materusPC & Old-materusPC: set "/materus" as needed for boot to fix sops

This reverts commit 60542cf0c9.

.git-crypt/.gitattributes

@@ -0,0 +1,4 @@
+# Do not edit this file.  To specify the files to encrypt, create your own
+# .gitattributes file in the directory where your files are.
+* !filter !diff
+*.gpg binary

.gitattributes

@@ -0,0 +1,2 @@
+**/private/** filter=git-crypt diff=git-crypt
+encrypted-test filter=git-crypt diff=git-crypt

.gitignore

@@ -0,0 +1 @@
+\#*\#

README.md

@@ -0,0 +1,18 @@
+# nixos-config
+My NixOS and home-manager configs.
+Dotfiles and helper scripts.
+
+Not all config is here, some I keep in private flake.
+
+## Hosts
+materusPC - my main PC
+
+Old-materusPC - my old PC, barely used
+
+flamaster - my laptop, used mostly as server for games.
+
+valkyrie - VPS, my website and pleroma instance
+
+waffentrager - raspberry pi4, home server
+
+

configurations/home/genHomes.nix

@@ -1,44 +0,0 @@
-{ inputs, materusFlake, ... }:
-let
-  profiles = import ../profile;
-
-  hosts = builtins.attrNames materusFlake.nixosConfigurations;
-  genHomes = username:
-    let
-      #Make host specific user profile "username@host"
-      _list = builtins.map (host: username + "@" + host) hosts;
-      _for = i: (
-        let len = builtins.length hosts; in
-        ([{
-          name = builtins.elemAt _list i;
-          value = let host = builtins.elemAt hosts i; in
-            inputs.configInputs.inputs.home-manager.lib.homeManagerConfiguration {
-              pkgs = materusFlake.nixosConfigurations.${host}.pkgs;
-              extraSpecialArgs = { inherit inputs; inherit materusFlake; };
-              modules = [
-                ./${username}
-                ../host/${host}/extraHome.nix
-                profiles.homeProfile
-                inputs.private.homeModule
-
-              ];
-            };
-        }]
-        ++ (if ((i + 1) < len) then _for (i + 1) else [ ]))
-      );
-    in
-    (builtins.listToAttrs (_for 0)) // {
-      #Make generic x86_64-linux user profile "username"
-      ${username} = inputs.configInputs.inputs.home-manager.lib.homeManagerConfiguration {
-        pkgs = import inputs.nixpkgs { system = "x86_64-linux"; config = {allowUnfree = true;}; };
-        extraSpecialArgs = { inherit inputs; inherit materusFlake; };
-        modules = [
-          ./${username}
-          profiles.homeProfile
-          inputs.private.homeModule
-        ];
-      };
-    };
-
-in
-genHomes

configurations/host/Old-materusPC/configuration.nix

@@ -0,0 +1,308 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, materusArg, ... }:
+
+{
+  imports =
+    [
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+    ];
+  boot.supportedFilesystems = [ "ntfs" ];
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  nix.settings.auto-optimise-store = true;
+  nix.settings.substituters = [
+    "https://nix-community.cachix.org"
+    "https://cache.nixos.org/"
+  ];
+  nix.settings.trusted-public-keys = [ "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" ];
+  nixpkgs.config.allowUnfree = true;
+
+
+  # Use the systemd-boot EFI boot loader.
+  boot.loader.grub = {
+    enable = true;
+    efiSupport = true;
+    device = "nodev";
+    gfxmodeEfi = "1920x1080";
+    gfxmodeBios = "1920x1080";
+    useOSProber = true;
+  };
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.efi.efiSysMountPoint = "/boot/efi";
+  boot.kernelPackages = pkgs.linuxPackages_zen;
+  boot.tmpOnTmpfs = true;
+
+  services.flatpak.enable = true;
+  services.gvfs.enable = true;
+
+  networking.hostName = "Old-materusPC"; # Define your hostname.
+  # Pick only one of the below networking options.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+  networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
+
+  # Set your time zone.
+  time.timeZone = "Europe/Warsaw";
+
+
+  services.fstrim = {
+    enable = true;
+    interval = "weekly";
+  };
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "pl_PL.UTF-8";
+  console = {
+    font = "lat2-16";
+    #     keyMap = "pl";
+    useXkbConfig = true; # use xkbOptions in tty.
+  };
+
+  hardware.bluetooth.enable = true;
+  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+
+
+  hardware.opengl.enable = true;
+  hardware.opengl.driSupport32Bit = true;
+
+  materus.profile.steam.enable = true;
+
+
+
+
+
+
+
+
+
+  # Configure keymap in X11
+  services.xserver.layout = "pl";
+  # services.xserver.xkbOptions = {
+  #   "eurosign:e";
+  #   "caps:escape" # map caps to escape.
+  # };
+
+  # Enable CUPS to print documents.
+  services.printing.enable = true;
+
+  # Enable sound.
+  sound.enable = true;
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    # If you want to use JACK applications, uncomment this
+    jack.enable = true;
+  };
+  hardware.pulseaudio.enable = false;
+
+
+
+  virtualisation.podman = {
+    enable = true;
+    dockerCompat = true;
+    dockerSocket.enable = true;
+  };
+
+
+  users.users.materus = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" "networkmanager" "kvm" "input" "libvirt" "libvirtd" "podman" ];
+    shell = pkgs.zsh;
+    description = "Mateusz Słodkowicz";
+
+  };
+  environment.sessionVariables = rec {
+    XDG_CACHE_HOME = "\${HOME}/.cache";
+    XDG_CONFIG_HOME = "\${HOME}/.config";
+    XDG_BIN_HOME = "\${HOME}/.local/bin";
+    XDG_DATA_HOME = "\${HOME}/.local/share";
+
+    #SSH_ASKPASS_REQUIRE = "prefer";
+
+    STEAM_EXTRA_COMPAT_TOOLS_PATHS = "\${HOME}/.steam/root/compatibilitytools.d";
+
+    MOZ_USE_XINPUT2 = "1";
+    PATH = [
+      "\${XDG_BIN_HOME}"
+    ];
+  };
+  environment.shellInit = ''
+    if ! [ -z "$DISPLAY" ]; then xhost +si:localuser:root &> /dev/null; fi;
+    if ! [ -z "$DISPLAY" ]; then xhost +si:localuser:$USER &> /dev/null; fi;
+  '';
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+
+
+
+
+  i18n.inputMethod.enabled = "fcitx5";
+  i18n.inputMethod.fcitx5.addons = [ pkgs.fcitx5-configtool pkgs.fcitx5-lua pkgs.fcitx5-mozc pkgs.libsForQt5.fcitx5-qt ];
+
+  environment.systemPackages = with pkgs; [
+    brave
+
+    glibc
+    patchelf
+    vim
+    wget
+    killall
+    xorg.xkill
+    xorg.xhost
+    nix-top
+    gitFull
+    curl
+    jdk
+    nss_latest
+    aspell
+    aspellDicts.pl
+    aspellDicts.en
+    aspellDicts.en-computers
+    distrobox
+    p7zip
+    unrar
+    bzip2
+    rar
+    unzip
+    zstd
+    xz
+    zip
+    gzip
+
+    tree
+    mc
+    lf
+    htop
+    nmon
+    iftop
+    iptraf-ng
+    mprocs
+
+
+
+    nix-du
+    git-crypt
+
+
+    wineWowPackages.stagingFull
+    winetricks
+    protontricks
+    openal
+    gnupg
+    ncurses
+    monkeysphere
+    gparted
+
+    inkscape
+    gimp
+
+
+
+
+    virt-manager
+    libguestfs
+
+    bubblewrap
+    bindfs
+
+    pulseaudio
+
+    binutils
+
+
+  ];
+
+  fonts.fontDir.enable = true;
+  fonts.enableDefaultFonts = true;
+  fonts.fonts = with pkgs; [
+    dejavu_fonts
+    hack-font
+    noto-fonts
+    noto-fonts-extra
+    noto-fonts-emoji
+    noto-fonts-cjk-sans
+    noto-fonts-cjk-serif
+    ubuntu_font_family
+    wqy_zenhei
+    monocraft
+    (nerdfonts.override { fonts = [ "FiraCode" "DroidSansMono" "Meslo" "ProFont" ]; })
+  ];
+  fonts.fontconfig.enable = true;
+  fonts.fontconfig.cache32Bit = true;
+  fonts.fontconfig.defaultFonts.sansSerif = [ "Noto Sans" "DejaVu Sans" "WenQuanYi Zen Hei" "Noto Color Emoji" ];
+  fonts.fontconfig.defaultFonts.serif = [ "Noto Serif" "DejaVu Serif" "WenQuanYi Zen Hei" "Noto Color Emoji" ];
+  fonts.fontconfig.defaultFonts.emoji = [ "Noto Color Emoji" "OpenMoji Color" ];
+  fonts.fontconfig.defaultFonts.monospace = [ "Hack Nerd Font" "Noto Sans Mono" "WenQuanYi Zen Hei Mono" ];
+
+
+  environment.enableAllTerminfo = true;
+  environment.pathsToLink = [ "/share/zsh" ];
+  environment.shells = with pkgs; [ zsh ];
+  programs = {
+    steam = {
+      enable = true;
+      dedicatedServer.openFirewall = true;
+      remotePlay.openFirewall = true;
+    };
+    fish.enable = true;
+    java.enable = true;
+    command-not-found.enable = false;
+    dconf.enable = true;
+  };
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  services.pcscd.enable = true;
+
+  /*systemd.user.services.gpg-agent.serviceConfig.ExecStart = [
+    ""
+    ''
+    ${pkgs.gnupg}/bin/gpg-agent --supervised \
+    --pinentry-program ${pkgs.kwalletcli}/bin/pinentry-kwallet
+    ''
+    ];*/
+
+
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = false;
+    enableBrowserSocket = true;
+  };
+  programs.ssh.startAgent = true;
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+
+
+  # Open ports in the firewall.
+  networking.firewall.allowedTCPPorts = [ 24800 5900 5357 4656 ];
+  networking.firewall.allowedUDPPorts = [ 24800 5900 3702 4656 ];
+  # Or disable the firewall altogether.
+  networking.firewall.enable = true;
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  system.copySystemConfiguration = false;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.11"; # Did you read the comment?
+
+}
+

configurations/host/Old-materusPC/default.nix

@@ -0,0 +1,13 @@
+{ config, pkgs, lib, ... }:
+{
+  imports =
+    [
+      ./secrets
+      ./configuration.nix
+      ./nvidia.nix
+      ./plasma.nix
+    ];
+
+
+
+}

configurations/host/Old-materusPC/hardware-configuration.nix

@@ -0,0 +1,91 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [
+      (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" "vfio-pci" ];
+  boot.extraModulePackages = [ ];
+  boot.kernel.sysctl = { "vm.swappiness" = 10; };
+  boot.kernelParams = [ "ibt=off" "intel_iommu=on" "iommu=pt" "pcie_acs_override=downstream,multifunction" ];
+  fileSystems."/" =
+    {
+      device = "/dev/disk/by-label/NixOS_Root";
+      fsType = "btrfs";
+      options = [ "subvol=@" "noatime" "ssd" "space_cache=v2" ];
+    };
+
+  fileSystems."/boot" =
+    {
+      device = "/dev/disk/by-label/NixOS_Root";
+      fsType = "btrfs";
+      options = [ "subvol=@boot" "ssd" ];
+    };
+
+  fileSystems."/materus" =
+    {
+      device = "/dev/disk/by-label/NixOS_Root";
+      fsType = "btrfs";
+      options = [ "subvol=@materus" "noatime" "compress=zstd" "ssd" "space_cache=v2" ];
+      neededForBoot = true;
+
+    };
+
+  fileSystems."/nix" =
+    {
+      device = "/dev/disk/by-label/NixOS_Root";
+      fsType = "btrfs";
+      options = [ "subvol=@nix" "noatime" "compress=zstd" "ssd" "space_cache=v2" ];
+    };
+
+  fileSystems."/home" =
+    {
+      device = "/dev/disk/by-label/NixOS_Home";
+      fsType = "btrfs";
+      options = [ "subvol=@home" "nossd" "noatime" "compress=zstd" "space_cache=v2" "autodefrag" ];
+    };
+
+  fileSystems."/materus/data" =
+    {
+      device = "/dev/disk/by-label/NixOS_Home";
+      fsType = "btrfs";
+      options = [ "subvol=@data" "nossd" "noatime" "compress=zstd" "space_cache=v2" "autodefrag" ];
+    };
+
+  fileSystems."/boot/efi" =
+    {
+      device = "/dev/disk/by-uuid/A5C2-31D1";
+      fsType = "vfat";
+    };
+
+  swapDevices =
+    [{ device = "/dev/disk/by-label/NixOS_Swap"; }];
+
+  fileSystems."/etc/nixos" =
+    {
+      device = "/materus/config/nixos-config";
+      fsType = "none";
+      options = [ "bind" ];
+      depends = [ "/materus" ];
+    };
+
+
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp3s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp6s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkForce true;
+}

configurations/host/Old-materusPC/home/materus/default.nix

@@ -0,0 +1,79 @@
+{ config, pkgs, materusArg, lib, ... }:
+{
+  home.stateVersion = "22.11";
+  home.homeDirectory = "/home/materus";
+  programs.wezterm.enable = true;
+  programs.git = {
+    userEmail = "materus@podkos.pl";
+    userName = "materus";
+    signing.signByDefault = true;
+    signing.key = "${materusArg.cfg.path}/extraFiles/keys/ssh/materus.pub";
+    extraConfig = {
+      commit.gpgsign = true;
+      gpg.format = "ssh";
+    };
+  };
+  materus.profile = {
+    fonts.enable = lib.mkDefault true;
+    nixpkgs.enable = lib.mkDefault false;
+    enableDesktop = lib.mkDefault true;
+    enableTerminal = lib.mkDefault true;
+    enableTerminalExtra = lib.mkDefault true;
+    enableNixDevel = lib.mkDefault true;
+    editor.code.fhs.enable = true;
+    editor.code.fhs.packages = (ps: with ps; let llvmpkgs = llvmPackages_16; in [
+      llvmpkgs.clang
+      llvmpkgs.llvm
+      llvmpkgs.bintools
+      llvmpkgs.lld
+      llvmpkgs.lldb
+      llvmpkgs.libllvm
+      llvmpkgs.libllvm.dev
+
+
+      gcc
+      gdb
+
+      cmake
+      gnumake
+      ninja
+      binutils
+      coreutils
+      util-linux
+
+      dotnet-sdk_8
+      mono
+      mold
+      python3
+      lua
+      gtk4.dev
+      gtk4
+      miniaudio
+      SDL2.dev
+      SDL2
+      freeglut.dev
+      freeglut
+      boost.dev
+      boost
+      glew.dev
+      libGL.dev
+      libGLU.dev
+      vulkan-loader.dev
+
+      jdk
+
+
+      ldc
+      dmd
+      dub
+    ]);
+
+    editor.emacs.enable = false;
+
+  };
+
+  home.packages = [
+    pkgs.papirus-icon-theme
+  ];
+
+}

configurations/host/Old-materusPC/nvidia.nix

@@ -0,0 +1,32 @@
+{ config, pkgs, ... }:
+{
+  services.xserver.videoDrivers = [ "nvidia" ];
+  hardware.nvidia = {
+    package = config.boot.kernelPackages.nvidiaPackages.stable;
+    modesetting.enable = true;
+    nvidiaSettings = true;
+    prime = {
+      offload = {
+        enable = true;
+        enableOffloadCmd = true;
+      };
+      intelBusId = "PCI:0:2:0";
+      nvidiaBusId = "PCI:1:0:0";
+    };
+
+  };
+  hardware.opengl.extraPackages = with pkgs; [
+    vaapiVdpau
+    nvidia-vaapi-driver
+    libvdpau-va-gl
+  ];
+
+  hardware.opengl.extraPackages32 = with pkgs.pkgsi686Linux; [
+    vaapiVdpau
+    nvidia-vaapi-driver
+    libvdpau-va-gl
+  ];
+  materus.profile.steam.extraEnv = {
+    VK_ICD_FILENAMES=''''$VK_ICD_FILENAMES:/run/opengl-driver/share/vulkan/icd.d/nvidia_icd.x86_64.json:/run/opengl-driver-32/share/vulkan/icd.d/nvidia_icd.i686.json'';
+  };
+}

configurations/host/Old-materusPC/plasma.nix

@@ -0,0 +1,27 @@
+{ pkgs, ... }:
+{
+
+  services.xserver.displayManager.sddm.enable = true;
+  services.xserver.displayManager.sddm.wayland.enable = true;
+  services.xserver.displayManager.sddm.settings = {
+    General = {
+      InputMethod = "";
+    };
+    Theme = {
+      CursorTheme = "breeze_cursors";
+      CursorSize = "24";
+    };
+  };
+  environment.variables = {
+    QT_PLUGIN_PATH = [ "${pkgs.qt6.qtimageformats}/${pkgs.qt6.qtbase.qtPluginPrefix}" ];
+    XCURSOR_THEME = "breeze_cursors";
+  };
+  services.desktopManager.plasma6.enable = true;
+  services.desktopManager.plasma6.enableQt5Integration = true;
+  environment.plasma6.excludePackages = with pkgs.kdePackages; [ kwallet kwalletmanager kwallet-pam ];
+  environment.systemPackages = with pkgs.kdePackages; [
+    ark
+    kate
+  ];
+  materus.profile.steam.extraPkgs = [ pkgs.kdePackages.breeze pkgs.kdePackages.breeze-gtk pkgs.kdePackages.dolphin ];
+}

configurations/host/Old-materusPC/secrets/default.nix

@@ -0,0 +1,25 @@
+{ config, pkgs, lib, materusCfg, ... }:
+{
+  imports =
+    [
+
+    ] ++ (if (materusCfg.materusFlake.decrypted) then [ ./private ] else [ ]);
+
+  sops.age.generateKey = false;
+  sops.gnupg.home = null;
+  sops.gnupg.sshKeyPaths = [ ];
+  sops.defaultSopsFile = materusCfg.hostPath + "/secrets/secrets.yaml";
+  sops.secrets."wg-key" = { };
+  services.openssh.hostKeys = [
+    {
+      bits = 4096;
+      path = "/materus/root/ssh_host_rsa_key";
+      type = "rsa";
+    }
+    {
+      path = "/materus/root/ssh_host_ed25519_key";
+      type = "ed25519";
+    }
+  ];
+
+}

configurations/host/Old-materusPC/secrets/secrets.yaml

@@ -0,0 +1,33 @@
+wg-key: ENC[AES256_GCM,data:+z+Xxq6A1h5ceCOZry9PSz871zVZpd9Y6vtqpfoAulHCN03DjzZ/PLmRvYQ=,iv:7hdjnUuaRk30hFJ8rv4zXxI8v42RWC1iQb64LMNgBnQ=,tag:eUSTVygR+u9ERPU9gfhYIw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1el7zhjxkrlravpt7hw36fuac0xfgd42qkjjkvxzqmyl28u8csasqkd4a40
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsT2w4SCt2ZGdLYktHckMw
+            QVhza2tqU2M1Q3lsYnhld1dKcTdYUHcvSzFrCjMxT05yU01nUmFQK0FCUThUNDNN
+            V2EyTUhoVUNjNlNwTU9FeTlGRkxvVDgKLS0tIDBFYys1TmI0T0x0RnE2N3JCWWpq
+            VFVjMGUvRVBaY0JsR2lVcUFsdk4rYjQKEiiqEcTaQSVXSAm5c9uylaf2Tt/KJtPl
+            GDp+2YSBHHnVYjtYf7k9WqsIEe5/0AifDp3YA8jNhOXuZwZdvk+fLw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-03-30T18:21:12Z"
+    mac: ENC[AES256_GCM,data:0DMB+ukujc6PMU45n1QJGryGie25Bj2hXmia69QgYZNk2vgfO+nYmWSpmqK4Z00xXNtbsgejfDto5mrzU/OJ4FF3eOfwWfdIwxQLEQKoPF5U3niON3YO8FEA+JIn+/fNGF3fY1AgBfhberST5ikKnmff1Nwe5GOwQHSB3LU+CZE=,iv:V89EFUby3bwsoZKpoJRmJS9E/UheMBkKDq7j40IzBTA=,tag:aOJnFFGIuzQ3T7YrIFiWtw==,type:str]
+    pgp:
+        - created_at: "2024-03-30T18:20:23Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4D5fSX77p80GYSAQdAnUVLGsgIKd3EtSAGTPyXqSlsz1T8RnDvAtBz/XaH0y0w
+            pkp84zTe85FRZDnTO8a44WkpNIrUih0CYQSPPCZqSi/qnIxPWgx67HTC1bPAO9Iw
+            1GgBCQIQNcrKr4YNKSP5XxJqMXOyZD7rZ4g02Xdw5XplZ/y34m9c83S44XRgHwg4
+            0obXI1UlsqyHf/ZnTM1pbXO/kdTdFomWvWbfbuKDgDvyiJJ18mJ48GOsv/SBBJjJ
+            3877O+Ia5I8Chg==
+            =q58P
+            -----END PGP MESSAGE-----
+          fp: 28D140BCA60B4FD1
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

configurations/host/default.nix

@@ -2,65 +2,60 @@
 
 let
   profiles = import ../profile;
+
+  makeSystem = { host, arch ? "x86_64-linux", extraModules ? [ ], stable ? true, hmAsModule ? true, hmUsers ? [ "materus" ] }:
+    let
+      nixosSystem = if stable then inputs.nixpkgs-stable.lib.nixosSystem else inputs.nixpkgs.lib.nixosSystem;
+      hm = if stable then inputs.configInputs-stable.home-manager else inputs.configInputs.home-manager;
+      materusCfg = {
+        inherit stable;
+        inherit materusFlake;
+        inherit host;
+        inherit hm;
+        inherit hmAsModule;
+        nixerus = if stable then inputs.configInputs-stable.nixerus else inputs.configInputs.nixerus;
+        configInputs = if stable then inputs.configInputs-stable else inputs.configInputs;
+        path = materusFlake.selfPath;
+        hostPath = materusFlake.selfPath + "/configurations/host/${host}";
+        isHm = false;
+      };
+    in
+    (nixosSystem {
+      specialArgs = { inherit materusCfg; };
+      system = arch;
+      modules = [
+        ./${host}
+        profiles.osProfile
+        materusCfg.configInputs.sops-nix.nixosModules.sops
+        (if hmAsModule then hm.nixosModules.home-manager else { })
+        (if hmAsModule then
+          {
+
+            home-manager.useGlobalPkgs = true;
+            home-manager.useUserPackages = true;
+            home-manager.users = (builtins.foldl' (a: b: a // b) { } (builtins.map
+              (user: {
+                ${user} = ({ ... }:
+                  {
+                    imports = [
+                      (materusFlake.selfPath + "/configurations/shared/home/${user}")
+                      (materusFlake.selfPath + "/configurations/host/${host}/home/${user}")
+                      profiles.homeProfile
+                    ];
+                  });
+              })
+              hmUsers));
+            home-manager.extraSpecialArgs = { materusCfg = materusCfg // { isHm = true; }; };
+          } else { })
+
+      ] ++ extraModules;
+    }) // { inherit materusCfg; };
 in
 {
-  materusPC = inputs.nixpkgs.lib.nixosSystem rec {
+  materusPC = makeSystem { host = "materusPC"; stable = false; };
-    specialArgs = { inherit inputs; inherit materusFlake; };
+  flamaster = makeSystem { host = "flamaster"; stable = true; };
-    system = "x86_64-linux";
+  valkyrie = makeSystem { host = "valkyrie"; stable = true; };
-    modules = [
+  waffentrager = makeSystem { host = "waffentrager"; stable = true; arch = "aarch64-linux"; };
-      ./materusPC
-      inputs.private.systemModule
-      profiles.osProfile
-    ];
-  };
-  flamaster = inputs.nixpkgs.lib.nixosSystem rec {
-    specialArgs = { inherit inputs; inherit materusFlake; };
-    system = "x86_64-linux";
-    modules = [
-      ./flamaster
-      inputs.private.systemModule
-      profiles.osProfile
-
-      inputs.home-manager.nixosModules.home-manager
-      {
-        home-manager.useGlobalPkgs = true;
-        home-manager.useUserPackages = true;
-        home-manager.users.materus = { config ,... }: {
-          imports = [
-            ../home/materus
-            flamaster/extraHome.nix
-            profiles.homeProfile
-            inputs.private.homeModule
-          ];
-          materus.profile.nixpkgs.enable = false;
-        };
-        home-manager.extraSpecialArgs = { inherit inputs; inherit materusFlake; };
-      }
-    ];
-  };
-  valkyrie = inputs.nixpkgs.lib.nixosSystem rec {
-    specialArgs = { inherit inputs; inherit materusFlake; };
-    system = "x86_64-linux";
-    modules = [
-      ./valkyrie
-      inputs.private.systemModule
-      profiles.osProfile
-      inputs.home-manager.nixosModules.home-manager
-      {
-        home-manager.useGlobalPkgs = true;
-        home-manager.useUserPackages = true;
-        home-manager.users.materus = { config ,... }: {
-          imports = [
-            ../home/materus
-            valkyrie/extraHome.nix
-            profiles.homeProfile
-            inputs.private.homeModule
-          ];
-          materus.profile.nixpkgs.enable = false;
-        };
-        home-manager.extraSpecialArgs = { inherit inputs; inherit materusFlake; };
-      }
-    ];
-  };
 
