fix: some small fixes, here and there

.sops.yaml

@@ -1,8 +1,10 @@
 keys:
   - &ataraxia age13phpsegg6vu7a34ydtfa9s904dfpgzqhzru7epnky7glezk0xvkst9qh6h
-  - &blueshift age186qkn94ck9lz0nmx57m37jwgwws5pgcs40q8d8uaetytz4gp6p9qlftp5x
   - &andromedae age1kj70enq8ynqdnl04l5d0v43vcn0de0snn732wfxdxrgxhp72myeq93e9ts
+  - &blueshift age186qkn94ck9lz0nmx57m37jwgwws5pgcs40q8d8uaetytz4gp6p9qlftp5x
+  - &orion age1m5msm7rgqye2q9zesgedg0emga4ntehlr629786lrxs3rhk0squq0ly9je
   - &redshift age1d4mqql020mpne9r3vtt4l9ywfzfq7zpa3mad33syxln2kldkjsxqgju90f
+  - &vega age1pu952207c8cttej5pqw949gj9fzfh2hztuukqdv0a36vss8q8eaqx45wuq
 creation_rules:
   - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
     key_groups:
@@ -10,7 +12,9 @@ creation_rules:
           - *ataraxia
           - *andromedae
           - *blueshift
+          - *orion
           - *redshift
+          - *vega
   - path_regex: secrets/andromedae/[^/]+\.(yaml|json|env|ini)$
     key_groups:
       - age:
@@ -21,8 +25,18 @@ creation_rules:
       - age:
           - *ataraxia
           - *blueshift
+  - path_regex: secrets/orion/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+      - age:
+          - *ataraxia
+          - *orion
   - path_regex: secrets/redshift/[^/]+\.(yaml|json|env|ini)$
     key_groups:
       - age:
           - *ataraxia
           - *redshift
+  - path_regex: secrets/vega/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+      - age:
+          - *ataraxia
+          - *vega

