Update flake.lock 2025-04-28

Normally I wont have VPN access on standalone

.sops.yaml

@@ -1,7 +1,7 @@
 keys:
   - &primary age1ee5udznhadk6m7jtglu4709rep080yjyd2ukzdl8jma4mm92y3psv0slpg
   - &aspi-ssh age1q8lc5340gz5xw2f57nglrss68wv0j0hf36py2pdtrl6ky3yrq9qqk0njr4
-  - &pianonix-ssh age1hsmfz8fjxu83sax9lr487h8xr6cyge0apdq4zpge4c8jpcjj2cksj825ct
+  - &pianonix-ssh age1tguyu2yd5xv8rgjjl50cq6dq5rr7umqgv098dgre4u9wyj30ea7sexw62c
   - &builder-ssh age1kw4kmdm45zprvdkrrpvgq966l7585vhusmum083qlwnr0xxgd3uqatcyja
   - &kardorf-ssh age15lxw97z03q40xrdscnxqqugh5ky5aqrerg2t2rphkcqm6rnllurq8v98q5
 
@@ -20,7 +20,7 @@ creation_rules:
       - *primary
       - *builder-ssh
 
-  - path_regex: hosts/pianonix/secrets.yaml$
+  - path_regex: hosts/pianonix/secrets*
     key_groups:
     - age:
       - *primary

Readme.org

@@ -24,7 +24,7 @@ sops edit secrets/secrets.yaml
 ** Authorize new device
 - Generate public key from ssh -> Private age key generation not needed
 #+begin_src sh
-ssh-to-age < /etc/ssh/ssh_host_ed25519_key
+ssh-to-age < /etc/ssh/ssh_host_ed25519_key.pub
 #+end_src
 - Add age public key to file:.sops.yaml
 - Update keys

