old nix

.gitea/workflows/analysis.yaml

@@ -1,15 +0,0 @@
-on: [push]
-
-jobs:
-  analysis:
-    permissions:
-      contents: read
-      id-token: write
-    name: perform flake analysis
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@v4
-      - uses: DeterminateSystems/nix-installer-action@main
-      - uses: DeterminateSystems/magic-nix-cache-action@main
-      - name: Check Nix flake inputs
-        uses: http://github.com/DeterminateSystems/flake-checker-action@main

.gitea/workflows/analysis.yml

@@ -0,0 +1,14 @@
+on: [push]
+
+jobs:
+  build:
+    name: Build Nix targets
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: http://github.com/cachix/install-nix-action@v18
+      - uses: http://github.com/cachix/cachix-action@v12
+        with:
+          name: statix
+      - name: Check Nix flake inputs
+        uses: http://github.com/DeterminateSystems/flake-checker-action@main

.gitea/workflows/deploy.yaml

@@ -1,43 +0,0 @@
-on:
-  push:
-    branches:
-      - master
-
-jobs:
-  deploy:
-    container:
-      volumes:
-        - /nix/store:/var/nix/hosted-store
-    permissions:
-      contents: read
-      id-token: write
-    name: build hive configuration
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@v4
-      - name: setup
-        env:
-          CACHE_PRIVKEY: ${{secrets.CACHE_PRIVKEY}}
-        shell: bash
-        run: |
-          mkdir -p /var/secrets/
-          echo "$CACHE_PRIVKEY" >> /var/secrets/cache_privkey
-          mkdir -p /etc/nix
-          cp ./scripts/upload-to-cache.sh /etc/nix/
-          chmod +x /etc/nix/upload-to-cache.sh
-      - uses: cachix/install-nix-action@v31
-        with:
-          extra_nix_config: |
-            extra-trusted-public-keys = localhost:TiRpr2LzamX/MCKBUmFlZ8inWz94QWGL88fMEHg9Kgc=
-            extra-substituters = "local?store=/var/nix/hosted-store&priority=20"
-            secret-key-files = /var/secrets/cache_privkey
-            post-build-hook = /etc/nix/upload-to-cache.sh
-      - name: Install SSH key
-        uses: shimataro/ssh-key-action@v2
-        with:
-          key: ${{ secrets.SSH_KEY }}
-          known_hosts: ${{ secrets.KNOWN_HOSTS }}
-      - uses: http://github.com/cachix/cachix-action@v16
-        with:
-          name: colmena
-      - run: nix run .#colmena apply

.gitea/workflows/deploy.yml

@@ -0,0 +1,17 @@
+on:
+  push:
+    branches:
+      - master
+      - test-deploy
+
+jobs:
+  build:
+    name: build hive configuration
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v5
+      - uses: cachix/install-nix-action@v31
+        with:
+          install_url: https://releases.nixos.org/nix/nix-2.20.0/install
+      - uses: https://github.com/nicknovitski/nix-develop@v1
+      - run: colmena apply

flake.lock

@@ -49,11 +49,11 @@
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1769470446,
+        "lastModified": 1762095388,
-        "narHash": "sha256-nze0VZ70K2kbDxjE+BBZLD7juOmnZqNYdOhl9aUNGWg=",
+        "narHash": "sha256-7Q8LtcvKWHbP8znARRTOY2tpU5WoV6FHwp5TZJOI8Us=",
         "owner": "9001",
         "repo": "copyparty",
-        "rev": "2f57228fd4e62f8cd8e12cb80a3531dc2d4d170a",
+        "rev": "ac085b8149ff50e03d260128596dd130ed1c7cae",
         "type": "github"
       },
       "original": {
@@ -91,11 +91,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769524058,
+        "lastModified": 1762276996,
-        "narHash": "sha256-zygdD6X1PcVNR2PsyK4ptzrVEiAdbMqLos7utrMDEWE=",
+        "narHash": "sha256-TtcPgPmp2f0FAnc+DMEw4ardEgv1SGNR3/WFGH0N19M=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "71a3fc97d80881e91710fe721f1158d3b96ae14d",
+        "rev": "af087d076d3860760b3323f6b583f4d828c1ac17",
         "type": "github"
       },
       "original": {
@@ -233,11 +233,11 @@
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1769567010,
+        "lastModified": 1762826586,
-        "narHash": "sha256-R4ESxjCluQQlSIPw4NaRYVvEtvsnKGRwmACcXU1at6g=",
+        "narHash": "sha256-KlPcXOxxyv+KNcf7yNFQ4DGVFbOpITqHfvMcAUYrL7E=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "1c9c95fea177a4f8430c34dc1f974394e72bca1f",
+        "rev": "1a4fa22ec6e9f2ece24fca273352463b75f6f7c0",
         "type": "github"
       },
       "original": {
@@ -311,16 +311,16 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1769318308,
+        "lastModified": 1762756533,
-        "narHash": "sha256-Mjx6p96Pkefks3+aA+72lu1xVehb6mv2yTUUqmSet6Q=",
+        "narHash": "sha256-HiRDeUOD1VLklHeOmaKDzf+8Hb7vSWPVFcWwaTrpm+U=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1cd347bf3355fce6c64ab37d3967b4a2cb4b878c",
+        "rev": "c2448301fb856e351aab33e64c33a3fc8bcf637d",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-25.11",
+        "ref": "nixos-25.05",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -340,6 +340,36 @@
       }
     },
     "nixpkgs_7": {
+      "locked": {
+        "lastModified": 1744440957,
+        "narHash": "sha256-FHlSkNqFmPxPJvy+6fNLaNeWnF1lZSgqVCl/eWaJRc4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "26d499fc9f1d567283d5d56fcf367edd815dba1d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-24.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_8": {
+      "locked": {
+        "lastModified": 1744463964,
+        "narHash": "sha256-LWqduOgLHCFxiTNYi3Uj5Lgz0SR+Xhw3kr/3Xd0GPTM=",
+        "rev": "2631b0b7abcea6e640ce31cd78ea58910d31e650",
+        "revCount": 782401,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.1.782401%2Brev-2631b0b7abcea6e640ce31cd78ea58910d31e650/01962c8a-63c4-7abd-a3df-63a17b548cc7/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/NixOS/nixpkgs/0.1.%2A.tar.gz"
+      }
+    },
+    "nixpkgs_9": {
       "locked": {
         "lastModified": 1736549401,
         "narHash": "sha256-ibkQrMHxF/7TqAYcQE+tOnIsSEzXmMegzyBWza6uHKM=",
@@ -355,6 +385,56 @@
         "type": "github"
       }
     },
+    "pyproject-build-systems": {
+      "inputs": {
+        "nixpkgs": [
+          "striped-back",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "striped-back",
+          "pyproject-nix"
+        ],
+        "uv2nix": [
+          "striped-back",
+          "uv2nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1744599653,
+        "narHash": "sha256-nysSwVVjG4hKoOjhjvE6U5lIKA8sEr1d1QzEfZsannU=",
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "rev": "7dba6dbc73120e15b558754c26024f6c93015dd7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "type": "github"
+      }
+    },
+    "pyproject-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "striped-back",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1743438845,
+        "narHash": "sha256-1GSaoubGtvsLRwoYwHjeKYq40tLwvuFFVhGrG8J9Oek=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "8063ec98edc459571d042a640b1c5e334ecfca1e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "agenix": "agenix",
@@ -364,6 +444,8 @@
         "nix-minecraft": "nix-minecraft",
         "nixpkgs": "nixpkgs_5",
         "shoblog-front": "shoblog-front",
+        "striped-back": "striped-back",
+        "striped-front": "striped-front",
         "testing-grounds": "testing-grounds",
         "unstable": "unstable"
       }
@@ -402,6 +484,45 @@
         "type": "github"
       }
     },
+    "striped-back": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_7",
+        "pyproject-build-systems": "pyproject-build-systems",
+        "pyproject-nix": "pyproject-nix",
+        "uv2nix": "uv2nix"
+      },
+      "locked": {
+        "lastModified": 1748719386,
+        "narHash": "sha256-nyXHemXPEKnqIVIYIorSbt64zRwMvijyGQGCW3zUUkc=",
+        "ref": "refs/heads/master",
+        "rev": "bdfd6f1f4aac6a00ae4509f14b3a63c84d169edf",
+        "revCount": 8,
+        "type": "git",
+        "url": "ssh://git@gitlab.com/striped1/striped-back"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://git@gitlab.com/striped1/striped-back"
+      }
+    },
+    "striped-front": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_8"
+      },
+      "locked": {
+        "lastModified": 1748718798,
+        "narHash": "sha256-KUxbrUjRfuKjkJZLzKr11WEXLfPs38YrW/CMG6XbnbY=",
+        "ref": "refs/heads/master",
+        "rev": "a553f10147dad9e41829f67b247817a079f6f671",
+        "revCount": 11,
+        "type": "git",
+        "url": "ssh://git@gitlab.com/striped1/striped-front"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://git@gitlab.com/striped1/striped-front"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
@@ -434,7 +555,7 @@
     },
     "testing-grounds": {
       "inputs": {
-        "nixpkgs": "nixpkgs_7"
+        "nixpkgs": "nixpkgs_9"
       },
       "locked": {
         "lastModified": 1755527993,
@@ -452,11 +573,11 @@
     },
     "unstable": {
       "locked": {
-        "lastModified": 1769461804,
+        "lastModified": 1762596750,
-        "narHash": "sha256-msG8SU5WsBUfVVa/9RPLaymvi5bI8edTavbIq3vRlhI=",
+        "narHash": "sha256-rXXuz51Bq7DHBlfIjN7jO8Bu3du5TV+3DSADBX7/9YQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "bfc1b8a4574108ceef22f02bafcf6611380c100d",
+        "rev": "b6a8526db03f735b89dd5ff348f53f752e7ddc8e",
         "type": "github"
       },
       "original": {
@@ -465,6 +586,31 @@
         "repo": "nixpkgs",
         "type": "github"
       }
+    },
+    "uv2nix": {
+      "inputs": {
+        "nixpkgs": [
+          "striped-back",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "striped-back",
+          "pyproject-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1744797880,
+        "narHash": "sha256-gt9JBkYjZAEvGwCG7RMAAAr0j2RsaRmOMj/vV0briXk=",
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "rev": "3583e037163491ecd833f1d5d3eedf3869543c5d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -3,7 +3,7 @@
 