flake.lock

@@ -89,11 +89,11 @@
         "nixpkgs": "nixpkgs_5"
       },
       "locked": {
-        "lastModified": 1750153510,
-        "narHash": "sha256-NYHXXJZ9m4fJpKk9tKn/EExX87SqcBcRINOGF7hKRLI=",
+        "lastModified": 1751705516,
+        "narHash": "sha256-Y099OGYWYHtpYFP4offuV6rldBnpUv4CYk+HwuaQwLU=",
         "owner": "catppuccin",
         "repo": "nix",
-        "rev": "4e95eaf8a351956d75cc400318579967ca2b6d0f",
+        "rev": "719bb50ca2c99bc9c077669a48bfd9815493a11d",
         "type": "github"
       },
       "original": {
@@ -111,11 +111,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1751477036,
-        "narHash": "sha256-0ZPQdjYMeRK/RMRagvr5a8dkjB7sQlXJsOBb40k+KYY=",
+        "lastModified": 1751777244,
+        "narHash": "sha256-/czsZlnHv8Sl/u2syCzucxfVFLBHXWxvgicYmlk5YEE=",
         "owner": "chaotic-cx",
         "repo": "nyx",
-        "rev": "55649265bd2fd701e6758299516a69db523fb966",
+        "rev": "a0d66535286f557ccfb7c7c4c4ddc95cce96fc8b",
         "type": "github"
       },
       "original": {
@@ -202,11 +202,11 @@
         "nixpkgs": "nixpkgs_8"
       },
       "locked": {
-        "lastModified": 1750885119,
-        "narHash": "sha256-nDxZMz1uk5suHPxE9Ky68g1OKbIs5QPGuszElkPyeoc=",
+        "lastModified": 1751820494,
+        "narHash": "sha256-y8IGLpeJ/IvAiBaS17hkSC21WsCw2f4GHxg3GxvMTro=",
         "owner": "cachix",
         "repo": "devenv",
-        "rev": "8f6da8234e6bf6a501f89c4c3aa6732fdaa1a6ea",
+        "rev": "c5f01223c737cd749f994b772ae84445acd45a9d",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750680230,
-        "narHash": "sha256-kD88T/NqmcgfOBFAwphN30ccaUdj6K6+LG0XdM2w2LA=",
+        "lastModified": 1751607816,
+        "narHash": "sha256-5PtrwjqCIJ4DKQhzYdm8RFePBuwb+yTzjV52wWoGSt4=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "8fd2d6c75009ac75f9a6fb18c33a239806778d01",
+        "rev": "da6109c917b48abc1f76dd5c9bf3901c8c80f662",
         "type": "github"
       },
       "original": {
@@ -351,11 +351,11 @@
         "nixpkgs-lib": "nixpkgs-lib_2"
       },
       "locked": {
-        "lastModified": 1749398372,
-        "narHash": "sha256-tYBdgS56eXYaWVW3fsnPQ/nFlgWi/Z2Ymhyu21zVM98=",
+        "lastModified": 1751413152,
+        "narHash": "sha256-Tyw1RjYEsp5scoigs1384gIg6e0GoBVjms4aXFfRssQ=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "9305fe4e5c2a6fcf5ba6a3ff155720fbe4076569",
+        "rev": "77826244401ea9de6e3bac47c2db46005e1f30b5",
         "type": "github"
       },
       "original": {
@@ -549,11 +549,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751473516,
-        "narHash": "sha256-nJFR4f4hh879Mm7ne4SaUihxQAwu1FdnRCaA/8pHc1k=",
+        "lastModified": 1751693185,
+        "narHash": "sha256-+LKghTO5wWBcR/MJAeoSarWR7c7dO6GyA8+jM8DHV08=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "bafcf336870c9daca80df1c4a09ef926fc497016",
+        "rev": "36c57c6a1d03a5efbf5e23c04dbe21259d25f992",
         "type": "github"
       },
       "original": {
@@ -569,11 +569,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750792728,
-        "narHash": "sha256-Lh3dopA8DdY+ZoaAJPrtkZOZaFEJGSYjOdAYYgOPgE4=",
+        "lastModified": 1751810233,
+        "narHash": "sha256-kllkNbIqQi3VplgTMeGzuh1t8Gk8TauvkTRt93Km+tQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "366f00797b1efb70f2882d3da485e3c10fd3d557",
+        "rev": "9b0873b46c9f9e4b7aa01eb634952c206af53068",
         "type": "github"
       },
       "original": {
@@ -607,11 +607,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751358277,
-        "narHash": "sha256-Xz2JtcO9UNLur+OhoDVyYXqBQCW2KsouLyUU/NmwBQQ=",
+        "lastModified": 1751529406,
+        "narHash": "sha256-jwKDHyUycp678zDYa5Hyfq3msO73YMXdZPxp96dU7po=",
         "owner": "Jovian-Experiments",
         "repo": "Jovian-NixOS",
-        "rev": "011d5a48d70c2a3ef35acd0e026e10b5844ce2a0",
+        "rev": "b2e5ce654e4f5bf8905c2e07a96dcf4966e6277d",
         "type": "github"
       },
       "original": {
@@ -655,11 +655,11 @@
     "lix": {
       "flake": false,
       "locked": {
-        "lastModified": 1750863598,
-        "narHash": "sha256-A9EwWUNC+8Fnsafi3Lcks2jNm6wjNoxfPS5TJXzpTk0=",
-        "rev": "9a59106c172b7d5963e3dc2cf07ff5b19f8119d6",
+        "lastModified": 1751825501,
+        "narHash": "sha256-6Jve3xCvRJGkz0A9D8dXH/DMWYE8MkFt+KJWQs9cLkw=",
+        "rev": "378b360bf8e0d04e8dd3733acd20d7a9b70360f1",
         "type": "tarball",
-        "url": "https://git.lix.systems/api/v1/repos/lix-project/lix/archive/9a59106c172b7d5963e3dc2cf07ff5b19f8119d6.tar.gz?rev=9a59106c172b7d5963e3dc2cf07ff5b19f8119d6"
+        "url": "https://git.lix.systems/api/v1/repos/lix-project/lix/archive/378b360bf8e0d04e8dd3733acd20d7a9b70360f1.tar.gz?rev=378b360bf8e0d04e8dd3733acd20d7a9b70360f1"
       },
       "original": {
         "type": "tarball",
@@ -678,11 +678,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747667424,
-        "narHash": "sha256-7EICjbmG6lApWKhFtwvZovdcdORY1CEe6/K7JwtpYfs=",
-        "rev": "3c23c6ae2aecc1f76ae7993efe1a78b5316f0700",
+        "lastModified": 1751240140,
+        "narHash": "sha256-gbFOUtmkzzNAiHoUtySwbi+AVDgWOW8CpWmTmkoaQiI=",
+        "rev": "ea74d925e650948d296fb85e4671fb0ce944f550",
         "type": "tarball",
-        "url": "https://git.lix.systems/api/v1/repos/lix-project/nixos-module/archive/3c23c6ae2aecc1f76ae7993efe1a78b5316f0700.tar.gz?rev=3c23c6ae2aecc1f76ae7993efe1a78b5316f0700"
+        "url": "https://git.lix.systems/api/v1/repos/lix-project/nixos-module/archive/ea74d925e650948d296fb85e4671fb0ce944f550.tar.gz?rev=ea74d925e650948d296fb85e4671fb0ce944f550"