flake.lock

@@ -1,5 +1,54 @@
 {
   "nodes": {
+    "alacritty-theme": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1745230862,
+        "narHash": "sha256-TFomYP13Wa2VSoxKGKaTDyIj8K1/Oi4LOhR93z07Ot4=",
+        "owner": "alacritty",
+        "repo": "alacritty-theme",
+        "rev": "0520b1f8f3eb25678444c0817a97636b6601ac85",
+        "type": "github"
+      },
+      "original": {
+        "owner": "alacritty",
+        "repo": "alacritty-theme",
+        "type": "github"
+      }
+    },
+    "aquamarine": {
+      "inputs": {
+        "hyprutils": [
+          "hyprland",
+          "hyprutils"
+        ],
+        "hyprwayland-scanner": [
+          "hyprland",
+          "hyprwayland-scanner"
+        ],
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1744289235,
+        "narHash": "sha256-ZFkHLdimtFzQACsVVyZkZlfYdj4iNy3PkzXfrwmlse8=",
+        "owner": "hyprwm",
+        "repo": "aquamarine",
+        "rev": "c8282f4982b56dfa5e9b9f659809da93f8d37e7a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "aquamarine",
+        "type": "github"
+      }
+    },
     "base16-schemes": {
       "flake": false,
       "locked": {
@@ -38,11 +87,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1756719547,
+        "lastModified": 1762286984,
-        "narHash": "sha256-N9gBKUmjwRKPxAafXEk1EGadfk2qDZPBQp4vXWPHINQ=",
+        "narHash": "sha256-9I2H9x5We6Pl+DBYHjR1s3UT8wgwcpAH03kn9CqtdQc=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "125ae9e3ecf62fb2c0fd4f2d894eb971f1ecaed2",
+        "rev": "9c870f63e28ec1e83305f7f6cb73c941e699f74f",
         "type": "github"
       },
       "original": {
@@ -51,6 +100,48 @@
         "type": "github"
       }
     },
+    "devshell": {
+      "inputs": {
+        "nixpkgs": [
+          "nix-topology",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1728330715,
+        "narHash": "sha256-xRJ2nPOXb//u1jaBnDP56M7v5ldavjbtR6lfGqSvcKg=",
+        "owner": "numtide",
+        "repo": "devshell",
+        "rev": "dd6b80932022cea34a019e2bb32f6fa9e494dfef",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "devshell",
+        "type": "github"
+      }
+    },
+    "devshell_2": {
+      "inputs": {
+        "nixpkgs": [
+          "nixvim",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1741473158,
+        "narHash": "sha256-kWNaq6wQUbUMlPgw8Y+9/9wP0F8SHkjy24/mN3UAppg=",
+        "owner": "numtide",
+        "repo": "devshell",
+        "rev": "7c9e793ebe66bcba8292989a68c0419b737a22a0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "devshell",
+        "type": "github"
+      }
+    },
     "disko": {
       "inputs": {
         "nixpkgs": [
@@ -58,11 +149,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758287904,
+        "lastModified": 1745502102,
-        "narHash": "sha256-IGmaEf3Do8o5Cwp1kXBN1wQmZwQN3NLfq5t4nHtVtcU=",
+        "narHash": "sha256-LqhRwzvIVPEjH0TaPgwzqpyhW6DtCrvz7FnUJDoUZh8=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "67ff9807dd148e704baadbd4fd783b54282ca627",
+        "rev": "ca27b88c88948d96feeee9ed814cbd34f53d0d70",
         "type": "github"
       },
       "original": {
@@ -111,11 +202,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759362264,
+        "lastModified": 1763759067,
-        "narHash": "sha256-wfG0S7pltlYyZTM+qqlhJ7GMw2fTF4mLKCIVhLii/4M=",
+        "narHash": "sha256-LlLt2Jo/gMNYAwOgdRQBrsRoOz7BPRkzvNaI/fzXi2Q=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "758cf7296bee11f1706a574c77d072b8a7baa881",
+        "rev": "2cccadc7357c0ba201788ae99c4dfa90728ef5e0",
         "type": "github"
       },
       "original": {
@@ -196,6 +287,116 @@
         "type": "github"
       }
     },
+    "flake-utils_5": {
+      "inputs": {
+        "systems": "systems_7"
+      },
+      "locked": {
+        "lastModified": 1694529238,
+        "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "ff7b65b44d01cf9ba6a71320833626af21126384",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "git-hooks": {
+      "inputs": {
+        "flake-compat": [
+          "nixvim",
+          "flake-compat"
+        ],
+        "gitignore": "gitignore_3",
+        "nixpkgs": [
+          "nixvim",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1742649964,
+        "narHash": "sha256-DwOTp7nvfi8mRfuL1escHDXabVXFGT1VlPD1JHrtrco=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "dcf5072734cb576d2b0c59b2ac44f5050b5eac82",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "hyprland",
+          "pre-commit-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
+    "gitignore_2": {
+      "inputs": {
+        "nixpkgs": [
+          "nix-topology",
+          "pre-commit-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
+    "gitignore_3": {
+      "inputs": {
+        "nixpkgs": [
+          "nixvim",
+          "git-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -203,32 +404,322 @@
         ]
       },
       "locked": {
-        "lastModified": 1758463745,
+        "lastModified": 1745557122,
-        "narHash": "sha256-uhzsV0Q0I9j2y/rfweWeGif5AWe0MGrgZ/3TjpDYdGA=",
+        "narHash": "sha256-eqSo9ugzsqhFgaDFYUZj943nurlX4L6f+AW0skJ4W+M=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3b955f5f0a942f9f60cdc9cacb7844335d0f21c3",
+        "rev": "dd26f75fb4ec1c731d4b1396eaf4439ce40a91c1",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-25.05",
+        "ref": "release-25.11",
         "repo": "home-manager",
         "type": "github"
       }
     },
     "impermanence": {
       "locked": {
-        "lastModified": 1737831083,
+        "lastModified": 1744743431,
-        "narHash": "sha256-LJggUHbpyeDvNagTUrdhe/pRVp4pnS6wVKALS782gRI=",
+        "narHash": "sha256-iyn/WBYDc7OtjSawbegINDe/gIkok888kQxk3aVnkgg=",
         "owner": "nix-community",
-        "repo": "impermanence",
+        "repo": "home-manager",
-        "rev": "4b3e914cdf97a5b536a889e939fb2fd2b043a170",
+        "rev": "c61bfe3ae692f42ce688b5865fac9e0de58e1387",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "repo": "impermanence",
+        "ref": "release-24.11",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "hyprcursor": {
+      "inputs": {
+        "hyprlang": [
+          "hyprland",
+          "hyprlang"
+        ],
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1742215578,
+        "narHash": "sha256-zfs71PXVVPEe56WEyNi2TJQPs0wabU4WAlq0XV7GcdE=",
+        "owner": "hyprwm",
+        "repo": "hyprcursor",
+        "rev": "2fd36421c21aa87e2fe3bee11067540ae612f719",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprcursor",
+        "type": "github"
+      }
+    },
+    "hyprgraphics": {
+      "inputs": {
+        "hyprutils": [
+          "hyprland",
+          "hyprutils"
+        ],
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1745015490,
+        "narHash": "sha256-apEJ9zoSzmslhJ2vOKFcXTMZLUFYzh1ghfB6Rbw3Low=",
+        "owner": "hyprwm",
+        "repo": "hyprgraphics",
+        "rev": "60754910946b4e2dc1377b967b7156cb989c5873",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprgraphics",
+        "type": "github"
+      }
+    },
+    "hyprland": {
+      "inputs": {
+        "aquamarine": "aquamarine",
+        "hyprcursor": "hyprcursor",
+        "hyprgraphics": "hyprgraphics",
+        "hyprland-protocols": "hyprland-protocols",
+        "hyprland-qtutils": "hyprland-qtutils",
+        "hyprlang": "hyprlang",
+        "hyprutils": "hyprutils",
+        "hyprwayland-scanner": "hyprwayland-scanner",
+        "nixpkgs": "nixpkgs_2",
+        "pre-commit-hooks": "pre-commit-hooks",
+        "systems": "systems_2",
+        "xdph": "xdph"
+      },
+      "locked": {
+        "lastModified": 1745795931,
+        "narHash": "sha256-i4zlEa2lnANuOZA1aA/X0cNGM7x9MLZqqmKP6fwfPEA=",
+        "owner": "hyprwm",
+        "repo": "Hyprland",
+        "rev": "f5c5cfa960c157c8df50b496f621290234ac4505",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "Hyprland",
+        "type": "github"
+      }
+    },
+    "hyprland-plugins": {
+      "inputs": {
+        "hyprland": [
+          "hyprland"
+        ],
+        "nixpkgs": [
+          "hyprland-plugins",
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland-plugins",
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1745610646,
+        "narHash": "sha256-R8rWH3oFV5/jwl87t7HyVoFgndrPw8QR/2pLwyKJLYM=",
+        "owner": "hyprwm",
+        "repo": "hyprland-plugins",
+        "rev": "61ab0385c8d9d456bf89539c76dd9e73becefde3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprland-plugins",
+        "type": "github"
+      }
+    },
+    "hyprland-protocols": {
+      "inputs": {
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1743714874,
+        "narHash": "sha256-yt8F7NhMFCFHUHy/lNjH/pjZyIDFNk52Q4tivQ31WFo=",
+        "owner": "hyprwm",
+        "repo": "hyprland-protocols",
+        "rev": "3a5c2bda1c1a4e55cc1330c782547695a93f05b2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprland-protocols",
+        "type": "github"
+      }
+    },
+    "hyprland-qt-support": {
+      "inputs": {
+        "hyprlang": [
+          "hyprland",
+          "hyprland-qtutils",
+          "hyprlang"
+        ],
+        "nixpkgs": [
+          "hyprland",
+          "hyprland-qtutils",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "hyprland-qtutils",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1737634706,
+        "narHash": "sha256-nGCibkfsXz7ARx5R+SnisRtMq21IQIhazp6viBU8I/A=",
+        "owner": "hyprwm",
+        "repo": "hyprland-qt-support",
+        "rev": "8810df502cdee755993cb803eba7b23f189db795",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprland-qt-support",
+        "type": "github"
+      }
+    },
+    "hyprland-qtutils": {
+      "inputs": {
+        "hyprland-qt-support": "hyprland-qt-support",
+        "hyprlang": [
+          "hyprland",
+          "hyprlang"
+        ],
+        "hyprutils": [
+          "hyprland",
+          "hyprland-qtutils",
+          "hyprlang",
+          "hyprutils"
+        ],
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1739048983,
+        "narHash": "sha256-REhTcXq4qs3B3cCDtLlYDz0GZvmsBSh947Ub6pQWGTQ=",
+        "owner": "hyprwm",
+        "repo": "hyprland-qtutils",
+        "rev": "3504a293c8f8db4127cb0f7cfc1a318ffb4316f8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprland-qtutils",
+        "type": "github"
+      }
+    },
+    "hyprlang": {
+      "inputs": {
+        "hyprutils": [
+          "hyprland",
+          "hyprutils"
+        ],
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1744468525,
+        "narHash": "sha256-9HySx+EtsbbKlZDlY+naqqOV679VdxP6x6fP3wxDXJk=",
+        "owner": "hyprwm",
+        "repo": "hyprlang",
+        "rev": "f1000c54d266e6e4e9d646df0774fac5b8a652df",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprlang",
+        "type": "github"
+      }
+    },
+    "hyprutils": {
+      "inputs": {
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1743950287,
+        "narHash": "sha256-/6IAEWyb8gC/NKZElxiHChkouiUOrVYNq9YqG0Pzm4Y=",
+        "owner": "hyprwm",
+        "repo": "hyprutils",
+        "rev": "f2dc70e448b994cef627a157ee340135bd68fbc6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprutils",
+        "type": "github"
+      }
+    },
+    "hyprwayland-scanner": {
+      "inputs": {
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1739870480,
+        "narHash": "sha256-SiDN5BGxa/1hAsqhgJsS03C3t2QrLgBT8u+ENJ0Qzwc=",
+        "owner": "hyprwm",
+        "repo": "hyprwayland-scanner",
+        "rev": "206367a08dc5ac4ba7ad31bdca391d098082e64b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprwayland-scanner",
         "type": "github"
       }
     },
@@ -320,7 +811,29 @@
         "type": "github"
       }
     },
-    "nix-gl": {
+    "nix-darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "nixvim",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1743127615,
+        "narHash": "sha256-+sMGqywrSr50BGMLMeY789mSrzjkoxZiu61eWjYS/8o=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "fc843893cecc1838a59713ee3e50e9e7edc6207c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnl7",
+        "ref": "nix-darwin-24.11",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
+    "nix-ld": {
       "inputs": {
         "flake-utils": "flake-utils_2",
         "nixpkgs": [
@@ -328,11 +841,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752054764,
+        "lastModified": 1744621833,
-        "narHash": "sha256-Ob/HuUhANoDs+nvYqyTKrkcPXf4ZgXoqMTQoCK0RFgQ=",
+        "narHash": "sha256-II6a32kRc+KbLhU/jS8EbuXYt1PNCvsRvuBw2becgQM=",
-        "owner": "nix-community",
+        "owner": "Mic92",
-        "repo": "nixgl",
+        "repo": "nix-ld",
-        "rev": "a8e1ce7d49a149ed70df676785b07f63288f53c5",
+        "rev": "9a3812797e25def1d4aed62b517606b7b93989dc",
         "type": "github"
       },
       "original": {
@@ -349,11 +862,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754476755,
+        "lastModified": 1745506915,
-        "narHash": "sha256-vSF0VMEmPMzwNkrXIZwkhOSYmKES9BaDK/LlEe7/q8E=",
+        "narHash": "sha256-ZonLQ5fDqRRbvHVwf4P53ktwUG2e+OTexXvbxyxForI=",
         "owner": "doronbehar",
         "repo": "nix-matlab",
-        "rev": "0e9c9fb660f9e1a1e4d59fd083e0212a15b513e2",
+        "rev": "68da9ca66d2e6c51c45e71d624c8bf0ca20846fb",
         "type": "gitlab"
       },
       "original": {
@@ -362,13 +875,36 @@
         "type": "gitlab"
       }
     },
+    "nix-topology": {
+      "inputs": {
+        "devshell": "devshell",
+        "flake-utils": "flake-utils_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pre-commit-hooks": "pre-commit-hooks_2"
+      },
+      "locked": {
+        "lastModified": 1744142264,
+        "narHash": "sha256-h5KyodobZm8dx/HSNN+basgdmjxrQxudjrss4gAQpZk=",
+        "owner": "oddlama",
+        "repo": "nix-topology",
+        "rev": "f49121cbbf4a86c560638ade406d99ee58deb7aa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oddlama",
+        "repo": "nix-topology",
+        "type": "github"
+      }
+    },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1759582739,
+        "lastModified": 1745503349,
-        "narHash": "sha256-spZegilADH0q5OngM86u6NmXxduCNv5eX9vCiUPhOYc=",
+        "narHash": "sha256-bUGjvaPVsOfQeTz9/rLTNLDyqbzhl0CQtJJlhFPhIYw=",
-        "owner": "nixos",
+        "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "3441b5242af7577230a78ffb03542add264179ab",
+        "rev": "f7bee55a5e551bd8e7b5b82c9bc559bc50d868d1",
         "type": "github"
       },
       "original": {
@@ -410,11 +946,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1759381078,
+        "lastModified": 1745526057,
-        "narHash": "sha256-gTrEEp5gEspIcCOx9PD8kMaF1iEmfBcTbO0Jag2QhQs=",
+        "narHash": "sha256-ITSpPDwvLBZBnPRS2bUcHY3gZSwis/uTe255QgMtTLA=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "7df7ff7d8e00218376575f0acdcc5d66741351ee",
+        "rev": "f771eb401a46846c1aebd20552521b233dd7e18b",
         "type": "github"
       },
       "original": {
@@ -425,6 +961,22 @@
       }
     },
     "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1744932701,
+        "narHash": "sha256-fusHbZCyv126cyArUwwKrLdCkgVAIaa/fQJYFlCEqiU=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b024ced1aac25639f8ca8fdfc2f8c4fbd66c48ef",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
       "locked": {
         "lastModified": 0,
         "narHash": "sha256-DjkQPnkAfd7eB522PwnkGhOMuT9QVCZspDpJJYyOj60=",
@@ -438,16 +990,16 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1759580034,
+        "lastModified": 1745487689,
-        "narHash": "sha256-YWo57PL7mGZU7D4WeKFMiW4ex/O6ZolUS6UNBHTZfkI=",
+        "narHash": "sha256-FQoi3R0NjQeBAsEOo49b5tbDPcJSMWc3QhhaIi9eddw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "3bcc93c5f7a4b30335d31f21e2f1281cba68c318",
+        "rev": "5630cf13cceac06cefe9fc607e8dfa8fb342dde3",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-25.05",
+        "ref": "nixos-25.11",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -462,16 +1014,16 @@
         "systems": "systems_5"
       },
       "locked": {
-        "lastModified": 1758373036,
+        "lastModified": 1745068593,
-        "narHash": "sha256-tm73KNHsGQwAAoFEcAvuXAmHf3KaWLSuf/R9UQ6WMnU=",
+        "narHash": "sha256-YuQRMvqLVu+ghl2XzqXyVg/YevH/t3XHVCl7w+UrCH8=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "a30decbd5fc231e84dfefeb75bc7f57d8167726c",
+        "rev": "d35dc6dfcae3ff1a0c72f2d59491a7d83e5505a3",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "nixos-25.05",
+        "ref": "nixos-25.11",
         "repo": "nixvim",
         "type": "github"
       }
@@ -486,11 +1038,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758662783,
+        "lastModified": 1745046075,
-        "narHash": "sha256-igrxT+/MnmcftPOHEb+XDwAMq3Xg1Xy7kVYQaHhPlAg=",
+        "narHash": "sha256-8v4y6k16Ra/fiecb4DxhsoOGtzLKgKlS+9/XJ9z0T2I=",
         "owner": "NuschtOS",
         "repo": "search",
-        "rev": "7d4c0fc4ffe3bd64e5630417162e9e04e64b27a4",
+        "rev": "066afe8643274470f4a294442aadd988356a478f",
         "type": "github"
       },
       "original": {
@@ -499,6 +1051,56 @@
         "type": "github"
       }
     },
+    "pre-commit-hooks": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1742649964,
+        "narHash": "sha256-DwOTp7nvfi8mRfuL1escHDXabVXFGT1VlPD1JHrtrco=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "dcf5072734cb576d2b0c59b2ac44f5050b5eac82",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "pre-commit-hooks_2": {
+      "inputs": {
+        "flake-compat": "flake-compat_4",
+        "gitignore": "gitignore_2",
+        "nixpkgs": [
+          "nix-topology",
+          "nixpkgs"
+        ],
+        "nixpkgs-stable": [
+          "nix-topology",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1730797577,
+        "narHash": "sha256-SrID5yVpyUfknUTGWgYkTyvdr9J1LxUym4om3SVGPkg=",
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "rev": "1864030ed24a2b8b4e4d386a5eeaf0c5369e50a9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "deploy-rs": "deploy-rs",
@@ -509,6 +1111,7 @@
         "nix-colors": "nix-colors",
         "nix-gl": "nix-gl",
         "nix-matlab": "nix-matlab",
+        "nixos-generators": "nixos-generators",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_3",
         "nixpkgs-unstable": "nixpkgs-unstable",
@@ -548,11 +1151,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759635238,
+        "lastModified": 1745310711,
-        "narHash": "sha256-UvzKi02LMFP74csFfwLPAZ0mrE7k6EiYaKecplyX9Qk=",
+        "narHash": "sha256-ePyTpKEJTgX0gvgNQWd7tQYQ3glIkbqcW778RpHlqgA=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "6e5a38e08a2c31ae687504196a230ae00ea95133",
+        "rev": "5e3e92b16d6fdf9923425a8d4df7496b2434f39c",
         "type": "github"
       },
       "original": {
@@ -662,7 +1265,58 @@
       },
       "original": {
         "owner": "nix-systems",
-        "repo": "default-linux",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_6": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_7": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixvim",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1744961264,
+        "narHash": "sha256-aRmUh0AMwcbdjJHnytg1e5h5ECcaWtIFQa6d9gI85AI=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "8d404a69efe76146368885110f29a2ca3700bee6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
         "type": "github"
       }
     },
@@ -684,14 +1338,55 @@
         "type": "github"
       }
     },
+    "xdph": {
+      "inputs": {
+        "hyprland-protocols": [
+          "hyprland",
+          "hyprland-protocols"
+        ],
+        "hyprlang": [
+          "hyprland",
+          "hyprlang"
+        ],
+        "hyprutils": [
+          "hyprland",
+          "hyprutils"
+        ],
+        "hyprwayland-scanner": [
+          "hyprland",
+          "hyprwayland-scanner"
+        ],
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1744644585,
+        "narHash": "sha256-p0D/e4J6Sv6GSb+9u8OQcVHSE2gPNYB5ygIfGDyEiXQ=",
+        "owner": "hyprwm",
+        "repo": "xdg-desktop-portal-hyprland",
+        "rev": "be6771e754345f18244fb00aae5c9e5ab21ccc26",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "xdg-desktop-portal-hyprland",
+        "type": "github"
+      }
+    },
     "yazi-flavors": {
       "flake": false,
       "locked": {
-        "lastModified": 1758842767,
+        "lastModified": 1763969227,
-        "narHash": "sha256-+awiEG5ep0/6GaW8YXJ7FP0/xrL4lSrJZgr7qjh8iBc=",
+        "narHash": "sha256-twgXHeIj52EfpMpLrhxjYmwaPnIYah3Zk/gqCNTb2SQ=",
         "owner": "yazi-rs",
         "repo": "flavors",
-        "rev": "2d73b79da7c1a04420c6c5ef0b0974697f947ef6",
+        "rev": "3edeb49597e1080621a9b0b50d9f0a938b8f62bb",
         "type": "github"
       },
       "original": {