+  Old-materusPC = makeSystem { host = "Old-materusPC"; stable = false; };
 }

configurations/host/flamaster/configuration.nix

@@ -2,7 +2,7 @@
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 
-{ config, lib, pkgs, materusFlake, materusPkgs, ... }:
+{ config, lib, pkgs, materusArg, ... }:
 
 {
   imports =
@@ -115,10 +115,11 @@
     isNormalUser = true;
     description = "Mateusz Słodkowicz";
     extraGroups = [ "networkmanager" "wheel" ];
-    openssh.authorizedKeys.keyFiles = [ (materusFlake.selfPath + /extraFiles/keys/ssh/materus.pub) ];
+    openssh.authorizedKeys.keyFiles = [ ("${materusArg.cfg.path}" + "/extraFiles/keys/ssh/materus.pub") ];
     packages = with pkgs; [
       kate
     ];
+    shell = pkgs.zsh;
   };
 
   # Allow unfree packages
@@ -135,7 +136,7 @@
     lshw
     steamcmd
     distrobox
-    steamcmd
+
 
     config.materus.profile.packages.firefox
     config.programs.java.package

configurations/host/flamaster/hardware-configuration.nix

@@ -16,13 +16,26 @@
 
   fileSystems."/" =
     {
-      device = "/dev/disk/by-label/NixOS_Root";
+      device = "/dev/disk/by-label/NixOS_Root_Laptop";
-      fsType = "ext4";
+      fsType = "btrfs";
+      options = [ "subvol=@" "noatime" "ssd" "space_cache=v2" "compress=zstd" ];
+    };
+  fileSystems."/nix" =
+    {
+      device = "/dev/disk/by-label/NixOS_Root_Laptop";
+      fsType = "btrfs";
+      options = [ "subvol=@nix" "noatime" "compress=zstd" "ssd" "space_cache=v2" ];
+    };
+  fileSystems."/boot" =
+    {
+      device = "/dev/disk/by-label/NixOS_Root_Laptop";
+      fsType = "btrfs";
+      options = [ "subvol=@boot" "ssd" ];
     };
 
   fileSystems."/boot/efi" =
     {
-      device = "/dev/disk/by-label/NixOS_EFI";
+      device = "/dev/disk/by-label/NixOS_EFI_L";
       fsType = "vfat";
     };
 

configurations/host/flamaster/home/materus/default.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, materusPkgs, lib, ... }:
+{ config, pkgs, materusArg, lib, ... }:
 {
   home.stateVersion = "23.05";
   home.homeDirectory = "/home/materus";
@@ -11,11 +11,13 @@
     enableTerminalExtra = lib.mkDefault true;
     enableNixDevel = lib.mkDefault true;
 
+    zsh.enable = true;
+
   };
 
   home.packages = [
     pkgs.papirus-icon-theme
-    (materusPkgs.polymc.wrap { extraJDKs = [ pkgs.graalvm-ce ]; })
+    (materusArg.pkgs.polymc.wrap { extraJDKs = [ pkgs.graalvm-ce ]; })
   ];
 
 }

configurations/host/materusPC/apps.nix

@@ -0,0 +1,106 @@
+{config, pkgs, materusArg, ...}:
+{
+    environment.systemPackages = with pkgs; [
+    gamescope
+    #(pkgs.lutris.override { extraLibraries = pkgs: with pkgs;  [ pkgs.samba pkgs.jansson pkgs.tdb pkgs.libunwind pkgs.libusb1 pkgs.gnutls pkgs.gtk3 pkgs.pango ]; })
+    materusArg.pkgs.amdgpu-pro-libs.prefixes
+    (pkgs.bottles.override { extraPkgs = pkgs: [ pkgs.libsForQt5.breeze-qt5 pkgs.kdePackages.breeze-gtk pkgs.nss_latest ]; extraLibraries = pkgs: [ pkgs.samba pkgs.jansson pkgs.tdb pkgs.libunwind pkgs.libusb1 pkgs.gnutls pkgs.gtk3 pkgs.pango ]; })
+    glibc
+    glib
+    gtk3
+    gtk4
+    gsettings-desktop-schemas
+    kdePackages.dolphin
+    vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+
+    patchelf
+    killall
+    util-linux
+    xorg.xhost
+    nix-top
+
+    gitFull
+    curl
+    wget
+
+    config.programs.java.package
+
+    nss_latest
+
+    pciutils
+
+    aspell
+    aspellDicts.pl
+    aspellDicts.en
+    aspellDicts.en-computers
+    steamtinkerlaunch
+    distrobox
+    # WebP support
+    libwebp
+    webp-pixbuf-loader
+
+    # Compression
+    p7zip
+    unrar
+    bzip2
+    rar
+    unzip
+    zstd
+    xz
+    zip
+    gzip
+
+    tree
+    mc
+    lf
+    htop
+    nmon
+    iftop
+    iptraf-ng
+    mprocs
+    tldr
+    bat
+    ##config.materus.profile.packages.home-manager
+    gcr
+    # pgcli
+    # litecli
+    materusArg.pkgs.alvr
+    #zenmonitor
+
+    nix-du
+
+
+    kate
+    krusader
+
+    wineWowPackages.stagingFull
+    winetricks
+    protontricks
+    gnupg
+    pinentry
+    pinentry-gnome3
+    pinentry-curses
+    ncurses
+    monkeysphere
+    gparted
+
+
+
+    virt-viewer
+
+    inkscape
+    gimp
+
+
+
+    git-crypt
+
+    bubblewrap
+    bindfs
+
+
+
+    binutils
+    
+  ];
+}

configurations/host/materusPC/audio.nix

@@ -0,0 +1,63 @@
+{ pkgs, lib, ... }:
+{
+
+  sound.enable = true;
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    audio.enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    systemWide = false;
+    jack.enable = true;
+  };
+  hardware.pulseaudio.enable = false;
+
+  environment.sessionVariables =
+    let
+      makePluginPath = format:
+        (lib.makeSearchPath format [
+          "$HOME/.nix-profile/lib"
+          "/run/current-system/sw/lib"
+          "/etc/profiles/per-user/$USER/lib"
+        ])
+        + ":$HOME/.${format}";
+    in
+    {
+      ALSOFT_DRIVERS = "pulse";
+
+      DSSI_PATH = makePluginPath "dssi";
+      LADSPA_PATH = makePluginPath "ladspa";
+      LV2_PATH = makePluginPath "lv2";
+      LXVST_PATH = makePluginPath "lxvst";
+      VST_PATH = makePluginPath "vst";
+      VST3_PATH = makePluginPath "vst3";
+
+    };
+
+  services.udev = {
+    extraRules = ''
+      KERNEL=="rtc0", GROUP="audio"
+      KERNEL=="hpet", GROUP="audio"
+    '';
+  };
+  environment.systemPackages = with pkgs; [
+    openal
+    pulseaudio
+
+    reaper
+
+    yabridge
+    yabridgectl
+
+    vital
+    odin2
+    surge
+    fire
+    decent-sampler
+    lsp-plugins
+
+  ];
+
+}

configurations/host/materusPC/default.nix

@@ -1,18 +1,23 @@
-{ config, pkgs, lib, inputs, materusFlake, ... }:
+{ config, pkgs, lib, ... }:
 {
   imports =
     [
 
       ./hardware
       ./vm
+      ./secrets
 
       ./scripts.nix
       ./tmp.nix
       ./network.nix
 
       ./kde.nix
+
+      ./audio.nix
+      ./apps.nix
     ];
 
+
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   system.copySystemConfiguration = false;
   system.stateVersion = "23.05";

configurations/host/materusPC/extraHome.nix

@@ -1,38 +0,0 @@
-{ config, pkgs, materusPkgs, lib, ... }:
-{
-  home.stateVersion = "23.05";
-  home.homeDirectory = "/home/materus";
-
-  programs.git.signing.signByDefault = true;
-
-  materus.profile = {
-    fonts.enable = lib.mkDefault true;
-    nixpkgs.enable = lib.mkDefault false;
-    enableDesktop = lib.mkDefault true;
-    enableTerminal = lib.mkDefault true;
-    enableTerminalExtra = lib.mkDefault true;
-    enableNixDevel = lib.mkDefault true;
-    editor.code.fhs.enable = true;
-    editor.code.fhs.packages = (ps: with ps;[
-      llvmPackages_16.clang
-      llvmPackages_16.llvm
-      llvmPackages_16.bintools
-      llvmPackages_16.lld
-      llvmPackages_16.lldb
-      llvmPackages_16.libllvm
-    ]);
-
-  };
-
-  home.packages = [
-    pkgs.papirus-icon-theme
-    materusPkgs.ffmpeg6-amf-full
-    (materusPkgs.polymc.wrap { extraJDKs = [ pkgs.graalvm-ce ]; extraLibs = [ ]; })
-  ];
-
-  programs.obs-studio = {
-    enable = true;
-    plugins = with pkgs.obs-studio-plugins; [ wlrobs obs-vaapi obs-vkcapture obs-gstreamer input-overlay obs-multi-rtmp obs-pipewire-audio-capture ];
-    package = materusPkgs.obs-amf;
-  };
-}

configurations/host/materusPC/gnome.nix

@@ -1,5 +1,4 @@
-
+{ config, pkgs, lib, ... }:
-{ config, pkgs, lib, inputs, materusFlake, materusPkgs, ... }:
 {
 
 
@@ -18,7 +17,7 @@
   services.gnome.core-shell.enable = true;
   services.gnome.core-os-services.enable = true;
 
-  programs.gnupg.agent.pinentryFlavor = "gnome3";
+  programs.gnupg.agent.pinentryPackage = lib.mkForce pkgs.pinentry-gnome3;
 
 
   programs.gnome-terminal.enable = true;
@@ -28,18 +27,18 @@
 
   environment.systemPackages = with pkgs; [
 
-      gnome3.adwaita-icon-theme
+    gnome3.adwaita-icon-theme
-      gnome3.gnome-tweaks
+    gnome3.gnome-tweaks
-      gnome3.gnome-color-manager
+    gnome3.gnome-color-manager
-      gnome3.gnome-shell-extensions
+    gnome3.gnome-shell-extensions
 
-      gnomeExtensions.appindicator
+    gnomeExtensions.appindicator
-      gnomeExtensions.desktop-clock
+    gnomeExtensions.desktop-clock
-      gnomeExtensions.gtk4-desktop-icons-ng-ding
+    gnomeExtensions.gtk4-desktop-icons-ng-ding
-      gnomeExtensions.compiz-windows-effect
+    gnomeExtensions.compiz-windows-effect
-      gnomeExtensions.burn-my-windows
+    gnomeExtensions.burn-my-windows
-      gnomeExtensions.user-themes
+    gnomeExtensions.user-themes
-      gnomeExtensions.gsconnect
+    gnomeExtensions.gsconnect
 
   ];
 }

configurations/host/materusPC/hardware/boot.nix

@@ -1,41 +1,41 @@
-{ config, pkgs, lib, inputs, materusFlake, ... }:
+{ config, pkgs, lib, ... }:
 let
-video = [
+  video = [
 
-  "video=HDMI-A-3:1920x1080@144"
+    "video=HDMI-A-3:1920x1080@144"
-  "video=DP-3:1920x1080@240"
+    "video=DP-3:1920x1080@240"
 
 
-  #"video=DP-1:1920x1080@240"
+    #"video=DP-1:1920x1080@240"
-  #"video=DP-2:1920x1080@240"
+    #"video=DP-2:1920x1080@240"
-  #"video=HDMI-A-1:1920x1080@240"
+    #"video=HDMI-A-1:1920x1080@240"
-  #"video=HDMI-A-2:1920x1080@240"
+    #"video=HDMI-A-2:1920x1080@240"
 
 
-];
+  ];
 in
 {
   #Kernel
   boot.kernelPackages = pkgs.linuxPackages_zen;
-  boot.kernelParams = [ /*"pci-stub.ids=1002:744c"*/ "nox2apic" "nvme_core.default_ps_max_latency_us=0" "nvme_core.io_timeout=255" "nvme_core.max_retries=10" "nvme_core.shutdown_timeout=10" "amd_iommu=on" "iommu=pt"] ++ video;
+  boot.kernelParams = [ "rcu_nocbs=8-15,24-31" "nohz_full=8-15,24-31" "vfio_iommu_type1.allow_unsafe_interrupts=1" "pcie_acs_override=downstream,multifunction" /*"pci-stub.ids=1002:744c"*/ "nox2apic" "nvme_core.default_ps_max_latency_us=0" "nvme_core.io_timeout=255" "nvme_core.max_retries=10" "nvme_core.shutdown_timeout=10" "amd_iommu=on" "iommu=pt" ] ++ video;
-  boot.kernelModules = [ "pci-stub" "amdgpu" "i2c_dev" "kvm_amd" "vfio" "vfio_iommu_type1" "vfio-pci" "v4l2loopback" ];
+  boot.kernelModules = [ "pci-stub" "amdgpu" "i2c_dev" "kvm_amd" "vfio" "vfio_iommu_type1" "vfio-pci"];
   boot.extraModprobeConfig = ''
-  options kvm_amd nested=1 avic=1 npt=1
+    options kvm_amd nested=1 avic=1 npt=1 sev=0
-  options vfio_iommu_type1 allow_unsafe_interrupts=1
+    options vfio_iommu_type1 allow_unsafe_interrupts=1
   '';
   boot.kernel.sysctl = {
-                        "vm.max_map_count" = 1000000;
+    "vm.max_map_count" = 1000000;
-                        "vm.swappiness" = 10;
+    "vm.swappiness" = 10;
-                       };
+  };
 
 
   boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
+  boot.initrd.kernelModules = [ "amdgpu" ];
 
   boot.extraModulePackages = with config.boot.kernelPackages; [ v4l2loopback ];
 
 
-  boot.supportedFilesystems = [ "ntfs" "btrfs" "vfat" "exfat" "ext4"];
+  boot.supportedFilesystems = [ "ntfs" "btrfs" "vfat" "exfat" "ext4" ];
 
   boot.tmp.useTmpfs = true;
 
@@ -52,4 +52,8 @@ in
     useOSProber = true;
     memtest86.enable = true;
   };
+
+  boot.plymouth.enable = true;
+
+  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
 }

configurations/host/materusPC/hardware/default.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, inputs, materusFlake, materusPkgs, ... }:
+{ config, pkgs, lib, materusArg, ... }:
 {
   imports =
     [
@@ -7,19 +7,25 @@
 
     ];
   hardware.firmware = with pkgs; [
-    materusPkgs.amdgpu-pro-libs.firmware.vcn
+    materusArg.pkgs.amdgpu-pro-libs.firmware.vcn
-    #materusPkgs.amdgpu-pro-libs.firmware
+    #materusArg.pkgs.amdgpu-pro-libs.firmware
     linux-firmware
     alsa-firmware
     sof-firmware
   ];
+
+  environment.variables = {
+    DISABLE_LAYER_AMD_SWITCHABLE_GRAPHICS_1 = "1";
+    VK_ICD_FILENAMES = "${pkgs.mesa.drivers}/share/vulkan/icd.d/radeon_icd.x86_64.json:${pkgs.driversi686Linux.mesa.drivers}/share/vulkan/icd.d/radeon_icd.i686.json";
+    AMD_VULKAN_ICD = "RADV";
+    RADV_PERFTEST = "gpl,rt,sam";
+    OCL_ICD_VENDORS = "${pkgs.rocmPackages.clr.icd}/etc/OpenCL/vendors/";
+  };
   hardware.cpu.amd.updateMicrocode = lib.mkForce true;
 
   #extra
   hardware.wooting.enable = true;
   hardware.bluetooth.enable = true;
-
-
   #Graphics
   hardware.opengl.enable = true;
   hardware.opengl.driSupport32Bit = true;
@@ -27,15 +33,15 @@
     vaapiVdpau
     libvdpau-va-gl
     amdvlk
-    rocm-opencl-icd
+    rocmPackages.clr.icd
-    rocm-opencl-runtime
+    rocmPackages.clr
-    materusPkgs.amdgpu-pro-libs.vulkan
+    materusArg.pkgs.amdgpu-pro-libs.vulkan
-    materusPkgs.amdgpu-pro-libs.amf
+    materusArg.pkgs.amdgpu-pro-libs.amf
   ];
   hardware.opengl.extraPackages32 = with pkgs.pkgsi686Linux; [
     vaapiVdpau
     pkgs.driversi686Linux.amdvlk
-    materusPkgs.i686Linux.amdgpu-pro-libs.vulkan
+    materusArg.pkgs.i686Linux.amdgpu-pro-libs.vulkan
     libvdpau-va-gl
   ];
   services.udev.extraRules = ''

configurations/host/materusPC/hardware/filesystem.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, inputs, materusFlake, ... }:
+{ config, pkgs, lib, ... }:
 {
   zramSwap = {
     enable = true;
@@ -12,14 +12,12 @@
   ];
 
 
-
-
-
   fileSystems."/etc/nixos" =
     {
       device = "/materus/config/nixos-config";
       fsType = "none";
       options = [ "bind" ];
+      depends = [ "/materus" ];
     };
 
 
@@ -28,6 +26,7 @@
       device = "/dev/disk/by-label/NixOS_Root";
       fsType = "btrfs";
       options = [ "subvol=@materus" "noatime" "compress=zstd" "ssd" "space_cache=v2" ];
+      neededForBoot = true;
     };
 
   fileSystems."/" =

configurations/host/materusPC/home/materus/default.nix

@@ -0,0 +1,96 @@
+{ pkgs, materusArg, lib, ... }:
+{
+  home.stateVersion = "23.05";
+  home.homeDirectory = "/home/materus";
+
+  programs.git.signing.signByDefault = true;
+  
+  xdg.userDirs.enable = true;
+  xdg.portal.enable = true;
+  xdg.portal.xdgOpenUsePortal = true;
+  xdg.portal.extraPortals = [ pkgs.kdePackages.xdg-desktop-portal-kde ];
+  xdg.portal.configPackages = [ pkgs.kdePackages.xdg-desktop-portal-kde ];
+  materus.profile = {
+    fonts.enable = lib.mkDefault true;
+    nixpkgs.enable = lib.mkDefault false;
+    enableDesktop = lib.mkDefault true;
+    enableTerminal = lib.mkDefault true;
+    enableTerminalExtra = lib.mkDefault true;
+    enableNixDevel = lib.mkDefault true;
+    editor.code.fhs.enable = true;
+    editor.code.fhs.packages = (ps: with ps; let llvmpkgs = llvmPackages_16; in [
+      llvmpkgs.clang
+      llvmpkgs.llvm
+      llvmpkgs.bintools
+      llvmpkgs.lld
+      llvmpkgs.lldb
+      llvmpkgs.libllvm
+      llvmpkgs.libllvm.dev
+
+      raylib
+      gcc
+      gdb
+      nil
+      nixfmt
+      nixpkgs-fmt
+      cmake
+      gnumake
+      ninja
+      binutils
+      coreutils
+      util-linux
+      openssl
+      openssl.dev
+      pkg-config
+      dotnet-sdk_8
+      mono
+      mold
+      python3
+      lua
+      gtk4.dev
+      gtk4
+      miniaudio
+      SDL2.dev
+      SDL2
+      freeglut.dev
+      freeglut
+      boost.dev
+      boost
+      glew.dev
+      libGL.dev
+      libGLU.dev
+      vulkan-loader.dev
+      xorg.xorgproto
+      xorg.libX11.dev
+      xorg.libXrandr.dev
+      xorg.libXrender.dev
+      rustup
+      freetype.dev
+
+      fpc
+      openjdk21
+      bison
+      flex
+
+      ldc
+      dmd
+      dub
+    ]);
+
+    editor.emacs.enable = false;
+
+  };
+
+  home.packages = [
+    pkgs.papirus-icon-theme
+    materusArg.pkgs.ffmpeg6-amf-full
+    (materusArg.pkgs.polymc.wrap { extraJDKs = [ pkgs.graalvm-ce ]; extraLibs = [ ]; })
+    pkgs.git-crypt
+  ];
+
+  programs.obs-studio = {
+    enable = false;
+    plugins = with pkgs.obs-studio-plugins; [ wlrobs obs-vaapi obs-vkcapture obs-gstreamer input-overlay obs-multi-rtmp obs-pipewire-audio-capture ];
+    package = materusArg.pkgs.obs-amf;
+  };
+}

configurations/host/materusPC/kde.nix

@@ -1,13 +1,20 @@
-{ config, pkgs, lib, inputs, materusFlake, materusPkgs, ... }:
+{ config, pkgs, lib, ... }:
 let
-  westonSddm = pkgs.writeText "weston.ini"
+  westonSddm = let xcfg = config.services.xserver; in  pkgs.writeText "weston.ini"
     ''
       [core]
-      xwayland=true
+      xwayland=false
       shell=fullscreen-shell.so
 
       [keyboard]
-      keymap_layout=pl
+      keymap_model = ${builtins.toString xcfg.xkb.model};
+      keymap_layout = ${builtins.toString xcfg.xkb.layout};
+      keymap_variant = ${builtins.toString xcfg.xkb.variant};
+      keymap_options = ${builtins.toString xcfg.xkb.options};
+
+      [libinput]
+      enable-tap = ${builtins.toString xcfg.libinput.mouse.tapping};
+      left-handed = ${builtins.toString xcfg.libinput.mouse.leftHanded};
 
       [output]
       name=DP-3
@@ -20,42 +27,47 @@ let
       [output]
       name=HDMI-A-3
       mode=off
-    ''
+
-  ;
+    '';
 in
 {
-  services.xserver.displayManager.defaultSession = "plasmawayland";
+  services.displayManager.defaultSession = "plasma";
-  services.xserver.displayManager.sddm.enable = true;
+  services.displayManager.sddm.enable = true;
-  services.xserver.displayManager.sddm.settings = {
+  services.displayManager.sddm.wayland.enable = true;
+  services.displayManager.sddm.wayland.compositor = lib.mkForce "weston";
+  services.displayManager.sddm.wayland.compositorCommand = lib.concatStringsSep " " [
+    "${lib.getExe pkgs.weston}"
+    "--shell=kiosk"
+    "-c ${westonSddm}"
+  ];
+
+  services.displayManager.sddm.settings = {
     General = {
-      DisplayServer = "wayland";
+      InputMethod = "";
-      InputMethod="";
     };
     Theme = {
       CursorTheme = "breeze_cursors";
       CursorSize = "24";
     };
-    Wayland = {
-      CompositorCommand = "${pkgs.weston}/bin/weston  -c ${westonSddm}";
-      
-    };
   };
-  services.xserver.desktopManager.plasma5.enable = true;
+  services.desktopManager.plasma6.enable = true;
-  services.xserver.desktopManager.plasma5.phononBackend = "gstreamer";
+  services.desktopManager.plasma6.enableQt5Integration = true;
-  services.xserver.desktopManager.plasma5.useQtScaling = true;
+  programs.gnupg.agent.pinentryPackage = lib.mkForce pkgs.pinentry-gnome3;
-  services.xserver.desktopManager.plasma5.runUsingSystemd = true;
+  environment.plasma6.excludePackages = with pkgs.kdePackages; [ kwallet kwalletmanager kwallet-pam ];
-  programs.gnupg.agent.pinentryFlavor = "qt";
-  environment.plasma5.excludePackages = with pkgs; [ libsForQt5.kwallet libsForQt5.kwalletmanager libsForQt5.kwallet-pam ];
 
   environment.variables = {
     # Old fix for black cursor on amdgpu, seems to work fine now
     #KWIN_DRM_NO_AMS = "1";
 