       },
       "original": {
         "type": "tarball",
@@ -771,11 +771,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750565152,
-        "narHash": "sha256-A6ZIoIgaPPkzIVxKuaxwEJicPOeTwC/MD9iuC3FVhDM=",
+        "lastModified": 1751774635,
+        "narHash": "sha256-DuOznGdgMxeSlPpUu6Wkq0ZD5e2Cfv9XRZeZlHWMd1s=",
         "owner": "nix-community",
         "repo": "nix-index-database",
-        "rev": "78cd697acc2e492b4e92822a4913ffad279c20e6",
+        "rev": "85686025ba6d18df31cc651a91d5adef63378978",
         "type": "github"
       },
       "original": {
@@ -792,11 +792,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750817194,
-        "narHash": "sha256-9CCF4ANxZUXHwz74SeGQkFi4OYnm0BD2I3GeQvxMKPM=",
+        "lastModified": 1751768141,
+        "narHash": "sha256-my0LtqLhcsSzIHQZPkgDSjXejaXQ62Gf2NfdheO7qQs=",
         "owner": "nix-community",
         "repo": "nix-vscode-extensions",
-        "rev": "fc01ad517af163c76d4493c5959fc5c44244a97f",
+        "rev": "41de1aa39e479cdf2e6fd522431aa1fc3615e35a",
         "type": "github"
       },
       "original": {
@@ -845,11 +845,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750117611,
-        "narHash": "sha256-LTwASICtyN3AjzlF9l2ZNAIVZqclio3yRcwwZy3QSJA=",
+        "lastModified": 1750955511,
+        "narHash": "sha256-IDB/oh/P63ZTdhgSkey2LZHzeNhCdoKk+4j7AaPe1SE=",
         "owner": "cachix",
         "repo": "nix",
-        "rev": "9e4fc95c388e2223d47da865503dee20d179776a",
+        "rev": "afa41b08df4f67b8d77a8034b037ac28c71c77df",
         "type": "github"
       },
       "original": {
@@ -892,11 +892,11 @@
     },
     "nixpkgs-lib_2": {
       "locked": {
-        "lastModified": 1748740939,
-        "narHash": "sha256-rQaysilft1aVMwF14xIdGS3sj1yHlI6oKQNBRTF40cc=",
+        "lastModified": 1751159883,
+        "narHash": "sha256-urW/Ylk9FIfvXfliA1ywh75yszAbiTEVgpPeinFyVZo=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "656a64127e9d791a334452c6b6606d17539476e2",
+        "rev": "14a40a1d7fb9afa4739275ac642ed7301a9ba1ab",
         "type": "github"
       },
       "original": {
@@ -907,11 +907,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1750741721,
-        "narHash": "sha256-Z0djmTa1YmnGMfE9jEe05oO4zggjDmxOGKwt844bUhE=",
+        "lastModified": 1751637120,
+        "narHash": "sha256-xVNy/XopSfIG9c46nRmPaKfH1Gn/56vQ8++xWA8itO4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "4b1164c3215f018c4442463a27689d973cffd750",
+        "rev": "5c724ed1388e53cc231ed98330a60eb2f7be4be3",
         "type": "github"
       },
       "original": {
@@ -971,11 +971,11 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1744463964,
-        "narHash": "sha256-LWqduOgLHCFxiTNYi3Uj5Lgz0SR+Xhw3kr/3Xd0GPTM=",
+        "lastModified": 1750776420,
+        "narHash": "sha256-/CG+w0o0oJ5itVklOoLbdn2dGB0wbZVOoDm4np6w09A=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2631b0b7abcea6e640ce31cd78ea58910d31e650",
+        "rev": "30a61f056ac492e3b7cdcb69c1e6abdcf00e39cf",
         "type": "github"
       },
       "original": {
@@ -987,11 +987,11 @@
     },
     "nixpkgs_6": {
       "locked": {
-        "lastModified": 1751271578,
-        "narHash": "sha256-P/SQmKDu06x8yv7i0s8bvnnuJYkxVGBWLWHaU+tt4YY=",
+        "lastModified": 1751637120,
+        "narHash": "sha256-xVNy/XopSfIG9c46nRmPaKfH1Gn/56vQ8++xWA8itO4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3016b4b15d13f3089db8a41ef937b13a9e33a8df",
+        "rev": "5c724ed1388e53cc231ed98330a60eb2f7be4be3",
         "type": "github"
       },
       "original": {
@@ -1035,11 +1035,11 @@
     },
     "nixpkgs_9": {
       "locked": {
-        "lastModified": 1750622754,
-        "narHash": "sha256-kMhs+YzV4vPGfuTpD3mwzibWUE6jotw5Al2wczI0Pv8=",
+        "lastModified": 1751741127,
+        "narHash": "sha256-t75Shs76NgxjZSgvvZZ9qOmz5zuBE8buUaYD28BMTxg=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "c7ab75210cb8cb16ddd8f290755d9558edde7ee1",
+        "rev": "29e290002bfff26af1db6f64d070698019460302",
         "type": "github"
       },
       "original": {
@@ -1083,11 +1083,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751423951,
-        "narHash": "sha256-AowKhJGplXRkAngSvb+32598DTiI6LOzhAnzgvbCtYM=",
+        "lastModified": 1751683029,
+        "narHash": "sha256-dYO5X5jK8bpQOeRAo8R5aUt6M/+Ji1cZgstZI7SQ2IA=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "1684ed5b15859b655caf41b467d046e29a994d04",
+        "rev": "9e5e62a33a929a67a5427fb7324a6f583dced0b2",
         "type": "github"
       },
       "original": {
@@ -1103,11 +1103,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750119275,
-        "narHash": "sha256-Rr7Pooz9zQbhdVxux16h7URa6mA80Pb/G07T4lHvh0M=",
+        "lastModified": 1751606940,
+        "narHash": "sha256-KrDPXobG7DFKTOteqdSVeL1bMVitDcy7otpVZWDE6MA=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "77c423a03b9b2b79709ea2cb63336312e78b72e2",
+        "rev": "3633fc4acf03f43b260244d94c71e9e14a2f6e0d",
         "type": "github"
       },
       "original": {
@@ -1202,11 +1202,11 @@
         "systems": "systems_4"
       },
       "locked": {
-        "lastModified": 1751351108,
-        "narHash": "sha256-C6lGn4ALRpKzdL129meWl4DaDP26Il3F7RhDzAjfKJQ=",
+        "lastModified": 1751822129,
+        "narHash": "sha256-aI8JTRZHynKKJQpNP5TJuHsFQpKfDVJbW/u99lTpGyg=",
         "owner": "abenz1267",
         "repo": "walker",
-        "rev": "94b180424d1cdfd98d513d37e5e2284c5b074140",
+        "rev": "2f16a48d6fa4f0f16c7b2173a1ff434005c8ed32",
         "type": "github"
       },
       "original": {