   # Flake inputs
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
     unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
     colmena.url = "github:zhaofengli/colmena";
 
@@ -18,14 +18,15 @@
     nix-minecraft.url = "github:Infinidoge/nix-minecraft";
     testing-grounds.url = "gitlab:shobu13/testing-grounds";
     shoblog-front.url = "gitlab:shobu13/shoblog";
+    striped-front.url = "git+ssh://git@gitlab.com/striped1/striped-front";
+    striped-back.url = "git+ssh://git@gitlab.com/striped1/striped-back";
     
     copyparty.url = "github:9001/copyparty";
 
   };
 
   # Flake outputs
-  outputs =
+  outputs = inputs@{
-    inputs@{
     self,
     
     nixpkgs,
@@ -37,8 +38,8 @@
     disko,
     
     shoblog-front,
-      # striped-front,
+    striped-front,
-      # striped-back,
+    striped-back,
     nix-minecraft,
     testing-grounds,
     copyparty,
@@ -51,36 +52,11 @@
       ];
 
       # Helper to provide system-specific attributes
-      forEachSupportedSystem =
+      forEachSupportedSystem = f: inputs.nixpkgs.lib.genAttrs supportedSystems (system: f {
-        f:
-        inputs.nixpkgs.lib.genAttrs supportedSystems (
-          system:
-          f {
         pkgs = import inputs.nixpkgs { inherit system; };
-          }
+      });
-        );
     in
     {
-      nixosConfigurations = {
-        sin = nixpkgs.lib.nixosSystem {
-          system = "x86_64-linux";
-
-          modules = [
-            disko.nixosModules.disko
-            agenix.nixosModules.default
-            ./hosts/sin/configuration.nix
-            ./hosts/sin/hardware-configuration.nix
-          ]
-          ++ [
-            # modules
-            ./modules/gitea/sin
-          ];
-
-          specialArgs = {
-            inherit inputs;
-          };
-        };
-      };
       colmenaHive = colmena.lib.makeHive {
         meta = {
           nixpkgs = import nixpkgs {
@@ -93,20 +69,11 @@
           };
         };
 
-        thea =
+        thea = {name, nodes, pkgs, ...}: {
-          {
-            name,
-            nodes,
-            pkgs,
-            ...
-          }:
-          {
           imports = [
-              agenix.nixosModules.default
             ./hosts/${name}/configuration.nix
             ./hosts/${name}/hardware-configuration.nix
-            ]
+          ] ++ [
-            ++ [
             # modules
             ./modules/gitea/${name}
           ];
@@ -114,54 +81,33 @@
           deployment.targetHost = "192.168.1.12";
         };
 
-        sin =
+        sin = {name, nodes, pkgs, ...}: {
-          {
-            name,
-            nodes,
-            pkgs,
-            ...
-          }:
-          {
           imports = [
             disko.nixosModules.disko
             agenix.nixosModules.default
             ./hosts/${name}/configuration.nix
             ./hosts/${name}/hardware-configuration.nix
-            ]
+          ] ++ [
-            ++ [
             # modules
             ./modules/gitea/${name}
           ];
 
           deployment.targetHost = "192.168.1.14";
-            deployment.allowLocalDeployment = true;
         };
       };
-      devShells = forEachSupportedSystem (
+      devShells = forEachSupportedSystem ({ pkgs }: {
-        { pkgs }:
-        {
         default = pkgs.mkShell {
           # The Nix packages provided in the environment
           # Add any you need here
-            packages = with pkgs; [
+          packages = with pkgs; [ colmena.packages.${pkgs.system}.colmena ];
-              colmena.packages.${pkgs.stdenv.system}.colmena
-              agenix.packages.${pkgs.stdenv.system}.agenix
-            ];
 
           # Set any environment variables for your dev shell
           env = { };
 
           # Add any shell logic you want executed any time the environment is activated
-            shellHook = '''';
+          shellHook = ''
-          };
+          '';
-        }
+        };
-      );
+      });
-
-      packages = forEachSupportedSystem (
-        { pkgs }:
-        {
-          inherit (colmena.packages."${pkgs.system}") colmena;
-        }
-      );
     };
 }

hosts/sin/configuration.nix

@@ -2,7 +2,6 @@
   modulesPath,
   lib,
   pkgs,
-  config,
   ...
 }:
 {
@@ -17,7 +16,6 @@
     ./secrets.nix
     ./coredns
     ./copyparty.nix
-    ./trilium.nix
   ];
 
   boot.initrd.kernelModules = [ "usb_storage" ];
@@ -44,8 +42,6 @@
 
         3000 # gitea
 
-        config.services.trilium-server.port
-
         53
       ];
 
