+    file:
+    (lib.optionalString (config.programs.zsh.dotDir != null) (config.programs.zsh.dotDir + "/")) + file;
+  pluginsDir =
+    if config.programs.zsh.dotDir != null then
+      relToDotDir "plugins"
+    else
+      "${config.home.homeDirectory}/.zsh/plugins";
+
+  p10kcfg = "${zshcfg}/p10kcfg";
+  zshcfg = "${materusArg.cfg.path}" + "/extraFiles/config/zsh";
+  cfg = config.materus.profile.zsh;
+
+  makeEnv = name: val: ''${name}=''${${name}:-"${val}"}'';
+  makeIfVar = var: val: ret: ''
+    if [[ "''$${var}" = "${val}" ]]; then 
+      ${ret}
+    fi
+  '';
+
+  makePlugin = nameArg: fileArg: srcArg: rec {
+    name = nameArg;
+    src = srcArg;
+    path = pluginsDir + "/" + name;
+    file = fileArg;
+    fullPath = path + "/" + file;
+  };
+
+  extraPlugins = {
+    powerlevel10k = makePlugin "powerlevel10k" "powerlevel10k.zsh-theme" (
+      pkgs.fetchFromGitHub {
+        owner = "romkatv";
+        repo = "powerlevel10k";
+        rev = "v1.20.0";
+        sha256 = "sha256-ES5vJXHjAKw/VHjWs8Au/3R+/aotSbY7PWnWAMzCR8E=";
+      }
+    );
+    sudo = makePlugin "sudo" "sudo.plugin.zsh" "${pkgs.oh-my-zsh}/share/oh-my-zsh/plugins/sudo";
+    extract =
+      makePlugin "extract" "extract.plugin.zsh"
+        "${pkgs.oh-my-zsh}/share/oh-my-zsh/plugins/extract";
+
+  };
+in
+{
+  options.materus.profile.zsh.enable = materusArg.pkgs.lib.mkBoolOpt config.materus.profile.enableTerminalExtra "Enable materus zsh config";
+  options.materus.profile.zsh.prompt = lib.mkOption {
+    type = lib.types.enum [ "p10k" ];
+    example = "p10k";
+    default = "p10k";
+  };
+  options.materus.profile.zsh.endConfig = lib.mkOption {
+    default = "";
+    description = "Zsh config after all of config";
+    type = lib.types.lines;
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = [ pkgs.ripgrep ];
+
+    home.file = lib.mkMerge [
+      (builtins.foldl' (a: b: a // b) { } (
+        builtins.map (plugin: { ${plugin.path}.source = plugin.src; }) (builtins.attrValues extraPlugins)
+      ))
+      { "${relToDotDir ".zshrc"}".text = lib.mkAfter cfg.endConfig; }
+    ];
+
+    programs.zsh = {
+      enable = true;
+      autosuggestion.enable = true;
+      syntaxHighlighting.enable = true;
+      enableVteIntegration = true;
+      historySubstringSearch.enable = true;
+      historySubstringSearch.searchUpKey = "$key[Up]";
+      historySubstringSearch.searchDownKey = "$key[Down]";
+
+      envExtra = ''
+        ${makeEnv "__MATERUS_HM_ZSH" "1"}
+        ${makeEnv "__MATERUS_HM_ZSH_PROMPT" cfg.prompt}
+        ${makeEnv "__MATERUS_HM_ZSH_PRIVATE" "0"}
+      '';
+      initExtraFirst = ''
+        bindkey -e
+        if [ -n "$EAT_SHELL_INTEGRATION_DIR" ]; then
+          source "$EAT_SHELL_INTEGRATION_DIR/zsh";
+        fi
+
+        ${makeIfVar "__MATERUS_HM_ZSH_PROMPT" "p10k" ''
+          if [[ -r "''${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-''${(%):-%n}.zsh" ]]; then
+            source "''${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-''${(%):-%n}.zsh"
+          fi
+          if [[ -f "${extraPlugins.powerlevel10k.fullPath}" ]]; then
+            source "${extraPlugins.powerlevel10k.fullPath}"
+          fi
+        ''}
+        if zmodload zsh/terminfo && (( "$terminfo[colors]" >= "256" )); then 
+          __MATERUS_HM_ZSH_256COLORS="''${__MATERUS_HM_ZSH_256COLORS:-1}"; else