flake.nix

@@ -116,6 +116,11 @@
               system = "x86_64-linux";
               useHomeManager = true;
             };
+            # dell-laptop
+            vega = {
+              system = "x86_64-linux";
+              useHomeManager = true;
+            };
             # home-hypervisor
             orion = {
               system = "x86_64-linux";
@@ -145,7 +150,12 @@
 
               name = "nixos-config";
               packages = builtins.attrValues {
-                inherit (pkgs) deploy-rs nixfmt-rfc-style sops;
+                inherit (pkgs)
+                  deploy-rs
+                  nixfmt-rfc-style
+                  sops
+                  ssh-to-age
+                  ;
               };
               languages.nix = {
                 enable = true;
@@ -198,7 +208,7 @@
                 deployPkgs = import liteConfigNixpkgs {
                   system = "x86_64-linux";
                   overlays = [
-                    inputs.deploy-rs.overlay
+                    inputs.deploy-rs.overlays.default
                     (_final: prev: {
                       deploy-rs = {
                         inherit (pkgs) deploy-rs;
@@ -219,6 +229,9 @@
                 orion = {
                   hostname = "10.10.10.10";
                 };
+                vega = {
+                  hostname = "10.10.10.101";
+                };
                 redshift = {
                   hostname = "104.164.54.197";
                   fastConnection = false;

hosts/vega/boot.nix

@@ -0,0 +1,50 @@
+{ lib, pkgs, ... }:
+{
+  fileSystems."/" = lib.mkForce {
+    device = "none";
+    options = [
+      "defaults"
+      "size=4G"
+      "mode=755"
+    ];
+    fsType = "tmpfs";
+  };
+
+  services.scx.enable = true;
+  services.scx.scheduler = "scx_rustland";
+
+  networking.hostId = "b06ca84a";
+
+  boot = {
+    kernelPackages = pkgs.linuxPackages_cachyos;
+    zfs.package = pkgs.zfs_cachyos;
+    zfs.devNodes = "/dev/disk/by-id";
+
+    blacklistedKernelModules = [ "psmouse" ];
+    kernelParams = [ "mem_sleep_default=deep" ];
+
+    loader = {
+      grub = {
+        enable = true;
+        device = "nodev";
+        copyKernels = true;
+        efiSupport = true;
+        enableCryptodisk = true;
+        useOSProber = false;
+        zfsSupport = true;
+        gfxmodeEfi = "1920x1080";
+      };
+      efi.efiSysMountPoint = "/efi";
+      efi.canTouchEfiVariables = true;
+    };
+
+    tmp.useTmpfs = true;
+    tmp.tmpfsSize = "100%";
+    tmp.tmpfsHugeMemoryPages = "within_size";
+
+    supportedFilesystems = [
+      "ntfs"
+      "zfs"
+    ];
+  };
+}

hosts/vega/default.nix

@@ -0,0 +1,110 @@
+{
+  config,
+  pkgs,
+  inputs,
+  ...
+}:
+let
+  defaultUser = config.ataraxia.defaults.users.defaultUser;
+in
+{
+  imports = [
+    ./disk-config.nix
+    # ./hardware-configuration.nix
+    ./boot.nix
+
+    inputs.catppuccin.nixosModules.catppuccin
+  ];
+  catppuccin.enable = true;
+  catppuccin.accent = "mauve";
+  catppuccin.flavor = "mocha";
+
+  ataraxia.defaults.role = "laptop";
+  ataraxia.defaults.hardware.cpuVendor = "intel";
+  ataraxia.defaults.hardware.gpuVendor = "intel";
+  ataraxia.defaults.bluetooth.enable = true;
+  # Impermanence
+  ataraxia.filesystems.zfs.enable = true;
+  ataraxia.filesystems.zfs.eraseOnBoot.enable = true;
+  ataraxia.filesystems.zfs.eraseOnBoot.snapshots = [
+    "rpool/nixos/root@blank"
+    "rpool/user/home@blank"
+  ];
+  ataraxia.filesystems.zfs.mountpoints = [
+    "/etc/secrets"
+    "/media/libvirt"
+    "/nix"
+    "/persist"
+    "/srv"
+    "/var/lib/containers"
+    "/var/lib/docker"
+    "/var/lib/libvirt"
+    "/var/lib/postgresql"
+    "/var/log"
+  ];
+
+  ataraxia.networkd.enable = false;
+  ataraxia.networkmanager.enable = true;
+
+  # Home-manager
+  home-manager.users.${defaultUser} = {
+    ataraxia.defaults.role = "laptop";
+    ataraxia.services.modprobed-db.enable = true;
+    ataraxia.theme.catppuccin.enable = true;
+
+    home.packages = with pkgs; [ modprobed-db ];
+
+    persist.state.directories = [ "projects" ];
+
+    home.stateVersion = "25.05";
+  };
+
+  # Services
+  services.postgresql.settings = {
+    full_page_writes = "off";
+    wal_init_zero = "off";
+    wal_recycle = "off";
+  };
+  services.fwupd.enable = true;
+  services.tlp = {
+    enable = true;
+    settings = {
+      TLP_DEFAULT_MODE = "BAT";
+      TLP_PERSISTENT_DEFAULT = 1;
+      CPU_SCALING_GOVERNOR_ON_AC = "powersave";
+      CPU_SCALING_GOVERNOR_ON_BAT = "powersave";
+      CPU_BOOST_ON_AC = 1;
+      CPU_BOOST_ON_BAT = 0;
+    };
+  };
+
+  ataraxia.programs.waydroid.enable = true;
+  ataraxia.vpn.sing-box.enable = true;
+  ataraxia.vpn.sing-box.config = "dell-singbox";
+  services.tailscale = {
+    enable = true;
+    useRoutingFeatures = "client";
+  };
+
+  # Mesa from unstable channel
+  hardware.graphics.package = pkgs.mesaUnstable;
+  hardware.graphics.package32 = pkgs.mesaUnstablei686;
+  programs.hyprland.package = pkgs.hyprlandUnstable;
+  programs.hyprland.portalPackage = pkgs.hyprlandPortalUnstable;
+
+  # Auto-mount lan nfs share
+  fileSystems = {
+    "/media/local-nfs" = {
+      device = "10.10.10.11:/";
+      fsType = "nfs4";
+      options = [
+        "nfsvers=4.2"
+        "noauto"
+        "x-systemd.automount"
+        "x-systemd.idle-timeout=1800"
+      ];
+    };
+  };
+
+  system.stateVersion = "25.05";
+}