flake.nix

@@ -3,15 +3,20 @@
 
   inputs = {
     nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.11";
     systems.url = "github:nix-systems/default-linux";
     nixos-hardware.url = "github:nixos/nixos-hardware";
     impermanence.url = "github:nix-community/impermanence";
     nix-colors.url = "github:misterio77/nix-colors";
     deploy-rs.url = "github:serokell/deploy-rs";
 
+    nixos-generators = {
+      url = "github:nix-community/nixos-generators";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     home-manager = {
-      url = "github:nix-community/home-manager/release-25.05";
+      url = "github:nix-community/home-manager/release-25.11";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     sops-nix = {
@@ -33,7 +38,7 @@
       flake = false;
     };
     nixvim = {
-      url = "github:nix-community/nixvim/nixos-25.05";
+      url = "github:nix-community/nixvim/nixos-25.11";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     nix-matlab = {
@@ -84,7 +89,7 @@
 
     packages = forEachSystem (pkgs: import ./pkgs {inherit pkgs;});
     devShells = forEachSystem (pkgs: import ./shell.nix {inherit pkgs;});
-    formatter = forEachSystem (pkgs: pkgs.alejandra);
+    formatter = forEachSystem (pkgs: pkgs.alejandra); # nix fmt *
 
     nixosConfigurations = {
       # Main laptop
@@ -183,5 +188,15 @@
         };
       };
     };
+
+    # substitutes: nixos-generate --flake .#pianonix -f sd-aarch64 --system aarch64-linux
+    pianonix-image = inputs.nixos-generators.nixosGenerate {
+      system = "aarch64-linux";
+      format = "sd-aarch64";
+      modules = [./hosts/pianonix];
+      specialArgs = {
+        inherit inputs outputs;
+      };
+    };
   };
 }

homes/julian/aspi.nix

@@ -11,6 +11,8 @@
     ./features/alacritty
     ./features/yazi
     ./features/emacs
+    ./features/tmux
+    ./features/qt-distrobox
 
     ./features/hyprland
 

homes/julian/features/emacs/default.nix

@@ -52,6 +52,14 @@ in {
       shfmt
       pyright
       clang-tools # c++ lsp etc
+      ccls # alternative c++ lsp
+      cmake
+      bear
+      cmake-language-server
+
+      # qt6.full # qt tools and libs including lsp
+      tinymist # typst lsp
+
       ltex-ls # latex languagetool
 
       graphviz

homes/julian/features/fish/default.nix

@@ -47,6 +47,10 @@ with lib; {
         end
         nix shell $args
       '';
+      fish_user_key_bindings = ''
+        bind ctrl-space 'zi; commandline -f repaint'
+        bind -M insert ctrl-space 'zi; commandline -f repaint'
+      '';
     };
   };
 }

homes/julian/features/fonts/default.nix

@@ -12,7 +12,7 @@ with lib; {
     dejavu_fonts
     noto-fonts
     noto-fonts-cjk-sans
-    noto-fonts-emoji
+    noto-fonts-color-emoji
     liberation_ttf
     fira-code
     fira-code-symbols

homes/julian/features/hyprland/default.nix

@@ -228,6 +228,10 @@ in {
         vfr = true; # power saving
       };
 
+      cursor = {
+        no_hardware_cursors = 1; # disable hardware cursors to fix tearing on kardorf
+      };
+
       render = {
         # we do, in fact, want direct scanout
         direct_scanout = true;
@@ -244,7 +248,9 @@ in {
       windowrulev2 = [
         "suppressevent maximize, class:.*"
         "workspace 1, class:firefox"
+        "workspace 8, class:Zotero"
         "workspace 9, class:nheko"
+        "workspace 9, class:discord"
         "workspace 9, class:org.telegram.desktop"
         "workspace 10, class:thunderbird"
         "float, class:qalculate-gtk"

homes/julian/features/neovim/default.nix

@@ -3,8 +3,9 @@
   pkgs,
   inputs,
   ...
-}: {
+}:
-  imports = [inputs.nixvim.homeManagerModules.nixvim];
+{
+  imports = [ inputs.nixvim.homeModules.nixvim ];
 
   home.sessionVariables = {
     EDITOR = "nvim";
@@ -78,6 +79,7 @@
       neogit.enable = true; # like magit
       trouble.enable = true;
       web-devicons.enable = true;
+      orgmode.enable = true; # org-mode support
 