-    #Fix fo amdgpu crashes
+    #Fix for amdgpu crashes
-    KWIN_DRM_USE_MODIFIERS="0";
+    KWIN_DRM_USE_MODIFIERS = "0";
-    KWIN_DRM_NO_DIRECT_SCANOUT="1";
+    KWIN_DRM_NO_DIRECT_SCANOUT = "1";
+    QT_PLUGIN_PATH = [ "${pkgs.qt6.qtimageformats}/${pkgs.qt6.qtbase.qtPluginPrefix}" ];
+    XCURSOR_THEME = "breeze_cursors";
   };
   environment.systemPackages = with pkgs; [
-
+    kdePackages.ark
   ];
+
+  materus.profile.steam.extraPkgs = [ pkgs.kdePackages.breeze pkgs.kdePackages.breeze-gtk pkgs.kdePackages.dolphin ];
 }

configurations/host/materusPC/network.nix

@@ -1,18 +1,51 @@
-{ config, pkgs, lib, inputs, materusFlake, ... }:
+{ config, pkgs, lib, materusArg, ... }:
 {
+  sops.templates."networkmanager.env".content = ''
+    WIREGUARD_PRIVATEKEY="${config.sops.placeholder.wireguard}"
+  '';
+
   networking.useDHCP = lib.mkDefault true;
   networking.hostName = "materusPC";
   networking.wireless.iwd.enable = true;
   networking.networkmanager.enable = true;
-  networking.networkmanager.wifi.backend = "iwd";
+  #networking.networkmanager.wifi.backend = "iwd";
   networking.firewall.enable = true;
-  networking.firewall.allowedTCPPorts = [ 24800 5900 5357 4656 8080 9943 9944];
+  networking.firewall.allowedTCPPorts = [ 24800 5900 5357 4656 8080 9943 9944 ];
-  networking.firewall.allowedUDPPorts = [ 24800 5900 3702 4656 6000 9943 9944];
+  networking.firewall.allowedUDPPorts = [ 24800 5900 3702 4656 6000 9943 9944 ];
   #Fix warning
   networking.networkmanager.extraConfig = lib.mkDefault ''
     [connectivity]
     uri=http://nmcheck.gnome.org/check_network_status.txt
   '';
 
-
+  networking.networkmanager.ensureProfiles.environmentFiles = [
+    config.sops.templates."networkmanager.env".path
+  ];
+  networking.networkmanager.ensureProfiles.profiles = {
+    wg0 = {
+      connection = {
+        id = "wg0";
+        type = "wireguard";
+        interface-name = "wg0";
+      };
+      wireguard = {
+        private-key = "$WIREGUARD_PRIVATEKEY";
+      };
+      "wireguard-peer.${materusArg.wireguard.pubKeys.valkyrie}" = {
+        endpoint = "${materusArg.ips.valkyrie}:${materusArg.wireguard.port}";
+        allowed-ips = "${materusArg.ip-masks.wireguard.general};";
+      };
+      ipv4 = {
+        address1 = "${materusArg.ips.wireguard.materusPC}/23";
+        dns = "${materusArg.ips.wireguard.valkyrie};";
+        method = "manual";
+        never-default = "true";
+      };
+      ipv6 = {
+        addr-gen-mode = "stable-privacy";
+        method = "disabled";
+      };
+      proxy = { };
+    };
+  };
 }

configurations/host/materusPC/scripts.nix

@@ -1,46 +1,46 @@
-{ config, pkgs, lib, inputs, materusFlake, ... }:
+{ config, pkgs, lib, ... }:
 let
-valkyrie-sync = pkgs.writeShellScriptBin "valkyrie-sync" ''
+  valkyrie-sync = pkgs.writeShellScriptBin "valkyrie-sync" ''
-${pkgs.rsync}/bin/rsync -avzrh --delete --exclude ".git*" --exclude "flake.lock" /materus/config/Nixerus materus@valkyrie:/materus/config/ && \
+    ${pkgs.rsync}/bin/rsync -avzrh --delete --exclude ".git*" --exclude "flake.lock" /materus/config/nixos-config materus@valkyrie:/materus/config/ && \
-  ${pkgs.rsync}/bin/rsync -avzrh --delete --exclude ".git*" /materus/config/private/valkyrie materus@valkyrie:/materus/config/private
+      ${pkgs.rsync}/bin/rsync -avzrh --delete --exclude ".git*" /materus/config/private/valkyrie materus@valkyrie:/materus/config/private
-'';
+  '';
 
-valkyrie-flakelock = pkgs.writeShellScriptBin "valkyrie-flakelock" ''
+  valkyrie-flakelock = pkgs.writeShellScriptBin "valkyrie-flakelock" ''
-${pkgs.openssh}/bin/ssh materus@valkyrie "nix flake update /materus/config/Nixerus --override-input nixpkgs github:NixOS/nixpkgs/23.05 \
+    ${pkgs.openssh}/bin/ssh materus@valkyrie "nix flake update /materus/config/nixos-config --override-input nixpkgs github:NixOS/nixpkgs/23.05 \
-  --override-input home-manager github:nix-community/home-manager/release-23.05 \
+      --override-input home-manager github:nix-community/home-manager/release-23.05 \
-  --override-input private /materus/config/private/valkyrie/flake"
+      --override-input private /materus/config/private/valkyrie/flake"
-'';
+  '';
 
-valkyrie-rebuild-boot = pkgs.writeShellScriptBin "valkyrie-rebuild-boot" ''
+  valkyrie-rebuild-boot = pkgs.writeShellScriptBin "valkyrie-rebuild-boot" ''
-${pkgs.openssh}/bin/ssh -t materus@valkyrie "sudo nixos-rebuild boot --flake /materus/config/Nixerus#valkyrie \
+    ${pkgs.openssh}/bin/ssh -t materus@valkyrie "sudo nixos-rebuild boot --flake /materus/config/nixos-config#valkyrie \
-  --override-input private /materus/config/private/valkyrie/flake"
+      --override-input private /materus/config/private/valkyrie/flake"
-'';
+  '';
-valkyrie-rebuild-switch = pkgs.writeShellScriptBin "valkyrie-rebuild-switch" ''
+  valkyrie-rebuild-switch = pkgs.writeShellScriptBin "valkyrie-rebuild-switch" ''
-${pkgs.openssh}/bin/ssh -t materus@valkyrie "sudo nixos-rebuild switch --flake /materus/config/Nixerus#valkyrie \
+    ${pkgs.openssh}/bin/ssh -t materus@valkyrie "sudo nixos-rebuild switch --flake /materus/config/nixos-config#valkyrie \
-  --override-input private /materus/config/private/valkyrie/flake"
+      --override-input private /materus/config/private/valkyrie/flake"
-'';
+  '';
 
 
 
-flamaster-sync = pkgs.writeShellScriptBin "flamaster-sync" ''
+  flamaster-sync = pkgs.writeShellScriptBin "flamaster-sync" ''
-${pkgs.rsync}/bin/rsync -avzrh --delete --exclude ".git*" --exclude "flake.lock" /materus/config/Nixerus materus@flamaster:/materus/config/ && \
+    ${pkgs.rsync}/bin/rsync -avzrh --delete --exclude ".git*" --exclude "flake.lock" /materus/config/nixos-config materus@flamaster:/materus/config/ && \
-  ${pkgs.rsync}/bin/rsync -avzrh --delete --exclude ".git*" /materus/config/private/flamaster materus@flamaster:/materus/config/private
+      ${pkgs.rsync}/bin/rsync -avzrh --delete --exclude ".git*" /materus/config/private/flamaster materus@flamaster:/materus/config/private
-'';
+  '';
 
-flamaster-flakelock = pkgs.writeShellScriptBin "flamaster-flakelock" ''
+  flamaster-flakelock = pkgs.writeShellScriptBin "flamaster-flakelock" ''
-${pkgs.openssh}/bin/ssh materus@flamaster "nix flake update /materus/config/Nixerus --override-input nixpkgs github:NixOS/nixpkgs/23.05 \
+    ${pkgs.openssh}/bin/ssh materus@flamaster "nix flake update /materus/config/nixos-config --override-input nixpkgs github:NixOS/nixpkgs/23.05 \
-  --override-input home-manager github:nix-community/home-manager/release-23.05 \
+      --override-input home-manager github:nix-community/home-manager/release-23.05 \
-  --override-input private /materus/config/private/flamaster/flake"
+      --override-input private /materus/config/private/flamaster/flake"
-'';
+  '';
 
-flamaster-rebuild-boot = pkgs.writeShellScriptBin "flamaster-rebuild-boot" ''
+  flamaster-rebuild-boot = pkgs.writeShellScriptBin "flamaster-rebuild-boot" ''
-${pkgs.openssh}/bin/ssh -t materus@flamaster "sudo nixos-rebuild boot --flake /materus/config/Nixerus#flamaster \
+    ${pkgs.openssh}/bin/ssh -t materus@flamaster "sudo nixos-rebuild boot --flake /materus/config/nixos-config#flamaster \
-  --override-input private /materus/config/private/flamaster/flake"
+      --override-input private /materus/config/private/flamaster/flake"
-'';
+  '';
-flamaster-rebuild-switch = pkgs.writeShellScriptBin "flamaster-rebuild-switch" ''
+  flamaster-rebuild-switch = pkgs.writeShellScriptBin "flamaster-rebuild-switch" ''
-${pkgs.openssh}/bin/ssh -t materus@flamaster "sudo nixos-rebuild switch --flake /materus/config/Nixerus#flamaster \
+    ${pkgs.openssh}/bin/ssh -t materus@flamaster "sudo nixos-rebuild switch --flake /materus/config/nixos-config#flamaster \
-  --override-input private /materus/config/private/flamaster/flake"
+      --override-input private /materus/config/private/flamaster/flake"
-'';
+  '';
 
 
 in
@@ -55,5 +55,5 @@ in
     flamaster-rebuild-switch
     flamaster-sync
     flamaster-flakelock
-    ];
+  ];
 }

configurations/host/materusPC/secrets/default.nix

@@ -0,0 +1,27 @@
+{ config, pkgs, lib, materusCfg, ... }:
+{
+  imports =
+    [
+
+    ] ++ (if (materusCfg.materusFlake.decrypted) then [ ./private ] else [ ]);
+
+  sops.age.generateKey = false;
+  sops.gnupg.home = null;
+  sops.gnupg.sshKeyPaths = [ ];
+  sops.age.sshKeyPaths = [ "/materus/root/ssh_host_ed25519_key" ];
+  sops.defaultSopsFile = materusCfg.hostPath + "/secrets/secrets.yaml";
+  sops.secrets."users/materus" = { neededForUsers = true; };
+  sops.secrets.wireguard = { };
+
+  services.openssh.hostKeys = [
+    {
+      bits = 4096;
+      path = "/materus/root/ssh_host_rsa_key";
+      type = "rsa";
+    }
+    {
+      path = "/materus/root/ssh_host_ed25519_key";
+      type = "ed25519";
+    }
+  ];
+}

configurations/host/materusPC/secrets/secrets.yaml

@@ -0,0 +1,36 @@
+users:
+    materus: ENC[AES256_GCM,data:okqSgMvdFq1BMAg+Gs725zaNbeAQIpJKSPB2Sa83i3EYimphZNBtrJLen+gQEGNq4yeTyAc9Ih/hcnr+3z+Tea/g9ffh/UC4YA==,iv:OhKoWLREAqCbtmS3Rw9nE9+PtcBLwEHimJXcj4oejRA=,tag:Ht/SQSwumnQR6E45Pl47AQ==,type:str]
+    root: ENC[AES256_GCM,data:vnPjK+xayk/Zk895rERYAeCzpjv5NJ7EAyK4MRDUzDbW++4Dy+UEI81v1v7w9dfpDeL+x5kOqUFO5zVVDUGfZ3yf/l8M8N8KcA==,iv:gGFGcy3K27nQxn0+7I/t0kg3nZyXeGWqysOl2auZJXo=,tag:N+LYhKpPCbI1EjEBwxuh1g==,type:str]
+wireguard: ENC[AES256_GCM,data:rBkftzBcdamhP0xZB3qxfLptL8bX1qc7SdcfPNpYV67TeQs6i79+5KB/da4=,iv:22J5SZbFtYco7iSHvD2GD1bcazfGWlyEJ2isa3Ab4bI=,tag:BeUn9Srl2vyoDgK5Xv0UCg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1fq9ckkwtgvm69w045rf9pgurnhch6ukdxejr8yxgrthn7j8vp48qvd9rkx
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEbHZZUVF1dVJSU1NvNXVk
+            N3VtTm00ZHRWb082T0FkNXJncUxCU3haVmpVCk9FQkJBZnVJVFNLOThjZzlxNVF1
+            b0phQ2daejRrdVhEZ2YvRHVRRU5BQlEKLS0tIGdQeDlOSzl4VDhGNURQditCWUFG
+            dWVzbzUyakxXUGpTQjNsYzcyVG1aRDgKXVa8tIAbmggw1vSt3NJYRLgXhbagpNrX
+            RNXyndPaeQXVPVXuJWmHgRCYbwPTcfAFpGwFlX2IxVLlmC914Zklhw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-04-19T15:58:46Z"
+    mac: ENC[AES256_GCM,data:BLa0G3ci8EWH43UkLI2OoFJp2F9YeuKDrg6+2I/bq/lLi/YUitkJvBkA9VSIbvCyYWs/5SlEL5MayX8iiVdJ7r9bCiw+LVsWNAdaYDCafbZRW5F7KiHS5WXV3v4c201kFok7rmnRhEfKfdDxLlQ/mFHqOhupHU/qCNMTuUzJBiA=,iv:EPRoXHVMB6I16lTFJdFVAuSnMD/B55fPYtSBOQddutE=,tag:gohg+BdRlMPAQmNpRdk8sg==,type:str]
+    pgp:
+        - created_at: "2024-03-02T22:10:50Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4D5fSX77p80GYSAQdAvGVUu56Pd2+DMHqgIcJokyh11952nQK2eVtQNj42CAUw
+            NQfulNRUHX5BonsLyvXPx74bVku6Wxr80loIWoz049/xbFj4S7FyftkakY8rOUGu
+            1GgBCQIQOoEFvTQB8qGbea/85fktuljXPou/WgUY6Mxd4n0dBz54f69B/NttnBGc
+            7eUDKfe79Omr0o/0CVC/6SGKoiS38suV903QHeF1MXFPeOG72k4TvfF9lVlBgK8H
+            k4DXtzC7wm3WWg==
+            =eh7Z
+            -----END PGP MESSAGE-----
+          fp: 28D140BCA60B4FD1
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

configurations/host/materusPC/tmp.nix

@@ -1,14 +1,10 @@
-{ config, pkgs, lib, inputs, materusFlake, materusPkgs, ... }:
+{ config, pkgs, materusArg, ... }:
 
 {
-  virtualisation.lxc.enable = false;
+  virtualisation.lxc.enable = true;
-  virtualisation.lxc.lxcfs.enable = false;
+  virtualisation.lxc.lxcfs.enable = true;
-  virtualisation.lxd.enable = false;
+  virtualisation.lxd.enable = true;
-  #virtualisation.lxd.recommendedSysctlSettings = true;
 
-  programs.corectrl.enable = true;
-  programs.corectrl.gpuOverclock.enable = true;
-  programs.corectrl.gpuOverclock.ppfeaturemask = "0xffffffff";
   programs.gamemode.enable = true;
 
 
@@ -17,44 +13,38 @@
   services.teamviewer.enable = true;
 
   systemd.tmpfiles.rules = [
-    "L+    /opt/rocm/hip   -    -    -     -    ${pkgs.hip}"
+    "L+    /opt/rocm/hip   -    -    -     -    ${pkgs.rocmPackages.clr}"
   ];
 
   services.flatpak.enable = true;
   services.gvfs.enable = true;
 
 
+  services.xserver.xkb.layout = "pl";
 
-  time.timeZone = "Europe/Warsaw";
-  i18n.defaultLocale = "pl_PL.UTF-8";
-  console = {
-    font = "lat2-16";
-    #     keyMap = "pl";
-    useXkbConfig = true; # use xkbOptions in tty.
-  };
-  services.xserver.layout = "pl";
 
   services.xserver.enable = true;
   services.xserver.videoDrivers = [ "amdgpu" ];
   services.dbus.enable = true;
-  services.dbus.packages = [ pkgs.gcr_4 ];
+  services.dbus.packages = [ pkgs.gcr ];
+
 
 
-  #services.xserver.displayManager.autoLogin.user = "materus";
   services.xserver.displayManager.startx.enable = false;
-  /*
-    services.xserver.displayManager.lightdm.enable = true;
-    services.xserver.displayManager.lightdm.greeters.enso.enable = true;
-    services.xserver.displayManager.lightdm.greeters.enso.blur = true;
-  */
 
-  services.xserver.config = pkgs.lib.mkAfter ''
+  xdg.portal.enable = true;
+  xdg.portal.wlr.enable = true;
+  xdg.portal.xdgOpenUsePortal = true;
+
+  services.xserver.exportConfiguration = true;
+  services.xserver.extraConfig = pkgs.lib.mkDefault ''
     Section "OutputClass"
       Identifier "amd-options"
       Option "TearFree" "True"
       Option "SWCursor" "True"
       Option "VariableRefresh" "true"
       Option "AsyncFlipSecondaries" "true"
+      Option "DRI3" "1"
       MatchDriver "amdgpu"
     EndSection
 
@@ -66,26 +56,13 @@
   services.printing.enable = true;
 
 
-  sound.enable = true;
+
-  security.rtkit.enable = true;
-  services.pipewire = {
-    enable = true;
-    audio.enable = true;
-    alsa.enable = true;
-    alsa.support32Bit = true;
-    pulse.enable = true;
-    systemWide = false;
-    # If you want to use JACK applications, uncomment this
-    jack.enable = true;
-  };
-  hardware.pulseaudio.enable = false;
 
   services.xserver.libinput.enable = true;
 
   virtualisation.waydroid.enable = false;
   virtualisation.podman = {
     enable = true;
-    #enableNvidia = true;
     dockerCompat = true;
     dockerSocket.enable = true;
   };
@@ -96,30 +73,36 @@
 
   users.users.materus = {
     isNormalUser = true;
-    extraGroups = [ "audio" "video" "render" "pipewire" "wheel" "networkmanager" "input" "kvm" "libvirt-qemu" "libvirt" "libvirtd" "podman" "lxd" ]; # Enable ‘sudo’ for the user.
+    extraGroups = [
-    shell = pkgs.bashInteractive;
+      "audio"
+      "video"
+      "render"
+      "pipewire"
+      "wheel"
+      "networkmanager"
+      "input"
+      "kvm"
+      "libvirt-qemu"
+      "libvirt"
+      "libvirtd"
+      "podman"
+      "lxd"
+    ]; 
+    shell = pkgs.zsh;
     description = "Mateusz Słodkowicz";
-    #   packages = with pkgs; [
-    #     firefox
-    #     thunderbird
-    #   ];
   };
-  environment.variables = {
+
-    DISABLE_LAYER_AMD_SWITCHABLE_GRAPHICS_1 = "1";
+  environment.sessionVariables = {
-    VK_ICD_FILENAMES = "/run/opengl-driver/share/vulkan/icd.d/radeon_icd.x86_64.json:/run/opengl-driver-32/share/vulkan/icd.d/radeon_icd.i686.json";
-    AMD_VULKAN_ICD = "RADV";
-    RADV_PERFTEST = "gpl,rt,sam";
-    ALSOFT_DRIVERS = "pulse";
-  };
-  environment.sessionVariables = rec {
     XDG_CACHE_HOME = "\${HOME}/.cache";
     XDG_CONFIG_HOME = "\${HOME}/.config";
     XDG_BIN_HOME = "\${HOME}/.local/bin";
     XDG_DATA_HOME = "\${HOME}/.local/share";
+    QT_XKB_CONFIG_ROOT = "\${XKB_CONFIG_ROOT}";
+    GTK_IM_MODULE = "fcitx";
+    QT_IM_MODULE = "fcitx";
+    XMODIFIERS = "@im=fcitx";
+    SDL_IM_MODULE = "fcitx";
 
-    SDL_AUDIODRIVER = "pipewire";
-
-    #SSH_ASKPASS_REQUIRE = "prefer";
 
     MOZ_USE_XINPUT2 = "1";
     PATH = [
@@ -132,12 +115,10 @@
   '';
 
   i18n.inputMethod.enabled = "fcitx5";
-  i18n.inputMethod.fcitx5.addons = [ pkgs.fcitx5-configtool pkgs.fcitx5-lua pkgs.fcitx5-mozc pkgs.fcitx5-gtk pkgs.libsForQt5.fcitx5-qt ];
+  i18n.inputMethod.fcitx5.addons = [ pkgs.kdePackages.fcitx5-configtool pkgs.fcitx5-lua pkgs.fcitx5-mozc pkgs.fcitx5-gtk pkgs.kdePackages.fcitx5-qt ];
+
 
 
-  # Some programs need SUID wrappers, can be configured further or are
-  # started in user sessions.
-  # programs.mtr.enable = true;
   services.pcscd.enable = true;
   services.samba-wsdd.enable = true;
 
@@ -161,17 +142,6 @@
   environment.shells = with pkgs; [ zsh bashInteractive fish ];
   programs = {
     fish.enable = true;
-    zsh = {
-      enable = true;
-      interactiveShellInit = ''
-        if [[ ''${__MATERUS_HM_ZSH:-0} == 0 ]]; then
-          source ${pkgs.grml-zsh-config}/etc/zsh/zshrc
-        fi
-      '';
-      promptInit = ''
-
-      '';
-    };
     java.enable = true;
     java.package = pkgs.graalvm-ce;
     java.binfmt = true;
@@ -179,264 +149,10 @@
     dconf.enable = true;
   };
 
+  materus.profile.browser.enable = true;
 
 
+  services.davfs2.enable = true;
 
