Update flake.lock 2025-04-28

.sops.yaml

@@ -17,3 +17,10 @@ creation_rules:
     - age:
       - *primary
       - *builder-ssh
+
+  - path_regex: features-nixos/optional/k9s/kubeconfig.secret.yaml$
+    key_groups:
+    - age:
+      - *primary
+      - *aspi-ssh
+      - *kardorf-ssh

features-nixos/optional/k9s/default.nix

@@ -0,0 +1,18 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  environment.systemPackages = with pkgs; [
+    kubectl
+    k9s
+  ];
+
+  sops.secrets.kubeconfig = {
+    sopsFile = ./kubeconfig.secret.yaml;
+    format = "binary";
+    owner = config.users.users.julian.name;
+    group = config.users.users.julian.group;
+  };
+  environment.variables.KUBECONFIG = config.sops.secrets."kubeconfig".path;
+}

features-nixos/optional/k9s/kubeconfig.secret.yaml

@@ -0,0 +1,22 @@
+{
+	"data": "ENC[AES256_GCM,data:nq2czkXqOhjRECF9kASPiBCiz1I7LQLljTV+LkrBp4+BH92YTV6ywRyerNoTDmaBmnY+fuhdnPkN7Q9jjT1SNGLIxBG4b6gOpzgr3amhfNAW3MAUUcPuqNsk0EZ4ZJiUluPCvRtAKHyXsrQpN8P04Rg0OjHoxCrOgKjmODr14QNiQH4RAONSai76dRgRBMQs0PIzcAiMSkwKc0OgBYTccSspV7DlulA3ngv0LuUavKS6QoJ4DuCnFgOu5KHGLQS0ww+Ijp1wAx/4/tq8Iimdn968uvzFjrZATb3bHVjHSR/cbNRCJn6GrpqFCNdpI5OPw3P9f9rodXZKai/bESu2aC8Dlya2by29lCPHkg5lp6atZA8ksnj9brYsFUb6xKPUAPGDElBaUEf+LidsZlI6hAz98/uf3bwyqq22+gMkfKUM1pX1YOtyTq+5eMSn0kBuSVupvEDJaO/G/YlTUDvJL0CzwO0hLzzotLrGcqhvYqjHCr2XhIER+YgYA7D22iml5YOLRxp5RQd3sj74hUGWJkGq1p/uhniaOvrjF0zmQsqHFC4+jUNBKVMVVTLBX/AdL45Lv+HDM4jYCvtNIKAGtTGT71cplhBI2xP1s607NiIbUsSY+2qayh3INOP7qGWwpYquYe/xAk6KZMu1/UuvneVqOjqlcJFOpLqydPnP0oQRy1dtCcJsvT5nv0QEI+Tr24Dbn3tX8fmc8EzZwpmEyHto7nYzHFicgvmYavmTHkmbzySDMI03ktZ7EdM0unlNe9EmR8YyGeg7tmG4bKx9K+7qs0Piqq03gHwN9L92O80J8jiKu8MDURWywYPYHUmCKYbkHh5en1qvyFTU7dDI7L+gdp9+VSqJrkQqPbWAouMBlLE0664lTpzmYQOXWo8riwjYPllkd8EqCaKxrMMHp4Y46X69lsZS1mImuHac3xJV57r6A+mMJajGW92KI13416rwG9sXS1ynNdBTi9+P/1f3Sy8B6ypYa1BP/6+tHqghNAuz5aaKZJnsCWYMAk6y5AuFaZ2ZkO1ruSfdPmyjKoMcp/qO5nmHxF+0h+teSuvLeCb7KrL80IlKElgDINlPYHDVtaoYVv4sZAWhSNJSOUWRbue3bJaqhKz3xOdq5lJy7H3P+MQF8YFgoY7Po4EcXqTP8Upm3tIehPr7BJXNIv6beDPwpMZrvVKqVIgsXD85DqyA1Mh7k5gQpB4uAhZfRUQ8T4reVumjOnGakXh+1DcFPYJumScCP1/68btIYGYJiPJTJhL7/U+12siGzzXXZeaJ7NpCzpvpgmFvoMfV+gFgrAUkb2+eSeEI6BNRjfXWc5NM03RQqotqW4E3Ui+gYbwU0D9/8b5UsRc4IiujnZFSKbCZGGHm79Yrm8IhtTuVyQV67/NeuRfIcJuPPmYGS8nnX8v7pymlagm/43sFHpupsrgeVStsLl1asKJanA6Njus/YA3zrdmgKb1kMK6ALBc73WaT9S+4aZeKB8A6jA5PD2GAgW/T5jaHxi0VPisg0eChKtJfhJVFoZFE+U2fx2YrTeC/joSdS4jqTKaqwDgJ19d5Wvs8ZDQDjHo5I8uUArWODTW/H8An9zp8jsEN6bS1mBeta8qhkz2v9diBUFwmDvmGNX5REirrm3bkqWF2xx6NEiDARTUVAf+fh9VQaQQKK2sQ35zjaAbI4aXmDTI9vy8aFs+6MvJ/iiIwKkjVgZYmyiUVtHy6ZRGwdzgpuOAcoYRxGHaDYIEL33nDQclLmgUwWAfbc0bTI1rvaIzZ25nZ6n4aFFtpANJHTtYeMrAAl1Sho0dio6clM7/k4XST5GA4BqDlRs/Oze4yNjjQb5WoYrBCFEuVcypvRBmLEbM3XOK1sHdQAEAqey/ZfhfNhAVeapVw3ir4E2jsX9pAqlTjH4YkrIURhG05yPb2D3+WMKGAoC4yyusd7siz6tJ4uXvFXkTeOjXMM/Xo/dBnm2J1FPHr9msELIxhtG046/m+I/MEaF6Hg9XC2CZrlxi5OsH61PGBOLLNVFiQ8NaPChHRppQEH1y1GSN+5FinxTK0R5GS3PxN15NZXjmMsj+ixYmbWjkJJXn2bDM7Muv7PRetpcMhU0UIr75+6MWbwPy6v62IsDoQCOslnQVbGc/oHY47EoZ7lKbuulP0ZvQOQxGNvcOtbVc0dJHdFUTgrPxpkCyOQ4NGSLSah1qzDP5j4Fq4ag+OdITPQpDdX6TkiufGfFqq7C5GNHDK8olYKGwH3D0GCGT8o9pFx+FIeRapaWJHkcPibDMyu3KumRy04HF1ih2Z6IoWFHa532pgsK9FlAMGHeqtL/LXWZKtLONR6wNU8DxfbIhV+lUlvbbs27VMj0VHXMXdYnbvGvXOPkb4iP4Pm+HQU4AF3ROA7rtWtrL401Qpdbln5qLEWz9hKCXbM1MbvpGvNvHKckKAWpKmCsVWY8oPCNOqqWAZF5sfrlLb4fULOXg0YQCeobo3O9DZjPf/D/ki6OX5KEgYlqikKdd9hR1d5koyt0bunuFHty2guh8oaUsPjJbcuSCLz80HND9j12msuG13qFWvf77rUiE3WZ5aTSGWh7VB/lUofuEn+aTaGBK7iLAj2PU+/YQUmEFAWaIXOdq7fumHgVdsBRThXvqf7RHD+ZkpMq3D0wsnCwIgCGvxH76ah1wZzPm0lg/tecL294e8ICDuQw+pyOVj96vMdiNF31ADd1BZCO505Y7jsEFdJCJvCGXNNvTr+ir4Vh9RdwBOXxxpX9DcQaaruVQ9nCty/ikBJ04Qok6ZVV8XXbN+HNu8iGVpLNrj1E1rRAJmeqfKiDuiG6ABqLDtq9beMS9K2xhKvwjG/z+AD3v6djipkdYjjlDOV6WNxWWv74LlzjSC9Se9ERATZfCj5U06LHO1yg8y+uIvRyoWIEaAFG7aFrEvfDH6OfzbhutGDMoxBThzKhxPDq9pm/N4cBcoRwGKgrlYmjLIl5Full/ArbLN1C6EXABn9Bu6lL7VrhwSj+HC0sp1vJb3ECmvtD7lzZsqejf4p6P/FPKLHUBNVr6sTJ9fHtOaYFi7DxQONqM/yoPBLB/TeZnB0KFFfKkCNM7YDOZjQ/UZscOZxztcYc7TeQ8dA0ZUfto=,iv:ZgZWZAQZmYUs0EqZuoTCTWQ52CnuSTS+zdIuIA1UNOM=,tag:vbI3RDpvU+X1xQo+lT7WbA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvMVNBZDd4VndET2pMVjVr\nNkw4aW9HckJXYU0yREoyZ09oZ3JKSVlsQ3c4CkFRWURVN2tmOXNTZHhOdS91QW5a\nRlhhSDI3c2dHVVlTLzB3NjA4c1J2UncKLS0tIHFaL21rRWNpeGlqd0pIaXU5WFRP\neTZSOHpBTTE3ZjFIbXRuSnJjdlEwSXcKqWIxCnWJvE058ojm2RrwzXkTWQLZbE7L\nXPisgwudwY+vFaTziubbPp/U9P3LXs3oFhPSqgiuCkDNLETFkpw1ng==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1ee5udznhadk6m7jtglu4709rep080yjyd2ukzdl8jma4mm92y3psv0slpg"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHZHc0TzJKNzBUSG9GajVr\nazFWSS96Z3VXdDZOM2hPdVB4QTRhOEtVNDNRCmJkWm1TUGRwb0hpS1BBWm5WcURx\nQ21idzVZZzR5U0o3eDM1NmwySFpGQzAKLS0tIG51ZndsSDI1N2M4b280SW53eEF0\nMStNSU9odzRhY05SL05RYWlpaUlFQUkKoxVqeqZ9xAR4+JMcJXdEq0cq2CkZz63/\nSjwNDdCHjePc62yj5Qyw15zLrL2t7jvLUG44kPUbDuOIVwMH2KV2hQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1q8lc5340gz5xw2f57nglrss68wv0j0hf36py2pdtrl6ky3yrq9qqk0njr4"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYd1ZJTUtLbzY4d1hSRDA1\ndHdRQnhhUHVFMDJVOUQ0VFZCeW40S0lFODBJCmFvRSsyRkI3MDFGeDdkeGRSTVh5\nTEdwQTBWVVlwSjZHWXpoN0xzb0tuR1kKLS0tIEpvVU0rVTRWQUxLNW9zMFo3cVBr\ncGYxemF6MHlBS1dqSXM3aXRTZmdHQWMKjEcJJXRKCber6afB11j1VmWM3dObm45u\nkZ+E3bK1zd/L6YoLr1jF7GP9b62GjTG9Qv1M/JdKM4qlY//GmW6IIQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age15lxw97z03q40xrdscnxqqugh5ky5aqrerg2t2rphkcqm6rnllurq8v98q5"
+			}
+		],
+		"lastmodified": "2026-06-18T18:37:59Z",
+		"mac": "ENC[AES256_GCM,data:UXFXrUrbmyp+MnBNDKKr4FP0WFhWH97W68KXlE/UzEvBVpeHste92UPzdX4FMk2rEd7ldsMcTV9hmRavWI5v/Y/y/hzuhdCkqsYfnixS15Z9PrfuFX6YjrpeoJ84s1itmhjimKe4mmXt/aND8DLJ49rQ/A1hebJ2UndBlsRIGmc=,iv:YJPVWuajQ0tzhuoIBcWw8Wy5IBy+HC0JcR69gelGzGM=,tag:YW0STCsswNaqjKBta1OwyQ==,type:str]",
+		"version": "3.13.1"
+	}
+}