       # Shows file trees
       oil = {

homes/julian/features/qt-distrobox/default.nix

@@ -0,0 +1,22 @@
+{
+  programs.distrobox = {
+    enable = true;
+    containers."qt-distrobox" = {
+      image = "debian:12.2";
+      exported_apps = "qtcreator";
+      enableSystemdUnit = false; # fails in creating and does not recreate. Do distrobox-assemble create --replace --file ~/.config/distrobox/containers.ini instead
+      additional_packages = [
+        "qtcreator"
+        "qt6-base-dev"
+        "qt6-wayland"
+        "qt6-tools-dev-tools"
+        "qt6-tools-dev"
+        "qt6-serialbus-dev"
+        "qt6-websockets-dev"
+        "libgl1-mesa-dev"
+        "build-essential"
+        "cmake"
+      ];
+    };
+  };
+}

homes/julian/features/suites/cli/default.nix

@@ -1,7 +1,7 @@
 {pkgs, ...}: {
   home.packages = with pkgs; [
     bat
-    du-dust # Like du tree but better
+    dust # Like du tree but better
     fd # better find
     fdupes # find and delete duplicate files
     ffmpeg
@@ -24,7 +24,7 @@
     p7zip # unzip 7zip archives
     parted
     pciutils # lspci
-    poppler_utils # Pdf utils including pdfimages
+    poppler-utils # Pdf utils including pdfimages
     libqalculate # Nice tui calculator (qalc)
     ripgrep # better grep
     rnr # renaming tool

homes/julian/features/suites/desktop/default.nix

@@ -27,7 +27,7 @@
     # element-desktop
     # rocketchat-desktop
     thunderbird
-    tdesktop # telegram
+    telegram-desktop # telegram
     # schildichat-desktop # not updated regularly
     nheko
     evince # Simple pdf reader, good for focusing on document content
@@ -48,10 +48,10 @@
     qpdfview
     # qutebrowser
     # realvnc-vnc-viewer
-    rpi-imager # make isos
+    # rpi-imager # make isos
     # rustdesk
     tor-browser
-    unstable.path-of-building # Path of Building
+    rusty-path-of-building # Path of Building for poe1 and poe2
     # frajul.pob-dev-version # Path of Building
     vlc
     wineWowPackages.stable # 32-bit and 64-bit wine

homes/julian/features/suites/development/default.nix

@@ -9,7 +9,7 @@
     clippy
     cntr # nix debugger
     conda
-    micromamba # a better, faster conda
+    # micromamba # a better, faster conda
     devcontainer # development container
     devenv # devbox alternative
     dbeaver-bin
@@ -21,20 +21,21 @@
     unstable.zed-editor
     jdk
     julia-bin
-    (texlive.combine {
+    # (texlive.combine {
-      # for rendering latex in inkscape
+    #   # for rendering latex in inkscape
-      inherit
+    #   inherit
-        (texlive)
+    #     (texlive)
-        scheme-medium
+    #     scheme-medium
-        standalone
+    #     standalone
-        amsmath
+    #     amsmath
-        preview
+    #     preview
-        # needed for org mode export
+    #     # needed for org mode export
-        wrapfig
+    #     wrapfig
-        capt-of
+    #     capt-of
-        biblatex
+    #     biblatex
-        ;
+    #     ;
-    })
+    # })
+    vagrant
     matlab # Using nix-matlab overlay defined in flake
     maven
     nodejs

homes/julian/features/tmux/default.nix

@@ -0,0 +1,10 @@
+{
+  programs.tmux = {
+    enable = true;
+    clock24 = true;
+    keyMode = "vi";
+    customPaneNavigationAndResize = true; # use hjkl
+    mouse = true;
+    prefix = "C-Space"; # use instead of C-b
+  };
+}

homes/julian/features/yazi/default.nix

@@ -9,8 +9,8 @@
   home.packages = with pkgs; [
     exiftool
     unar # extract archives
-    xdragon # dragndrop
+    dragon-drop # dragndrop
-    poppler_utils # pdf preview
+    poppler-utils # pdf preview
     fd
     ripgrep
     fzf

homes/julian/hm-standalone-config.nix

@@ -19,12 +19,13 @@
       "https://nix-community.cachix.org"
       "https://cache.nixos.org/"
       "https://hyprland.cachix.org"
-      "http://binarycache.julian-mutter.de"
+      "https://devenv.cachix.org"
     ];
     trusted-public-keys = [
+      "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
       "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
       "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
-      "binarycache.julian-mutter.de:oJ67uRFwRhNPKL58CHzy3QQLv38Kx7OA1K+6xlEPu7E="
+      "devenv.cachix.org-1:w1cLUi8dv3hnoSPGAuibQv+f9TZLr6cv/Hm9XgU50cw="
     ];
 
     trusted-users = [

homes/julian/kardorf.nix

@@ -8,11 +8,14 @@
     ./features/neovim
     ./features/ghostty
     ./features/wezterm
+    ./features/alacritty
     ./features/yazi
     ./features/emacs
 
-    # ./features/hyprland
+    ./features/tmux
-    ./features/i3
+    ./features/qt-distrobox
+    ./features/hyprland
+    # ./features/i3
 
     ./features/suites/cli
     ./features/suites/desktop
@@ -21,7 +24,7 @@
 
   hostName = "kardorf";
   is-nixos = true;
-  terminal = "ghostty";
+  terminal = "alacritty";
 
   #  ---------   ---------
   # | DVI-D-1 | | DVI-D-2 |

homes/julian/pianonix.nix

@@ -14,8 +14,8 @@
   is-nixos = true;
   terminal = "wezterm";
 
-  services.syncthing.tray.enable = true;
+  # services.syncthing.tray.enable = true;
-  services.syncthing.tray.command = "syncthingtray --wait"; # Wait for tray to become available
+  # services.syncthing.tray.command = "syncthingtray --wait"; # Wait for tray to become available
 
   home.packages = with pkgs; [
     music-reader
@@ -27,9 +27,34 @@
     onboard
   ];
 
+  programs.firefox = {
+    enable = true;
+
+    profiles.default = {
+      isDefault = true;
+
+      settings = {
+        "browser.startup.homepage" = "https://sheets.julian-mutter.de";
+        "browser.startup.page" = 1; # 0=blank, 1=home page, 3=restore previous session
+      };
+    };
+  };
+
+  programs.chromium = {
+    enable = true;
+
+    # commandLineArgs = [
+    #   "--homepage=https://sheets.julian-mutter.de"
+    #   "--no-first-run"
+    # ];
+  };
+
   # Autostart link
   home.file = {
-    ".config/autostart/sheet-organizer.desktop".source = "${pkgs.sheet-organizer}/share/applications/sheet-organizer.desktop";
+    # ".config/autostart/sheet-organizer.desktop".source = "${pkgs.sheet-organizer}/share/applications/sheet-organizer.desktop";
+    ".config/autostart/firefox.desktop".source = "${pkgs.firefox}/share/applications/firefox.desktop";
+    ".config/autostart/onboard.desktop".source = "${pkgs.onboard}/share/applications/onboard.desktop";
+    # ".config/autostart/chromium.desktop".source = "${pkgs.chromium}/share/applications/chromium.desktop";
     ".config/sheet-organizer/config.toml".text = ''
       working_directory = "/home/julian/Klavier"
     '';

homes/julian/v3ms/default.nix

@@ -13,6 +13,7 @@
     ../features/yazi
     ../features/emacs
     ../features/nix-helper
+    ../features/qt-distrobox
   ];
 
   hostName = "aspi";

homes/julian/v3ms/fonts.nix

@@ -5,7 +5,7 @@ with pkgs; [
   dejavu_fonts
   noto-fonts
   noto-fonts-cjk-sans
-  noto-fonts-emoji
+  noto-fonts-color-emoji
   liberation_ttf
   fira-code
   fira-code-symbols

homes/julian/v3ms/packages.nix

@@ -31,7 +31,7 @@ with pkgs; [
   ffmpeg
   julia-bin
 
-  poppler_utils # Pdf utils including pdfimages
+  poppler-utils # Pdf utils including pdfimages
   sage
 
   pkg-config # Often needed to build something

hosts/aspi/default.nix

@@ -20,7 +20,7 @@
     ../common/optional/virtualbox.nix
 
     ../common/optional/podman.nix
-    # ../common/optional/wireguard.nix
+    ../common/optional/wireguard.nix
     ../common/optional/flatpak.nix
 
     ../common/optional/avahi.nix
@@ -29,6 +29,8 @@
   networking.hostName = "aspi";
   system.stateVersion = "24.05";
 
+  # networking.firewall.checkReversePath = false; # Makes wg interface with all ips work
+
   modules = {
     syncthing = {
       enable = true;
@@ -40,6 +42,7 @@
     };
   };
 
+  programs.hyprland.enable = true;
   services.desktopManager.plasma6.enable = true;
 
   services.blueman.enable = true;
@@ -48,8 +51,8 @@
   programs.steam.enable = true;
 
   # TODO: not working
-  services.logind.lidSwitch = "lock";
+  # services.logind.lidSwitch = "lock";
-  services.logind.lidSwitchDocked = "lock";
+  # services.logind.lidSwitchDocked = "lock";
 
   programs.kdeconnect.enable = true;
 

hosts/builder/default.nix

@@ -19,6 +19,7 @@
   networking.hostName = "builder";
   system.stateVersion = "23.11";
 
+  networking.networkmanager.enable = true;
   networking.nameservers = [
     "192.168.3.252"
     "172.30.20.10"

hosts/common/global/default.nix

@@ -31,14 +31,19 @@
     ];
   };
   services.resolved.enable = true;
+  # MDNS Taken by avahi
+  services.resolved.extraConfig = ''
+    MulticastDNS=false
+  '';
 
   networking.nameservers = lib.mkDefault [
     "1.1.1.1"
     "8.8.8.8"
   ];
 
-  # HM
+  # HM module
-  home-manager.useGlobalPkgs = true;
+  home-manager.useGlobalPkgs = true; # hm module uses the pkgs of the nixos config
+  home-manager.backupFileExtension = "hm-backup"; # backup conflicting files. So hm activation never fails
   home-manager.extraSpecialArgs = {
     inherit inputs outputs;
   };

hosts/common/global/nix.nix

@@ -2,7 +2,8 @@
   lib,
   outputs,
   ...
-}: {
+}:
+{
   # Apply overlays
   nixpkgs = {
     # TODO: apply this to hm and nixos without duplicate code
@@ -18,7 +19,9 @@
     };
   };
 