 
-  /*containers.test = {
-    config = { config, pkgs, ... }: { environment.systemPackages = with pkgs; [ wayfire ]; };
-    autoStart = false;
-    };*/
-
-  environment.systemPackages = with pkgs; [
-    firefox
-    gamescope
-    #(pkgs.lutris.override { extraLibraries = pkgs: with pkgs;  [ pkgs.samba pkgs.jansson pkgs.tdb pkgs.libunwind pkgs.libusb1 pkgs.gnutls pkgs.gtk3 pkgs.pango ]; })
-    materusPkgs.amdgpu-pro-libs.prefixes
-    (pkgs.bottles.override { extraPkgs = pkgs: with pkgs; [ pkgs.libsForQt5.breeze-qt5 pkgs.libsForQt5.breeze-gtk pkgs.nss_latest ]; extraLibraries = pkgs: with pkgs; [ pkgs.samba pkgs.jansson pkgs.tdb pkgs.libunwind pkgs.libusb1 pkgs.gnutls pkgs.gtk3 pkgs.pango ]; })
-    glibc
-    glib
-    gtk3
-    gtk4
-    gsettings-desktop-schemas
-    libsForQt5.dolphin
-
-    vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
-
-    patchelf
-    killall
-    util-linux
-    xorg.xhost
-    nix-top
-
-    gitFull
-    curl
-    wget
-
-    config.programs.java.package
-
-    nss_latest
-
-    aspell
-    aspellDicts.pl
-    aspellDicts.en
-    aspellDicts.en-computers
-    steamtinkerlaunch
-    distrobox
-
-    p7zip
-    unrar
-    bzip2
-    rar
-    unzip
-    zstd
-    xz
-    zip
-    gzip
-
-    tree
-    mc
-    lf
-    htop
-    nmon
-    iftop
-    iptraf-ng
-    mprocs
-    tldr
-    bat
-    ##config.materus.profile.packages.home-manager
-
-    # pgcli
-    # litecli
-
-    #zenmonitor
-
-    nix-du
-
-    ark
-    kate
-    krusader
-
-    wineWowPackages.stagingFull
-    winetricks
-    protontricks
-    openal
-    gnupg
-    pinentry
-    pinentry-gnome
-    pinentry-curses
-    ncurses
-    monkeysphere
-    gparted
-
-    virt-viewer
-
-    inkscape
-    gimp
-
-
-
-
-
-    bubblewrap
-    bindfs
-
-    pulseaudio
-
-    binutils
-    config.materus.profile.packages.firefox
-  ];
-
-
-
-
-
-
-
-  environment.etc = {
-
-
-    /*
-      "libvirt/hooks/qemu.d/win11/prepare/begin/start.sh" = {
-      text =
-      ''
-      #!/usr/bin/env bash
-      # Debugging
-      exec 19>/home/materus/startlogfile
-      BASH_XTRACEFD=19
-      set -x
-
-      exec 3>&1 4>&2
-      trap 'exec 2>&4 1>&3' 0 1 2 3
-      exec 1>/home/materus/startlogfile.out 2>&1
-
-
-
-      # Stop display manager
-      killall -u materus
-      systemctl stop display-manager.service
-      killall gdm-x-session
-      #systemctl isolate multi-user.target
-      sleep 1
-
-
-      # Load variables we defined
-      source "/etc/libvirt/hooks/kvm.conf"
-
-      # Isolate host to core 0
-      systemctl set-property --runtime -- user.slice AllowedCPUs=0
-      systemctl set-property --runtime -- system.slice AllowedCPUs=0
-      systemctl set-property --runtime -- init.scope AllowedCPUs=0
-
-
-
-      # Unbind VTconsoles
-      for (( i = 0; i < 16; i++))
-      do
-      if test -x /sys/class/vtconsole/vtcon"''${i}"; then
-      if [ "$(grep -c "frame buffer" /sys/class/vtconsole/vtcon"''${i}"/name)" = 1 ]; then
-      echo 0 > /sys/class/vtconsole/vtcon"''${i}"/bind
-      echo "$DATE Unbinding Console ''${i}"
-      fi
-      fi
-      done
-
-      # Unbind EFI Framebuffer
-      echo "efi-framebuffer.0" > /sys/bus/platform/drivers/efi-framebuffer/unbind
-
-      # Avoid race condition
-      sleep 1
-
-      # Unload NVIDIA kernel modules
-      modprobe -r nvidia_uvm
-      modprobe -r nvidia_drm
-      modprobe -r nvidia_modeset
-      modprobe -r nvidia
-      modprobe -r i2c_nvidia_gpu
-      modprobe -r drm_kms_helper
-      modprobe -r drm
-
-      # Detach GPU devices from host
-      #virsh nodedev-detach $VIRSH_GPU_VIDEO
-      #virsh nodedev-detach $VIRSH_GPU_AUDIO
-      #virsh nodedev-detach $VIRSH_GPU_USB
-      #virsh nodedev-detach $VIRSH_GPU_SERIAL_BUS
-
-      # Load vfio module
-      modprobe vfio
-      modprobe vfio_pci
-      modprobe vfio_iommu_type1
-      '';
-      mode = "0755";
-      };
-
-      "libvirt/hooks/qemu.d/win11/release/end/stop.sh" = {
-      text =
-      ''
-      #!/usr/bin/env bash
-      # Debugging
-      exec 19>/home/materus/stoplogfile
-      BASH_XTRACEFD=19
-      set -x
-
-      exec 3>&1 4>&2
-      trap 'exec 2>&4 1>&3' 0 1 2 3
-      exec 1>/home/materus/stoplogfile.out 2>&1
-
-      # Load variables we defined
-      source "/etc/libvirt/hooks/kvm.conf"
-
-      # Unload vfio module
-      modprobe -r vfio-pci
-      modprobe -r vfio_iommu_type1
-      modprobe -r vfio
-
-
-
-      modprobe drm
-      modprobe drm_kms_helper
-      modprobe i2c_nvidia_gpu
-      modprobe nvidia
-      modprobe nvidia_modeset
-      modprobe nvidia_drm
-      modprobe nvidia_uvm
-
-      # Attach GPU devices from host
-      #virsh nodedev-reattach $VIRSH_GPU_VIDEO
-      #virsh nodedev-reattach $VIRSH_GPU_AUDIO
-      #virsh nodedev-reattach $VIRSH_GPU_USB
-      #virsh nodedev-reattach $VIRSH_GPU_SERIAL_BUS
-
-      #echo "0000:01:00.0" > /sys/bus/pci/drivers/nvidia/bind
-      # Bind EFI Framebuffer
-      echo "efi-framebuffer.0" > /sys/bus/platform/drivers/efi-framebuffer/bind
-
-      # Bind VTconsoles
-      echo 1 > /sys/class/vtconsole/vtcon0/bind
-      #echo 1 > /sys/class/vtconsole/vtcon1/bind
-
-
-      # Start display manager
-      sleep 1
-      systemctl start display-manager.service
-
-      # Return host to all cores
-      systemctl set-property --runtime -- user.slice AllowedCPUs=0-3
-      systemctl set-property --runtime -- system.slice AllowedCPUs=0-3
-      systemctl set-property --runtime -- init.scope AllowedCPUs=0-3
-      '';
-        
-
-
-      text = ''
-      #!/usr/bin/env bash
-      reboot
-      '';*-/
-      mode = "0755";
-      };
-      "libvirt/vgabios/patched.rom".source = ./vbios.rom;
-      }; 
-      };
-    */
-  };
 }

configurations/host/materusPC/vm/default.nix

@@ -1,9 +1,31 @@
-{ config, pkgs, lib, inputs, materusFlake, ... }:
+{ config, pkgs, ... }:
 {
   imports = [
     ./win10
   ];
 
+  systemd.mounts = [
+    {
+      where = "/dev/hugepages";
+      enable = false;
+    }
+    {
+      where = "/dev/hugepages/hugepages-2048kB";
+      enable = true;
+      what = "hugetlbfs";
+      type = "hugetlbfs";
+      options = "pagesize=2M";
+      requiredBy = [ "basic.target" ];
+    }
+    {
+      where = "/dev/hugepages/hugepages-1048576kB";
+      enable = true;
+      what = "hugetlbfs";
+      type = "hugetlbfs";
+      options = "pagesize=1G";
+      requiredBy = [ "basic.target" ];
+    }
+  ];
 
   virtualisation.libvirtd = {
     enable = true;

configurations/host/materusPC/vm/win10/default.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, inputs, materusFlake, ... }:
+{ config, pkgs, ... }:
 let
   startHook = /*''
 
@@ -14,31 +14,36 @@ let
     ''
     +*/
     ''
-    # Make sure nothing renders on gpu to prevent "sysfs: cannot create duplicate filename" after rebinding to amdgpu
+       # Make sure nothing renders on gpu to prevent "sysfs: cannot create duplicate filename" after rebinding to amdgpu
-    chmod 0 /dev/dri/renderD128 
+       chmod 0 /dev/dri/renderD128 
-    fuser -k /dev/dri/renderD128
+       fuser -k /dev/dri/renderD128
 
-    # Seems to fix reset bug for 7900 XTX
+       # Seems to fix reset bug for 7900 XTX
-    echo "0" > "/sys/bus/pci/devices/''${VIRSH_GPU_VIDEO}/d3cold_allowed"
+       echo "0" > "/sys/bus/pci/devices/''${VIRSH_GPU_VIDEO}/d3cold_allowed"
 
-    systemctl stop mountWin10Share.service
+       systemctl stop mountWin10Share.service
     
     
-    echo ''$VIRSH_GPU_VIDEO > "/sys/bus/pci/devices/''${VIRSH_GPU_VIDEO}/driver/unbind"
+       echo ''$VIRSH_GPU_VIDEO > "/sys/bus/pci/devices/''${VIRSH_GPU_VIDEO}/driver/unbind"
-    echo ''$VIRSH_GPU_AUDIO > "/sys/bus/pci/devices/''${VIRSH_GPU_AUDIO}/driver/unbind"
+       echo ''$VIRSH_GPU_AUDIO > "/sys/bus/pci/devices/''${VIRSH_GPU_AUDIO}/driver/unbind"
 
-    sleep 1s
+       sleep 1s
 
-    echo "10" > "/sys/bus/pci/devices/''${VIRSH_GPU_VIDEO}/resource0_resize"
+       echo "10" > "/sys/bus/pci/devices/''${VIRSH_GPU_VIDEO}/resource0_resize"
-    echo "8" > "/sys/bus/pci/devices/''${VIRSH_GPU_VIDEO}/resource2_resize"
+       echo "8" > "/sys/bus/pci/devices/''${VIRSH_GPU_VIDEO}/resource2_resize"
+
+       echo "3" > /proc/sys/vm/drop_caches
+       echo "1" > /proc/sys/vm/compact_memory
+      #echo "8192" >  /sys/devices/system/node/node1/hugepages/hugepages-2048kB/nr_hugepages
 
 
-    systemctl set-property --runtime -- user.slice AllowedCPUs=12-15,28-31
+
-    systemctl set-property --runtime -- system.slice AllowedCPUs=12-15,28-31
+       systemctl set-property --runtime -- user.slice AllowedCPUs=0-7,16-23
-    systemctl set-property --runtime -- init.scope AllowedCPUs=12-15,28-31
+       systemctl set-property --runtime -- system.slice AllowedCPUs=0-7,16-23
+       systemctl set-property --runtime -- init.scope AllowedCPUs=0-7,16-23
 
 
-  '';
+    '';
   stopHook = ''
 
     # Debugging
@@ -67,6 +72,7 @@ let
     echo ''$VIRSH_GPU_VIDEO > /sys/bus/pci/drivers/amdgpu/bind
     echo ''$VIRSH_GPU_AUDIO > /sys/bus/pci/drivers/snd_hda_intel/bind
     
+   #echo "0" >  /sys/devices/system/node/node1/hugepages/hugepages-2048kB/nr_hugepages
 
     systemctl start mountWin10Share.service
 

configurations/host/valkyrie/default.nix

@@ -2,15 +2,16 @@
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running `nixos-help`).
 
-{ config, pkgs, materusFlake, ... }:
+{ pkgs, materusArg, config, ... }:
 
 {
   imports =
     [
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
-      ./pleroma.nix
+      ./services
-          ];
+      ./secrets
+    ];
 
   materus.profile.nix.enable = true;
 
@@ -28,7 +29,7 @@
   networking.hostName = "valkyrie"; # Define your hostname.
   # Pick only one of the below networking options.
   # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
-  networking.networkmanager.enable = false; # Easiest to use and most distros use this by default.
+  networking.networkmanager.enable = false;
 
   # Set your time zone.
   time.timeZone = "Europe/Warsaw";
@@ -69,11 +70,13 @@
   users.users.materus = {
     isNormalUser = true;
     extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
-    packages = with pkgs; [
+    packages = [
     ];
-    openssh.authorizedKeys.keyFiles = [ (materusFlake.selfPath + /extraFiles/keys/ssh/materus.pub) ];
+    openssh.authorizedKeys.keyFiles = [ ("${materusArg.cfg.path}" + "/extraFiles/keys/ssh/materus.pub") ];
+    shell = pkgs.zsh;
   };
-
+  users.users.acme.openssh.authorizedKeys.keyFiles = [ ("${materusArg.cfg.path}" + "/extraFiles/keys/ssh/waffentrager.pub") ];
+  users.users.acme.shell = pkgs.scponly;
   # List packages installed in system profile. To search, run:
   # $ nix search wget
   environment.systemPackages = with pkgs; [
@@ -97,10 +100,10 @@
   services.openssh.enable = true;
   services.openssh.openFirewall = false;
   services.openssh.settings.PermitRootLogin = "no";
-  services.openssh.settings.PasswordAuthentication = true;
+  services.openssh.settings.PasswordAuthentication = false;
+
 
 
-  services.adguardhome.enable = true;
   # Open ports in the firewall.
   # networking.firewall.allowedTCPPorts = [ ... ];
   # networking.firewall.allowedUDPPorts = [ ... ];
@@ -141,12 +144,13 @@
 
   security.acme.acceptTerms = true;
   security.acme.defaults.email = "materus+acme@podkos.pl";
+  security.acme.defaults.credentialsFile = config.sops.secrets.certs.path;
+  security.acme.defaults.dnsResolver = "9.9.9.9:53";
   security.acme.certs."materus.pl" = {
     domain = "materus.pl";
     group = "nginx";
     extraDomainNames = [ "*.materus.pl" ];
     dnsProvider = "ovh";
-    credentialsFile = "/materus/config/private/valkyrie/certs.secret";
   };
 
   security.acme.certs."podkos.pl" = {
@@ -154,7 +158,6 @@
     group = "nginx";
     extraDomainNames = [ "*.podkos.pl" ];
     dnsProvider = "ovh";
-    credentialsFile = "/materus/config/private/valkyrie/certs.secret";
   };
 
   security.acme.certs."podkos.xyz" = {
@@ -162,7 +165,15 @@
     group = "nginx";
     extraDomainNames = [ "*.podkos.xyz" ];
     dnsProvider = "ovh";
-    credentialsFile = "/materus/config/private/valkyrie/certs.secret";
+  };
+
+
+  security.acme.certs."${materusArg.waffentrager.samba.domain}" = {
+    domain = materusArg.waffentrager.samba.domain;
+    extraDomainNames = [
+      "${materusArg.waffentrager.samba.netbiosName}.${materusArg.waffentrager.samba.domain}"
+    ];
+    dnsProvider = "ovh";
   };
 
 }

configurations/host/valkyrie/home/materus/default.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, materusPkgs, lib, ... }:
+{ ... }:
 {
   home.stateVersion = "23.05";
   home.homeDirectory = "/home/materus";
@@ -10,7 +10,8 @@
     enableTerminalExtra = false;
     enableNixDevel = false;
 
-    fish.enable = true;
+    fish.enable = false;
     bash.enable = true;
+    zsh.enable = true;
   };
 }

configurations/host/valkyrie/pleroma.nix

@@ -1,146 +0,0 @@
-{ config, pkgs, lib, materusFlake, ... }:
-let
-
-  socketPath = "/run/pleroma/http.sock";
-
-
-  socketChmod = with pkgs; with lib; pkgs.writers.writeBashBin "pleroma-socket"
-    ''
-      coproc {
-          ${inotify-tools}/bin/inotifywait -q -m -e create ${escapeShellArg (dirOf socketPath)}
-        }
-
-        trap 'kill "$COPROC_PID"' EXIT TERM
-
-        until ${pkgs.coreutils}/bin/test -S ${escapeShellArg socketPath}
-          do read -r -u "''${COPROC[0]}"
-        done
-
-      ${pkgs.coreutils}/bin/chmod 0666 ${socketPath}
-    '';
-
-  soapbox = pkgs.stdenv.mkDerivation rec {
-    pname = "soapbox";
-    version = "v3.2.0";
-    dontBuild = true;
-    dontConfigure = true;
-    src = pkgs.fetchurl {
-      name = "soapbox";
-      url = "https://gitlab.com/soapbox-pub/soapbox/-/jobs/artifacts/${version}/download?job=build-production";
-      sha256 = "sha256-AdW6JK7JkIKLZ8X+N9STeOHqmGNUdhcXyC9jsQPTa9o=";
-    };
-    nativeBuildInputs = [pkgs.unzip];
-    unpackPhase = ''
-    unzip $src -d .
-    '';
-    installPhase = ''
-    mv ./static $out
-    '';
-
-  };
-
-in
-{
-  systemd.tmpfiles.rules = [
-    "d    /var/lib/pleroma   0766    pleroma    pleroma     -"
-    "d    /var/lib/pleroma/static   0766    pleroma    pleroma     -"
-    "d    /var/lib/pleroma/uploads   0766    pleroma    pleroma     -"
-    "L+   /var/lib/pleroma/static/frontends/soapbox/${soapbox.version}  0766 pleroma pleroma - ${soapbox}"
-  ];
-
-  services.nginx.virtualHosts."podkos.xyz" = {
-    http2 = true;
-    useACMEHost = "podkos.xyz";
-    forceSSL = true;
-    locations."/" = {
-      proxyPass = "http://unix:${socketPath}";
-      extraConfig = ''
-        etag on;
-        gzip on;
-
-        add_header 'Access-Control-Allow-Origin' '*' always;
-        add_header 'Access-Control-Allow-Methods' 'POST, PUT, DELETE, GET, PATCH, OPTIONS' always;
-        add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, Idempotency-Key' always;
-        add_header 'Access-Control-Expose-Headers' 'Link, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining, X-Request-Id' always;
-        if ($request_method = OPTIONS) {
-          return 204;
-        }
-
-        add_header X-XSS-Protection "1; mode=block";
-        add_header X-Permitted-Cross-Domain-Policies none;
-        add_header X-Frame-Options DENY;
-        add_header X-Content-Type-Options nosniff;
-        add_header Referrer-Policy same-origin;
-        add_header X-Download-Options noopen;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header Host $host;
-
-        client_max_body_size 8m;
-      
-      
-      '';
-    };
-
-  };
-  systemd.services.pleroma.serviceConfig = {
-    RuntimeDirectory = "pleroma";
-    RuntimeDirectoryPreserve = true;
-
-
-    ExecStartPost = "${socketChmod}/bin/pleroma-socket";
-    ExecStopPost = ''${pkgs.coreutils}/bin/rm -f ${socketPath}'';
-  };
-
-
-
-
-  services.pleroma = {
-    enable = true;
-    secretConfigFile = "/var/lib/pleroma/secrets.exs";
-    configs = [
-      ''
-        import Config
-
-        config :pleroma, Pleroma.Web.Endpoint,
-          url: [host: "podkos.xyz", scheme: "https", port: 443],
-          http: [ip: {:local, "${socketPath}"}, port: 0]
-
-        config :pleroma, :instance,
-          name: "Podziemia Kosmosu",
-          email: "admin@podkos.xyz",
-          notify_email: "noreply@podkos.xyz",
-          limit: 5000,
-          registrations_open: false
-
-        config :pleroma, :media_proxy,
-          enabled: false,
-          redirect_on_failure: true
-
-        config :pleroma, Pleroma.Repo,
-          adapter: Ecto.Adapters.Postgres,
-          socket: "/run/postgresql/.s.PGSQL.5432",
-          username: "pleroma",
-          database: "pleroma"
-          
-
-        # Configure web push notifications
-        config :web_push_encryption, :vapid_details,
-          subject: "mailto:admin@podkos.x yz"
-        config :pleroma, :frontends,
-          primary: %{
-            "name" => "soapbox",
-            "ref" => "${soapbox.version}"
-          }
-
-        config :pleroma, :database, rum_enabled: false
-        config :pleroma, :instance, static_dir: "/var/lib/pleroma/static"
-        config :pleroma, Pleroma.Uploaders.Local, uploads: "/var/lib/pleroma/uploads"
-
-        config :pleroma, configurable_from_database: true  
-        config :pleroma, Pleroma.Upload, filters: [Pleroma.Upload.Filter.AnonymizeFilename]
-      ''
-    ];
-  };
-}

configurations/host/valkyrie/secrets/default.nix

@@ -0,0 +1,35 @@
+{ materusCfg, ... }:
+{
+  imports =
+    [
+
+    ] ++ (if (materusCfg.materusFlake.decrypted) then [ ./private ] else [ ]);
+
+  sops.age.generateKey = false;
+  sops.gnupg.home = null;
+  sops.gnupg.sshKeyPaths = [ ];
+  sops.defaultSopsFile = materusCfg.hostPath + "/secrets/secrets.yaml";
+
+  sops.secrets.wireguard = { };
+  sops.secrets.discord-token = {};
+  sops.secrets.spotify-client-id = {};
+  sops.secrets.spotify-client-secret = {};
+  sops.secrets.youtube-api = {};
+  sops.secrets.certs = {};
+  sops.secrets.steamladder-api = {};
+  sops.secrets.webarchive-accesskey = {};
+  sops.secrets.webarchive-secretkey = {};
+  
+  services.openssh.hostKeys = [
+    {
+      bits = 4096;
+      path = "/materus/root/ssh_host_rsa_key";
+      type = "rsa";
+    }
+    {
+      path = "/materus/root/ssh_host_ed25519_key";
+      type = "ed25519";
+    }
+  ];
+
+}

configurations/host/valkyrie/secrets/secrets.yaml

@@ -0,0 +1,41 @@
+wireguard: ENC[AES256_GCM,data:i98U0ugxbNqWNuKR8u+mdWoSMLViHXfsWRBS1lvjb+hgGxveyzjBcagBIeY=,iv:/hF9oH2R6NSeHT/UQTlbmtx+gPX/3CJOLPNnxrzsY/g=,tag:2ub5w8uH2O1B2hoku8Kowg==,type:str]
+discord-token: ENC[AES256_GCM,data:JQ/6MJvBlJpKzs/L0hFB1LPpQSfJvDdEB6YerVZyDqGo7plA0S5wORACgA88Dei1x1NGsXhYtiwT4vE9jjeCOlWXZdl1mA==,iv:BsDu1De0qLX/8VDiZ5co1q1LXxkz/Som9+hvm/67/xU=,tag:YO0wQNF3/AXbifpeAa935Q==,type:str]
+spotify-client-id: ENC[AES256_GCM,data:WK7CJGw6mtIG3Jfp59cWx3ool4z1P09TvHcpbOQ2JV0=,iv:EaJ5ecXdmx0Ky+43xZITM811IOo4EisvPSyogXrJXng=,tag:NYTI4vLsWGa695CJ+TIgbw==,type:str]
+spotify-client-secret: ENC[AES256_GCM,data:TnR+zLLklTfzMdR4woaZWuMVJQ9VIYsFM588GRO6WCY=,iv:cYiqw8ZdMgLeug4ptwPV3L+MeY6xIldfUBfiYg1mFD8=,tag:YDLh6BXFcBHnpdgM7e87wg==,type:str]
+youtube-api: ENC[AES256_GCM,data:qmpFlFvudS9rXQfN+Th/UrPWCW0mg5GkpMucS/01AmOnlChqtojC,iv:q3bKwI2I6BNa3L9ezKCE1fWT/vZLiJ8uzug1z2z+TWA=,tag:gKG3HTz8jp2LAFh8e8O6sg==,type:str]
+steamladder-api: ENC[AES256_GCM,data:m30o5atqugwqn/WbXGkUq5GvqiIKQT0kSRQCtHc1Gxk/dC3YcbDvMw==,iv:duLKl1NvysD0XMaUOkl/6nclMQB6seXcQYkGMrm7K7Y=,tag:9dw+UH10uAdca5fVdlw1Mg==,type:str]
+webarchive-accesskey: ENC[AES256_GCM,data:jdKlHsZq2Dkk1BcBfUVv5g==,iv:BXCgPb/2W57PYXxRktInz1LxSEwlw6m3xnQU4TOPMeY=,tag:kK4+InaH7K4D4n1hyGaR+w==,type:str]
+webarchive-secretkey: ENC[AES256_GCM,data:nuA9G5dNtrNfbcx0G/GUTg==,iv:RRuTm4kZr5dNjBt9Zvk/NVefHCZYODmRvWAqZizKGJY=,tag:J2V0Q3BzXNWifVVvAkwYyg==,type:str]
+certs: ENC[AES256_GCM,data:ttmSNTTx51a3L2HTC8RnSphDLHO2OSyIgXQ0YpZGySTdu69mgEyhaiSi+IAXg/1AHKRjpFJgE4fhsLAiW78pNYb+Zg7aDL47YtABO99sTZrZnBxZo6k6itpZ3oClDch2ZALzoXChLroc0tUbZKwsfOwGe3pw9lOJZJT34AhV+BVoXDDLQcpQoxz23Baa8oxklecT6wpJ1u1nW+aAHw33gm41Vw==,iv:b0aNZwaRKBg+ipe5+19BowyFbCjZt52S738om6emYGo=,tag:lUqtcc4vVWKx/fnc19vj7A==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1wscr6kv8393wv0fjaux8juplaxq55znlzrp62qyteq0fauu3yg0s7d7k98
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSRXNLdUZaVU13alNhVGgz
+            aXdMb3IzNjNQcHJFV2JLNVM2SUVBa3VNZlRFCkxxd21CTWVDUkVXbzR6ZEkxbm5J
+            VGorSkp6a2xSdHRHcFk5T3VYVlJJa0UKLS0tIE1WdHo5eTlpNEEyN25oSjk1KzdS
+            d2dMUUh1RDB3UnpEdFJsNHpQRXFWemMKc41dlOapTsvH91QLNhdPbrzerPFakOiX
+            J/uoZDMIhsmQxgQM7Fqxr05NywhI/ZjOtJS2bayp73O57xjjMYcyNQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-04-05T22:42:16Z"
+    mac: ENC[AES256_GCM,data:KSRGzHipb58uNYaRYXAy3y+D9cBG53RGxZpNrx2gy+CHbGtkUW1SWc4PPrBwBhb6+TN0vb1zHuOB4HK4Bys/jqmvGgVkO2VKj15MTFMpF5n6w0blFM7d5bCDydHAhvXEZA/PFWq97DTI1Zxb+N/HWJlefKCzYOHHWj7i4leKNjk=,iv:88Ekp0sjEo5UTBLUyYSrkP+MbIFcCmegclJIK3+0jOQ=,tag:H/ESeQhC1PEF00RiDnamyw==,type:str]
+    pgp:
+        - created_at: "2024-03-21T22:55:36Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4D5fSX77p80GYSAQdA667A9P/3ktuS2iEjxkv3aYMAGSu0oPGIX7dsC23VVgkw
+            OmcwhXxBnipcG+izbtNylXz5VonyyKHwdR2QIgkt9FEuC8lI17GHVyogTCFiP7Dj
+            1GgBCQIQN4EqFdiXqzJUeeE+PdOzVPs+1kStz+S1H22NjrJAFv67cbyIgwpItuXD
+            Sfao+MU1HWDY4iKZrcfWArUgpQj/pvsmUeJ72iXD3bkTTrK61g3GZA+g9lFewl/B
+            SORJMu9btS4GAw==
+            =aBMP
+            -----END PGP MESSAGE-----
+          fp: 28D140BCA60B4FD1
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