@@ -55,25 +51,18 @@
 
   time.timeZone = "Europe/Paris";
 
-  nix.settings.experimental-features = [
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
-    "nix-command"
-    "flakes"
-  ];
   nixpkgs.config.allowUnfree = true;
 
   users.users = {
     zimablade = {
       isNormalUser = true;
       extraGroups = [ "wheel" ];
-      openssh.authorizedKeys.keys = [
+      openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKsu+4S+BHmypQTq2IR9y+ihvbF7sXbBznKtIjVAeHJ1 shobu@nixos" ];
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKsu+4S+BHmypQTq2IR9y+ihvbF7sXbBznKtIjVAeHJ1 shobu@nixos"
-      ];
     };
     shobu = {
       isNormalUser = true;
-      openssh.authorizedKeys.keys = [
+      openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKsu+4S+BHmypQTq2IR9y+ihvbF7sXbBznKtIjVAeHJ1 shobu@nixos" ];
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKsu+4S+BHmypQTq2IR9y+ihvbF7sXbBznKtIjVAeHJ1 shobu@nixos"
-      ];
     };
   };
   
@@ -82,12 +71,10 @@
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKsu+4S+BHmypQTq2IR9y+ihvbF7sXbBznKtIjVAeHJ1 shobu@nixos"
   ];
 
-  environment.systemPackages =
+  environment.systemPackages = map lib.lowPrio [
-    map lib.lowPrio [
     pkgs.curl
     pkgs.gitMinimal
-    ]
+  ] ++ (with pkgs; [
-    ++ (with pkgs; [
     helix
     httpie
     btop

hosts/sin/copyparty.nix

@@ -1,74 +1,27 @@
-{
+{inputs, pkgs, ...}: {
-  inputs,
-  pkgs,
-  config,
-  ...
-}:
-{
   imports = [ inputs.copyparty.nixosModules.default ];
   nixpkgs.overlays = [ inputs.copyparty.overlays.default ];
   environment.systemPackages = [ pkgs.copyparty ];
   services.copyparty = {
     enable = true;
 
-    group = "starr";
-
     settings = {
       p = [ 8086 ];
       e2dsa = true;
       e2ts = true;
       z = true;
       qr = true;
-      xff-hdr = "X-Real-IP";
       xff-src = "lan";
-      rproxy = 1;
       http-only = true;
       og = true;
       shr = "/shares";
     };
 
-    accounts = {
-      serhao = {
-        passwordFile = config.age.secrets.copyparty-serhao.path;
-      };
-    };
-
     volumes = {
-      "/movies" = {
+      "/media" = {
-        path = "/mnt/mediacenter/media/movies";
-        access = {
-          r = "*";
-        };
-      };
-      "/shows" = {
-        path = "/mnt/mediacenter/media/shows";
-        access = {
-          r = "*";
-        };
-      };
-
-      "/musics" = {
-        path = "/mnt/mediacenter/media/musics";
-        access = {
-          r = "*";
-        };
-      };
-      "/mediacenter" = {
         path = "/mnt/mediacenter/media";
         access = {
-          rw = ["serhao"];
+          r = "*";
-        };
-        flags = {
-          e2d = true;
-        };
-      };
-      "/data" = {
-        path = "/mnt/data";
-        access = {
-          rwd = ["serhao"];
-        };
-        flags = {
-          e2d = true;
         };
       };
     };

hosts/sin/coredns/default.nix

@@ -1,5 +1,4 @@
-{ ... }:
+{...}: {
-{
   services.coredns = {
     enable = false;
     config = ''

hosts/sin/flake.nix

@@ -14,15 +14,7 @@
   };
 
   # Flake outputs
-  outputs =
+    outputs = inputs@{ self, nixpkgs, disko, unstable, agenix, ... }:
-    inputs@{
-      self,
-      nixpkgs,
-      disko,
-      unstable,
-      agenix,
-      ...
-    }:
     let
       # The systems supported for this flake
       supportedSystems = [
@@ -30,14 +22,9 @@
       ];
 
       # Helper to provide system-specific attributes
-      forEachSupportedSystem =
+      forEachSupportedSystem = f: nixpkgs.lib.genAttrs supportedSystems (system: f {
-        f:
-        nixpkgs.lib.genAttrs supportedSystems (
-          system:
-          f {
         pkgs = import nixpkgs { inherit system; };
-          }
+      });
-        );
     in
     {
       nixosConfigurations.zimablade = nixpkgs.lib.nixosSystem {
@@ -53,21 +40,15 @@
         };
       };
 
-      devShells = forEachSupportedSystem (
+      devShells = forEachSupportedSystem ({ pkgs }: {
-        { pkgs }:
-        {
         default = pkgs.mkShell {
           # The Nix packages provided in the environment
           # Add any you need here
-            packages = with pkgs; [
+          packages = with pkgs; [ pkgs.disko nixos-anywhere ];
-              pkgs.disko
-              nixos-anywhere
-            ];
 
           # Add any shell logic you want executed any time the environment is activated
           shellHook = '''';
         };
-        }
+      });
-      );
     };
 }

hosts/sin/glances.nix

@@ -1,5 +1,4 @@
-{ ... }:
+{...}: {
-{
   services.glances = {
     enable = true;
     openFirewall = true;

hosts/sin/hardware-configuration.nix

@@ -1,27 +1,14 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{
+{ config, lib, pkgs, modulesPath, ... }:
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
 
 {
-  imports = [
+  imports =
-    (modulesPath + "/installer/scan/not-detected.nix")
+    [ (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
-  boot.initrd.availableKernelModules = [
+  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "usb_storage" "usbhid" "sd_mod" "sdhci_pci" ];
-    "ahci"
-    "xhci_pci"
-    "usb_storage"
-    "usbhid"
-    "sd_mod"
-    "sdhci_pci"
-  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];

hosts/sin/homepage.nix

@@ -1,12 +1,12 @@
-{ inputs, pkgs, ... }:
+
-{
+{inputs, pkgs, ...}: {
   services.homepage-dashboard = {
     enable = true;
     openFirewall = true;
     allowedHosts = "dashboard.shobu.fr";
     settings = {
       title = "Shobu's homelab dashboard";
-      description = "a dashboard of free and awesome bullshit";
+      description = "a dashboard of free and wesome bullshit";
       startUrl = "https://dashboard.shobu.fr";
       base = "https://dashboard.shobu.fr";
       headerStyle = "boxed";
@@ -44,7 +44,7 @@
     widgets = [
       {
         greeting = {
-          text = "Welcome on my services and links dashboard, make yourself home. :3";
+          text = "Welcome on my services and links dashboard, make yourself home.";
         };
       }
       {
@@ -117,15 +117,6 @@
               };
             };
           }
-          {
-            "reclamation" = {
-              description = "bring back your world to life";
-              widget = {
-                type = "minecraft";
-                url = "udp://minecraft.shobu.fr:25665";
-              };
-            };
-          }
         ];
       }
       {

hosts/sin/jellyfin.nix

@@ -1,8 +1,6 @@
-{ pkgs, inputs, ... }:
+{pkgs, inputs, ...}: let
-let
   unstable = import inputs.unstable { system = pkgs.system; };
-in
+in {
-{
   nixpkgs.config.packageOverrides = pkgs: {
     vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
   };
@@ -11,9 +9,10 @@ in
     extraPackages = with pkgs; [
       intel-media-driver
       intel-vaapi-driver
-      libva-vdpau-driver
+      vaapiVdpau
       intel-compute-runtime # OpenCL filter support (hardware tonemapping and subtitle burn-in)
       vpl-gpu-rt # QSV on 11th gen or newer
+      intel-media-sdk # QSV up to 11th gen
     ];
   };
 