hosts/vega/disk-config.nix

@@ -0,0 +1,239 @@
+{ inputs, ... }:
+let
+  emptySnapshot =
+    name: "zfs list -t snapshot -H -o name | grep -E '^${name}@blank$' || zfs snapshot ${name}@blank";
+in
+{
+  imports = [ inputs.disko.nixosModules.disko ];
+
+  disko.devices = {
+    disk = {
+      main = {
+        device = "/dev/disk/by-id/nvme-Samsung_SSD_960_EVO_250GB_S3ESNX0K159868B";
+        type = "disk";
+        content = {
+          type = "gpt";
+          partitions = {
+            esp = {
+              type = "EF00";
+              name = "ESP";
+              size = "512M";
+              priority = 1;
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/efi";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            swap = {
+              name = "swap";
+              size = "16G";
+              priority = 2;
+              content = {
+                type = "swap";
+                randomEncryption = true;
+              };
+            };
+            boot = {
+              name = "bpool";
+              size = "2G";
+              priority = 3;
+              content = {
+                type = "zfs";
+                pool = "bpool";
+              };
+            };
+            cryptroot = {
+              size = "100%";
+              priority = 4;
+              content = {
+                type = "zfs";
+                pool = "rpool";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      bpool = {
+        type = "zpool";
+        options = {
+          ashift = "13";
+          autotrim = "on";
+          compatibility = "grub2";
+        };
+        rootFsOptions = {
+          acltype = "posixacl";
+          atime = "on";
+          canmount = "off";
+          compression = "lz4";
+          devices = "off";
+          normalization = "formD";
+          relatime = "on";
+          xattr = "sa";
+          dedup = "off";
+        };
+        mountpoint = "/boot";
+        postCreateHook = emptySnapshot "bpool";
+
+        datasets = {
+          nixos = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+            options.canmount = "off";
+            postCreateHook = emptySnapshot "bpool/nixos";
+          };
+          "nixos/boot" = {
+            type = "zfs_fs";
+            mountpoint = "/boot";
+            options.canmount = "on";
+            postCreateHook = emptySnapshot "bpool/nixos/boot";
+          };
+        };
+      };
+      rpool = {
+        type = "zpool";
+        options = {
+          ashift = "13";
+          autotrim = "on";
+          cachefile = "none";
+        };
+        rootFsOptions = {
+          acltype = "posixacl";
+          atime = "on";
+          canmount = "off";
+          compression = "zstd";
+          dedup = "off";
+          dnodesize = "auto";
+          normalization = "formD";
+          relatime = "on";
+          xattr = "sa";
+        };
+        mountpoint = "/";
+        postCreateHook = emptySnapshot "rpool";
+
+        datasets = {
+          reserved = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+            options = {
+              canmount = "off";
+              refreservation = "10G";
+            };
+          };
+          nixos = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+            options.canmount = "off";
+            postCreateHook = emptySnapshot "rpool/nixos";
+          };
+          user = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+            options.canmount = "off";
+            postCreateHook = emptySnapshot "rpool/user";
+          };
+          persistent = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+            options.canmount = "off";
+            postCreateHook = emptySnapshot "rpool/persistent";
+          };
+          "nixos/root" = {
+            type = "zfs_fs";
+            mountpoint = "/";
+            options.canmount = "noauto";
+            postCreateHook = emptySnapshot "rpool/nixos/root";
+          };
+          "user/home" = {
+            type = "zfs_fs";
+            mountpoint = "/home";
+            options.canmount = "on";
+            postCreateHook = emptySnapshot "rpool/user/home";
+          };
+          "persistent/impermanence" = {
+            type = "zfs_fs";
+            mountpoint = "/persist";
+            options.canmount = "on";
+            postCreateHook = emptySnapshot "rpool/persistent/impermanence";
+          };
+          "persistent/servers" = {
+            type = "zfs_fs";
+            mountpoint = "/srv";
+            options.canmount = "on";
+            postCreateHook = emptySnapshot "rpool/persistent/servers";
+          };
+          "persistent/nix" = {
+            type = "zfs_fs";
+            mountpoint = "/nix";
+            options.canmount = "on";
+            postCreateHook = emptySnapshot "rpool/persistent/nix";
+          };
+          "persistent/secrets" = {
+            type = "zfs_fs";
+            mountpoint = "/etc/secrets";
+            options.canmount = "on";
+            postCreateHook = emptySnapshot "rpool/persistent/secrets";
+          };
+          "persistent/log" = {
+            type = "zfs_fs";
+            mountpoint = "/var/log";
+            options.canmount = "on";
+            postCreateHook = emptySnapshot "rpool/persistent/log";
+          };
+          "persistent/docker" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib/docker";
+            options.canmount = "on";
+            postCreateHook = emptySnapshot "rpool/persistent/docker";
+          };
+          "persistent/nixos-containers" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib/nixos-containers";
+            options.canmount = "on";
+            postCreateHook = emptySnapshot "rpool/persistent/nixos-containers";
+          };
+          "persistent/libvirt" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib/libvirt";
+            options.canmount = "on";
+            postCreateHook = emptySnapshot "rpool/persistent/libvirt";
+          };
+          "persistent/libvirt-user" = {
+            type = "zfs_fs";
+            mountpoint = "/media/libvirt";
+            options.canmount = "on";
+            postCreateHook = emptySnapshot "rpool/persistent/libvirt-user";
+          };
+          "persistent/libvirt-user/images" = {
+            type = "zfs_fs";
+            mountpoint = "/media/libvirt/images";
+            options.canmount = "on";
+            options.atime = "off";
+            options.recordsize = "16K";
+            options.compression = "lz4";
+            postCreateHook = emptySnapshot "rpool/persistent/libvirt-user/images";
+          };
+          "persistent/containers" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib/containers";
+            options.canmount = "on";
+            options.atime = "off";
+            postCreateHook = emptySnapshot "rpool/persistent/containers";
+          };
+          "persistent/postgresql" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib/postgresql";
+            options.canmount = "on";
+            options.recordsize = "16K";
+            options.atime = "off";
+            options.logbias = "latency";
+            postCreateHook = emptySnapshot "rpool/persistent/postgresql";
+          };
+        };
+      };
+    };
+  };
+}