configurations/host/valkyrie/services/dcbot.nix

@@ -0,0 +1,38 @@
+{ config, pkgs, lib, materusArg, ... }:
+{
+  options.valkyrieService.dcbot.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable dcbot";
+
+
+
+
+  config =
+    let
+      cfg = config.valkyrieService.dcbot;
+    in
+    lib.mkIf cfg.enable {
+      sops.templates."dcbot.env".content = ''
+          TOKEN=${config.sops.placeholder.discord-token}
+          MAX_PLAYLIST_SIZE=100
+          PRUNING=false
+          LOCALE=pl
+          DEFAULT_VOLUME=100
+          STAY_TIME=30
+      '';
+
+      systemd.tmpfiles.rules = [
+        "d    /var/lib/muse  0776    root    root     -"
+      ];
+
+      virtualisation.oci-containers.containers.dcbot = {
+        image = "eritislami/evobot:latest";
+        volumes = [
+        ];
+        environmentFiles = [
+          config.sops.templates."dcbot.env".path
+        ];
+      };
+
+    };
+
+
+}

configurations/host/valkyrie/services/default.nix

@@ -0,0 +1,17 @@
+{ config, pkgs, ... }:
+{
+  imports =
+    [
+      ./pleroma.nix
+      ./pihole.nix
+      ./dcbot.nix
+      ./secureyoursoul.nix
+    ];
+  services.adguardhome.enable = true;
+
+  valkyrieService.pihole.enable = false;
+  valkyrieService.pleroma.enable = true;
+  valkyrieService.dcbot.enable = true;
+  valkyrieService.secureyoursoul.enable = true;
+
+}

configurations/host/valkyrie/services/pihole.nix

@@ -0,0 +1,56 @@
+{ config, pkgs, lib, materusArg, ... }:
+{
+  options.valkyrieService.pihole.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable pihole";
+  options.valkyrieService.pihole.dnsIP = lib.mkOption { default = "127.0.0.1"; };
+  options.valkyrieService.pihole.webIP = lib.mkOption { default = "127.0.0.1"; };
+
+
+
+  config =
+    let
+      cfg = config.valkyrieService.pihole;
+      dnsmasqConf = pkgs.writeText "02-dnsmasq-custom.conf" ''
+        no-hosts
+      '';
+
+    in
+    lib.mkIf config.valkyrieService.pihole.enable {
+      systemd.tmpfiles.rules = [
+        "d    /var/lib/dnsmasq.d   0776    root    root     -"
+        "d    /var/lib/pihole   0776    root    root     -"
+        "L+   /var/lib/dnsmasq.d/02-dnsmasq-custom.conf  0776 root root - ${dnsmasqConf}"
+      ];
+
+      virtualisation.oci-containers.containers.pihole = {
+        image = "pihole/pihole:latest";
+        ports =
+          [
+            "${cfg.dnsIP}:53:53/tcp"
+            "${cfg.dnsIP}:53:53/udp"
+            "${cfg.webIP}:3000:80"
+          ];
+        environment = {
+          TZ = "Europe/Warsaw";
+          FTLCONF_LOCAL_IPV4 = "127.0.0.1";
+          DNSMASQ_USER = "root";
+          VIRTUAL_HOST = "pi.hole";
+          PROXY_LOCATION = "pi.hole";
+        };
+        volumes = [
+          "/var/lib/pihole/:/etc/pihole/"
+          "/var/lib/dnsmasq.d:/etc/dnsmasq.d/"
+          "/nix/store:/nix/store"
+        ];
+        extraOptions =
+          [
+            "--cap-add=NET_ADMIN"
+            "--dns=127.0.0.1"
+            "--dns=9.9.9.9"
+            "--hostname=pi.hole"
+          ];
+      };
+
+    };
+
+
+}

configurations/host/valkyrie/services/pleroma.nix

@@ -0,0 +1,149 @@
+{ config, pkgs, lib, materusArg, ... }:
+let
+
+  socketPath = "/run/pleroma/http.sock";
+
+
+  socketChmod = with pkgs; with lib; pkgs.writers.writeBashBin "pleroma-socket"
+    ''
+      coproc {
+          ${inotify-tools}/bin/inotifywait -q -m -e create ${escapeShellArg (dirOf socketPath)}
+        }
+
+        trap 'kill "$COPROC_PID"' EXIT TERM
+
+        until ${pkgs.coreutils}/bin/test -S ${escapeShellArg socketPath}
+          do read -r -u "''${COPROC[0]}"
+        done
+
+      ${pkgs.coreutils}/bin/chmod 0666 ${socketPath}
+    '';
+
+  soapbox = pkgs.stdenv.mkDerivation rec {
+    pname = "soapbox";
+    version = "v3.2.0";
+    dontBuild = true;
+    dontConfigure = true;
+    src = pkgs.fetchurl {
+      name = "soapbox";
+      url = "https://gitlab.com/soapbox-pub/soapbox/-/jobs/artifacts/${version}/download?job=build-production";
+      sha256 = "sha256-AdW6JK7JkIKLZ8X+N9STeOHqmGNUdhcXyC9jsQPTa9o=";
+    };
+    nativeBuildInputs = [ pkgs.unzip ];
+    unpackPhase = ''
+      unzip $src -d .
+    '';
+    installPhase = ''
+      mv ./static $out
+    '';
+
+  };
+
+in
+{
+  options.valkyrieService.pleroma.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable pleroma";
+  config = lib.mkIf config.valkyrieService.pleroma.enable {
+    systemd.tmpfiles.rules = [
+      "d    /var/lib/pleroma   0766    pleroma    pleroma     -"
+      "d    /var/lib/pleroma/static   0766    pleroma    pleroma     -"
+      "d    /var/lib/pleroma/uploads   0766    pleroma    pleroma     -"
+      "L+   /var/lib/pleroma/static/frontends/soapbox/${soapbox.version}  0766 pleroma pleroma - ${soapbox}"
+    ];
+
+    services.nginx.virtualHosts."podkos.xyz" = {
+      http2 = true;
+      useACMEHost = "podkos.xyz";
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://unix:${socketPath}";
+        extraConfig = ''
+          etag on;
+          gzip on;
+
+          add_header 'Access-Control-Allow-Origin' '*' always;
+          add_header 'Access-Control-Allow-Methods' 'POST, PUT, DELETE, GET, PATCH, OPTIONS' always;
+          add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, Idempotency-Key' always;
+          add_header 'Access-Control-Expose-Headers' 'Link, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining, X-Request-Id' always;
+          if ($request_method = OPTIONS) {
+            return 204;
+          }
+
+          add_header X-XSS-Protection "1; mode=block";
+          add_header X-Permitted-Cross-Domain-Policies none;
+          add_header X-Frame-Options DENY;
+          add_header X-Content-Type-Options nosniff;
+          add_header Referrer-Policy same-origin;
+          add_header X-Download-Options noopen;
+          proxy_http_version 1.1;
+          proxy_set_header Upgrade $http_upgrade;
+          proxy_set_header Connection "upgrade";
+          proxy_set_header Host $host;
+
+          client_max_body_size 8m;
+      
+      
+        '';
+      };
+
+    };
+    systemd.services.pleroma.serviceConfig = {
+      RuntimeDirectory = "pleroma";
+      RuntimeDirectoryPreserve = true;
+
+
+      ExecStartPost = "${socketChmod}/bin/pleroma-socket";
+      ExecStopPost = ''${pkgs.coreutils}/bin/rm -f ${socketPath}'';
+    };
+
+
+
+
+    services.pleroma = {
+      enable = true;
+      secretConfigFile = "/var/lib/pleroma/secrets.exs";
+      configs = [
+        ''
+          import Config
+
+          config :pleroma, Pleroma.Web.Endpoint,
+            url: [host: "podkos.xyz", scheme: "https", port: 443],
+            http: [ip: {:local, "${socketPath}"}, port: 0]
+
+          config :pleroma, :instance,
+            name: "Podziemia Kosmosu",
+            email: "admin@podkos.xyz",
+            notify_email: "noreply@podkos.xyz",
+            limit: 5000,
+            registrations_open: false
+
+          config :pleroma, :media_proxy,
+            enabled: false,
+            redirect_on_failure: true
+
+          config :pleroma, Pleroma.Repo,
+            adapter: Ecto.Adapters.Postgres,
+            socket: "/run/postgresql/.s.PGSQL.5432",
+            username: "pleroma",
+            database: "pleroma"
+          
+
+          # Configure web push notifications
+          config :web_push_encryption, :vapid_details,
+            subject: "mailto:admin@podkos.x yz"
+          config :pleroma, :frontends,
+            primary: %{
+              "name" => "soapbox",
+              "ref" => "${soapbox.version}"
+            }
+
+          config :pleroma, :database, rum_enabled: false
+          config :pleroma, :instance, static_dir: "/var/lib/pleroma/static"
+          config :pleroma, Pleroma.Uploaders.Local, uploads: "/var/lib/pleroma/uploads"
+
+          config :pleroma, configurable_from_database: true  
+          config :pleroma, Pleroma.Upload, filters: [Pleroma.Upload.Filter.AnonymizeFilename]
+        ''
+      ];
+    };
+  };
+}

configurations/host/valkyrie/services/secureyoursoul.nix

@@ -0,0 +1,141 @@
+{ config, pkgs, lib, materusArg, ... }:
+{
+  options.valkyrieService.secureyoursoul.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable secureyoursoul, web archive";
+
+
+
+
+  config =
+    let
+      cfg = config.valkyrieService.secureyoursoul;
+    in
+    lib.mkIf cfg.enable {
+      systemd.timers.secureyoursoul-steam = {
+        wantedBy = [ "timers.target" ];
+        timerConfig = {
+          OnCalendar = "*-*-1,7,14,21 3:00:00";
+          Persistent = true; 
+          Unit = "secureyoursoul-steam.service";
+        };
+      };
+      systemd.timers.secureyoursoul-p1 = {
+        wantedBy = [ "timers.target" ];
+        timerConfig = {
+          OnCalendar = "*-*-3,9,16,23 3:00:00";
+          Persistent = true; 
+          Unit = "secureyoursoul-p1.service";
+        };
+      };
+      systemd.timers.secureyoursoul-p2 = {
+        wantedBy = [ "timers.target" ];
+        timerConfig = {
+          OnCalendar = "*-*-5,11,18,25 3:00:00";
+          Persistent = true; 
+          Unit = "secureyoursoul-p2.service";
+        };
+      };
+
+      systemd.services.secureyoursoul-steam = {
+        description = "Make curl requests to archive steam related things";
+        path = [ pkgs.coreutils pkgs.util-linux pkgs.curl ];
+        serviceConfig.Type = "oneshot";
+        serviceConfig.RemainAfterExit = false;
+        script = ''
+          STEAM_IDS=( ${ builtins.foldl' (x: y:  x +"\""+ y + "\" ") "" materusArg.to_save.steamids })
+          EXTRA_LINKS=( ${ builtins.foldl' (x: y:  x +"\""+ y + "\" ") "" materusArg.to_save.extraLinks-steam  })
+
+          steamladder() {
+                  for id in ''${STEAM_IDS[@]}; do
+                          curl -X POST -H "Authorization: Token ''$(cat ${config.sops.secrets.steamladder-api.path})" \
+                          "https://steamladder.com/api/v1/profile/$id/"
+                  done;
+          }
+
+          webarchive(){
+          for id in ''${STEAM_IDS[@]}; do
+                  curl -X POST -H "Accept: application/json" \
+                          -H "Authorization: LOW ''$(cat ${config.sops.secrets.webarchive-accesskey.path}):''$(cat ${config.sops.secrets.webarchive-secretkey.path})" \
+                          -d"url=https://steamcommunity.com/profiles/$id" \
+                          -d"capture_outlinks=1" \
+                          -d"capture_screenshot=on" \
+                          -d"capture_all=on" \
+                          "https://web.archive.org/save";
+                  sleep 180;
+          done;
+
+
+          for link in ''${EXTRA_LINKS[@]}; do
+                  curl -X POST -H "Accept: application/json" \
+                          -H "Authorization: LOW ''$(cat ${config.sops.secrets.webarchive-accesskey.path}):''$(cat ${config.sops.secrets.webarchive-secretkey.path})" \
+                          -d"url=$link" \
+                          -d"capture_outlinks=1" \
+                          -d"capture_screenshot=on" \
+                          -d"capture_all=on" \
+                          "https://web.archive.org/save";
+                  sleep 180;
+          done;
+
+          }
+
+
+
+          steamladder &
+          webarchive
+          wait
+        '';
+      };
+
+
+       systemd.services.secureyoursoul-p1 = {
+        description = "Make curl requests to archive related things";
+        path = [ pkgs.coreutils pkgs.util-linux pkgs.curl ];
+        serviceConfig.Type = "oneshot";
+        serviceConfig.RemainAfterExit = false;
+        script = ''
+          EXTRA_LINKS=( ${ builtins.foldl' (x: y:  x +"\""+ y + "\" ") "" materusArg.to_save.extraLinks1  })
+          webarchive(){
+          for link in ''${EXTRA_LINKS[@]}; do
+                  curl -X POST -H "Accept: application/json" \
+                          -H "Authorization: LOW ''$(cat ${config.sops.secrets.webarchive-accesskey.path}):''$(cat ${config.sops.secrets.webarchive-secretkey.path})" \
+                          -d"url=$link" \
+                          -d"capture_outlinks=1" \
+                          -d"capture_screenshot=on" \
+                          -d"capture_all=on" \
+                          "https://web.archive.org/save";
+                  sleep 180;
+          done;
+
+          }
+          webarchive
+        '';
+      };
+
+      systemd.services.secureyoursoul-p2 = {
+        description = "Make curl requests to archive related things - part 2";
+        path = [ pkgs.coreutils pkgs.util-linux pkgs.curl ];
+        serviceConfig.Type = "oneshot";
+        serviceConfig.RemainAfterExit = false;
+        script = ''
+          EXTRA_LINKS=( ${ builtins.foldl' (x: y:  x +"\""+ y + "\" ") "" materusArg.to_save.extraLinks2  })
+          webarchive(){
+          for link in ''${EXTRA_LINKS[@]}; do
+                  curl -X POST -H "Accept: application/json" \
+                          -H "Authorization: LOW ''$(cat ${config.sops.secrets.webarchive-accesskey.path}):''$(cat ${config.sops.secrets.webarchive-secretkey.path})" \
+                          -d"url=$link" \
+                          -d"capture_outlinks=1" \
+                          -d"capture_screenshot=on" \
+                          -d"capture_all=on" \
+                          "https://web.archive.org/save";
+                  sleep 180;
+          done;
+
+          }
+          webarchive
+        '';
+      };
+
+
+    };
+
+
+}

configurations/host/waffentrager/configuration.nix

@@ -0,0 +1,155 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running `nixos-help`).
+
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+    ];
+
+  materus.profile.nixpkgs.enable = true;
+  environment.systemPackages = with pkgs; [
+    libraspberrypi
+    raspberrypi-eeprom
+    git
+
+    p7zip
+    unrar
+    bzip2
+    unzip
+    zstd
+    xz
+    zip
+    gzip
+
+  ];
+  sound.enable = false;
+  boot.tmp.useTmpfs = true;
+  services.xserver.enable = false;
+  networking.hostName = "waffentrager";
+
+  services.openssh.enable = true;
+  services.openssh.settings.PermitRootLogin = "no";
+
+  users.users.materus = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPEDY+H8Hc/RSLE064AAh8IojvqxPd8BE5gec2aOfYMh materus@podkos.pl"
+    ];
+    hashedPasswordFile = config.sops.secrets."users/materus".path;
+    shell = pkgs.zsh;
+  };
+
+  nix = {
+    settings = {
+      auto-optimise-store = true;
+      experimental-features = [ "nix-command" "flakes" "repl-flake" "no-url-literals" ];
+      trusted-users = [ "root" "@wheel" ];
+      substituters = [
+        "https://nix-community.cachix.org"
+        "https://cache.nixos.org/"
+        "https://nixerus.cachix.org/"
+      ];
+      trusted-public-keys = [ "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" "nixerus.cachix.org-1:2x7sIG7y1vAoxc8BNRJwsfapZsiX4hIl4aTi9V5ZDdE=" ];
+    };
+  };
+  # Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
+  boot.loader.grub.enable = false;
+  # Enables the generation of /boot/extlinux/extlinux.conf
+  boot.loader.generic-extlinux-compatible.enable = true;
+  # networking.hostName = "nixos"; # Define your hostname.
+  # Pick only one of the below networking options.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+  # networking.networkmanager.enable = true;  # Easiest to use and most distros use this by default.
+
+  # Set your time zone.
+  # time.timeZone = "Europe/Amsterdam";
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Select internationalisation properties.
+  # i18n.defaultLocale = "en_US.UTF-8";
+  # console = {
+  #   font = "Lat2-Terminus16";
+  #   keyMap = "us";
+  #   useXkbConfig = true; # use xkbOptions in tty.
+  # };
+
+  # Enable the X11 windowing system.
+  # services.xserver.enable = true;
+
+
+
+
+  # Configure keymap in X11
+  # services.xserver.layout = "us";
+  # services.xserver.xkbOptions = "eurosign:e,caps:escape";
+
+  # Enable CUPS to print documents.
+  # services.printing.enable = true;
+
+  # Enable sound.
+  # sound.enable = true;
+  # hardware.pulseaudio.enable = true;
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  # services.xserver.libinput.enable = true;
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  # users.users.alice = {
+  #   isNormalUser = true;
+  #   extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+  #   packages = with pkgs; [
+  #     firefox
+  #     tree
+  #   ];
+  # };
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  # environment.systemPackages = with pkgs; [
+  #   vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+  #   wget
+  # ];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  # services.openssh.enable = true;
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It's perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.11"; # Did you read the comment?
+
+}
+

configurations/host/waffentrager/default.nix

@@ -0,0 +1,10 @@
+{ config, pkgs, materusCfg, ... }:
+{
+
+  imports = [
+    materusCfg.configInputs.nixos-hardware.nixosModules.raspberry-pi-4
+    ./configuration.nix
+    ./secrets
+    ./services
+  ];
+}

configurations/host/waffentrager/hardware-configuration.nix

@@ -0,0 +1,46 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [
+      (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+  boot.kernelPackages = pkgs.linuxPackages_rpi4;
+  boot.initrd.availableKernelModules = [ "xhci_pci" "usb_storage" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+  boot.kernel.sysctl = {
+    "vm.swappiness" = 10;
+  };
+  fileSystems."/" =
+    {
+      device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888";
+      fsType = "ext4";
+    };
+  fileSystems."/etc/nixos" =
+    {
+      device = "/materus/config/nixos-config";
+      fsType = "none";
+      options = [ "bind" ];
+    };
+
+  swapDevices = [{
+    device = "/var/.swapfile";
+    size = 8 * 1024;
+  }];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.end0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlan0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = "aarch64-linux";
+  powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand";
+}

configurations/host/waffentrager/home/materus/default.nix

@@ -0,0 +1,17 @@
+{ config, pkgs, lib, ... }:
+{
+  home.stateVersion = "23.11";
+  home.homeDirectory = "/home/materus";
+  materus.profile = {
+    fonts.enable = false;
+    nixpkgs.enable = false;
+    enableDesktop = false;
+    enableTerminal = false;
+    enableTerminalExtra = false;
+    enableNixDevel = false;
+
+    fish.enable = false;
+    bash.enable = true;
+    zsh.enable = true;
+  };
+}

configurations/host/waffentrager/secrets/default.nix

@@ -0,0 +1,28 @@
+{ materusCfg, ... }:
+{
+  imports =
+    [
+
+    ] ++ (if (materusCfg.materusFlake.decrypted) then [ ./private ] else [ ]);
+
+  sops.age.generateKey = false;
+  sops.gnupg.home = null;
+  sops.gnupg.sshKeyPaths = [ ];
+  sops.defaultSopsFile = materusCfg.hostPath + "/secrets/secrets.yaml";
+
+  services.openssh.hostKeys = [
+    {
+      bits = 4096;
+      path = "/materus/root/ssh_host_rsa_key";
+      type = "rsa";
+    }
+    {
+      path = "/materus/root/ssh_host_ed25519_key";
+      type = "ed25519";
+    }
+  ];
+  sops.secrets.wireguard = { };
+  sops.secrets."users/materus" = { neededForUsers = true; };
+  sops.secrets.elements = { };
+  sops.secrets.nextcloud-adminpass = { };
+}

configurations/host/waffentrager/secrets/secrets.yaml

@@ -0,0 +1,37 @@
+wireguard: ENC[AES256_GCM,data:QLngCAtEa6wfRRrZwywbARhsS1oGj9+hGTlC1QV6xnRmlZLorAoftGb8jTg=,iv:rNbE0tfJKTjo0pPwfw3oKxOZmSO9PGgW/xDo9zi8lCU=,tag:ZT4mfXaToiR6SjzOwSz4HA==,type:str]
+nextcloud-adminpass: ENC[AES256_GCM,data:5vohRPEcJJ8gIRro38O73ufSYYEp1DXpBgjCPdPnMcg=,iv:STh3k5wUwx3AfSDTPCXhuXbPb3d+Vi1cAaQN2a9eW1w=,tag:Ef/Z2Idvl6575Jvs2GDJ8A==,type:str]
+elements: ENC[AES256_GCM,data:Kh6ueReXpj9h5yQ3P0qY8X1ow4RRZD9zyXZLS6DUIIVuthgqgu9dPzBc7ojnz6nXoYTHt1I2LJJKLOGQYZC+iVxXOk+QADJMPwY4NCyeZ3prgvYMghlD,iv:WFA/UQ0XDFjpbgaDEacrBxkteLitXv3CJP54ANVSJHM=,tag:M+tTpTR0alvQxvUiP2MWlA==,type:str]
+users:
+    materus: ENC[AES256_GCM,data:MhPrMJ4/0oxEsFZDUKcYb3WMUWLI2ZbRTgnh1fQZG1Ly2J781jcUWtA8vVAdMBedNfWky0mDq5+KEQ/2fJNGU4IkTBvLdAqnWw==,iv:Dpl+M+x1weNIVkEsf3I/uXpG0SM6bDz+d9w7AYwn/MY=,tag:yGc1D2ODp6Te/QAztOj7yA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1j34lqh0z6ak2c94n564wgyjeykn9srma34f5e5e7xvf498fwk3rqxvwx0l
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvejRrcGVwZHNkTVB5dkYr
+            RnhVVjNEblFVd0xXSStqdjFhWVVNS3ljUTNZCnBFVmRRVVVENGhJUVg2L1lSM1NO
+            dkQydVhOaFVxd0p0aFhVcmp6eXdGeVEKLS0tIFIvRDlvZDdsbm1USEZUZ3FYMmla
+            eFN4VVdUMkVjcTVWNFdLM0xtbExLdncK6LYUufWzIcd2jFyEeZDypo0xkJQ4z91F
+            ULyGxJLLWl6/inYXtxHNdxIIPfwW+5yppBAbXaOgvABi1E7tf1JZcA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-04-12T11:21:33Z"
+    mac: ENC[AES256_GCM,data:TbWjHvrJAB55AjFsbOK/IPb7v4wzqL2JGLvnNTr+ah/c2brdlq6DWeAF2+HA3FpLRt2a0MajwMTCsconoe8hW6Am/WO0FJBoYlneLAl/RlAv7BYfyorTD/Vyp9am7ml5T3f2pdYdsw1k/5RSn1ulUg43vSgi5es5Co8CtzC5hPE=,iv:+V48Azrr9yArwqNi3POYh7QaRMfUreCf7Bmv7kjV9qo=,tag:HDcMMCnyfVQRHTQJZB0R3Q==,type:str]
+    pgp:
+        - created_at: "2024-03-21T18:15:00Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4D5fSX77p80GYSAQdAWetrf0jhs/b9qcQc4b21+PJUPdSjk372BjokfwJ2oXQw
+            4LaIaNB3LRmY4FF3UOqk28NwkwBw6n0AzYKC/k1G4ntaNBMI9eDtFJ1c1+KkxSl2
+            1GYBCQIQMCKcu2aBEMiIGOyG08vcRW2T23DUAfTQqQdRKD/SgSTqAZLSICVJ91xU
+            TBsdiPBKO2cRDfPc7DlVLbPNe/SUqVUX9N4GTGPUocXc1s6lvgx3NBP5cGoSNx+A
+            xCmXl373IDc=
+            =uSyc
+            -----END PGP MESSAGE-----
+          fp: 28D140BCA60B4FD1
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