+          __MATERUS_HM_ZSH_256COLORS="''${__MATERUS_HM_ZSH_256COLORS:-0}"; 
+        fi
+
+        if [[ -f "${extraPlugins.sudo.fullPath}" ]]; then
+          source "${extraPlugins.sudo.fullPath}"
+        fi
+        if [[ -f "${extraPlugins.extract.fullPath}" ]]; then
+          source "${extraPlugins.extract.fullPath}"
+          path+="${extraPlugins.extract.path}"
+          fpath+="${extraPlugins.extract.path}"
+        fi
+      '';
+
+      plugins = [ ];
+
+      history = {
+        extended = true;
+        save = 100000;
+        size = 100000;
+        share = true;
+        ignoreDups = true;
+        ignoreAllDups = true;
+        ignoreSpace = true;
+      };
+
+      completionInit = ''
+        ZSH_COMPDUMP="''${ZSH_COMPDUMP:-''${XDG_CACHE_HOME:-${config.home.homeDirectory}/.cache}/.zcompdump-''${HOST}-''${ZSH_VERSION}}"
+        autoload -U compinit && compinit -d $ZSH_COMPDUMP
+      '';
+      initExtra =
+        ''
+          if [[ "$__ETC_ZSHRC_SOURCED" != "1" ]]; then
+            . ${zshcfg}/zinputrc
+          fi
+          source ${zshcfg}/zshcompletion.zsh
+
+          history-substring-search-up-prefixed(){
+            HISTORY_SUBSTRING_SEARCH_PREFIXED=1 history-substring-search-up
+          }
+          history-substring-search-down-prefixed(){
+            HISTORY_SUBSTRING_SEARCH_PREFIXED=1 history-substring-search-down
+          }
+
+
+          zle -N history-substring-search-up-prefixed
+          zle -N history-substring-search-down-prefixed
+
+
+          bindkey -r "^["
+          bindkey "^[[1;5C" forward-word
+          bindkey "^[[1;5D" backward-word
+          bindkey "^[[1;5A" history-substring-search-up-prefixed
+          bindkey "^[[1;5B" history-substring-search-down-prefixed
+
+          bindkey '^[[3~' delete-char
+          bindkey '^[[3;2~' delete-word
+
+          zsh-private() {
+            __MATERUS_HM_ZSH_PRIVATE=1 ${lib.getExe config.programs.zsh.package}
+          }
+
+          myip() {
+            ${lib.getExe pkgs.wget} -qO- https://wtfismyip.com/text
+          }
+
+          speedtest() {
+            ${lib.getExe pkgs.curl} -s https://raw.githubusercontent.com/sivel/speedtest-cli/master/speedtest.py | ${lib.getExe pkgs.python3} 
+          }
+          ${lib.optionalString config.materus.profile.editor.emacs.enable ''alias "e"="emacsclient -nw -c --alternate-editor= "''}
+          ${lib.optionalString config.materus.profile.editor.emacs.enable ''alias "ee"="emacsclient -n -r --alternate-editor= "''}
+
+
+
+
+        ''
+        + makeIfVar "__MATERUS_HM_ZSH_PROMPT" "p10k" ''
+          if [[ "$__MATERUS_HM_ZSH_256COLORS" = "1" ]] ; then
+            [[ ! -f ${p10kcfg}/fullcolor.zsh ]] || source ${p10kcfg}/fullcolor.zsh
+          else
+            [[ ! -f ${p10kcfg}/compatibility.zsh ]] || source ${p10kcfg}/compatibility.zsh
+          fi
+        ''
+        + makeIfVar "__MATERUS_HM_ZSH_PRIVATE" "1" ''
+          unset HISTFILE
+          ${lib.optionalString config.programs.zsh.history.share "unsetopt SHARE_HISTORY"}
+          alias -- 'zsh'="__MATERUS_HM_ZSH_PRIVATE=0 zsh "
+        ''
+
+      ;
+
+    };
+
+    programs.starship.enableZshIntegration = lib.mkDefault false;
+  };
+
+}

configurations/profile/home/terminal/default.nix

@@ -0,0 +1,9 @@
+{...}:
+{
+
+  imports = [
+    ./wezterm.nix
+    ./tmux.nix
+  ];
+    
+}