modules/home/applications/mpv.nix

@@ -32,7 +32,7 @@ in
     };
 
     persist.state.directories = [
-      ".config/mpv"
+      ".local/state/mpv"
     ];
   };
 

modules/home/applications/packages.nix

@@ -28,6 +28,8 @@ in
       bottom
       fd
       file
+      jellyfin-mpv-shim
+      jq
       libqalculate
       p7zip
       pinfo
@@ -41,9 +43,11 @@ in
       translate-shell
       unrar
       xarchiver
+      yt-dlp
     ];
 
     persist.state.directories = [
+      ".config/jellyfin-mpv-shim"
       ".config/qalculate"
       ".config/qBittorrent"
       ".config/qimgv"

modules/home/persist/default.nix

@@ -141,7 +141,6 @@ in
         services."persist-cache-cleanup-${username}" = {
           Unit = {
             Description = "Cleaning up cache files and directories for user ${username}";
-            Wants = [ "modprobed-db.timer" ];
           };
           Service =
             let
@@ -162,13 +161,9 @@ in
               '';
               Type = "simple";
             };
-          Install.WantedBy = [ "default.target" ];
         };
         timers."persist-cache-cleanup-${username}" = {
-          Unit = {
-            Description = "Run persist-cache-cleanup-${username} service by set schedule";
-            PartOf = [ "persist-cache-cleanup-${username}.service" ];
-          };
+          Unit.Description = "Run persist-cache-cleanup-${username} service by set schedule";
           Timer = {
             Persistent = true;
             OnCalendar = cfg.cache.clean.dates;

modules/home/roles/default.nix

@@ -25,6 +25,7 @@ in
         "base"
         "server"
         "desktop"
+        "laptop"
       ];
       default = "none";
     };
@@ -97,10 +98,14 @@ in
         ataraxia.wayland.waybar.enable = mkDefault true;
         ataraxia.wayland.wlogout.enable = mkDefault true;
       };
+      laptopRole = recursiveUpdate desktopRole {
+        ataraxia.wayland.waybar.laptopWidgets = true;
+      };
     in
     mkMerge [
       (mkIf (role == "base") baseRole)
       (mkIf (role == "server") serverRole)
       (mkIf (role == "desktop") desktopRole)
+      (mkIf (role == "laptop") laptopRole)
     ];
 }

modules/home/theme/catppuccin.nix

@@ -68,7 +68,7 @@ in
       catppuccin.enable = true;
       catppuccin.waybar.mode = "prependImport"; # or "createLink"
 