configurations/host/waffentrager/services/auth/default.nix

@@ -0,0 +1,63 @@
+{ config, materusArg, lib, pkgs, ... }:
+let
+  cfg = config.waffentragerService.auth;
+in
+{
+  options.waffentragerService.auth.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable auth";
+  imports =
+    [
+      ./samba.nix
+    ];
+  config = lib.mkIf cfg.enable
+    {
+      waffentragerService.elements.enable = true;
+      waffentragerService.nginx.enable = true;
+
+
+      security.acme.defaults.credentialsFile = config.sops.secrets.certs.path;
+
+      systemd.services.resolvconf.enable = false;
+      networking.hosts = {
+        "${materusArg.ips.wireguard.waffentrager}" = [
+          materusArg.waffentrager.samba.domain
+          "${materusArg.waffentrager.samba.netbiosName}.${materusArg.waffentrager.samba.domain}"
+          materusArg.waffentrager.samba.netbiosName
+        ];
+      };
+      environment.etc = {
+        resolvconf = {
+          text = ''
+            search ${materusArg.waffentrager.samba.domain}
+            nameserver ${materusArg.waffentrager.samba.dnsIp}
+            nameserver 9.9.9.9
+          '';
+        };
+      };
+
+      systemd.timers.rsync-acme = {
+        wantedBy = [ "timers.target" ];
+        timerConfig = {
+          OnBootSec = "1min";
+          OnUnitActiveSec = "1h";
+          Unit = "rsync-acme.service";
+        };
+      };
+
+      systemd.services.rsync-acme = {
+        description = "Sync acme for samba";
+        path = [ pkgs.rsync ];
+        requires = [ "var-lib-mnt_acme.mount" ];
+        after = [ "var-lib-mnt_acme.mount" ];
+        serviceConfig.Type = "oneshot";
+        serviceConfig.RemainAfterExit = false;
+        script = ''
+          rsync -avzr --chmod=0600 --chown=root:root /var/lib/mnt_acme/${materusArg.waffentrager.samba.domain}/key.pem ${materusArg.waffentrager.samba.servicePath}/tls/
+          rsync -avzr --chmod=0640 --chown=root:root /var/lib/mnt_acme/${materusArg.waffentrager.samba.domain}/chain.pem ${materusArg.waffentrager.samba.servicePath}/tls/
+          rsync -avzr --chmod=0640 --chown=root:root /var/lib/mnt_acme/${materusArg.waffentrager.samba.domain}/fullchain.pem ${materusArg.waffentrager.samba.servicePath}/tls/
+        '';
+      };
+
+
+
+    };
+}

configurations/host/waffentrager/services/auth/samba.nix

@@ -0,0 +1,91 @@
+{ materusArg, config, lib, pkgs, ... }:
+{
+  
+
+  config =
+    let
+      cfg = config.waffentragerService.auth;
+      sambaCfg = config.services.samba;
+      servicePath = materusArg.waffentrager.samba.servicePath;
+      smbToString = x:
+        if builtins.typeOf x == "bool"
+        then lib.boolToString x
+        else builtins.toString x;
+      shareConfig = name:
+        let share = lib.getAttr name cfg.shares; in
+        "[${name}]\n " + (smbToString (
+          map
+            (key: "${key} = ${smbToString (lib.getAttr key share)}\n")
+            (lib.attrNames share)
+        ));
+    in
+    lib.mkIf cfg.enable {
+      
+      systemd.services.samba-smbd.enable = false;
+      systemd.services.samba = {
+        description = "Samba Service Daemon";
+        requires = [ "rsync-acme.service" ];
+        after = [ "rsync-acme.service" ];
+        requiredBy = [ "samba.target" ];
+        partOf = [ "samba.target" ];
+
+        serviceConfig = {
+          ExecStart = "${pkgs.samba4Full}/sbin/samba --foreground --no-process-group";
+          ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+          LimitNOFILE = 16384;
+          PIDFile = "/run/samba.pid";
+          Type = "notify";
+          NotifyAccess = "all";
+        };
+        unitConfig.RequiresMountsFor = servicePath;
+      };
+      # https://wiki.samba.org/index.php/Samba_AD_DC_Port_Usage
+      networking.firewall.allowedTCPPorts = [ 139 445 389 88 53 464 636 3268];
+      networking.firewall.allowedUDPPorts = [ 135 137 138 389 88 53 123 464];
+      systemd.tmpfiles.rules = [
+        "d    ${servicePath}/tls/  0600    root    3000000     -"
+        "d    ${servicePath}/private/  0600    root    3000000     -"
+        "d    ${servicePath}/lock/  0600    root    3000000     -"
+        "d    ${servicePath}/cache/  0600    root    3000000     -"
+      ];
+      services.samba = {
+        enable = true;
+        enableNmbd = false;
+        enableWinbindd = false;
+        package = pkgs.samba4Full;
+        configText = ''
+          # Global parameters
+          [global]
+              dns forwarder = ${materusArg.waffentrager.samba.dnsIp}
+              netbios name = ${materusArg.waffentrager.samba.netbiosName}
+              realm = ${lib.toUpper materusArg.waffentrager.samba.domain}
+              server role = active directory domain controller
+              workgroup = ${materusArg.waffentrager.samba.workgroup}
+              idmap_ldb:use rfc2307 = yes
+              ldap server require strong auth = yes
+              private dir = ${servicePath}/private
+              lock dir = ${servicePath}/lock
+              state directory = ${servicePath}/lock
+              cache directory = ${servicePath}/cache
+              tls enabled  = yes
+              tls keyfile  = ${servicePath}/tls/key.pem
+              tls certfile = ${servicePath}/tls/fullchain.pem
+              tls cafile   = ${servicePath}/tls/chain.pem
+
+          [sysvol]
+              path = ${servicePath}/sysvol
+              read only = No
+
+          [netlogon]
+              path = ${servicePath}/sysvol/${materusArg.waffentrager.samba.domain}/scripts
+              read only = No
+
+
+            ${sambaCfg.extraConfig}
+
+            ${smbToString (map shareConfig (lib.attrNames sambaCfg.shares))}
+        '';
+      };
+    };
+
+}

configurations/host/waffentrager/services/default.nix

@@ -0,0 +1,20 @@
+{ ... }:
+{
+  imports =
+    [
+      ./elements.nix
+      ./postgresql.nix
+      ./mount-acme.nix
+      ./gitea.nix
+      ./nginx.nix
+      ./nextcloud.nix
+      ./auth
+    ];
+  waffentragerService.elements.enable = true;
+  waffentragerService.postgresql.enable = true;
+  waffentragerService.mount-acme.enable = true;
+  waffentragerService.gitea.enable = true;
+  waffentragerService.nginx.enable = true;
+  waffentragerService.nextcloud.enable = true;
+  waffentragerService.auth.enable = true;
+}

configurations/host/waffentrager/services/elements.nix

@@ -0,0 +1,40 @@
+{ materusArg, config, lib, pkgs, ... }:
+{
+  options.waffentragerService.elements.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable elements drive";
+  options.waffentragerService.elements.path = lib.mkOption { default = "/var/lib/elements"; };
+  options.waffentragerService.elements.uuid = lib.mkOption { default = "e32039c6-e98d-44b0-8e7d-120994bf7be1"; };
+  options.waffentragerService.elements.postgresqlDir = lib.mkOption { default = "${config.waffentragerService.elements.path}/services/postgresql"; };
+  options.waffentragerService.elements.nextcloudDir = lib.mkOption { default = "${config.waffentragerService.elements.path}/services/nextcloud"; };
+  config =
+    let
+      cfg = config.waffentragerService.elements;
+    in
+    lib.mkIf cfg.enable {
+
+      systemd.services.elements-mount = {
+        description = "Decrypt and mount elements drive";
+        wantedBy = [ "multi-user.target" ];
+        path = [ pkgs.cryptsetup pkgs.coreutils pkgs.util-linux ];
+        serviceConfig.Type = "oneshot";
+        serviceConfig.RemainAfterExit = true;
+        script = ''
+          mkdir -p ${cfg.path}
+          cryptsetup luksOpen /dev/disk/by-uuid/${cfg.uuid} elements -d ${config.sops.secrets.elements.path}
+          mount /dev/mapper/elements ${cfg.path}
+        '' + lib.optionalString config.waffentragerService.postgresql.enable ''
+          mkdir -p ${cfg.postgresqlDir}/${config.waffentragerService.postgresql.version}
+          chown -R postgres:postgres ${cfg.postgresqlDir}
+        '' + lib.optionalString config.waffentragerService.nextcloud.enable ''
+          mkdir -p ${cfg.nextcloudDir}
+          chown -R nextcloud:nextcloud ${cfg.nextcloudDir}
+        ''
+
+        ;
+        preStop = ''
+          umount ${cfg.path}
+          cryptsetup luksClose elements
+        '';
+      };
+
+    };
+}

configurations/host/waffentrager/services/gitea.nix

@@ -0,0 +1,62 @@
+{ materusArg, config, lib, ... }:
+{
+  options.waffentragerService.gitea.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable gitea";
+
+
+  config =
+    let
+      cfg = config.waffentragerService.gitea;
+    in
+    lib.mkMerge
+      [
+        (lib.mkIf cfg.enable {
+          waffentragerService.postgresql.enable = true;
+          waffentragerService.elements.enable = true;
+
+          services.gitea.enable = true;
+          services.gitea.lfs.enable = true;
+          services.gitea.stateDir = "${config.waffentragerService.elements.path}/services/gitea";
+          services.gitea.settings.service.DISABLE_REGISTRATION = true;
+          services.gitea.settings.server.DOMAIN = "baka.materus.pl";
+          services.gitea.settings.server.ROOT_URL = lib.mkForce "https://baka.materus.pl/";
+          services.gitea.settings.server.PROTOCOL = "fcgi+unix";
+          services.gitea.settings.cors = {
+            ENABLED = true;
+            X_FRAME_OPTIONS = "ALLOW-FROM https://*.materus.pl/";
+          };
+
+          services.gitea.database.type = "postgres";
+          services.gitea.database.socket = "/var/run/postgresql/";
+
+        })
+        (lib.mkIf (cfg.enable && config.waffentragerService.nginx.enable) {
+
+          services.nginx.virtualHosts = {
+            "baka.materus.pl" = {
+              sslTrustedCertificate = "/var/lib/mnt_acme/materus.pl/chain.pem";
+              sslCertificateKey = "/var/lib/mnt_acme/materus.pl/key.pem";
+              sslCertificate = "/var/lib/mnt_acme/materus.pl/fullchain.pem";
+              addSSL = true;
+              http2 = false;
+              locations."/" = {
+                extraConfig = ''
+                  client_max_body_size 2G;
+                  include ${config.services.nginx.package}/conf/fastcgi.conf;
+                  include ${config.services.nginx.package}/conf/fastcgi_params;
+                  proxy_http_version 1.1;
+                  proxy_set_header    Host                $host;
+                  proxy_set_header    X-Real-IP           $remote_addr;
+                  proxy_set_header    X-Forwarded-Ssl     on;
+                  proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
+                  proxy_set_header    X-Forwarded-Proto   $scheme;
+
+                  fastcgi_pass  unix:/var/run/gitea/gitea.sock;
+                '';
+              };
+
+            };
+          };
+        }
+        )
+      ];
+}

configurations/host/waffentrager/services/mount-acme.nix

@@ -0,0 +1,20 @@
+{ materusArg, config, lib, pkgs, ... }:
+{
+  options.waffentragerService.mount-acme.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable mount-acme";
+
+  config =
+    let
+      cfg = config.waffentragerService.mount-acme;
+    in
+    lib.mkIf cfg.enable {
+      environment.systemPackages = with pkgs; [ sshfs ];
+      systemd.mounts = [{
+        description = "Mount remote acme dir from valkyrie";
+        what = "acme@valkyrie:/var/lib/acme";
+        where = "/var/lib/mnt_acme";
+        type = "fuse.sshfs";
+        options = "reconnect,gid=${builtins.toString config.ids.gids.nginx},_netdev,rw,nosuid,allow_other,default_permissions,follow_symlinks,idmap=user,compression=yes,identityfile=/materus/root/ssh_host_ed25519_key";
+        wantedBy = [ "multi-user.target" ];
+      }];
+    };
+}

configurations/host/waffentrager/services/nextcloud.nix

@@ -0,0 +1,95 @@
+{ materusArg, config, lib, pkgs, ... }:
+{
+  options.waffentragerService.nextcloud.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable nextcloud";
+
+  config =
+    let
+      cfg = config.waffentragerService.nextcloud;
+    in
+    lib.mkIf cfg.enable {
+      waffentragerService.elements.enable = true;
+      waffentragerService.postgresql.enable = true;
+      waffentragerService.nginx.enable = true;
+      environment.systemPackages = [ pkgs.samba pkgs.exiftool pkgs.ffmpeg-headless ];
+      sops.secrets.nextcloud-adminpass.owner = config.users.users.nextcloud.name;
+      sops.secrets.nextcloud-adminpass.group = config.users.users.nextcloud.group;
+
+      services.postgresql.ensureDatabases = [ "nextcloud" ];
+      services.postgresql.ensureUsers = [{
+        name = "nextcloud";
+        ensureDBOwnership = true;
+      }];
+      services.nextcloud = {
+        enable = true;
+        notify_push.enable = true;
+        package = pkgs.nextcloud28;
+        hostName = "waffentrager.materus.pl";
+        home = config.waffentragerService.elements.nextcloudDir;
+        config.adminuser = "master";
+        config.adminpassFile = config.sops.secrets.nextcloud-adminpass.path;
+        config.dbtype = "pgsql";
+        config.defaultPhoneRegion = "PL";
+        config.trustedProxies = [ materusArg.ips.valkyrie materusArg.ips.wireguard.valkyrie materusArg.ips.wireguard.waffentrager ];
+        extraAppsEnable = true;
+        maxUploadSize = "4G";
+        https = true;
+        enableImagemagick = true;
+        configureRedis = true;
+        webfinger = true;
+        appstoreEnable = true;
+        database.createLocally = true;
+        nginx.recommendedHttpHeaders = true;
+        extraApps = with pkgs.nextcloud28Packages.apps; {
+          inherit notify_push previewgenerator;
+        };
+        extraOptions = {
+          mail_smtpmode = "sendmail";
+          mail_sendmailmode = "pipe";
+          enable_previews = true;
+          preview_format = "webp";
+          enabledPreviewProviders = [
+            ''OC\Preview\Movie''
+            ''OC\Preview\PNG''
+            ''OC\Preview\JPEG''
+            ''OC\Preview\GIF''
+            ''OC\Preview\BMP''
+            ''OC\Preview\XBitmap''
+            ''OC\Preview\MP3''
+            ''OC\Preview\MP4''
+            ''OC\Preview\TXT''
+            ''OC\Preview\MarkDown''
+            ''OC\Preview\PDF''
+            ''OC\Preview\WebP''
+            ''OC\Preview\OpenDocument''
+            ''OC\Preview\Krita''
+            ''OC\Preview\AVIF''
+          ];
+          "overwrite.cli.url" = "https://${config.services.nextcloud.hostName}";
+        };
+        globalProfiles = true;
+
+        phpOptions = {
+          "opcache.memory_consumption" = "512";
+          "opcache.interned_strings_buffer" = "64";
+          "opcache.max_accelerated_files"="50000";
+          "opcache.jit" = "1255";
+          "opcache.jit_buffer_size" = "128M";
+          "opcache.validate_timestamps" = "0";
+          "opcache.revalidate_freq" = "0";
+          "opcache.fast_shutdown" = "1";
+          "opcache.save_comments" = "1";
+        };
+        phpExtraExtensions = ex: [ ex.zip ex.zlib ex.tidy ex.smbclient ];
+      };
+      services.nginx.virtualHosts.${config.services.nextcloud.hostName} = {
+        forceSSL = true;
+        http3 = true;
+        sslTrustedCertificate = "/var/lib/mnt_acme/materus.pl/chain.pem";
+        sslCertificateKey = "/var/lib/mnt_acme/materus.pl/key.pem";
+        sslCertificate = "/var/lib/mnt_acme/materus.pl/fullchain.pem";
+        extraConfig = ''
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        '';
+      };
+    };
+}

configurations/host/waffentrager/services/nginx.nix

@@ -0,0 +1,29 @@
+{ materusArg, config, lib, ... }:
+{
+  options.waffentragerService.nginx.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable nginx";
+
+
+  config =
+    let
+      cfg = config.waffentragerService.nginx;
+    in
+    lib.mkIf cfg.enable {
+      networking.firewall.allowedTCPPorts = [ 80 443 ];
+      services.nginx = {
+        enable = true;
+        recommendedTlsSettings = true;
+        recommendedOptimisation = true;
+        recommendedGzipSettings = true;
+      };
+
+      systemd.services.nginx = {
+        requires = [ "var-lib-mnt_acme.mount" ];
+        after = [ "var-lib-mnt_acme.mount" ];
+        serviceConfig = {
+          restart = "always";
+          restartSec = 60;
+        };
+      };
+    };
+
+}

configurations/host/waffentrager/services/postgresql.nix

@@ -0,0 +1,27 @@
+{ materusArg, config, lib, pkgs, ... }:
+{
+  options.waffentragerService.postgresql.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable postgresql";
+  options.waffentragerService.postgresql.version = lib.mkOption { default = "16"; };
+
+  config =
+    let
+      cfg = config.waffentragerService.postgresql;
+    in
+    lib.mkIf cfg.enable {
+      waffentragerService.elements.enable = true;
+
+      services.postgresql.enable = true;
+      services.postgresql.package = pkgs."postgresql_${cfg.version}";
+      services.postgresql.dataDir = "${config.waffentragerService.elements.postgresqlDir}/${cfg.version}";
+      services.postgresql.enableJIT = true;
+      services.postgresql.authentication = pkgs.lib.mkOverride 10 ''
+        local all all trust
+        host all all 127.0.0.1/32 scram-sha-256
+      '';
+      systemd.services.postgresql = {
+        partOf = [ "elements-mount.service" ];
+        requires = [ "elements-mount.service" ];
+        after = [ "elements-mount.service" ];
+      };
+    };
+}

configurations/profile/common/default.nix

@@ -1,9 +1,26 @@
-{ config, pkgs, lib, materusFlake, inputs, ... }:
+{ config, pkgs, lib, materusCfg, ... }:
+let
+  materusArg = {
+    pkgs = (import materusCfg.nixerus { inherit pkgs; }) //
+      (if pkgs.system == "x86_64-linux" then { i686Linux = import materusCfg.nixerus { pkgs = pkgs.pkgsi686Linux; }; } else { });
+    cfg = materusCfg;
+  };
+in
 {
   imports = [
     ./nixpkgs.nix
     ./packages
+    ./private
   ];
-  config._module.args.materusPkgs = (import inputs.configInputs.inputs.nixerus { inherit pkgs; }) //
+  options.materus.materusArg = lib.mkOption { default = { }; };
-  (if pkgs.system == "x86_64-linux" then { i686Linux = import inputs.configInputs.inputs.nixerus { pkgs = pkgs.pkgsi686Linux; }; } else { });
+  config._module.args.materusArg = config.materus.materusArg // materusArg;
+  config.assertions = [
+    {
+      assertion = materusCfg.materusFlake.decrypted;
+      message = "Repository not decrypted, use crypt.sh to decrypt";
+    }
+  ];
+
+
+
 }

configurations/profile/common/nixpkgs.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, inputs, lib,... }:
+{ config, pkgs, lib, materusArg, materusCfg, ... }:
 let
   mkBoolOpt = default: description: lib.mkOption {
     inherit default;
@@ -12,11 +12,80 @@ in
 {
   options.materus.profile.nixpkgs.enable = mkBoolOpt false "Enable materus nixpkgs config";
   options.materus.profile.nixpkgs.enableOverlays = mkBoolOpt (cfg.enable) "Enable materus overlays";
+  options.materus.profile.nix.enableRegistry = mkBoolOpt (!materusCfg.isHm) "Enable materus nix registry";
 
-  config.nixpkgs.config = lib.mkIf cfg.enable{
+  config.nixpkgs.config = lib.mkIf cfg.enable {
     allowUnfree = lib.mkDefault true;
     joypixels.acceptLicense = lib.mkDefault true;
-    firefox.enablePlasmaBrowserIntegration = true;
   };
-  config.nixpkgs.overlays = lib.mkIf cfg.enableOverlays [inputs.configInputs.inputs.emacs-overlay.overlay];
+  config.nixpkgs.overlays = lib.mkIf cfg.enableOverlays [ materusArg.cfg.configInputs.emacs-overlay.overlay ];
+
+  config.nix.package = lib.mkDefault pkgs.nixUnstable;
+  config.nix.registry = lib.mkIf config.materus.profile.nix.enableRegistry {
+    nixpkgs-stable = {
+      from = { type = "indirect"; id = "nixpkgs-stable"; };
+      flake = materusCfg.materusFlake.inputs.nixpkgs-stable;
+    };
+    nixpkgs-unstable = {
+      from = { type = "indirect"; id = "nixpkgs-unstable"; };
+      flake = materusCfg.materusFlake.inputs.nixpkgs;
+    };
+
+    nixpkgs = {
+      from = { type = "indirect"; id = "nixpkgs"; };
+      flake = materusCfg.configInputs.nixpkgs;
+    };
+
+    emacs-overlay = {
+      from = { type = "indirect"; id = "emacs-overlay"; };
+      flake = materusCfg.configInputs.emacs-overlay;
+    };
+
+    flake-utils = {
+      from = { type = "indirect"; id = "flake-utils"; };
+      flake = materusCfg.configInputs.flake-utils;
+    };
+
+    nixos-hardware = {
+      from = { type = "indirect"; id = "nixos-hardware"; };
+      flake = materusCfg.configInputs.nixos-hardware;
+    };
+
+    nixerus = {
+      from = { type = "indirect"; id = "nixerus"; };
+      flake = materusCfg.configInputs.nixerus;
+    };
+
+    devshell = {
+      from = { type = "indirect"; id = "devshell"; };
+      flake = materusCfg.configInputs.devshell;
+    };
+
+    home-manager = {
+      from = { type = "indirect"; id = "home-manager"; };
+      flake = materusCfg.configInputs.home-manager;
+    };
+
+    sops-nix = {
+      from = { type = "indirect"; id = "sops-nix"; };
+      flake = materusCfg.configInputs.sops-nix;
+    };
+
+    base16 = {
+      from = { type = "indirect"; id = "base16"; };
+      flake = materusCfg.configInputs.base16;
+    };
+
+    git-agecrypt = {
+      from = { type = "indirect"; id = "git-agecrypt"; };
+      flake = materusCfg.configInputs.git-agecrypt;
+    };
+
+    nur = {
+      from = { type = "indirect"; id = "nur"; };
+      flake = materusCfg.configInputs.nur;
+    };
+
+
+  };
 }

configurations/profile/common/packages/default.nix

@@ -1,13 +1,17 @@
-{ config, pkgs, lib, inputs, materusFlake, materusPkgs, ... }:
+{ config, pkgs, lib, materusArg, ... }:
-with materusPkgs.lib;
+with materusArg.pkgs.lib;
 {
   imports = [
     ./fonts.nix
   ];
 
   #Single Packages
-  options.materus.profile.packages.home-manager = mkPrivateVar inputs.configInputs.inputs.home-manager.packages.${pkgs.system}.home-manager;
+  options.materus.profile.packages.home-manager = mkPrivateVar materusArg.cfg.configInputs.home-manager.packages.${pkgs.system}.home-manager;
-  options.materus.profile.packages.firefox = mkPrivateVar pkgs.firefox;
+  options.materus.profile.packages.firefox = mkPrivateVar (pkgs.firefox.override {
+    nativeMessagingHosts = [
+      pkgs.plasma-browser-integration
+    ];
+  });
 