@@ -28,44 +27,13 @@ in
     extraGroups = [ "jellyfin" ];
   };
 
-  users.users.sonarr.extraGroups = [
+  users.users.sonarr.extraGroups = ["jellyfin" "radarr" "transmission" "starr"];
-    "jellyfin"
+  users.users.radarr.extraGroups = ["jellyfin" "sonarr" "transmission" "starr"];
-    "radarr"
+  users.users.bazarr.extraGroups = ["jellyfin" "sonarr" "transmission" "starr" "radarr"];
-    "transmission"
+  users.users.lidarr.extraGroups = ["jellyfin" "starr" "transmission"];
-    "starr"
-  ];
-  users.users.radarr.extraGroups = [
-    "jellyfin"
-    "sonarr"
-    "transmission"
-    "starr"
-  ];
-  users.users.bazarr.extraGroups = [
-    "jellyfin"
-    "sonarr"
-    "transmission"
-    "starr"
-    "radarr"
-  ];
-  users.users.lidarr.extraGroups = [
-    "jellyfin"
-    "starr"
-    "transmission"
-  ];
   
-  users.users.whisparr.extraGroups = [
+  users.users.shobu.extraGroups = [ "jellyfin" "starr" "transmission" "radarr" "sonarr" ];
-    "jellyfin"
-    "starr"
-    "transmission"
-  ];
 
-  users.users.shobu.extraGroups = [
-    "jellyfin"
-    "starr"
-    "transmission"
-    "radarr"
-    "sonarr"
-  ];
   
   users.groups = {
     starr = {};
@@ -81,27 +49,15 @@ in
       enable = true;
       openFirewall = true;
       group = "starr";
-      settings = {
-        authentication.AuthenticationMethod = "external";
-        authentication.AuthenticationType = "enabled";
-      };
     };
     radarr = {
       enable = true;
       openFirewall = true;
       group = "starr";
-      settings = {
-        authentication.AuthenticationMethod = "external";
-        authentication.AuthenticationType = "enabled";
-      };
     };
     prowlarr = {
       enable = true;
       openFirewall = true;
-      settings = {
-        authentication.AuthenticationMethod = "external";
-        authentication.AuthenticationType = "enabled";
-      };
     };
     bazarr = {
       enable = true;
@@ -110,18 +66,7 @@ in
     lidarr = {
       enable = true;
       openFirewall = true;
-      settings = {
+      package = unstable.lidarr;
-        authentication.AuthenticationMethod = "external";
-        authentication.AuthenticationType = "enabled";
-      };
-    };
-    whisparr = {
-      enable = true;
-      openFirewall = true;
-      settings = {
-        authentication.AuthenticationMethod = "external";
-        authentication.AuthenticationType = "enabled";
-      };
     };
     
     jellyseerr = {

hosts/sin/luks-btrfs-raid.nix

@@ -1,5 +1,4 @@
-{ ... }:
+{...}: {
-{
   disko.devices = {
     disk = {
       # Devices will be mounted and formatted in alphabetical order, and btrfs can only mount raids
@@ -7,7 +6,7 @@
       # and the actual btrfs raid on the second disk, and the name of these entries matters!
       system = {
         type = "disk";
-        device = "/dev/sdb";
+        device = "/dev/mmcblk0";
         content = {
           type = "gpt";
           partitions = {
@@ -42,10 +41,6 @@
                     "/root" = {
                       mountpoint = "/";
                     };
-                    "/nix" = {
-                      mountpoint = "/nix";
-                      mountOptions = [ "compress=zstd:3" ];
-                    };
                   };
                 };
               };
@@ -54,17 +49,39 @@
         };
       };
 
-      data = {
+      data1 = {
         type = "disk";
         device = "/dev/sda";
         content = {
           type = "gpt";
           partitions = {
-            crypt_p = {
+            crypt_p1 = {
               size = "100%";
               content = {
                 type = "luks";
-                name = "p_data";
+                name = "p_data1"; # device-mapper name when decrypted
+                # Remove settings.keyFile if you want to use interactive password entry
+                settings = {
+                  allowDiscards = true;
+                  keyFile = "/dev/disk/by-uuid/2021-07-11-12-33-27-00";
+                  keyFileSize = 4096;
+                };
+              };
+            };
+          };
+        };
+      };
+      data2 = {
+        type = "disk";
+        device = "/dev/sdb";
+        content = {
+          type = "gpt";
+          partitions = {
+            crypt_p2 = {
+              size = "100%";
+              content = {
+                type = "luks";
+                name = "p_data2";
                 # Remove settings.keyFile if you want to use interactive password entry
                 settings = {
                   allowDiscards = true;
@@ -73,11 +90,19 @@
                 };
                 content = {
                   type = "btrfs";
+                  extraArgs = [
+                    "-d raid0"
+                    "/dev/mapper/p_data1" # Use decrypted mapped device, same name as defined in disk1
+                  ];
                   subvolumes = {
                     "/" = {
                       mountpoint = "/mnt/fs";
                       mountOptions = [ "compress=zstd:3" ];
                     };
+                    "/nix" = {
+                      mountpoint = "/nix";
+                      mountOptions = [ "compress=zstd:3" ];
+                    }; 
 
                     "/data" = {
                       mountpoint = "/mnt/data";

hosts/sin/matrix.nix

@@ -26,10 +26,7 @@
     '';
   };
 
-  networking.firewall.allowedTCPPorts = [
+  networking.firewall.allowedTCPPorts = [ 8008 8448 ];
-    8008
-    8448
-  ];
 
   services.matrix-synapse = {
     enable = true;
@@ -48,10 +45,7 @@
           x_forwarded = true;
           resources = [
             {
-              names = [
+              names = [ "client" "federation" ];
-                "client"
-                "federation"
-              ];
               compress = true;
             }
           ];

hosts/sin/ollama.nix

@@ -1,21 +0,0 @@
-{ inputs, ... }:
-{
-  # virtualisation.docker = {
-  #   enable = true;
-  #   storageDriver = "btrfs";
-  # };
-
-  services.ollama = {
-    enable = true;
-    openFirewall = true;
-    loadModels = [ ];
-    acceleration = "cuda";
-  };
-
-  services.open-webui = {
-    enable = true;
-    openFirewall = true;
-    host = "0.0.0.0";
-    port = 8050;
-  };
-}

hosts/sin/secrets.nix

@@ -1,5 +1,4 @@
-{ ... }:
+{...}: {
-{
   age.secrets = {
     # captcha = {
     #   file = ./secrets/matrix_captcha.age;
@@ -10,22 +9,5 @@
       file = ./secrets/airvpn_wireguard_key_env.age;
       mode = "700";
     };
-    copyparty-serhao = {
-      file = ./secrets/copyparty-serhao.age;
-      mode = "700";
-      owner = "copyparty";
-    };
-    authelia-jwt = {
-      file = ./secrets/authelia-jwt.age;
-      mode = "700";
-    };
-    authelia-encryption = {
-      file = ./secrets/authelia-encryption.age;
-      mode = "700";
-    };
-    authelia-session = {
-      file = ./secrets/authelia-session.age;
-      mode = "700";
-    };
   };
 }