-      catppuccin.vscode = {
+      catppuccin.vscode.profiles.default = {
         enable = true;
         flavor = cfg.flavor;
         settings = {

modules/home/workspace/wayland/hyprland.nix

@@ -171,8 +171,8 @@ in
           "$mod SHIFT,Y,exec,${execApp} ${yt-mpv} --no-video"
           "$mod,print,exec,${execApp} grim $(xdg-user-dir PICTURES)/Screenshots/$(date +'%Y-%m-%d+%H:%M:%S').png && notify-send 'Screenshot Saved'"
           "$mod CTRL,print,exec,${execApp} grim - | wl-copy && notify-send 'Screenshot Copied to Clipboard'"
-          "$mod SHIFT,print,exec,${execApp} grim -g '$(slurp)' $(xdg-user-dir PICTURES)/Screenshots/$(date +'%Y-%m-%d+%H:%M:%S').png && notify-send 'Screenshot Saved'"
-          "$mod CTRLSHIFT,print,exec,${execApp} grim -g '$(slurp)' - | wl-copy && notify-send 'Screenshot Copied to Clipboard'"
+          "$mod SHIFT,print,exec,${execApp} grim -g \"$(slurp)\" $(xdg-user-dir PICTURES)/Screenshots/$(date +'%Y-%m-%d+%H:%M:%S').png && notify-send 'Screenshot Saved'"
+          "$mod CTRLSHIFT,print,exec,${execApp} grim -g \"$(slurp)\" - | wl-copy && notify-send 'Screenshot Copied to Clipboard'"
           ",xf86audioplay,exec,${execApp} mpris-ctl pp"
           ",xf86audionext,exec,${execApp} mpris-ctl next"
           ",xf86audioprev,exec,${execApp} mpris-ctl prev"

modules/home/workspace/wayland/waybar.nix

@@ -28,7 +28,7 @@ in
           modules-left =
             [
               "hyprland/workspaces"
-              # "wireplumber"
+              "wireplumber"
             ]
             ++ lib.optionals cfg.laptopWidgets [
               "battery"

modules/nixos/hardware/bluetooth.nix

@@ -0,0 +1,25 @@
+{ config, lib, ... }:
+let
+  inherit (lib) mkEnableOption mkIf;
+
+  cfg = config.ataraxia.defaults.bluetooth;
+in
+{
+  options.ataraxia.defaults.bluetooth = {
+    enable = mkEnableOption "Default bluetooth settings";
+  };
+
+  config = mkIf cfg.enable {
+    services.blueman.enable = true;
+    hardware.bluetooth = {
+      enable = true;
+      settings = {
+        General = {
+          Experimental = true;
+        };
+      };
+    };
+
+    persist.state.directories = [ "/var/lib/bluetooth" ];
+  };
+}

modules/nixos/roles/default.nix

@@ -28,6 +28,7 @@ in
         "base"
         "server"
         "desktop"
+        "laptop"
       ];
       default = "none";
     };
@@ -115,10 +116,20 @@ in
 
         zramSwap.memoryPercent = 150;
       };
+      laptopRole = recursiveUpdate desktopRole {
+        programs.light = {
+          enable = true;
+          brightnessKeys.enable = true;
+          # Allow dark screen
+          brightnessKeys.minBrightness = 0;
+          brightnessKeys.step = 10;
+        };
+      };
     in
     mkMerge [
       (mkIf (role == "base") baseRole)
       (mkIf (role == "server") serverRole)
       (mkIf (role == "desktop") desktopRole)
+      (mkIf (role == "laptop") laptopRole)
     ];
 }