homes/julian/features/hyprland/hyprland.lua

@@ -63,7 +63,7 @@ hl.config({
 		border_size = 2,
 
 		-- Set to true to enable resizing windows by clicking and dragging on borders and gaps
-		resize_on_border = true,
+		resize_on_border = false,
 
 		-- Please see https://wiki.hypr.land/Configuring/Advanced-and-Cool/Tearing/ before you turn this on
 		allow_tearing = false,

homes/julian/features/hyprland/noctalia.json

@@ -12,14 +12,14 @@
     "widgetSpacing": 6,
     "contentPadding": 2,
     "fontScale": 1,
-    "enableExclusionZoneInset": true,
+    "enableExclusionZoneInset": false,
     "backgroundOpacity": 1,
     "useSeparateOpacity": false,
     "marginVertical": 4,
     "marginHorizontal": 4,
     "frameThickness": 8,
     "frameRadius": 12,
-    "outerCorners": true,
+    "outerCorners": false,
     "hideOnOverview": false,
     "displayMode": "always_visible",
     "autoHideDelay": 500,
@@ -121,9 +121,7 @@
           "useCustomFont": false
         },
         {
-          "blacklist": [
+          "blacklist": [],
-            "nm-applet"
-          ],
           "chevronColor": "none",
           "colorizeIcons": false,
           "drawerEnabled": false,
@@ -524,7 +522,7 @@
     ]
   },
   "notifications": {
-    "enabled": true,
+    "enabled": false,
     "enableMarkdown": false,
     "density": "default",
     "monitors": [],

hosts/aspi/default.nix

@@ -21,6 +21,7 @@
     "${pwd}/features-nixos/optional/wireguard.nix"
     "${pwd}/features-nixos/optional/wireshark.nix"
     "${pwd}/features-nixos/optional/flatpak.nix"
+    "${pwd}/features-nixos/optional/k9s"
 
     "${pwd}/features-nixos/optional/avahi.nix"
   ];

hosts/aspi/hardware-configuration.nix

@@ -75,4 +75,9 @@
   powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
   hardware.nvidia.open = false;
+
+  hardware.bluetooth = {
+    enable = true;
+    powerOnBoot = true;
+  };
 }

hosts/builder/default.nix

@@ -102,17 +102,17 @@
   };
 
   # Ollama used by open-webui as llm backend
-  services.ollama = {
+  # services.ollama = {
-    enable = true;
+  #   enable = true;
-    # acceleration = "rocm";
+  #   # acceleration = "rocm";
-    openFirewall = true;
+  #   openFirewall = true;
-  };
+  # };
 
-  services.nextjs-ollama-llm-ui = {
+  # services.nextjs-ollama-llm-ui = {
-    enable = true;
+  #   enable = true;
-    hostname = "192.168.3.118";
+  #   hostname = "192.168.3.118";
-    port = 3001;
+  #   port = 3001;
-  };
+  # };
   # services.open-webui = {
   #   enable = true;
   #   port = 8080;
@@ -248,15 +248,28 @@
     name = "builder";
     tokenFile = config.sops.secrets."gitea_token".path;
     labels = [
-      # provide a debian base with nodejs for actions
-      "debian-latest:docker://node:18-bullseye"
       # fake the ubuntu name, because node provides no ubuntu builds
-      "ubuntu-latest:docker://node:18-bullseye"
+      "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+      # my custom nix+devenv ci container
+      "nix-ci:docker://gitlab.julian-mutter.de/julian/nix-ci-container:latest"
       # devenv
       "devenv:docker://ghcr.io/cachix/devenv/devenv:latest"
       # provide native execution on the host
       "nixos:host"
     ];
+    # Packages are intjected into PATH for "nixos:host"
+    hostPackages = with pkgs; [
+      bash
+      coreutils
+      curl
+      gawk
+      gitMinimal
+      nodejs # Required by many standard actions (like actions/checkout)
+      docker
+      devenv
+      wget
+      nix
+    ];
   };
 
   virtualisation.docker.enable = true;