hosts/sin/secrets/authelia-encryption.age

@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 /uqj4A L95rgX9APIgoMvkplZIYgMQDhKBOsPGOw/maymMhiks
-LNfa/YBCd84iknAMk4wbQps4KMXCvrhPp2d9KkhJWHI
--> ssh-ed25519 NoSl6Q G/y6DUFTyV6Jy6KHo8yc+xxtu3aJtTOF3Ldmxq3FmyE
-FOExj321S/VIPQ/qdvZBcJ930HI/GsjDVjJp9WMSXLA
---- iIpq/CWng+4+kQbvJQb/qgejr/eza94wCkegEJ2dvno
-ÿNôU*1=DÔOˆ£W6]_â©Kà=©*ÊÞký¦_ù˜Ýøɇ™tmË•ãw°

hosts/sin/secrets/authelia-jwt.age

@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 /uqj4A i6SPCzjkGrPMjhC9NQDdYTk3fzXoD4OSQdhS1togN0A
-Lqus8sROz1O4EepauPwC4RX/qH+SnDiL2H5iZGtAhXo
--> ssh-ed25519 NoSl6Q LxV4a5HiB6qfPjbba75dkVVECzaqrMjksMXHh53JbGQ
-x4POzurz+J2mymT81M+cu69Iv/MeiYt+JvaRteinm5Q
---- OFqooyZ2HPBxP756PqpgJAyVOTkqhJ0LhEQsLJBZUtE
-—>»&Ȇw·\D„Au{õz{CˆÁ~á$‘_ˆ9»¢ZZ<5A>U^„ÎÊL!(lnпÂó‰Üv{fdº 1Ýßl
¢,<2C>|<7C>Ü.¤çH«¤³êVaù¥ÍÓˆ™PêwOo3ž

hosts/sin/secrets/authelia-session.age

@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 /uqj4A eff535EaT7gEZOacWx9raBJMdd4PPd9+y6Y3eOt1wBI
-5P4aefjWVJ4L11ff+Cg8j3gQ58I+agDPUMFWiCaL/sQ
--> ssh-ed25519 NoSl6Q 3+EZtaiiZQk7JK6zCNo/nUSSRAJzf8nal2X1sFkYmxo
-f5gzpiOtCbYdiV7vOxfZvJPRmRruTbHg6T8g0r5JRgc
---- BBL3wE2eSmHVI4tlhq+5fy84cauw6P6G69nFXuObLKE
-êéæí	@[¡SÓcñ‘<C3B1>SyÉŠ‡<; í†<C3AD>e±Ë茟<C592><C5B8>§(°Æž1\Yj›È¯½½4åõ Ý
ȹ.3>Â[Èq¢Jh8í·šÕVt”øX[Ì~[(#
^‘_5€§<E282AC>

hosts/sin/secrets/copyparty-serhao.age

@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 BoEq8A O6x9n4kvpqLucX7NuNeD2SsMmvT5n6aVYwo4nQt21H8
-R+4g1QuXtxovyv5Mav+mAhgGjOcGQW4q17FSBtzXZQo
--> ssh-ed25519 NoSl6Q iKPipXfIGWxUobXF/9CSRhc/zKgmKKWWZhDTDgX0jWA
-LB4TFCdbEG0VToYzTWdFedd0duF5PKlCnpBs4nBbLAQ
---- D7VE3Mwgx9ehk5rNuHm62S5ggQBm9wJodZa61jLEVsY
-8ÔîÐÄÒë`S«šéT¯Fª9&(½Ú²Á‡¸=~Ïáš­où».XŽ¶ž7ðV&'Øøå ÒÔ¸‹%ã î

hosts/sin/transmission.nix

@@ -1,10 +1,4 @@
-{
+{config, ...}: {
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-{
 
   users.users."starr" = {
     extraGroups = [ "transmission" ];
@@ -20,28 +14,9 @@
     transmission.gid = 989;
   };
 
-  # systemd.services = {
+  virtualisation.oci-containers = let
-  #   docker-transmission-network = {
-  #     after = [
-  #       "network.target"
-  #       "docker-gluetun.service"
-  #       "docker-transmission.service"
-  #     ];
-  #     wantedBy = [
-  #       "docker-gluetun.service"
-  #       "docker-transmission.service"
-  #     ];
-  #     serviceConfig = {
-  #       ExecStart = "${lib.getExe pkgs.docker} network create docker-transmission; exit 0";
-  #     };
-  #   };
-  # };
-
-  virtualisation.oci-containers =
-    let
     peerport = "63369";
-    in
+  in {
-    {
     backend = "docker";
     containers = {
       gluetun = {
@@ -61,7 +36,6 @@
         extraOptions = [
           "--cap-add=NET_ADMIN"
           "--device=/dev/net/tun"
-            # "--network=docker-transmission"
         ];
         ports = [
           "13277:13277"

hosts/sin/trilium.nix

@@ -1,9 +0,0 @@
-{ ... }:
-{
-  services.trilium-server = {
-    enable = true;
-    port = 12783;
-    host = "0.0.0.0";
-    noAuthentication = true;
-  };
-}

hosts/thea/authelia.nix

@@ -1,126 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.services.authelia.instances.main;
-  dataDir = "/var/lib/authelia-${cfg.name}";
-  authelia-snippets = pkgs.callPackage ./lib/autheliaSnippets.nix { inherit pkgs; };
-in
-{
-  services.authelia.instances = {
-    main = {
-      enable = true;
-      secrets = {
-        jwtSecretFile = config.age.secrets.authelia-jwt.path;
-        storageEncryptionKeyFile = config.age.secrets.authelia-encryption.path;
-        sessionSecretFile = config.age.secrets.authelia-session.path;
-      };
-      settings = {
-        theme = "light";
-        log.level = "debug";
-
-        authentication_backend = {
-          file = {
-            path = dataDir + "/users.yml";
-          };
-        };
-        storage = {
-          local = {
-            path = dataDir + "/db.sqlite3";
-          };
-        };
-        session = {
-          cookies = [
-            {
-              domain = "shobu.fr";
-              authelia_url = "https://auth.shobu.fr";
-              default_redirection_url = "https://shobu.fr";
-            }
-          ];
-        };
-        notifier = {
-          filesystem = {
-            filename = "${dataDir}/notification.txt";
-          };
-        };
-        access_control = {
-          default_policy = "deny";
-          rules = [
-            # {
-            #   domain = "radarr.shobu.fr";
-            #   policy = "bypass";
-            # }
-            {
-              domain = "*.shobu.fr";
-              policy = "one_factor";
-            }
-          ];
-        };
-        server = {
-          endpoints = {
-            authz = {
-              auth-request = {
-                implementation = "AuthRequest";
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-
-  # systemd.tmpfiles.rules = lib.mkIf cfg.enable [
-  #   "d '${dataDir}' 0700 ${cfg.user} ${cfg.group} - -"
-  # ];
-
-  age.secrets = {
-    authelia-jwt = {
-      owner = cfg.user;
-      file = ./secrets/authelia-jwt.age;
-      mode = "700";
-    };
-    authelia-encryption = {
-      owner = cfg.user;
-      file = ./secrets/authelia-encryption.age;
-      mode = "700";
-    };
-    authelia-session = {
-      owner = cfg.user;
-      file = ./secrets/authelia-session.age;
-      mode = "700";
-    };
-  };
-
-  services.nginx = {
-    enable = true;
-    recommendedProxySettings = true;
-    recommendedTlsSettings = true;
-
-    virtualHosts."auth.shobu.fr" =
-      let
-        upstream = "http://thea:9091";
-      in
-      {
-        enableACME = true;
-        forceSSL = true;
-
-        locations."/" = {
-          proxyPass = upstream;
-          extraConfig = ''
-            error_log /var/log/nginx/debug_authelia.log debug;
-            include ${authelia-snippets.proxy};
-            set $upstream ${upstream};
-          '';
-        };
-        locations."/api/verify" = {
-          proxyPass = upstream;
-        };
-        locations."/api/authz" = {
-          proxyPass = upstream;
-        };
-      };
-  };
-}

hosts/thea/configuration.nix

@@ -2,25 +2,19 @@
 # your system. Help is available in the configuration.nix(5) man page, on
 # https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
 