-  nix.settings.auto-optimise-store = lib.mkDefault true;
+  # optimize at every build, slows down builds
+  # better to do optimise.automatic for regular optimising
+  # nix.settings.auto-optimise-store = lib.mkDefault true;
   nix.settings.experimental-features = [
     "nix-command"
     "flakes"
@@ -29,8 +32,11 @@
   nix.gc = {
     automatic = true;
     dates = "weekly";
-    # Keep the last 3 generations
+    options = "--delete-older-than 30d";
-    options = "--delete-older-than +3";
+  };
+  nix.optimise = {
+    automatic = true;
+    dates = [ "weekly" ]; # Optional; allows customizing optimisation schedule
   };
 
   programs.nix-ld.enable = true;

hosts/common/global/sops.nix

@@ -13,7 +13,7 @@ in {
     sshKeyPaths = map getKeyPath keys;
 
     # TODO: remove? only rely on ssh or pgp keys (e.g. ubikey like misterio is using!!!)
-    keyFile = "/home/julian/.config/sops/age/keys.txt";
+    # keyFile = "/home/julian/.config/sops/age/keys.txt";
     # Generate key if none of the above worked. With this, building will still work, just without secrets
     generateKey = false; # TODO: building should not work without secrets!?
   };

hosts/common/optional/avahi.nix

@@ -3,7 +3,10 @@
   services.avahi = {
     enable = true;
     nssmdns4 = true;
+    nssmdns6 = true;
     publish.enable = true;
     publish.addresses = true;
+    ipv4 = true;
+    ipv6 = true;
   };
 }

hosts/common/optional/greetd.nix

@@ -1,26 +1,9 @@
-{
+{config, ...}: let
-  pkgs,
-  lib,
-  config,
-  ...
-}: let
   homeCfgs = config.home-manager.users;
-  homeSharePaths = lib.mapAttrsToList (_: v: "${v.home.path}/share") homeCfgs;
-  vars = ''XDG_DATA_DIRS="$XDG_DATA_DIRS:${lib.concatStringsSep ":" homeSharePaths}" GTK_USE_PORTAL=0'';
-
   julianCfg = homeCfgs.julian;
-
-  sway-kiosk = command: "${lib.getExe pkgs.sway} --unsupported-gpu --config ${pkgs.writeText "kiosk.config" ''
-    output * bg #000000 solid_color
-    xwayland disable
-    input "type:touchpad" {
-      tap enabled
-    }
-    exec '${vars} ${command}; ${pkgs.sway}/bin/swaymsg exit'
-  ''}";
 in {
   users.extraUsers.greeter = {
-    # For caching and such
+    # For caching
     home = "/tmp/greeter-home";
     createHome = true;
   };
@@ -33,13 +16,22 @@ in {
     cursorTheme = {
       inherit (julianCfg.gtk.cursorTheme) name package;
     };
+    cageArgs = [
+      "-s"
+      "-m"
+      "last"
+    ]; # multimonitor use last monitor
     # settings.background = {
     #   path = julianCfg.wallpaper;
     #   fit = "Cover";
     # }; # TODO: fix
-  };
+
-  services.greetd = {
+    # TODO: setting keyboard language does not work
-    enable = true;
+    # settings = {
-    settings.default_session.command = sway-kiosk (lib.getExe config.programs.regreet.package);
+    #   env = {
+    #     XKB_DEFAULT_LAYOUT = "de";
+    #     # XKB_DEFAULT_VARIANT = "altgr-intl";
+    #   };
+    # };
   };
 }

hosts/common/optional/pcmanfm.nix

@@ -1,7 +1,7 @@
 {pkgs, ...}: {
   environment.systemPackages = with pkgs; [
     shared-mime-info # extended mimetype support
-    lxde.lxmenu-data # open with "Installed Applications"
+    lxmenu-data # open with "Installed Applications"
     pcmanfm
   ];
 

hosts/common/secrets.yaml

@@ -14,38 +14,38 @@ sops:
         - recipient: age1ee5udznhadk6m7jtglu4709rep080yjyd2ukzdl8jma4mm92y3psv0slpg
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxV2IzcEZ6eGYxbXAvaEta
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBualdnWmtBTThhZDFVdDRP
-            c3RLbmZubnVEL1EwSlNNY3ZNbkVSUXN5ZDBZClRTYWwzbHhDK1VsMzVVL0VMVzZF
+            WHlMamk1MFhUYUwwa0hyQmpobGNocC9VR0ZVCmc3N1FjcUZCNUdTTm91OVpwZDhP
-            SEQ0ZHVMdytrY0xXUEppQkpNZEZ3VFkKLS0tIG95ZkJLWTZBWWpIOEQ4bHpBNWEx
+            bTNXekp2bDd3Tjh6a2ZVTVNTSW9RTU0KLS0tIGJpcUVHb2ZlODgvelhwQ0JFU3l5
-            QXVpMTNSNzU1dTBPYjlsc1BvNHZ3dDgKMHrT9DCC5W6UwC1Mfq6YCwkvZtDs3I7j
+            WU5VanhYMTUvNklYazJxOXVveXhpM2cKCo+4FhhcbRylASEbQb9rAQUzEO1D+0AR
-            vKlnanFp8hMMyYONRVlkvh+vOGQdbgXco4Z5nr02LQDu6Rwm4jSp9g==
+            52Jzc9s9rSdypeBRE7SaSOI4eVnkEjPfyhNFvMdxiBzBj7GdocpmCw==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1q8lc5340gz5xw2f57nglrss68wv0j0hf36py2pdtrl6ky3yrq9qqk0njr4
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKTnpqclVmVHR3M1ZvMDZ0
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4STZpU0ZnRzVVOFFRUXZG
-            eEtrbnhpTW5uZlhOYWFxbktxcTJ3bXZISkhzClpud2tNVzUvT2N2SkRadWk5aVpE
+            akcwS2Z5V3lmQzRTSGNHT2hDME5JMks2QTNNClpkZzNMc0wyRjVEaVlBRFlyNFhs
-            S2VkTFlIVUhFclA0WEh5cEp0Qjg3ejgKLS0tIDNXY0lpKys4Q3NBRFcya2RoSG1F
+            M1pyeW1XdnZubnRxMzEzMFJoK0lkVVEKLS0tIENhRExzUWRWMUlObmhxazM5cU9y
-            YW0raHlNekdWT3p0WHpGMk9xMmgzWFUKCue4GvgmH3nJBa7ny7rqft5MuSWHqAsP
+            aDFyaDJackFoaEZOYWdTbWt0ODB1bm8Kg1VDAj5/i8ZbYxspIdXrI474YN5YkV4H
-            5HnaAudL+rh2j1swm635QUrf9UnpUznE5NSOGrQDmA6RCBypNM4rsw==
+            86maCRDfUxO5lvu4zBa9pOmFtJ2iuJ2MxDnmCSHTl+GOk8yyUT8JhA==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1hsmfz8fjxu83sax9lr487h8xr6cyge0apdq4zpge4c8jpcjj2cksj825ct
+        - recipient: age1tguyu2yd5xv8rgjjl50cq6dq5rr7umqgv098dgre4u9wyj30ea7sexw62c
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBESlZOeHY0T01ra0gwMS8z
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAveE9NV2JCOW9odlN6Wmkw
-            R3c1eW45WVkyeTBuRlFMRngrb2NFL1hkcmhRCitwZ3lweXM0di9EdEdQZmF4ZUZr
+            WFEvU2pka3htV2FTTFlpc05ES2JjbGxTaFJZCjhYdG1sRVBFaEF3YjNkWEw3Ny8x
-            M1hqNkM3Q1Jrb09Kb2M0ZkhTcFZPYkkKLS0tIHpCTEFCV0JlRzQwK3hndDJ4aHVC
+            MlYyTjJBMHA2YVpHRkkwWW5hNDdrS1UKLS0tIFZXTFNVbkd6VFExc0dSVU4vd3JF
-            S1o0QVlXSVl0dmlpWUQ3ZXdqUU5maTgKY4UJPx37CU5OUgkqYWlz9+0rA+dQkrH9
+            ajlFY2pvWW13VGxOZ0hEc3dMbU9IeUUKNSf7ycj+1XHhsoghmY2iR1BwIySqfIOF
-            +/kTT/2qZ2Op67WKtlas7arC7BjU8uygM208q+nr48Lic5n1fMtnXA==
+            zawE+MQcQg0u+fy6Aik26eUGvQG3rya2Fx2+3VlAbKB+rbiP0fwsgg==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age15lxw97z03q40xrdscnxqqugh5ky5aqrerg2t2rphkcqm6rnllurq8v98q5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvYkdwSy9vc0lEWXJIdWRw
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxaTNJNkJ0RVJiYlRzcmlX
-            VmJ2NStaZDVxaG1LNU1NQlErdElPdkQvY3pjCkJyL1BRR2w1dmpqYnk5Tys3eHpX
+            TmEweVdLaGpoVXMxZEFDU3dOZTJCRjdiNENBCkZ3bjJUNm1vcmY1ZUpZcEo4OGxa
-            c0FJdzA1bU5GWWhrUWhOK1Jqa2lTaU0KLS0tIDMzMEQwL3I0ckVyYWFubU9VNlAr
+            UWJKSjNKL002UDhmTmJER2M0MjJ3aG8KLS0tIFMvZjBkOS83T3NDUE82M3kweVNw
-            NlBud3VHczNnMm5wOGhHdEoxTG5CNDgK4s7cFGvUCeztjjIAWtMW7TUqFP+YEQIg
+            VXhoN0VyWkVxMEJPQ3orVUNDK21rRU0KvnmuFxcCpP+LZg7v5jaStw9F0owVrQl9
-            So5A7DGxVsUcqarTUPazpIBBlO4n9zj79Qe+eQd6ti0EZG6sYX6+2Q==
+            AkIq7GUJh7xewLxcVZfiBRpXMhw/mM8LYnd2KGP8R/TfYg+v0//+5A==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2025-04-23T07:00:17Z"
     mac: ENC[AES256_GCM,data:JgaTIRbzD0hs2o86xUlQrPN2cPXvsuTH/zKG5xbQIDaYcEvD/mkuVa3hfnYKrA91kWg2Y1DgEi9583+o6UCl/+ldY4ptu+xpnYfyQFdhM4rB+KoP/pDt8vQKQ3zAX8fpAkugCgTTbuvm3TfQ1nt98V8boyhCn4JHNC1T0j7ZtZI=,iv:G3YJOLeDWDKuANo2mxS2JAdrRaonD87CU9BpCZZrlRs=,tag:mcKIdP5cSQUwNL2tcv/o6g==,type:str]