   #Package Lists
   options.materus.profile.packages.list.nixRelated = mkPrivateVar (with pkgs; [
@@ -20,18 +24,18 @@ with materusPkgs.lib;
     nix-tree
     nix-diff
     nix-ld
-    rnix-hashes
+    nil
-    rnix-lsp
+    nixpkgs-fmt
     nixpkgs-review
   ]);
 
   options.materus.profile.packages.list.desktopApps = mkPrivateVar (with pkgs; [
-    barrier
+    (discord.override { nss = nss_latest; withOpenASAR = true; withTTS = true; })
-    (discord.override { nss = nss_latest; withOpenASAR = true; withTTS = true;})
     tdesktop
     mpv
     ani-cli
-    (pkgs.obsidian)
+    obsidian
+    nextcloud-client
     spotify
     thunderbird
     keepassxc

configurations/profile/common/packages/fonts.nix

@@ -16,14 +16,15 @@ let
     pkgs.noto-fonts-cjk-serif
     pkgs.wqy_zenhei
     pkgs.corefonts
+    pkgs.hack-font
+    (pkgs.nerdfonts.override { fonts = [ "Hack" ]; })
 
   ] ++ defaultFonts;
 
   moreFonts = [
     pkgs.ubuntu_font_family
     pkgs.monocraft
-    pkgs.hack-font
+    (pkgs.nerdfonts.override { fonts = [ "DroidSansMono" "Meslo" "ProFont" "FiraCode"]; })
-    (pkgs.nerdfonts.override { fonts = [ "FiraCode" "DroidSansMono" "Meslo" "ProFont" ]; })
   ];
 in
 {

configurations/profile/home/browser.nix

@@ -1,20 +1,24 @@
-{ config, lib, pkgs, materusPkgs, ... }:
+{ config, lib, pkgs, materusArg, ... }:
 let
-cfg = config.materus.profile.browser;
+  cfg = config.materus.profile.browser;
+  osConfig = (if (builtins.hasAttr "osConfig" config._module.args) then config._module.args.osConfig else null);
 in
 {
 
-  options= let mkBoolOpt = materusPkgs.lib.mkBoolOpt; in{
+  options = let mkBoolOpt = materusArg.pkgs.lib.mkBoolOpt; in {
-    materus.profile.browser.firefox.enable = mkBoolOpt config.materus.profile.enableDesktop "Enable Firefox with materus cfg";
+    materus.profile.browser.firefox.enable = mkBoolOpt false "Enable Firefox with materus cfg";
-    materus.profile.browser.vivaldi.enable = mkBoolOpt config.materus.profile.enableDesktop "Enable Vivaldi with materus cfg";
+    materus.profile.browser.vivaldi.enable = mkBoolOpt false "Enable Vivaldi with materus cfg";
-    materus.profile.browser.brave.enable = mkBoolOpt  false "Enable Brave with materus cfg";
+    materus.profile.browser.brave.enable = mkBoolOpt false "Enable Brave with materus cfg";
 
   };
   #TODO: Make some config
-  config.home.packages = [
+  config = lib.mkMerge [{
-  (lib.mkIf cfg.firefox.enable config.materus.profile.packages.firefox)
+      home.packages = [
-  (lib.mkIf cfg.vivaldi.enable pkgs.vivaldi)
+      (lib.mkIf cfg.firefox.enable config.materus.profile.packages.firefox)
-  (lib.mkIf cfg.brave.enable pkgs.brave)
+      (lib.mkIf cfg.vivaldi.enable pkgs.vivaldi)
+      (lib.mkIf cfg.brave.enable pkgs.brave)
+    ] ++ [ (lib.mkIf (osConfig != null && osConfig.materus.profile.browser.enable) osConfig.materus.profile.browser.package)];
+  }
   ];
 
 

configurations/profile/home/default.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, materusPkgs, ... }:
+{ config, lib, pkgs, materusArg, ... }:
 let
   packages = cfg.packages;
   cfg = config.materus.profile;
@@ -7,22 +7,24 @@ in
   imports = [
     ./fonts.nix
     ./browser.nix
+    ./xdg.nix
 
     ./shell
     ./editor
+    ./terminal
 
   ];
-  options.materus.profile.enableDesktop = materusPkgs.lib.mkBoolOpt false "Enable settings for desktop";
+  options.materus.profile.enableDesktop = materusArg.pkgs.lib.mkBoolOpt false "Enable settings for desktop";
-  options.materus.profile.enableTerminal = materusPkgs.lib.mkBoolOpt true "Enable settings for terminal";
+  options.materus.profile.enableTerminal = materusArg.pkgs.lib.mkBoolOpt true "Enable settings for terminal";
-  options.materus.profile.enableTerminalExtra = materusPkgs.lib.mkBoolOpt false "Enable extra settings for terminal";
+  options.materus.profile.enableTerminalExtra = materusArg.pkgs.lib.mkBoolOpt false "Enable extra settings for terminal";
-  options.materus.profile.enableNixDevel = materusPkgs.lib.mkBoolOpt false "Enable settings for nix devel";
+  options.materus.profile.enableNixDevel = materusArg.pkgs.lib.mkBoolOpt false "Enable settings for nix devel";
 
   config =
     {
 
-      home.packages = (if cfg.enableDesktop then packages.list.desktopApps else []) ++
+      home.packages = (if cfg.enableDesktop then packages.list.desktopApps else [ ]) ++
-        (if cfg.enableNixDevel then packages.list.nixRelated else []) ++
+        (if cfg.enableNixDevel then packages.list.nixRelated else [ ]) ++
-        (if cfg.enableTerminal then packages.list.terminalApps else []);
+        (if cfg.enableTerminal then packages.list.terminalApps else [ ]);
       #Desktop
       programs.feh.enable = lib.mkDefault cfg.enableDesktop;
 
@@ -50,8 +52,7 @@ in
         enableZshIntegration = lib.mkDefault config.programs.zsh.enable;
       };
 
-      programs.tmux.enable = lib.mkDefault cfg.enableTerminal;
+
-      programs.tmux.clock24 = lib.mkDefault config.programs.tmux.enable;
 
       programs.fzf = {
         enable = lib.mkDefault cfg.enableTerminalExtra;
@@ -60,8 +61,7 @@ in
         enableZshIntegration = lib.mkDefault config.programs.zsh.enable;
       };
 
-      programs.exa.enable = lib.mkDefault cfg.enableTerminalExtra;
+      programs.eza.enable = lib.mkDefault cfg.enableTerminalExtra;
-      programs.exa.enableAliases = lib.mkDefault config.programs.exa.enable;
 
       programs.yt-dlp.enable = lib.mkDefault cfg.enableTerminalExtra;
 

configurations/profile/home/editor/code.nix

@@ -1,15 +1,15 @@
-{ config, lib, pkgs, materusPkgs, ... }:
+{ config, lib, pkgs, materusArg, ... }:
 let
   cfg = config.materus.profile.editor.code;
 in
 {
-  options.materus.profile.editor.code.enable = materusPkgs.lib.mkBoolOpt config.materus.profile.enableDesktop "Enable VSCodium with materus cfg";
+  options.materus.profile.editor.code.enable = materusArg.pkgs.lib.mkBoolOpt config.materus.profile.enableDesktop "Enable VSCodium with materus cfg";
-  options.materus.profile.editor.code.fhs.enable = materusPkgs.lib.mkBoolOpt false "Use fhs vscodium";
+  options.materus.profile.editor.code.fhs.enable = materusArg.pkgs.lib.mkBoolOpt false "Use fhs vscodium";
-  options.materus.profile.editor.code.fhs.packages = lib.mkOption { default = (ps: []);};
+  options.materus.profile.editor.code.fhs.packages = lib.mkOption { default = (ps: [ ]); };
   config = lib.mkIf cfg.enable {
     programs.vscode = {
       enable = lib.mkDefault true;
-      package = lib.mkDefault (if (cfg.fhs.enable)  then (pkgs.vscodium.fhsWithPackages cfg.fhs.packages) else pkgs.vscodium);
+      package = lib.mkDefault (if (cfg.fhs.enable) then (pkgs.vscodium.fhsWithPackages cfg.fhs.packages) else pkgs.vscodium);
       mutableExtensionsDir = lib.mkDefault true;
     };
     materus.profile.fonts.enable = lib.mkDefault true;

configurations/profile/home/editor/default.nix

@@ -3,6 +3,6 @@
   imports = [
     ./code.nix
     ./neovim.nix
-    ./emacs.nix
+    ./emacs
   ];
 }

configurations/profile/home/editor/emacs.nix

@@ -1,25 +0,0 @@
-{ config, lib, pkgs, materusPkgs, ... }:
-let
-  cfg = config.materus.profile.editor.emacs;
-in
-{
-  options.materus.profile.editor.emacs.enable = materusPkgs.lib.mkBoolOpt false "Enable emacs with materus cfg";
-
-  config = lib.mkIf cfg.enable {
-    #TODO: Make config
-    /*home.activation.doomEmacs = lib.hm.dag.entryBetween [ "onFilesChange" ] [ "writeBoundry" ] ''
-      if [ ! -d ~/.emacs.d ] ; 
-        then ${pkgs.git}/bin/git clone --depth 1 https://github.com/doomemacs/doomemacs ~/.emacs.d 
-      fi
-      PATH="${config.programs.git.package}/bin:${config.programs.emacs.package}/bin:$PATH"
-      ~/.emacs.d/bin/doom sync
-    '';
-
-    home.file.doomEmacs.source = "${materusArg.flakeData.extraFiles}/config/emacs/doom";
-    home.file.doomEmacs.target = "${config.xdg.configHome}/doom";*/
-
-    programs.emacs.enable = true;
-    programs.emacs.package = with pkgs; lib.mkDefault (if pkgs ? emacsUnstablePgtk then emacsUnstablePgtk else emacs-gtk);
-
-  };
-}

configurations/profile/home/editor/emacs/default.nix

@@ -0,0 +1,122 @@
+{ config, lib, pkgs, materusArg, ... }:
+let
+  configPath = "${materusArg.cfg.path}" + "/extraFiles/config/emacs/";
+
+  inits = import ./init.nix { path = configPath; inherit pkgs; };
+  packages = epkgs: with epkgs; [
+    load-relative
+    elcord
+    persp-mode
+    dashboard
+    magit
+    helm
+    avy
+    corfu
+    vterm
+    centaur-tabs
+    projectile
+    company
+    clipetty
+
+    treemacs
+    treemacs-nerd-icons
+    treemacs-perspective
+    treemacs-icons-dired
+    treemacs-magit
+    treemacs-projectile
+    tree-edit
+    vertico
+    nerd-icons
+    nerd-icons-completion
+    perspective
+    minions
+    telephone-line
+    rainbow-delimiters
+    use-package
+
+    cmake-mode
+    lsp-mode
+    lsp-java
+    lsp-jedi
+    lsp-haskell
+    lsp-ui
+    lsp-treemacs
+    dap-mode
+    d-mode
+    multiple-cursors
+    org
+    org-rainbow-tags
+    org-roam
+    org-roam-ui
+    org-review
+    markdown-mode
+    json-mode
+    nix-mode
+
+    minimap
+
+
+    moe-theme
+    doom-themes
+  ];
+
+
+  default-config = ''
+    (defvar materus/nix-packages t)
+    (defvar materus/init-from-home nil)
+    (unless materus/init-from-home
+            (message "Config loading not from homeDir, need \"materus/init-from-home\" variable in init.el")
+            ${setNixInit}
+            ${inits.initText}
+          )
+  '';
+
+  emacsPkgs = with pkgs;[
+    python3
+    lua
+    multimarkdown
+    git
+  ];
+
+
+  cfg = config.materus.profile.editor.emacs;
+
+
+  setNixInit = ''
+    (setenv "PATH" (concat (getenv "PATH") ":${lib.makeBinPath emacsPkgs}"))
+    ${builtins.concatStringsSep "\n" (builtins.map (x: "(setq exec-path (append exec-path '(\""+x+"/bin\")))" ) emacsPkgs)}
+    (call-process-shell-command "${pkgs.xorg.xmodmap}/bin/xmodmap -e \"keycode 66 = Hyper_L\" -e \"remove Mod4 = Hyper_L\" -e \"add Mod3 = Hyper_L\" &" nil 0)
+  '';
+in
+{
+  options.materus.profile.editor.emacs.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable emacs with materus cfg";
+
+  config = lib.mkIf cfg.enable {
+    home.activation.emacsCompile = lib.hm.dag.entryAfter [ "linkGeneration" ] ''
+      run ${config.programs.emacs.finalPackage}/bin/emacs --batch \
+      --eval '(setq warning-minimum-log-level :error)' \
+      --eval '(byte-compile-file "${config.xdg.configHome}/emacs/early-init.el")' \
+      --eval '(byte-compile-file "${config.xdg.configHome}/emacs/init.el")'
+    '';
+    xdg.configFile."emacs/init.el".text = ''
+      (defvar materus/nix-packages nil)
+      (defvar materus/init-from-home t)
+      (setq-default materus/init-from-home t)
+    
+      ${setNixInit}
+      ${inits.initText}
+    '';
+
+    xdg.configFile."emacs/early-init.el".text = ''
+      ${inits.earlyInitText}
+    '';
+
+    programs.emacs = {
+      enable = true;
+      package = with pkgs; lib.mkDefault materusArg.pkgs.emacs-materus;
+      extraPackages = epkgs: ((packages epkgs));
+      extraConfig = default-config;
+    };
+
+  };
+}

configurations/profile/home/editor/emacs/init.nix

@@ -0,0 +1,17 @@
+{ path, pkgs }:
+{
+
+  earlyInitText = ''
+    ${builtins.readFile (path + "early-init.el")}
+  '';
+  initText = ''
+      (defvar materus/init-from-home nil)
+      (when materus/init-from-home
+        (setq-default inhibit-defaul-init 1)
+      )
+    (setq-default materus/nix-packages (require 'doom-themes nil 'noerror))
+      ${builtins.readFile (path + "packages.el")}
+      ${builtins.readFile (path + "init.el")}
+  '';
+
+}

configurations/profile/home/editor/neovim.nix

@@ -1,9 +1,9 @@
-{ config, lib, pkgs, materusPkgs, ... }:
+{ config, lib, pkgs, materusArg, ... }:
 let
-cfg = config.materus.profile.editor.neovim;
+  cfg = config.materus.profile.editor.neovim;
 in
 {
-  options.materus.profile.editor.neovim.enable = materusPkgs.lib.mkBoolOpt config.materus.profile.enableTerminalExtra "Enable neovim with materus cfg";
+  options.materus.profile.editor.neovim.enable = materusArg.pkgs.lib.mkBoolOpt config.materus.profile.enableTerminalExtra "Enable neovim with materus cfg";
   config = lib.mkIf cfg.enable {
     programs.neovim = {
       enable = true;
@@ -11,43 +11,24 @@ in
       viAlias = true;
       vimAlias = true;
       vimdiffAlias = true;
-      withNodeJs = true;
+
-      withPython3 = true;
-      withRuby = true;
-      defaultEditor = true;
 
       extraConfig = ''
-      set number
+        set number
       '';
 
 
-    plugins = with pkgs.vimPlugins;[
+      plugins = with pkgs.vimPlugins;[
-      nerdtree
+        syntastic
-      syntastic
 
-      vim-fugitive
+        vim-fugitive
-      vim-airline
+        vim-airline
-      vim-nix
+        vim-nix
 
-      nvim-fzf
+        nvim-fzf
-      nvim-treesitter.withAllGrammars
+        nvim-treesitter.withAllGrammars
 
-      coc-clangd
+      ];
-      coc-python
-      coc-pyright
-      coc-sh
-      coc-git
-      coc-css
-      coc-yaml
-      coc-toml
-      coc-json
-      coc-html
-      coc-highlight
-      coc-java
-      coc-cmake
-      coc-vimlsp
-      
-    ];
     };
   };
 

configurations/profile/home/fonts.nix

@@ -1,10 +1,10 @@
-{ config, pkgs, lib, materusPkgs, ... }:
+{ config, pkgs, lib, materusArg, ... }:
 let
   packages = config.materus.profile.packages;
   cfg = config.materus.profile.fonts;
 in
 {
-  options.materus.profile.fonts.enable = materusPkgs.lib.mkBoolOpt config.materus.profile.enableDesktop "Enable materus font settings";
+  options.materus.profile.fonts.enable = materusArg.pkgs.lib.mkBoolOpt config.materus.profile.enableDesktop "Enable materus font settings";
 
   config = lib.mkIf cfg.enable {
     fonts.fontconfig.enable = lib.mkDefault true;

configurations/profile/home/shell/bash.nix

@@ -1,20 +1,20 @@
-{ config, pkgs, lib, materusFlake, materusPkgs, ... }:
+{ config, pkgs, lib, materusArg, ... }:
 let
-cfg = config.materus.profile.bash;
+  cfg = config.materus.profile.bash;
 in
 {
-    options.materus.profile.bash.enable = materusPkgs.lib.mkBoolOpt config.materus.profile.enableTerminal "Enable materus bash config";
+  options.materus.profile.bash.enable = materusArg.pkgs.lib.mkBoolOpt config.materus.profile.enableTerminal "Enable materus bash config";
 
 
-    config = lib.mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
-      programs.bash = {
+    programs.bash = {
-        enable = lib.mkDefault true;
+      enable = true;
-        enableCompletion = lib.mkDefault true;
+      enableCompletion = lib.mkDefault true;
-        enableVteIntegration = lib.mkDefault true;
+      enableVteIntegration = lib.mkDefault true;
-        historyControl = lib.mkDefault ["erasedups" "ignorespace"];
+      historyControl = lib.mkDefault [ "erasedups" "ignorespace" ];
-        shellOptions = lib.mkDefault [ "autocd" "checkwinsize" "cmdhist" "expand_aliases" "extglob" "globstar" "checkjobs" "nocaseglob" ];
+      shellOptions = lib.mkDefault [ "autocd" "checkwinsize" "cmdhist" "expand_aliases" "extglob" "globstar" "checkjobs" "nocaseglob" ];
-      };
     };
+  };
 
 }

configurations/profile/home/shell/default.nix

@@ -5,5 +5,5 @@
     ./bash.nix
     ./fish.nix
     ./starship.nix
-    ];
+  ];
 }

configurations/profile/home/shell/fish.nix

@@ -1,12 +1,12 @@
-{ config, pkgs, lib, materusFlake, materusPkgs, ... }:
+{ config, pkgs, lib, materusArg, ... }:
 let
-cfg = config.materus.profile.fish;
+  cfg = config.materus.profile.fish;
 in
 {
-  options.materus.profile.fish.enable = materusPkgs.lib.mkBoolOpt config.materus.profile.enableTerminalExtra "Enable materus fish config";
+  options.materus.profile.fish.enable = materusArg.pkgs.lib.mkBoolOpt config.materus.profile.enableTerminalExtra "Enable materus fish config";
   config = lib.mkIf cfg.enable {
     programs.fish = {
-      enable = lib.mkDefault true;
+      enable =  true;
     };
   };
 }

configurations/profile/home/shell/starship.nix

@@ -1,13 +1,13 @@
-{ config, pkgs, lib, materusFlake, materusPkgs, ... }:
+{ config, pkgs, lib, materusArg, ... }:
 let
   profile = config.materus.profile;
   cfg = config.materus.profile.starship;
 in
 {
-  options.materus.profile.starship.enable = materusPkgs.lib.mkBoolOpt (profile.zsh.enable || profile.bash.enable || profile.fish.enable) "Enable materus fish config";
+  options.materus.profile.starship.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable materus starship config";
 
   config = lib.mkIf cfg.enable {
-    programs.starship.enable = lib.mkDefault cfg.enable;
+    programs.starship.enable = true;
 
     programs.starship.settings = {
 
@@ -28,8 +28,8 @@ in
       shell = {
         disabled = false;
         fish_indicator = "fish";
-        bash_indicator= "bash";
+        bash_indicator = "bash";
-        zsh_indicator= "zsh";
+        zsh_indicator = "zsh";
         style = "blue bold";
       };
 

configurations/profile/home/shell/zsh.nix

@@ -1,16 +1,61 @@
-{ config, pkgs, lib, materusFlake, materusPkgs, options, ... }:
+{ config, pkgs, lib, materusArg, ... }:
 let
+
+  relToDotDir = file: (lib.optionalString (config.programs.zsh.dotDir != null) (config.programs.zsh.dotDir + "/")) + file;
+  pluginsDir =
+    if config.programs.zsh.dotDir != null then
+      relToDotDir "plugins" else "${config.home.homeDirectory}/.zsh/plugins";
+
+
+
   p10kcfg = "${zshcfg}/p10kcfg";
-  zshcfg = "${materusFlake.selfPath}/extraFiles/config/zsh";
+  zshcfg = "${materusArg.cfg.path}" + "/extraFiles/config/zsh";
   cfg = config.materus.profile.zsh;
-  enableStarship = config.materus.starship.enable;
+
+  makeEnv = name: val: ''${name}=''${${name}:-"${val}"}'';
+  makeIfVar = var: val: ret: ''
+    if [[ "''$${var}" = "${val}" ]]; then 
+      ${ret}
+    fi
+  '';
+
+
+
+
+
+
+  makePlugin = nameArg: fileArg: srcArg: rec {
+    name = nameArg;
+    src = srcArg;
+    path = pluginsDir + "/" + name;
+    file = fileArg;
+    fullPath = path + "/" + file;
+  };
+
+  extraPlugins = {
+    powerlevel10k = makePlugin "powerlevel10k" "powerlevel10k.zsh-theme" (pkgs.fetchFromGitHub {
+      owner = "romkatv";
+      repo = "powerlevel10k";
+      rev = "v1.20.0";
+      sha256 = "sha256-ES5vJXHjAKw/VHjWs8Au/3R+/aotSbY7PWnWAMzCR8E=";
+    });
+    sudo = makePlugin "sudo" "sudo.plugin.zsh" "${pkgs.oh-my-zsh}/share/oh-my-zsh/plugins/sudo";
+    extract = makePlugin "extract" "extract.plugin.zsh" "${pkgs.oh-my-zsh}/share/oh-my-zsh/plugins/extract";
+
+
+  };
 in
 {
-  options.materus.profile.zsh.enable = materusPkgs.lib.mkBoolOpt config.materus.profile.enableTerminalExtra "Enable materus zsh config";
+  options.materus.profile.zsh.enable = materusArg.pkgs.lib.mkBoolOpt config.materus.profile.enableTerminalExtra "Enable materus zsh config";
   options.materus.profile.zsh.prompt = lib.mkOption {
-      type = lib.types.enum ["p10k" "starship"];
+    type = lib.types.enum [ "p10k" ];
-      example = "p10k";
+    example = "p10k";
-      default = "p10k";
+    default = "p10k";
+  };
+  options.materus.profile.zsh.endConfig = lib.mkOption {
+    default = "";
+    description = "Zsh config after all of config";
+    type = lib.types.lines;
   };
 
 
@@ -19,77 +64,125 @@ in
       pkgs.ripgrep
     ];
 
+    home.file = lib.mkMerge [
+      (builtins.foldl' (a: b: a // b) { } (builtins.map (plugin: { ${plugin.path}.source = plugin.src; }) (builtins.attrValues extraPlugins)))
+      { "${relToDotDir ".zshrc"}".text = lib.mkAfter cfg.endConfig; }
+    ];
+
     programs.zsh = {
       enable = true;
       enableAutosuggestions = true;
       enableSyntaxHighlighting = true;
       enableVteIntegration = true;
       historySubstringSearch.enable = true;
-      historySubstringSearch.searchUpKey = ";5A";
+      historySubstringSearch.searchUpKey = "$key[Up]";
-      historySubstringSearch.searchDownKey = ";5B";
+      historySubstringSearch.searchDownKey = "$key[Down]";
 
 
       envExtra = ''
-        if [[ -z "$__MATERUS_HM_ZSH" ]]; then
+        ${makeEnv "__MATERUS_HM_ZSH" "1"}
-          __MATERUS_HM_ZSH=1
+        ${makeEnv "__MATERUS_HM_ZSH_PROMPT" cfg.prompt}
-        fi
+        ${makeEnv "__MATERUS_HM_ZSH_PRIVATE" "0"}
-        if [[ -z "$__MATERUS_HM_ZSH_PROMPT" ]]; then
-          __MATERUS_HM_ZSH_PROMPT=${cfg.prompt}
-        fi
       '';
-
+      initExtraFirst = ''
-
+        ${makeIfVar "__MATERUS_HM_ZSH_PROMPT" "p10k" ''
-      initExtraFirst = lib.mkIf (cfg.prompt == "p10k" ) ''
+              if [[ -r "''${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-''${(%):-%n}.zsh" ]]; then
-        if [[ -r "''${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-''${(%):-%n}.zsh" ]]; then
+                source "''${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-''${(%):-%n}.zsh"
-          source "''${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-''${(%):-%n}.zsh"
+              fi
+              if [[ -f "${extraPlugins.powerlevel10k.fullPath}" ]]; then
+                source "${extraPlugins.powerlevel10k.fullPath}"
+              fi
+              ''
+        }
+        if zmodload zsh/terminfo && (( "$terminfo[colors]" >= "256" )); then 
+          __MATERUS_HM_ZSH_256COLORS="''${__MATERUS_HM_ZSH_256COLORS:-1}"; else
+          __MATERUS_HM_ZSH_256COLORS="''${__MATERUS_HM_ZSH_256COLORS:-0}"; 
         fi
-      '';
+
+        if [[ -f "${extraPlugins.sudo.fullPath}" ]]; then
+          source "${extraPlugins.sudo.fullPath}"
+        fi
+        if [[ -f "${extraPlugins.extract.fullPath}" ]]; then
+          source "${extraPlugins.extract.fullPath}"
+          path+="${extraPlugins.extract.path}"
+          fpath+="${extraPlugins.extract.path}"
+        fi
+        '';
 