-{
+{ config, lib, pkgs, nodes, ... }:let
-  config,
-  lib,
-  pkgs,
-  nodes,
-  ...
-}:
-let
   sin-address = "192.168.1.14";
 in
 
 {
-  imports = [
+  imports =
+    [
       ./nginx.nix
+      # ./striped
       # ./cybercoffee
       ./ollama.nix
       ./minecraft.nix
-    ./secrets
+      # ./shares.nix
-    ./authelia.nix
     ];
 
   # Use the systemd-boot EFI boot loader.
@@ -37,36 +31,24 @@ in
     # dhcpcd.extraConfig = "nohook resolv.conf";
     
     firewall = {
-      allowedTCPPorts = [
+      allowedTCPPorts = [ nodes.sin.config.services.gitea.settings.server.SSH_PORT ];
-        nodes.sin.config.services.gitea.settings.server.SSH_PORT
-      ]
-      ++ [
-        # minecraft ad hoc server ports
-        25665
-        25675
-      ];
     };
     nat = {
       enable = true;
       internalInterfaces = [ "enp1s0" ];
       externalInterface = "enp1s0";
-      forwardPorts = [
+      forwardPorts = [ {
-        {
         # TODO refactor this in the gitea/n100 module
         sourcePort = nodes.sin.config.services.gitea.settings.server.SSH_PORT;
         proto = "tcp";
         destination = "${sin-address}:22";  
-        }
+      } ];
-      ];
     };
   };
 
   time.timeZone = "Europe/Paris";
 
-  nix.settings.experimental-features = [
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
-    "nix-command"
-    "flakes"
-  ];
   nixpkgs.config.allowUnfree = true;
 
   users.users.n100 = {
@@ -75,17 +57,14 @@ in
     packages = with pkgs; [
     ];
 
-    openssh.authorizedKeys.keys = [
+    openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKsu+4S+BHmypQTq2IR9y+ihvbF7sXbBznKtIjVAeHJ1 shobu@nixos" ];
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKsu+4S+BHmypQTq2IR9y+ihvbF7sXbBznKtIjVAeHJ1 shobu@nixos"
-    ];
   };
 
   users.users.root = {
-    openssh.authorizedKeys.keys = [
+    openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKsu+4S+BHmypQTq2IR9y+ihvbF7sXbBznKtIjVAeHJ1 shobu@nixos" ];
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKsu+4S+BHmypQTq2IR9y+ihvbF7sXbBznKtIjVAeHJ1 shobu@nixos"
-    ];
   };
 
+
   environment.systemPackages = with pkgs; [
     lunarvim 
     wget
@@ -133,3 +112,4 @@ in
   system.stateVersion = "24.11"; # Did you read the comment?
 
 }
+

hosts/thea/cybercoffee/halflife.nix

@@ -1 +1,2 @@
+
 {...}: {}

hosts/thea/flake.nix

@@ -12,8 +12,7 @@
   };
 
   # Flake outputs
-  outputs =
+  outputs = inputs@{
-    inputs@{
     self,
     nixpkgs,
     nix-minecraft,

hosts/thea/hardware-configuration.nix

@@ -1,60 +1,46 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{
+{ config, lib, pkgs, modulesPath, ... }:
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
 
 {
-  imports = [
+  imports =
-    (modulesPath + "/installer/scan/not-detected.nix")
+    [ (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
-  boot.initrd.availableKernelModules = [
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "sd_mod" "sdhci_pci" ];
-    "xhci_pci"
-    "ahci"
-    "sd_mod"
-    "sdhci_pci"
-  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" = {
+  fileSystems."/" =
-    device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
+    { device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
       fsType = "btrfs";
       options = [ "subvol=root" ];
     };
 
-  fileSystems."/nix" = {
+  fileSystems."/nix" =
-    device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
+    { device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
       fsType = "btrfs";
       options = [ "subvol=nix" ];
     };
 
-  fileSystems."/home" = {
+  fileSystems."/home" =
-    device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
+    { device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
       fsType = "btrfs";
       options = [ "subvol=home" ];
     };
 
-  fileSystems."/swap" = {
+  fileSystems."/swap" =
-    device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
+    { device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
       fsType = "btrfs";
       options = [ "subvol=swap" ];
     };
 
-  fileSystems."/boot" = {
+  fileSystems."/boot" =
-    device = "/dev/disk/by-uuid/D1B9-8019";
+    { device = "/dev/disk/by-uuid/D1B9-8019";
       fsType = "vfat";
-    options = [
+      options = [ "fmask=0077" "dmask=0077" ];
-      "fmask=0077"
-      "dmask=0077"
-    ];
     };
 
   swapDevices = [ ];

hosts/thea/lib/autheliaSnippets.nix

@@ -1,81 +0,0 @@
-{ pkgs }:
-{
-  proxy = pkgs.writeText "proxy.conf" ''
-    ## Headers
-    # proxy_set_header Host $host;
-    proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
-    proxy_set_header X-Forwarded-Proto $scheme;
-    proxy_set_header X-Forwarded-Host $http_host;
-    proxy_set_header X-Forwarded-URI $request_uri;
-    proxy_set_header X-Forwarded-Ssl on;
-    proxy_set_header X-Forwarded-For $remote_addr;
-  '';
-  authelia-location = pkgs.writeText "authelia-location.conf" ''
-    set $upstream_authelia http://192.168.1.12:9091/api/authz/auth-request;
-
-    ## Virtual endpoint created by nginx to forward auth requests.
-    location /internal/authelia/authz {
-        ## Essential Proxy Configuration
-        internal;
-        proxy_pass $upstream_authelia;
-
-        ## Headers
-        ## The headers starting with X-* are required.
-        proxy_set_header X-Original-Method $request_method;
-        proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
-        proxy_set_header X-Forwarded-For $remote_addr;
-        proxy_set_header Content-Length "";
-        proxy_set_header Connection "";
-
-        ## Basic Proxy Configuration
-        proxy_pass_request_body off;
-        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; # Timeout if the real server is dead
-        proxy_redirect http:// $scheme://;
-        proxy_http_version 1.1;
-        proxy_cache_bypass $cookie_session;
-        proxy_no_cache $cookie_session;
-        proxy_buffers 4 32k;
-        client_body_buffer_size 128k;
-
-        ## Advanced Proxy Configuration
-        send_timeout 5m;
-        proxy_read_timeout 240;
-        proxy_send_timeout 240;
-        proxy_connect_timeout 240;
-    }
-  '';
-  authelia-authrequest = pkgs.writeText "authelia-authrequest.conf" ''
-    ## Send a subrequest to Authelia to verify if the user is authenticated and has permission to access the resource.
-    auth_request /internal/authelia/authz;
-
-    ## Save the upstream metadata response headers from Authelia to variables.
-    auth_request_set $user $upstream_http_remote_user;
-    auth_request_set $groups $upstream_http_remote_groups;
-    auth_request_set $name $upstream_http_remote_name;
-    auth_request_set $email $upstream_http_remote_email;
-
-    ## Inject the metadata response headers from the variables into the request made to the backend.
-    proxy_set_header Remote-User $user;
-    proxy_set_header Remote-Groups $groups;
-    proxy_set_header Remote-Email $email;
-    proxy_set_header Remote-Name $name;
-
-    ## Configure the redirection when the authz failure occurs. Lines starting with 'Modern Method' and 'Legacy Method'
-    ## should be commented / uncommented as pairs. The modern method uses the session cookies configuration's authelia_url
-    ## value to determine the redirection URL here. It's much simpler and compatible with the mutli-cookie domain easily.
-
-    ## Modern Method: Set the $redirection_url to the Location header of the response to the Authz endpoint.
-    auth_request_set $redirection_url $upstream_http_location;
-
-    ## Modern Method: When there is a 401 response code from the authz endpoint redirect to the $redirection_url.
-    error_page 401 =302 $redirection_url;
-
-    ## Legacy Method: Set $target_url to the original requested URL.
-    ## This requires http_set_misc module, replace 'set_escape_uri' with 'set' if you don't have this module.
-    # set_escape_uri $target_url $scheme://$http_host$request_uri;
-
-    ## Legacy Method: When there is a 401 response code from the authz endpoint redirect to the portal with the 'rd'
-    ## URL parameter set to $target_url. This requires users update 'auth.shobu.fr/' with their external authelia URL.
-    # error_page 401 =302 https://auth.shobu.fr/?rd=$target_url;
-  '';
-}