hosts/common/users/yukari/default.nix

@@ -55,7 +55,7 @@ in {
         # element-desktop
         # rocketchat-desktop
         thunderbird
-        tdesktop # telegram
+        telegram-desktop # telegram
         # schildichat-desktop # not updated regularly
         nheko
         evince # Simple pdf reader, good for focusing on document content
@@ -71,15 +71,12 @@ in {
         nomacs # Image viewer
         kdePackages.okular # Pdf reader with many features, good for commenting documents
         pavucontrol
-        pdfsam-basic # Split, merge, etc for pdfs
         qalculate-gtk # Nice gui calculator
         qpdfview
         # qutebrowser
         # realvnc-vnc-viewer
-        rpi-imager # make isos
         # rustdesk
         tor-browser
-        unstable.path-of-building # Path of Building
         # frajul.pob-dev-version # Path of Building
         vlc
         wineWowPackages.stable # 32-bit and 64-bit wine

hosts/kardorf/default.nix

@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   imports = [
     ./hardware-configuration.nix
 
@@ -7,21 +8,22 @@
     ../common/users/wolfi
     ../common/optional/binarycaches.nix
 
-    ../common/optional/xserver.nix
+    # ../common/optional/xserver.nix
     ../common/optional/remote-builder.nix
     ../common/optional/boot-efi.nix
 
-    # ../common/optional/greetd.nix
+    ../common/optional/greetd.nix
-
-    ../common/optional/gdm.nix
-    ../common/optional/i3.nix
-
-    ../common/optional/openssh.nix
-
     ../common/optional/authentication.nix
     ../common/optional/pcmanfm.nix
     ../common/optional/pipewire.nix
 
+    ../common/optional/virtualbox.nix
+
+    # ../common/optional/gdm.nix
+    # ../common/optional/i3.nix
+
+    ../common/optional/openssh.nix
+
     ../common/optional/podman.nix
     ../common/optional/flatpak.nix
   ];
@@ -32,8 +34,11 @@
   # Not using the drivers leads to way better results
   # services.xserver.videoDrivers = [ "nvidia" ];
 
+  networking.networkmanager.insertNameservers = [ "192.168.3.252" ];
+
   programs.kdeconnect.enable = true;
 
+  programs.hyprland.enable = true;
   services.desktopManager.plasma6.enable = true;
 
   # Enable CUPS to print documents.

hosts/pianonix/default.nix

@@ -22,21 +22,67 @@
     ../common/optional/pcmanfm.nix
     ../common/optional/redshift.nix
     ../common/optional/authentication.nix
+
+    ../common/optional/avahi.nix
+  ];
+
+  environment.systemPackages = [
+    (pkgs.python3.withPackages (p:
+      with p; [
+        numpy
+        pillow
+        flask
+        rpi-gpio
+        webcolors
+        psutil
+        mido
+        rtmidi-python
+        spidev
+        waitress
+        websockets
+        werkzeug
+
+        pkgs.frajul.rpi-ws281x-python
+      ]))
   ];
 
   # disko.devices.disk.main.device = "/dev/mmcblk1";
 
-  # networking.wireless.enable = true;
+  # enabled by fish, disabling speeds up builds
-  # networking.wireless.environmentFile = config.sops.secrets."wifi/pianonix".path;
+  documentation.man.generateCaches = false;
-  # networking.wireless.networks = {
+
-  #   "@SSID@".psk = "@PSK@";
+  # networking.enableIPv6 = false; # This only leads to issues with avahi
+  # services.avahi.ipv6 = false;
+
+  hardware.raspberry-pi."4".bluetooth.enable = true;
+  hardware.bluetooth.enable = true;
+  hardware.bluetooth.powerOnBoot = true;
+  services.blueman.enable = true; # bluetooth gui
+  # raspberry pi specific
+  # systemd.services.btattach = {
+  #   before = [ "bluetooth.service" ];
+  #   after = [ "dev-ttyAMA0.device" ];
+  #   wantedBy = [ "multi-user.target" ];
+  #   serviceConfig = {
+  #     ExecStart = "${pkgs.bluez}/bin/btattach -B /dev/ttyAMA0 -P bcm -S 3000000";
   #   };
+  # };
+  # networking.wireless.enable = true;
+  # networking.wireless.secretsFile = config.sops.secrets."wifi/pianonix".path;
+  # networking.wireless.networks = {
+  #   "SMARTments".pskRaw = "ext:PSK";
+  # };
+
+  # networking.networkmanager.enable = lib.mkForce false;
+
+  services.gnome.at-spi2-core.enable = true; # for onboard
+
   networking.hostName = "pianonix";
   system.stateVersion = "22.11";
 
   sops.secrets."vnc-passwd" = {
     owner = config.users.users.julian.name;
-    sopsFile = ./vnc-passwd;
+    sopsFile = ./secrets-vnc-passwd.bin;
     format = "binary";
   };
   sops.secrets."wifi/pianonix" = {};
@@ -45,6 +91,18 @@
   # sops.secrets."syncthing/public-keys/aspi-nix" = { };
   # sops.secrets."syncthing/public-keys/pianonix" = { };
 
+  sops.secrets."wg-config" = {
+    sopsFile = ./secrets-wg-config.bin;
+    format = "binary";
+  };
+
+  networking.wg-quick.interfaces = {
+    home = {
+      configFile = config.sops.secrets."wg-config".path;
+      autostart = true; # This interface is started on boot
+    };
+  };
+
   modules = {
     syncthing = {
       enable = true;
@@ -54,6 +112,7 @@
 
   # Enable the Desktop Environment.
   # services.xserver.displayManager.lightdm.enable = true;
+  services.displayManager.defaultSession = "xfce";
   services.displayManager.autoLogin = {
     enable = true;
     user = "julian";
@@ -73,10 +132,11 @@
     };
   };
 
-  boot.loader.timeout = 1; # Set boot loader timeout to 1s
+  boot.loader.timeout = lib.mkForce 1; # Set boot loader timeout to 1s
 
   # De-facto disable network manager, which is enabled by gnome
   # networking.networkmanager.unmanaged = [ "*" ];
+  services.xserver.enable = true;
   services.xserver.desktopManager = {
     xfce = {
       enable = true;
@@ -129,7 +189,7 @@
     };
   };
 
-  networking.firewall.enable = true;
+  networking.firewall.enable = false;
   networking.firewall.allowedTCPPorts = [
     5900 # for vnc
   ];
@@ -156,4 +216,61 @@
   # boot.loader.raspberryPi.firmwareConfig = ''
   #   dtparam=audio=on
   # '';
+
+  ## Enable SPI
+  hardware.raspberry-pi."4".apply-overlays-dtmerge.enable = true;
+  hardware.deviceTree = {
+    enable = true;
+    filter = lib.mkForce "*-rpi-4*.dtb";
+    overlays = [
+      {
+        name = "spi";
+        dtboFile = ./spi0-0cs.dtbo;
+      }
+    ];
+  };
+
+  users.groups.spi = {};
+
+  # services.udev.extraRules = ''
+  #   SUBSYSTEM=="spidev", KERNEL=="spidev0.0", GROUP="spi", MODE="0660"
+  # '';
+
+  ## Use GPIO as non-root
+  # Create gpio group
+  users.groups.gpio = {};
+
+  # Change permissions gpio devices
+  services.udev.extraRules = ''
+    SUBSYSTEM=="spidev", KERNEL=="spidev0.0", GROUP="spi", MODE="0660"
+
+    SUBSYSTEM=="bcm2835-gpiomem", KERNEL=="gpiomem", GROUP="gpio",MODE="0660"
+    SUBSYSTEM=="gpio", KERNEL=="gpiochip*", ACTION=="add", RUN+="${pkgs.bash}/bin/bash -c 'chown root:gpio /sys/class/gpio/export /sys/class/gpio/unexport ; chmod 220 /sys/class/gpio/export /sys/class/gpio/unexport'"
+    SUBSYSTEM=="gpio", KERNEL=="gpio*", ACTION=="add",RUN+="${pkgs.bash}/bin/bash -c 'chown root:gpio /sys%p/active_low /sys%p/direction /sys%p/edge /sys%p/value ; chmod 660 /sys%p/active_low /sys%p/direction /sys%p/edge /sys%p/value'"
+  '';
+
+  # Add user to group
+  users.users.julian.extraGroups = ["gpio"];
+
+  ## My own Piano LED Visualizer
+  services.piano-led-visualizer.enable = true;
+
+  ## Crude fix for avahi
+  systemd.timers.avahiRestart = {
+    description = "Restart avahi-daemon every 5 minutes";
+    wantedBy = ["timers.target"];
+    timerConfig = {
+      OnBootSec = "5min";
+      OnUnitActiveSec = "5min";
+      Unit = "avahiRestart.service";
+    };
+  };
+
+  systemd.services.avahiRestart = {
+    description = "Restart avahi-daemon service";
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.systemd}/bin/systemctl restart avahi-daemon.service";
+    };
+  };
 }