 
 
       plugins = [
-        (lib.mkIf (cfg.prompt == "p10k" ) {
-          name = "powerlevel10k";
-          src = pkgs.fetchFromGitHub {
-            owner = "romkatv";
-            repo = "powerlevel10k";
-            rev = "bc5983543a10cff2eac30cced9208bbfd91428b8";
-            sha256 = "0s8ndbpmlqakg7s7hryyi1pqij1h5dv0xv9xvr2qwwyhyj6zrx2i";
-          };
-          file = "powerlevel10k.zsh-theme";
-        })
       ];
 
       history = {
         extended = true;
         save = 100000;
         size = 100000;
-        share = false;
+        share = true;
         ignoreDups = true;
+        ignoreAllDups = true;
         ignoreSpace = true;
       };
 
-
+      completionInit = ''
+      ZSH_COMPDUMP="''${ZSH_COMPDUMP:-''${XDG_CACHE_HOME:-${config.home.homeDirectory}/.cache}/.zcompdump-''${HOST}-''${ZSH_VERSION}}"
+      autoload -U compinit && compinit -d $ZSH_COMPDUMP
+      '';
       initExtra = ''
-        . ${zshcfg}/zinputrc
+        if [[ "$__ETC_ZSHRC_SOURCED" != "1" ]]; then
+          . ${zshcfg}/zinputrc
+        fi
         source ${zshcfg}/zshcompletion.zsh
 
+        history-substring-search-up-prefixed(){
+          HISTORY_SUBSTRING_SEARCH_PREFIXED=1 history-substring-search-up
+        }
+        history-substring-search-down-prefixed(){
+          HISTORY_SUBSTRING_SEARCH_PREFIXED=1 history-substring-search-down
+        }
+
+
+        zle -N history-substring-search-up-prefixed
+        zle -N history-substring-search-down-prefixed
+
+
         bindkey -r "^["
-        bindkey ";5C" forward-word
+        bindkey "^[[1;5C" forward-word
-        bindkey ";5D" backward-word
+        bindkey "^[[1;5D" backward-word
-        '' +
+        bindkey "^[[1;5A" history-substring-search-up-prefixed
-        (if (cfg.prompt == "p10k" ) then
+        bindkey "^[[1;5B" history-substring-search-down-prefixed
-        ''
+
-        if zmodload zsh/terminfo && (( terminfo[colors] >= 256 )); then
+        zsh-private() {
+          __MATERUS_HM_ZSH_PRIVATE=1 ${lib.getExe config.programs.zsh.package}
+        }
+
+        myip() {
+          ${lib.getExe pkgs.wget} -qO- https://wtfismyip.com/text
+        }
+
+        speedtest() {
+          ${lib.getExe pkgs.curl} -s https://raw.githubusercontent.com/sivel/speedtest-cli/master/speedtest.py | ${lib.getExe pkgs.python3} 
+        }
+
+
+      '' +
+      makeIfVar "__MATERUS_HM_ZSH_PROMPT" "p10k" ''
+        if [[ "$__MATERUS_HM_ZSH_256COLORS" = "1" ]] ; then
           [[ ! -f ${p10kcfg}/fullcolor.zsh ]] || source ${p10kcfg}/fullcolor.zsh
         else
           [[ ! -f ${p10kcfg}/compatibility.zsh ]] || source ${p10kcfg}/compatibility.zsh
         fi
-      '' else "");
+      '' + makeIfVar "__MATERUS_HM_ZSH_PRIVATE" "1" ''
+        unset HISTFILE
+        ${lib.optionalString config.programs.zsh.history.share "unsetopt SHARE_HISTORY"}
+        alias -- 'zsh'="__MATERUS_HM_ZSH_PRIVATE=0 zsh "
+      ''
+
+      ;
 
     };
 
-    programs.starship.enableZshIntegration = lib.mkForce false; 
+    programs.starship.enableZshIntegration = lib.mkDefault false;
   };
 
 

configurations/profile/home/terminal/default.nix

@@ -0,0 +1,9 @@
+{...}:
+{
+
+  imports = [
+    ./wezterm.nix
+    ./tmux.nix
+  ];
+    
+}

configurations/profile/home/terminal/tmux.nix

@@ -0,0 +1,20 @@
+{ materusArg, config, lib, ... }:
+let
+  cfg = config.materus.profile.tmux;
+in
+{
+  options.materus.profile.tmux.enable = materusArg.pkgs.lib.mkBoolOpt true "Enable materus tmux config";
+  config = lib.mkIf cfg.enable
+    {
+      programs.tmux = {
+        enable = true;
+        clock24 = lib.mkDefault true;
+        aggressiveResize = lib.mkDefault true;
+        escapeTime = lib.mkDefault 0;
+        historyLimit = lib.mkDefault 10000;
+        mouse = lib.mkDefault true;
+        terminal = lib.mkDefault "tmux-256color";
+      };
+
+    };
+}

configurations/profile/home/terminal/wezterm.nix

@@ -0,0 +1,45 @@
+{ config, lib, materusArg, pkgs, ... }:
+let
+  cfg = config.materus.profile.wezterm;
+  zshCfg = ''
+    source "${config.programs.wezterm.package}/etc/profile.d/wezterm.sh"
+  '';
+in
+{
+  options.materus.profile.wezterm.enable = materusArg.pkgs.lib.mkBoolOpt config.materus.profile.enableDesktop "Enable materus wezterm config";
+  options.materus.profile.wezterm.enableHackFont = materusArg.pkgs.lib.mkBoolOpt true "Enable hack nerd font for wezterm";
+  options.materus.profile.wezterm.enableWezcraft = materusArg.pkgs.lib.mkBoolOpt true "Enable alias to start wezcraft with monocraft font";
+  options.materus.profile.wezterm.extraConfig = lib.mkOption {
+    default = "";
+    description = "Config for wezterm";
+    type = lib.types.lines;
+  };
+  config = lib.mkIf cfg.enable
+    {
+      programs.wezterm.enable = true;
+      programs.wezterm.colorSchemes = { };
+      programs.wezterm.enableZshIntegration = false;
+      programs.wezterm.extraConfig = ''
+
+      package.path = package.path .. ";${materusArg.cfg.path}/extraFiles/config/wezterm/?.lua"
+      require("wezterm_config");
+      local config = materus_wezterm_config();
+      ${lib.optionalString cfg.enableHackFont "config.font = wezterm.font 'Hack Nerd Font';"}
+      ${cfg.extraConfig}
+
+      return config;
+    '';
+
+      home.packages = [
+        (lib.mkIf cfg.enableHackFont (pkgs.nerdfonts.override {
+          fonts = [ "Hack" ];
+        }))
+        (lib.mkIf cfg.enableWezcraft (pkgs.monocraft))
+        (lib.mkIf cfg.enableWezcraft (pkgs.writeShellScriptBin "wezcraft" ''
+          ${lib.getExe config.programs.wezterm.package} --config font="wezterm.font 'Monocraft Nerd Font'" $@
+        ''))
+      ];
+
+      materus.profile.zsh.endConfig = lib.optionalString cfg.enableWezcraft zshCfg;
+    };
+}

configurations/profile/home/xdg.nix

@@ -0,0 +1,40 @@
+{ config, lib, materusArg, pkgs, ... }:
+{
+
+  options.materus.profile.xdg =
+    {
+      enable = materusArg.pkgs.lib.mkBoolOpt config.materus.profile.enableDesktop "Enable xdg settings";
+    };
+
+  config =
+    let
+      cfg = config.materus.profile.xdg;
+    in
+    lib.mkIf cfg.enable {
+      xdg.enable = true;
+
+      xdg.userDirs.enable = lib.mkDefault true;
+      xdg.userDirs.createDirectories = lib.mkDefault config.xdg.userDirs.enable;
+
+      xdg.userDirs.desktop = lib.mkDefault "${config.home.homeDirectory}/Pulpit";
+      xdg.userDirs.documents = lib.mkDefault "${config.home.homeDirectory}/Dokumenty";
+      xdg.userDirs.download = lib.mkDefault "${config.home.homeDirectory}/Pobrane";
+      xdg.userDirs.music = lib.mkDefault "${config.xdg.userDirs.extraConfig.XDG_AUDIO_DIR}/Muzyka";
+      xdg.userDirs.pictures = lib.mkDefault "${config.home.homeDirectory}/Obrazy";
+      xdg.userDirs.publicShare = lib.mkDefault "${config.home.homeDirectory}/Publiczny";
+      xdg.userDirs.templates = lib.mkDefault "${config.home.homeDirectory}/Szablony";
+      xdg.userDirs.videos = lib.mkDefault "${config.home.homeDirectory}/Wideo";
+      xdg.userDirs.extraConfig = {
+        XDG_MISC_DIR = lib.mkDefault "${config.home.homeDirectory}/Inne";
+        XDG_PIC_SCREENSHOTS_DIR = lib.mkDefault "${config.xdg.userDirs.pictures}/Zrzuty ekranu";
+        XDG_PIC_MEMES_DIR = lib.mkDefault "${config.xdg.userDirs.pictures}/Memy";
+        XDG_PIC_MISC_DIR = lib.mkDefault "${config.xdg.userDirs.pictures}/Inne";
+        XDG_PIC_PHOTOS_DIR = lib.mkDefault "${config.xdg.userDirs.pictures}/Zdjęcia";
+        XDG_PIC_AVATARS_DIR = "${config.xdg.userDirs.pictures}/Avatar";
+        XDG_AUDIO_DIR = lib.mkDefault "${config.home.homeDirectory}/Audio";
+        XDG_KEYS_DIR = lib.mkDefault "${config.xdg.userDirs.documents}/Klucze";
+      };
+    };
+
+
+}

configurations/profile/os/default.nix

@@ -1,9 +1,29 @@
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
 {
   imports = [
     ./nix.nix
     ./fonts.nix
 
+    ./shell
     ./games
+    ./desktop
   ];
+
+  time.timeZone = lib.mkDefault "Europe/Warsaw";
+  i18n.defaultLocale = lib.mkDefault "pl_PL.UTF-8";
+
+  console = {
+    enable = lib.mkDefault true;
+    earlySetup = lib.mkDefault true;
+    font = lib.mkDefault "LatArCyrHeb-16";
+    keyMap = lib.mkDefault "pl";
+  };
+
+  programs.tmux = {
+    enable = lib.mkDefault true;
+    clock24 = lib.mkDefault true;
+  };
+  environment.systemPackages = lib.mkIf config.programs.tmux.enable [ pkgs.tmux.terminfo ];
+
 }
+ 

configurations/profile/os/desktop/browser.nix

@@ -0,0 +1,24 @@
+{ materusArg, config, pkgs, lib, ... }:
+let
+  cfg = config.materus.profile.browser;
+in
+{
+  options.materus.profile.browser.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable materus default browser config";
+  options.materus.profile.browser.default = lib.mkOption {
+    type = lib.types.enum [ "firefox" "brave" "vivaldi" ];
+    example = "vivaldi";
+    default = "brave";
+  };
+  options.materus.profile.browser.package = materusArg.pkgs.lib.mkPrivateVar
+    (if (cfg.default == "firefox") then config.materus.profile.packages.firefox else
+    if (cfg.default == "vivaldi") then pkgs.vivaldi else
+    if (cfg.default == "brave") then pkgs.brave else { });
+  config = lib.mkIf cfg.enable {
+
+    environment.systemPackages = [
+      config.materus.profile.browser.package
+    ];
+
+  };
+
+}

configurations/profile/os/desktop/default.nix

@@ -0,0 +1,6 @@
+{
+
+  imports = [
+    ./browser.nix
+  ];
+}

configurations/profile/os/fonts.nix

@@ -1,24 +1,24 @@
-{ config, pkgs, lib, materusPkgs, ... }:
+{ config, pkgs, lib, materusArg, ... }:
 let
   packages = config.materus.profile.packages;
   cfg = config.materus.profile.fonts;
 in
 {
-  options.materus.profile.fonts.enable = materusPkgs.lib.mkBoolOpt false "Enable materus font settings for OS";
+  options.materus.profile.fonts.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable materus font settings for OS";
 
   config = lib.mkIf cfg.enable {
 
-    fonts.fonts = packages.list.fonts ++ packages.list.moreFonts;
+    fonts.packages = packages.list.fonts ++ packages.list.moreFonts;
-    fonts.enableDefaultFonts = lib.mkForce true;
+    fonts.enableDefaultPackages = lib.mkDefault true;
 
-    fonts.fontconfig.enable = lib.mkForce true;
+    fonts.fontconfig.enable = lib.mkDefault true;
-    fonts.fontconfig.cache32Bit = lib.mkForce  true;
+    fonts.fontconfig.cache32Bit = lib.mkDefault true;
 
-    fonts.fontconfig.defaultFonts.sansSerif =  [ "Noto Sans" "DejaVu Sans" "WenQuanYi Zen Hei" "Noto Color Emoji" ];
+    fonts.fontconfig.defaultFonts.sansSerif = [ "Noto Sans" "DejaVu Sans" "WenQuanYi Zen Hei" "Noto Color Emoji" ];
-    fonts.fontconfig.defaultFonts.serif =  [ "Noto Serif" "DejaVu Serif" "WenQuanYi Zen Hei" "Noto Color Emoji" ];
+    fonts.fontconfig.defaultFonts.serif = [ "Noto Serif" "DejaVu Serif" "WenQuanYi Zen Hei" "Noto Color Emoji" ];
-    fonts.fontconfig.defaultFonts.emoji =  [ "Noto Color Emoji" "OpenMoji Color" ];
+    fonts.fontconfig.defaultFonts.emoji = [ "Noto Color Emoji" "OpenMoji Color" ];
-    fonts.fontconfig.defaultFonts.monospace =  [ "FiraCode Nerd Font Mono" "Noto Sans Mono" "WenQuanYi Zen Hei Mono" ];
+    fonts.fontconfig.defaultFonts.monospace = [ "Hack Nerd Font" "Noto Sans Mono" "WenQuanYi Zen Hei Mono" ];
 
-    fonts.fontDir.enable = lib.mkForce true;
+    fonts.fontDir.enable = lib.mkDefault true;
   };
 }

configurations/profile/os/games/steam.nix

@@ -1,31 +1,8 @@
-{ config, pkgs, lib, materusPkgs, inputs, ... }:
+{ config, pkgs, lib, materusArg, inputs, ... }:
 let
-  optHip = pkgs.stdenv.mkDerivation rec {
-  pname = "optHip";
-  version = pkgs.hip.version;
-
-
-  dontFixup = true;
-  dontBuild = true;
-  dontPatchELF = true;
-  dontUnpack = true;
-  sourceRoot = ".";
-
-  buildInputs = [
-    pkgs.hip
-  ];
-
-  installPhase = ''
-    mkdir -p $out/opt/rocm
-    ln -s ${pkgs.hip} $out/opt/rocm/hip
-  '';
-  };
-
   steamPkg = pkgs.steam.override {
     extraPkgs = pkgs: [
-      #config.materus.profile.packages.firefox
+      pkgs.libdecor
-      optHip #for blender
-
       pkgs.obs-studio-plugins.obs-vkcapture
       pkgs.steamcmd
       pkgs.nss_latest
@@ -55,15 +32,12 @@ let
       pkgs.libinput
       pkgs.openvdb
       pkgs.openssl
-      pkgs.tbb_2021_8
+      pkgs.tbb
       pkgs.gtk4
       pkgs.gtk3
       pkgs.glib
       pkgs.gsettings-desktop-schemas
       pkgs.fuse
-      pkgs.libsForQt5.breeze-qt5
-      pkgs.libsForQt5.breeze-gtk
-      pkgs.libsForQt5.dolphin
       pkgs.samba4Full
       pkgs.tdb
       pkgs.jbig2enc
@@ -71,8 +45,11 @@ let
       pkgs.vivaldi
       pkgs.x264.lib
       pkgs.steamtinkerlaunch
+      pkgs.pipewire
+      pkgs.gitFull
+      pkgs.git-lfs
 
-    ] ++ config.materus.profile.packages.list.fonts;
+    ] ++ config.materus.profile.packages.list.fonts ++ config.materus.profile.steam.extraPkgs;
 
     extraLibraries = pkgs: [
       pkgs.libkrb5
@@ -85,31 +62,42 @@ let
       pkgs.gnutls
       pkgs.samba
       pkgs.tdb
+      pkgs.jemalloc
+      pkgs.gperftools
     ] ++
     (with config.hardware.opengl; if pkgs.hostPlatform.is64bit
     then [ package ] ++ extraPackages
     else [ package32 ] ++ extraPackages32);
 
-    extraEnv = {
+    extraEnv = config.materus.profile.steam.extraEnv;
-      XDG_DATA_DIRS = "/usr/share:\${XDG_DATA_DIRS}";
-      OBS_VKCAPTURE = "1";
-    };
 
   };
 
   cfg = config.materus.profile.steam;
 in
 {
-  options.materus.profile.steam.enable = materusPkgs.lib.mkBoolOpt false "Enable materus steam settings for OS";
+  options.materus.profile.steam.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable materus steam settings for OS";
   options.materus.profile.steam.package = lib.mkOption {
     type = lib.types.package;
     default = steamPkg;
     description = "Package used by steam";
   };
+  options.materus.profile.steam.extraPkgs = lib.mkOption {
+    default = [ ];
+    description = "Extra packages for steam";
+  };
+  options.materus.profile.steam.extraEnv = lib.mkOption {
+    default = { };
+    description = "Extra Env for steam";
+  };
 
 
   config = lib.mkIf cfg.enable {
     hardware.steam-hardware.enable = lib.mkDefault true;
+    materus.profile.steam.extraEnv = {
+      XDG_DATA_DIRS = "/usr/share:\${XDG_DATA_DIRS}";
+      OBS_VKCAPTURE = "1";
+    };
     programs.steam = {
       enable = lib.mkDefault true;
       dedicatedServer.openFirewall = lib.mkDefault true;

configurations/profile/os/nix.nix

@@ -1,11 +1,10 @@
-{ config, pkgs, lib, inputs, materusPkgs, ... }:
+{ config, pkgs, lib, materusArg, ... }:
 let
   cfg = config.materus.profile.nix;
 in
 {
-  options.materus.profile.nix.enable = materusPkgs.lib.mkBoolOpt false "Enable materus nix settings";
+  options.materus.profile.nix.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable materus nix settings";
   config.nix = lib.mkIf cfg.enable {
-    package = lib.mkDefault pkgs.nixVersions.unstable;
 
     settings = {
       experimental-features = [ "nix-command" "flakes" "repl-flake" "no-url-literals" ];
@@ -17,7 +16,7 @@ in
         "https://cache.nixos.org/"
         "https://nixerus.cachix.org/"
       ];
-      trusted-public-keys = [ "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" "nixerus.cachix.org-1:2x7sIG7y1vAoxc8BNRJwsfapZsiX4hIl4aTi9V5ZDdE="];
+      trusted-public-keys = [ "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" "nixerus.cachix.org-1:2x7sIG7y1vAoxc8BNRJwsfapZsiX4hIl4aTi9V5ZDdE=" ];
     };
   };
 }

configurations/profile/os/shell/default.nix

@@ -0,0 +1,7 @@
+{
+  imports = [
+    ./zsh.nix
+  ];
+
+
+}

configurations/profile/os/shell/zsh.nix

@@ -0,0 +1,22 @@
+{materusArg, config, pkgs, lib, ...}:
+let
+cfg = config.materus.profile.zsh;
+in
+{
+  options.materus.profile.zsh.enable = materusArg.pkgs.lib.mkBoolOpt true "Enable materus system zsh config";
+  config =  lib.mkIf cfg.enable {
+    users.defaultUserShell = pkgs.zsh;
+    environment.shells = [ pkgs.zsh ];
+    programs.zsh = {
+      enable = true;
+      enableGlobalCompInit=false;
+      interactiveShellInit = ''
+        if [[ ''${__MATERUS_HM_ZSH:-0} == 0 ]]; then
+          source ${pkgs.grml-zsh-config}/etc/zsh/zshrc
+        fi
+      '';
+      promptInit = ''
+      '';
+    };
+  };
+}

configurations/shared/home/default.nix

@@ -2,5 +2,4 @@
 let
   genHomes = import ./genHomes.nix { inherit inputs; inherit materusFlake; };
 in
-{ }
+genHomes "materus"
-  // genHomes "materus"

configurations/shared/home/genHomes.nix

@@ -0,0 +1,56 @@
+{ inputs, materusFlake, ... }:
+let
+  profiles = import (materusFlake.selfPath + "/configurations/profile");
+
+  hosts = builtins.attrNames materusFlake.nixosConfigurations;
+  genHomes = username:
+    let
+      #Make host specific user profile "username@host"
+      _list = builtins.map (host: username + "@" + host) hosts;
+      _for = i: (
+        let len = builtins.length hosts; in
+        ([{
+          name = builtins.elemAt _list i;
+          value = let host = builtins.elemAt hosts i; in
+            materusFlake.nixosConfigurations.${host}.materusCfg.hm.lib.homeManagerConfiguration {
+              pkgs = materusFlake.nixosConfigurations.${host}.pkgs;
+              extraSpecialArgs = { materusCfg = materusFlake.nixosConfigurations.${host}.materusCfg // { isHm = true; }; };
+              modules = [
+                (materusFlake.selfPath + "/configurations/shared/home/${username}")
+                (materusFlake.selfPath + "/configurations/host/${host}/home/${username}")
+                profiles.homeProfile
+                materusFlake.nixosConfigurations.${host}.materusCfg.configInputs.sops-nix.homeManagerModules.sops
+              ];
+            };
+        }]
+        ++ (if ((i + 1) < len) then _for (i + 1) else [ ]))
+      );
+    in
+    (builtins.listToAttrs (_for 0)) // {
+      #Make generic x86_64-linux user profile "username"
+      ${username} =
+        let
+          materusCfg = {
+            stable = false;
+            inherit materusFlake;
+            host = "Generic";
+            hm = inputs.configInputs.home-manager;
+            hmAsModule = false;
+            nixerus = inputs.configInputs.nixerus;
+            configInputs = inputs.configInputs;
+            path = materusFlake.selfPath;
+            isHm = true;
+          };
+        in
+        inputs.configInputs.home-manager.lib.homeManagerConfiguration {
+          pkgs = import inputs.nixpkgs { system = "x86_64-linux"; config = { allowUnfree = true; }; };
+          extraSpecialArgs = { inherit materusCfg; };
+          modules = [
+            ./${username}
+            profiles.homeProfile
+            materusCfg.configInputs.sops-nix.homeManagerModules.sops
+          ];
+        };
+    };
+in
+genHomes

configurations/shared/home/materus/default.nix

@@ -1,10 +1,15 @@
 { config, pkgs, lib, ... }:
 {
 
-  home.username =  "materus";
+  home.username = "materus";
-  home.packages = [];
+  home.packages = [ ];
 
   programs.git.signing.key = lib.mkDefault "28D140BCA60B4FD1";
   programs.git.userEmail = lib.mkDefault "materus@podkos.pl";
   programs.git.userName = lib.mkDefault "materus";
+
+  home.stateVersion = lib.mkDefault "23.05";
+  home.homeDirectory = lib.mkDefault "/home/materus";
+
+  programs.home-manager.enable = lib.mkDefault true;
 }