hosts/thea/minecraft.nix

@@ -1,18 +1,9 @@
-{
+{pkgs, inputs, ...}:
-  pkgs,
-  inputs,
-  lib,
-  ...
-}:
 let
   modpack = pkgs.fetchPackwizModpack {
       url = "file:///${inputs.testing-grounds.modpack}/pack.toml";
     packHash = "sha256-+taYj4uroLNxM4Nia3n+5P1Y/g6dzE6Iq13TsZgk4mU=";
   };
-  gregpack = pkgs.fetchPackwizModpack {
-    url = "https://raw.githubusercontent.com/GregTechCEu/GregTech-Modern-Community-Pack/refs/heads/main/pack.toml";
-    packHash = "sha256-SE86gP15H/Aug6vTLmMxHuxF2/+iLmCI/wQlON1xasM=";
-  };
 in
 {
   imports = [ inputs.nix-minecraft.nixosModules.minecraft-servers ];
@@ -39,10 +30,4 @@ in
       };
     };
   };
-
-  networking.firewall.allowedTCPPorts = [
-    25865 # autismcraft
-    25665 # reclamation
-    25675 # reclamation
-  ];
 }

hosts/thea/nginx.nix

@@ -1,114 +1,46 @@
-{
+{inputs, ...}:
-  inputs,
-  pkgs,
-  lib,
-  ...
-}:
 let
-  # striped-front = inputs.striped-front;
+  striped-front = inputs.striped-front;
 
   sin-address = "192.168.1.14";
-  authelia-snippets = pkgs.callPackage ./lib/autheliaSnippets.nix { inherit pkgs; };
+in {
-in
-{
 
-  networking.firewall.allowedTCPPorts = [
+  networking.firewall.allowedTCPPorts = [ 80 443 8448 ];
-    80
-    443
-    8448
-  ];
 
   services.nginx = {
     enable = true;
     recommendedProxySettings = true;
     recommendedTlsSettings = true;
 
-    typesHashMaxSize = 512;
-    mapHashMaxSize = 512;
-
     virtualHosts = 
     let
-        mkVHost = host: port: {
-          "${host}" = {
-            enableACME = true;
-            forceSSL = true;
-
-            locations."/" = {
-              proxyPass = "http://${sin-address}:${port}";
-            };
-          };
-        };
       mkStarr = host: port: {
         "${host}" = {
           enableACME = true;
           forceSSL = true;
 
-            extraConfig = ''
-              include ${authelia-snippets.authelia-location};
-            '';
-
-            locations."/api" = {
-              proxyPass = "http://${sin-address}:${port}";
-              proxyWebsockets = true;
-              extraConfig = ''
-                proxy_ssl_server_name on;
-              '';
-            };
           locations."/" = {
             proxyPass = "http://${sin-address}:${port}";
             proxyWebsockets = true;
             extraConfig = ''
-                include ${authelia-snippets.proxy};
-                include ${authelia-snippets.authelia-authrequest};
-
               proxy_ssl_server_name on;
               proxy_read_timeout 4800s;
             '';
           }; 
         };
       };
-        withAuthelia =
-          vhost: location:
-          (builtins.mapAttrs (
-            name: value:
-            (lib.recursiveUpdate value {
-              extraConfig = (if value ? extraConfig then value.extraConfig else "") + ''
-                include ${authelia-snippets.authelia-location};
-              '';
-              locations."${location}".extraConfig =
-                (
-                  if value.locations."${location}" ? extraConfig then
-                    value.locations."${location}".extraConfig
-                  else
-                    ""
-                )
-                + ''
-                  include ${authelia-snippets.proxy};
-                  include ${authelia-snippets.authelia-authrequest};
-                '';
-            })
-          ) vhost);
-        withWebsockets =
-          vhost: location:
-          (builtins.mapAttrs (
-            name: value:
-            (lib.recursiveUpdate value {
-              locations."${location}".proxyWebsockets = true;
-            })
-          ) vhost);
     in
     (
-        (withWebsockets (mkVHost "jellyfin.shobu.fr" "8096") "/")
+      mkStarr "jellyfin.shobu.fr" "8096"
       // mkStarr "radarr.shobu.fr" "7878"
       // mkStarr "sonarr.shobu.fr" "8989"
       // mkStarr "prowlarr.shobu.fr" "9696"
       // mkStarr "bazarr.shobu.fr" "6767"
+      // mkStarr "jellyseerr.shobu.fr" "5055"
+      // mkStarr "fileshelter.shobu.fr" "5091"
       // mkStarr "lidarr.shobu.fr" "8686"
-        // mkStarr "whisparr.shobu.fr" "6969"
+      // mkStarr "transmission.shobu.fr" "9091"
-        // mkVHost "jellyseerr.shobu.fr" "5055"
+      // mkStarr "zimablade-admin.shobu.fr" "61208"
-        // mkVHost "transmission.shobu.fr" "9091"
-        // mkVHost "zimablade-admin.shobu.fr" "61208"
-        // (withWebsockets (withAuthelia (mkVHost "trilium.shobu.fr" "12783") "/") "/")
       // {
         "shobu.fr" = {
           enableACME = true;
@@ -145,12 +77,12 @@ in
             '';
           };
         };
-          # "striped.shobu.fr" = {
+        "striped.shobu.fr" = {
-          #   enableACME = true;
+          enableACME = true;
-          #   forceSSL = true;
+          forceSSL = true;
 
-          #   root = "${striped-front.packages.x86_64-linux.default}/dist";
+          root = "${striped-front.packages.x86_64-linux.default}/dist";
-          # };
+        };
         "dashboard.shobu.fr" = {
           enableACME = true;
           forceSSL = true;
@@ -171,19 +103,8 @@ in
           enableACME = true;
           forceSSL = true;
 