hosts/pianonix/hardware-configuration.nix

@@ -14,9 +14,16 @@
   boot.initrd.kernelModules = [];
   boot.kernelModules = [];
   boot.extraModulePackages = [];
+  boot.kernelPackages = pkgs.linuxKernel.packages.linux_rpi4;
+  boot.blacklistedKernelModules = ["snd_bcm2835"]; # Disables sound, required for ws281x to work
+  # boot.supportedFilesystems = lib.mkForce [
+  #   # remove zfs, since its incompatible with latest kernel
+  #   "vfat"
+  #   "ext4"
+  # ];
 
   fileSystems."/" = {
-    device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888";
+    device = "/dev/disk/by-label/NIXOS_SD";
     fsType = "ext4";
   };
 

hosts/pianonix/secrets-vnc-passwd.bin

@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:13hToequR4A=,iv:U7a6mIOYanQjozPrL92edFrhdyuSJj14pqVa2tGE/zA=,tag:uyeE3dj7NTKPi0jNLkFMLA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1ee5udznhadk6m7jtglu4709rep080yjyd2ukzdl8jma4mm92y3psv0slpg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXWEFYNThYQkpuTW10MjNM\nU3pWYmE5UnBPUzhQSTltc3hXdk9EWkg5czI0CmxnK3FuYitGci9ndnRCZms4a0lD\nOWh4alF1MEtJUis5YVNyYXRLbVppNnMKLS0tIEQ5WVVIMzlIV0pnc2ZWMnc5bjE4\nR3lpbzJiRmljcWI4SWlOS2svZVBSYnMKYIfhDjNZPDxmws3Z3P55K7V/NHiukQ0u\n00Kk603U+1JhgfJBk0Y3tMo//vKCHQj87wtZoqDLEN7Gu+ZtHhkhow==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1tguyu2yd5xv8rgjjl50cq6dq5rr7umqgv098dgre4u9wyj30ea7sexw62c",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjSVpBR1NPY0svSWNWYzFC\nZE1uTjZTRm9XM24wcXByajVDYUJ4Y3FmNUc0CkJMMXRtUE5mSjYwU25MYy9xNFlP\ndUNmYmJ5RVF0dG5LYjA4L1NnNEtCMVEKLS0tIFl0Slovd2NiWjg1VXJ1VDJwTWJQ\nTWFZeW1ZYisvenVycWYwZ1lkOXBaVVUKqGu6Q8IbiUAzazLKN95uAtmXJMPzx02u\nr/R8q7ugG8lX5pWX3H3P7vtBz57Oo3rWlRpUhN/4+PpijkJNUyr3XQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-12-01T16:14:57Z",
+		"mac": "ENC[AES256_GCM,data:zKz8OX1yi68Qn3X6HwdbgTCr/3ZVBh5Wz4KUACmWG3XhOEVi8uoDEdAxfKMDBqNzXLeDmxxTKj6TMLkk68ozDYJqu0OevVritnZqvBTr9VKGpMPBFN3DuaeqSZ6wjHGbce1iqO0kusnwopRbEWHmr/lZxiXTNgLPdN+p5Aszi54=,iv:resppfGPecKvKwqNwqecDBcXGhcTWSGZis8hf1jT0Us=,tag:V80P25Pr4HD9pUUrQHZSQg==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.8.1"
+	}
+}

hosts/pianonix/secrets-wg-config.bin

@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:SFc3K1hvBjeCS6ikLZl3vIPFJqsUrZZi9yO9tVuv14exKhOuK17HN/d+cYMtVxGwqQ/biFdXYdP8/sfTPwwZgd/wRLT2xRDMOg5ru7kj8sEhcOEYmrgYRLo3ImdWANFaxelWOmjEvzphTQ7guvXTo7BACUA9AygYa9Ou9bklYImWhOCsk8e9uz5afLZXscidiqUqqFuJNo3QGMDEAxFI2YC3OpLwEj5zlsI4AXEEHRVUxU1sVtspdolDaeiFIs/JW4jLu/2la6JyGJUluYXAThzL1LO39NA/MSNskMSedatz89vnCd9CP6Q3eT93vrUYAEY=,iv:e+tWIlHm4NH1w8AQAw6tvgCX9XOiroE1XmrSua3Bcg4=,tag:RwGpKtG9JzQ3TgcnzEV5Rg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1ee5udznhadk6m7jtglu4709rep080yjyd2ukzdl8jma4mm92y3psv0slpg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTYTFjRnpPVDAvQ0ZHZU0v\neEduOTVockFoZGhuMmZNd0w3bVFCVUQzUlI4CmZTaktOQWxrTDNpYXlPTm9SdlZZ\nN0dURmlHVFlHSjZpbkpGb09lTmVzWm8KLS0tIDhMWlFIRWFkQjcya0hjeUdUSklB\nbWlqNlVoR1BnWG9TM0RhWnI4a0J4YUEKGWIX77EVXYFVyA2u6CkF1cGfwd4Gq0Vb\nNqrlMUYEDZ5nO/eLWsAt2kj1/YFjkGw0iI02HLRHdxQ59vFyl3CS1Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1tguyu2yd5xv8rgjjl50cq6dq5rr7umqgv098dgre4u9wyj30ea7sexw62c",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsNlZGdktzSGp0bzIyUjlR\nUU9LSXRrZTgxcEZwczhidWVOdGRnRFYrOVZZCmx3VzM4V2dsWmZpUWxNUG82MzU2\nT3dmQjRwdmRJbTJxVm9vQjJKU3JXSncKLS0tIFlhYy9uQW5aa1E0K3Q1RUFSQkZP\nR29sY3RCYVg5bGdqMU1uc0E3Szhmb0kKFzKHUVNDdHWfycb7xWeAyIVlC4ab7ivR\nVlfmbPAXq2THw/s4zk/ckfE5RP82a1aX4++XRa7fm5KXpI8vExjJ5A==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-14T06:56:31Z",
+		"mac": "ENC[AES256_GCM,data:DrcOET5U6veg0qhcBjQQ5neCdTUufMxhIz4ZQzvzd+YxKfAqaq8R1PW5VVlUjhDBaUH9i3J1Wj6X4E600uhayY0E9I5VqfO84hqlosfZWPiWPO8prK46Y7R3Ybdh9uvWQxiaSxy8KHXsdDgsBFLlmLe/QvsDSUv56rPofkm06vg=,iv:XBFP8ANpsszeXqQIE/v7+GmZGlFtxgE/EtgL/Cc3x+8=,tag:ZJgO+hLuwIatE55wo94RVw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.11.0"
+	}
+}

hosts/pianonix/vnc-passwd

@@ -1,28 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:13hToequR4A=,iv:U7a6mIOYanQjozPrL92edFrhdyuSJj14pqVa2tGE/zA=,tag:uyeE3dj7NTKPi0jNLkFMLA==,type:str]",
-	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
-		"age": [
-			{
-				"recipient": "age1ee5udznhadk6m7jtglu4709rep080yjyd2ukzdl8jma4mm92y3psv0slpg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWWUp5TU9kWTNpa0s5TFRC\nK1hoc0d0K3JQYWN3VVVWM2JvemtieGo2UGpVCit5MUcvZldBZkNNZ3ZWTWRtd0Zx\nT3I4aTdUcitPRmhhV0htZlhEYjhRakUKLS0tIEdmYUI4N1g1Nkp3YzdtaHJybVcz\neFNwUnd0Vyt2MTBpRTZlMzZnNHJGd1EKy/0zXv9CPf5k0ky7TBGY9GbcIeQyPk1L\nKmMCuWMLX0yTGqB3M3/UNdoc4L0q//7keUZH5PlkxJbnu6IN3fE5qg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1q8lc5340gz5xw2f57nglrss68wv0j0hf36py2pdtrl6ky3yrq9qqk0njr4",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMdy9tZlZtNFJPRFNUUUNI\nUWtPZmZOY1V5SHc5bTZOZVluTUV6N3dlQWprClVqK2tKNFlBWHdyNDF1Q0d2bi9z\naldTTDdWYzZ6WmgrNHlZSDlTSU9SbmsKLS0tIDJZM2Y4ZDVmZk54eTZLOTU4Ui9X\nR3l3WDkwRWUyakFLdGZXeDJxRUJsaHMK6hgZ1KYe9qx4tO7RervEAKGjNHg4mi0E\nxx3I9P8MFzPiCVKG5ZNxRx25y7H4bQSRRtxIlXIhqzf2+5Q6U7/Hrw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1hsmfz8fjxu83sax9lr487h8xr6cyge0apdq4zpge4c8jpcjj2cksj825ct",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2cUg4dUlCY0IwS3pPeTF5\nZTVkRTkzaVBYTmh0MmYyaHlOaFRHSnk5dWs4CmhvaTlSOTFDQzZmbHVudXpwQitV\nQjhRQWl3OHNLVGJYMm1ObVEyQmhxS0kKLS0tIDJsZnN4K2pUOEdIYVg4ZlQ5Ujhn\nNlpGL1hMVXd5cWR2YkdIVmJiblMzR1EKJYS51sKQ/tBV7dv88pOxJhzHQGckoF8q\nwIioVjs9sm4JBgQqSIbVhXwnKl05IUkyAgw6LfsbSJz3nKe7lmmRpg==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2024-12-01T16:14:57Z",
-		"mac": "ENC[AES256_GCM,data:zKz8OX1yi68Qn3X6HwdbgTCr/3ZVBh5Wz4KUACmWG3XhOEVi8uoDEdAxfKMDBqNzXLeDmxxTKj6TMLkk68ozDYJqu0OevVritnZqvBTr9VKGpMPBFN3DuaeqSZ6wjHGbce1iqO0kusnwopRbEWHmr/lZxiXTNgLPdN+p5Aszi54=,iv:resppfGPecKvKwqNwqecDBcXGhcTWSGZis8hf1jT0Us=,tag:V80P25Pr4HD9pUUrQHZSQg==,type:str]",
-		"pgp": null,
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.8.1"
-	}
-}