-            extraConfig = ''
-              # include ${authelia-snippets.authelia-location};
-              # error_log /var/log/nginx/debug_files.log debug;
-            '';
-
           locations."/" = {
             proxyPass = "http://${sin-address}:8086";
-              extraConfig = ''
-                # include ${authelia-snippets.proxy};
-                # include ${authelia-snippets.authelia-authrequest};
-                proxy_set_header X-Real-IP $remote_addr;
-                client_max_body_size 100M;
-              '';
           };
         };
         # "matrix.shobu.fr" = {

hosts/thea/ollama.nix

@@ -1,5 +1,4 @@
-{ inputs, ... }:
+{inputs, ...}: {
-{
   # virtualisation.docker = {
   #   enable = true;
   #   storageDriver = "btrfs";

hosts/thea/secrets/authelia-encryption.age

@@ -1,10 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 /uqj4A 9cZH/SlDpiluz2O3wCxRcBhmt3L5eN24I0HHwiJDWRU
-VVZaJlB4QzxBPcaN3MjCemjptEbqSUMD8VVtKyGezH8
--> ssh-ed25519 70Re8Q ZFEQxmnm+dFKSXcQAc0KxkewCB59J5FyL1Ob/uEEtVg
-fRdEZpIytxjUeSKPieIzvZaAn5Mikjp28HlZhKwzS7M
--> ssh-ed25519 QvCxGg ifsqXBKO0mqE1RuJ44Y7qDJ7lyci8iyz+J1xFgO38jI
-MkhMTZ+RttBFFMkbIaSCSQiExR1gf4OyFWHXIsx+QYQ
---- nnMlLyQjixpBkx+bSU5I364IP3KnZ0qnmMPueBcRHpU
-ë˜<EFBFBD>6TX—ÕÞÌfÁ““É
-®?Z7M<37>T<EFBFBD>Å|ÚQf

hosts/thea/secrets/authelia-session.age

@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 /uqj4A yxpGM3pJxfnM/5q9+NzdfG2kBjjNex6bdyUeZEBKjnI
-UO6ovn2cFeNi6SbcGpfF71/OAyQccyG+l6aZXubUal8
--> ssh-ed25519 70Re8Q GW40lmeg6Lj7ntZswT0/hWZFpYBWoV3CMq4pdo+Ncgc
-oWTYuM/s3G7EKPWPQpHbXo9Tpzgn7YlYVQHYGn4xKS8
--> ssh-ed25519 QvCxGg pKLpxtuMIa0xPXoaeb4WeQWVEINRE/j4nrxDB1J9BUI
-1azpt5MImTiDSF+Ts9EvUCdWMeVG7lErUHSBQfMiip4
---- IOOR8Us6zlZhJm0V4X3IlbkHSdtR3GLLxEfa4i+lqv0
-ó P¬¥rhé"BFãŽÌŸtÌ€ê¤{¾(öB`q“Óø"AµnN_ ™f*ÏŒºvPpj&{)ìŠØ@‹ÃkF«Ú
]<Aš*Á<>‡<EFBFBD>´WTm”ƪD‡,Ý1E­™”¦³eѨ·O¢š

hosts/thea/secrets/default.nix

@@ -1,3 +0,0 @@
-{ ... }:
-{
-}

hosts/thea/shares.nix

@@ -1,5 +1,4 @@
-{ ... }:
+{...}: let
-let
   sin-address = "192.168.1.14";
 in
 {

hosts/thea/striped/back.nix

@@ -1,8 +1,7 @@
 {inputs, ...}:
 let
   striped-back = inputs.striped-back;
-in
+in {
-{
   imports = [
     striped-back.nixosModules.default
   ];

hosts/thea/striped/default.nix

@@ -1,5 +1,4 @@
-{ striped-back, striped-front, ... }:
+{striped-back, striped-front, ...}:{
-{
   imports = [
     ./back.nix
   ];

modules/gitea/sin/default.nix

@@ -1,8 +1,6 @@
-{ lib, ... }:
+{lib, ...}: let
-let
   ssh_port = 24658;
-in
+in {
-{
   services = {
     gitea = {
       enable = true;

modules/gitea/thea/default.nix

@@ -1,56 +1,12 @@
-{
+{nodes, ...}:let
-  nodes,
-  inputs,
-  pkgs,
-  ...
-}:
-let
   sin-address = "192.168.1.14";
-  unstable = import inputs.unstable { system = pkgs.system; };
+in{
-in
-{
   imports = [
     ./virtualisation.nix
   ];
-  networking.nat.forwardPorts = [
+  networking.nat.forwardPorts = [{
-    {
     sourcePort = nodes.sin.config.services.gitea.settings.server.SSH_PORT;
     proto = "tcp";
     destination = "${sin-address}:22";  
-    }
+  }];
-  ];
-
-  services.gitea-actions-runner.package = unstable.gitea-actions-runner;
-
-  # services.gitea-actions-runner.instances = {
-  #   "gitea.shobu.fr-runner" = {
-  #     enable = true;
-  #     name = "gitea.shobu.fr-runner";
-  #     url = nodes.sin.config.services.gitea.settings.server.ROOT_URL;
-  #     token = "uEDPBW6Z9oItAKRtloVwis0LkPbD4OmV2w5esOhW";
-  #     labels = [
-  #       "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
-  #     ];
-  #     settings = {
-  #       cache = {
-  #         # Enable cache server to use actions/cache.
-  #         enabled = true;
-  #         # The directory to store the cache data.
-  #         # If it's empty, the cache data will be stored in $HOME/.cache/actcache.
-  #         dir = "";
-  #         # The host of the cache server.
-  #         # It's not for the address to listen, but the address to connect from job containers.
-  #         # So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
-  #         host = "";
-  #         # The port of the cache server.
-  #         # 0 means to use a random available port.
-  #         port = 0;
-  #         # The external cache server URL. Valid only when enable is true.
-  #         # If it's specified, act_runner will use this URL as the ACTIONS_CACHE_URL rather than start a server by itself.
-  #         # The URL should generally end with "/".
-  #         external_server = "";
-  #       };
-  #     };
-  #   };
-  # };
 }

modules/gitea/thea/virtualisation.nix

@@ -1,5 +1,4 @@
-{ nodes, pkgs, ... }:
+{nodes, pkgs, ...}: {
-{
   systemd.sockets.podman.socketConfig.Symlinks = [
     "/run/docker.sock"
   ];
@@ -16,23 +15,15 @@
     };
   };
 
-  environment.systemPackages = with pkgs; [
+  virtualisation.oci-containers.containers = let
-    podman-compose
-  ];
-
-  virtualisation.oci-containers.containers =
-    let
     runner_config = pkgs.writeTextFile {
       name = "config.yml";
       text = ''
           container:
             network: "host"
-            valid_volumes:
-              - "/var/nix/hosted-store"
         '';
     };
-    in
+  in {
-    {
     gitea-runner = {
       image = "gitea/act_runner@sha256:8477d5b61b655caad4449888bae39f1f34bebd27db56cb15a62dccb3dcf3a944";
       autoStart = true;

scripts/upload-to-cache.sh

@@ -1,11 +0,0 @@
-#!/bin/sh
-set -eu
-set -f
-
-if ! nix --version; then
-  exit 0
-fi
-
-export IFS=' '
-echo "Uploading paths" $OUT_PATHS
-exec nix copy --to "ssh://root@localhost" $OUT_PATHS