modules/nixos/default.nix

@@ -2,4 +2,5 @@
   # hydra-auto-upgrade = import ./hydra-auto-upgrade.nix;
   syncthing = import ./syncthing.nix;
   frajulAutoUpgrade = import ./frajul-auto-upgrade.nix;
+  pianoLEDVisualizer = import ./piano-led-visualizer.nix;
 }

modules/nixos/frajul-auto-upgrade.nix

@@ -27,6 +27,10 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
+    security.sudo.extraConfig = ''
+      root ALL=(julian) NOPASSWD: ${pkgs.git}/bin/git -C "${cfg.flakePath}" commit -m *
+    '';
+
     # Ensure the flag directory exists
     systemd.tmpfiles.rules = [
       "d /var/lib/frajul-auto-upgrade 0755 root root -"
@@ -67,11 +71,16 @@ in {
         echo $$ > "$LOCK_FILE"
         trap 'rm -f "$LOCK_FILE"' EXIT
 
-        if /run/current-system/sw/bin/nix flake update --flake "${cfg.flakePath}" && /run/current-system/sw/bin/nixos-rebuild switch --flake "${cfg.flakePath}"; then
+        # Back up flake.lock
+        cp -f "${cfg.flakePath}/flake.lock" /var/lib/frajul-auto-upgrade/flake.lock.bak
+
+        # Try updating
+        if /run/current-system/sw/bin/nix flake update --flake "${cfg.flakePath}" && /run/current-system/sw/bin/nixos-rebuild switch --flake "${cfg.flakePath}" && ${pkgs.sudo}/bin/sudo -u julian git -C "${cfg.flakePath}" commit -m "Auto-update flake.lock" -- flake.lock; then
             echo "success" > "$LAST_STATUS_FILE"
         else
             echo "failure" > "$LAST_STATUS_FILE"
-            git -C "${cfg.flakePath}" restore flake.lock
+            # Restore flake.lock
+            cp -f /var/lib/frajul-auto-upgrade/flake.lock.bak "${cfg.flakePath}/flake.lock"
         fi
 
         # Write full timestamp

modules/nixos/piano-led-visualizer.nix

@@ -0,0 +1,51 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  cfg = config.services.piano-led-visualizer;
+in {
+  options.services.piano-led-visualizer = {
+    enable = lib.mkEnableOption "Enable Piano LED Visualizer";
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "plv";
+      description = "User to run the Piano LED Visualizer service.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "plv";
+      description = "Group to run the Piano LED Visualizer service.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.users.${cfg.user} = {
+      isSystemUser = true;
+      group = cfg.group;
+      createHome = true;
+      home = "/home/${cfg.user}";
+      extraGroups = ["wheel" "gpio"];
+    };
+    users.groups.${cfg.group} = {};
+
+    systemd.services.piano-led-visualizer = {
+      description = "Piano LED Visualizer";
+      after = ["network-online.target"];
+      wants = ["network-online.target"];
+      wantedBy = ["multi-user.target"];
+
+      serviceConfig = {
+        WorkingDirectory = "/home/${cfg.user}/Piano-LED-Visualizer";
+        ExecStart = "${pkgs.frajul.piano-led-visualizer}/bin/piano-led-visualizer";
+        Restart = "always";
+        Type = "simple";
+        # User = cfg.user;
+        # Group = cfg.group;
+      };
+    };
+  };
+}

pkgs/default.nix

@@ -14,4 +14,7 @@
   wl-ocr = pkgs.callPackage ./wl-ocr {};
   rtklib = pkgs.qt6Packages.callPackage ./rtklib {};
   pob2-frajul = pkgs.callPackage ./pob2-frajul {};
+
+  rpi-ws281x-python = pkgs.callPackage ./rpi-ws281x-python {};
+  piano-led-visualizer = pkgs.callPackage ./piano-led-visualizer {};
 }

pkgs/piano-led-visualizer/default.nix

@@ -0,0 +1,63 @@
+{
+  lib,
+  python3,
+  callPackage,
+  fetchFromGitHub,
+  ...
+}: let
+  pythonPackages = python3.pkgs;
+  rpi-ws281x-python = callPackage ../rpi-ws281x-python {inherit python3;};
+in
+  pythonPackages.buildPythonApplication rec {
+    pname = "piano-led-visualizer";
+    version = "1.6";
+
+    src = fetchFromGitHub {
+      owner = "onlaj";
+      repo = "Piano-LED-Visualizer";
+      rev = "v${version}";
+      sha256 = "sha256-SkNNu2pqVG40HBZZYJMCCKiRj1h1QdkteaPR3Ek2P7I=";
+    };
+
+    patches = [
+      ./fix-log-dir.patch
+    ];
+
+    propagatedBuildInputs = with pythonPackages; [
+      setuptools
+
+      numpy
+      pillow
+      flask
+      rpi-gpio
+      webcolors
+      psutil
+      mido
+      rtmidi-python
+      spidev
+      waitress
+      websockets
+      werkzeug
+
+      rpi-ws281x-python
+    ];
+
+    format = "setuptools";
+
+    preBuild = ''
+      cp ${./setup.py} setup.py
+      sed -i 's/PLACEHOLDER_VERSION/${version}/' setup.py
+    '';
+
+    postInstall = ''
+      mv -v $out/bin/visualizer.py $out/bin/piano-led-visualizer
+    '';
+
+    meta = with lib; {
+      description = "Piano LED Visualizer for Raspberry Pi";
+      homepage = "https://github.com/onlaj/Piano-LED-Visualizer";
+      license = licenses.gpl3;
+      maintainers = [];
+      platforms = platforms.linux;
+    };
+  }

pkgs/piano-led-visualizer/fix-log-dir.patch

@@ -0,0 +1,24 @@
+diff --git a/lib/log_setup.py b/lib/log_setup.py
+index 34f9156..e164d14 100644
+--- a/lib/log_setup.py
++++ b/lib/log_setup.py
+@@ -1,6 +1,7 @@
+ import logging
+ from logging.handlers import RotatingFileHandler
+ import sys
++import os
+ 
+ # Create a custom logger
+ logger = logging.getLogger("my_app")
+@@ -10,7 +11,10 @@ logger.setLevel(logging.DEBUG)
+ 
+ # Create handlers
+ console_handler = logging.StreamHandler()
+-file_handler = RotatingFileHandler('/home/Piano-LED-Visualizer/visualizer.log', maxBytes=500000, backupCount=10)
++
++log_path = os.path.expanduser('~/Piano-LED-Visualizer/visualizer.log')
++os.makedirs(os.path.dirname(log_path), exist_ok=True)
++file_handler = RotatingFileHandler(log_path, maxBytes=500000, backupCount=10)
+ 
+ 
+ # Set the level for handlers

pkgs/piano-led-visualizer/setup.py

@@ -0,0 +1,24 @@
+from setuptools import setup, find_packages
+
+setup(
+    name="piano_led_visualizer",
+    version="PLACEHOLDER_VERSION",
+    py_modules=["visualizer"],
+    packages=find_packages(),  # includes all packages with __init__.py
+    install_requires=[
+        "numpy",
+        "pillow",
+        "flask",
+        "rpi-gpio",
+        "webcolors",
+        "psutil",
+        "mido",
+        "rtmidi",
+        "spidev",
+        "waitress",
+        "websockets",
+        "werkzeug",
+        "rpi_ws281x",
+    ],
+    scripts=["visualizer.py"],
+)

pkgs/rpi-ws281x-python/default.nix

@@ -0,0 +1,37 @@
+{
+  lib,
+  python3,
+  fetchFromGitHub,
+  pkgs,
+}:
+python3.pkgs.buildPythonPackage rec {
+  pname = "rpi-ws281x";
+  version = "5.0.0";
+
+  src = fetchFromGitHub {
+    owner = "rpi-ws281x";
+    repo = "rpi-ws281x-python";
+    rev = "v${version}";
+    sha256 = "sha256-CVPibDs1QLeXhtoEBw3JplKIIUpzahjgJKy8GVy99Wk=";
+    fetchSubmodules = true;
+  };
+
+  format = "setuptools";
+
+  propagatedBuildInputs = with python3.pkgs; [
+    setuptools
+    wheel
+  ];
+
+  postUnpack = ''
+    sourceRoot="$sourceRoot/library"
+  '';
+
+  meta = with lib; {
+    description = "Python bindings for the rpi_ws281x C library";
+    homepage = "https://github.com/rpi-ws281x/rpi-ws281x-python";
+    license = licenses.mit;
+    maintainers = [];
+    platforms = platforms.linux;
+  };
+}

shell.nix

@@ -3,6 +3,9 @@
     NIX_CONFIG = "extra-experimental-features = nix-command flakes ca-derivations";
     nativeBuildInputs = with pkgs; [
       nix
+      deploy-rs # for deploy
+      nixos-generators # for nixos-generate -f iso --flake .#host
+      nh # nix helper for nice interfaces
       home-manager
       git