secrets/misc.yaml

@@ -0,0 +1,66 @@
+attic-token: ENC[AES256_GCM,data:mO5g45uO9fMh9EakmjmdClVkhquKurjXmwnc3Qenj0Wq4QCUvQrOUa9xNcOpQPJsnGnVFH9qFF1X26kGqgUtX3vy4pibvgyoEi5EWVMw8d6tZ/OOKqm4UHlnbG1uEHq5VN5o+IRkk5P0pxXSXiWHNh1aUmW2NrQ8+Wcx7izH01rG5rAZ0hrPZAm/a66W882p6fRdGGvVo4KJBUx8T5n4MD8UNPlafGRKPiloZbXbNAb4NFPnvDLvSPn3VNM659AvDkweMUIQuLvsV0dXB2tOc9ZTkoYHqdYqVMDN/vy+sN+QpKJx0vL5x7e4bSbSCQ7ZP1tJHknuod0DKZqMjg==,iv:Fj35Z4G6jscv8hpcASmoTGc6TUWl/wbebMkQeYoEDeQ=,tag:Y0L5NrA0MKFE+/Fa+eL8oA==,type:str]
+headscale-api: ENC[AES256_GCM,data:oTVPF4ZwvXEle6R7WyNFTkOgbEEaCVumC2fXtWwSCOpWezCYPNpN1Jwtu+JHDiSCgn8zKu9H,iv:iSkHmcCLBHzeWc3r2GPEM2y+nxPCSDK2rVdcatkEtao=,tag:XBCLGwwbYR3YpLDR957hqg==,type:str]
+headscale-api-env: ENC[AES256_GCM,data:YdXBG+jYWOMpzMQvga+LOI7C/plmsxhDdhwkCSUzQGkv383KSPFM/KK+tVaEL2/9r4HaO8flnjGKYGPPC9IaPrrJbiNolcjzyBbIYA==,iv:61h8KDlhEUtOCyS+5FKmFdCuXYe3BQ+nNjpPKEgkenw=,tag:V27Dg0jQQSgrLYXORLzxrQ==,type:str]
+cf-dns-api: ENC[AES256_GCM,data:Y1NYeX6YzOyWkXDlqgv1KFV1rjpkEqTQz1MZC4qKI5zJ7SuXNUqc8w==,iv:mbaJHKJxoNGqSe425UyrGMWa/QT1uiapLccIqzTC11M=,tag:CdMFS6NMLKhH/WLmvgNJ7Q==,type:str]
+git-ssh-key: ENC[AES256_GCM,data:TfQzwqjWNSYZ/x2f6nSlhzRJ+LEzsY8pP/je0Y9wW64oVVyYOJnJsFyu/6TruZKWbCpf0kw9aRyali4ztKoGo6/RR7PiH1EvI/+V55+cwAtUBlTUBadrT1Ed1SHj0hKOLmSoo9M7L4TvOMQjqLr69BxkDIX8LBG/Fp1Hk2dpblqCdG3710o+R6wHMLUURPrMCb8ff953FLVOcCSBi2G34BV+rbuPXV2H3aS3kerMY3XXKeII4a7PKwyk1P+v5Fore2sVxQ8tWa+xfuzgC5pugKZrrkX9CldDA0wb3fBufk6YkBNNGG+EqqFq7IBP8jnZxZ8Gr7XLpXNSTwZ8Vkkhw8ebt0+f60uoxgHbor9m6Vi71k8+yy0HsTfbCbDToi25G094qOTHAINv+36X3KLl+Ea19+53BhYor675bziMBUiZ4o4YE2Da8Wu369lrHXTzPNncOCYwVV4UnxCrmeLV1yPJ4w0LFKpAeyo+v5tqZy9L/0xHZHVfUJq7i6jgpjx+ll4ACxV+V8xxFuFZ8pybY9tcH0VSTk/PZjmjbg0U2LlOa8n8KtywXgkWG+HZjQN+LylyBgaVQjOOuCEPG6NVerIE7N41r1GI0kdPlvg6ituA9umAEWFA1vmJ+s6e1WqUt2+webIi24zPrEUbdZGmmkgRLRJ9hXT0WOS35vtHQtZJYdz8fWKkId9jKVNgXNyrTzp5yFY4ySBfHGR0JxCjmAxVpaq7TQUh+c5qpu9+6wsQhi31t11TrJMoZ09DKJEWJ/lAuGsGvyAI6E2qqxK0lRaHIDZWbyCzf51+aOYlNRK5Z4OCeDahx08iFuA3CbZB981D6PQTLZ+40a6Xi2CeLGC3aL6hyBV4t/+btHad6u4SNGFD09AZkSHB9kKiJ8gMJw3iPwdbOnNTi6ExIuEY/Hcafq+8GFc0nT9aeaef3hFrThWhvmoXZMDWllwFRYWrKZL3IhsNTLIdWNWsV+huDiwmPeYMBVX3dX+SxQ31DRjSxr1ybUrb3JgrsrnJ1nDZcJxKHGtqKlv3bsKooZq2Lgoq2o5lvv3xIlfNSt4w+ehIM/9VzcYI48vvWl/tiHXAxzbD9qOFH7Y4agNn7lTtb/9kF70qDFUguUOk/GX+ec65b9SassmTTdQw7wREaTThF+v88HAez30A8ZzWHVKh0pfacnNAZZqdy3EYiUUkxmTQbnS/ASCNruFEyekAF0v5sGTKe7tgXZRoZB0T0Iy9lDT8IkEYOBTPn4qFjUq2v3Sg12zB5qs5ghnvBG9JW4SqXP0yx5s5Nzc4lZvcPsuEPzMA0GQM+iDU6AUw5sjE2PSsaarflLStotayU5fAQBJGOV/Oo1tsZWqhWlbIOXiky1xo3S1XTaV523MvChY0h3TbjVRDcP41BNgVQ7Q2SiF3j5WAxj6ry8vvR2RBcgglQXZMq+RYHZD81vU4JUFtV9QMDhlI3X53jnbOkignGq5gk3Pv1jV9C8SXXGqgtm8cH2LkNG1JRwt+IEGbKcL6XPAs/mUaT4m0bTE3Wl2HeGjEWHklEFaS0Kl5+m+wwTmO/qspJc8ap+ilQ7dFcyGlPFVl8ddyIPnUYSPND7OLd4OvvIA4+Dga9ngVFNKgQb1eho6gtQQRiO6J/y956uks98OmdOwkf/cZq3O/9GHamHoF5N2eN4okrvnsgF5rANN24ufVo7K+vSqVrCYqxCwcZwtrBqit5eKDceyhiM9MVm1iV2JolIiL3c7gHc3KG4l8LuQ2ET3ijI2eulsHbqssloB8wGNG/iihfMRYH9lNSSaRDMG5BBXWAz0hJp08CqqVnuEnlFagOAqHg4VfArkZE+0e34ybjq6gw0X/8L5ULQg1sICsjad/wT8DTLuaNT1/uvBDeG/V+OIycM/HYg8x2eqfBClQ3YMR4OfLzXNcwQAFjFHTLuuiHY8PXWtVDpfRUAA90lr/YfGqa4mHwcvvd3WyyrMoWkNyQ7jhsPtwF0qVQUZUAIsv3NbucRNfocE1CyeeQxyffkN2stMhZLJUJEDrIE4IRQV/qdgtFnaUC5OcCQ/z3P5dIueAKOUCynu7r/jImLaS4Bdeyh2VS5bQjBAVXoN30fk+E6JmRnfnvgN/5xvkK8ycCmt5j40Msbn68hXYLmxJnflpJHLeTwY2rS7JBLRHc1jNmUhi8QIWD9FeUrtWF875/5ZTo48KH1Ny2aQM26GHOhcGlJb2BCvieXsawtIDFtEw6T9q,iv:3Q2gIetHriabpmTvw7D4+TnKWCTQaKYWmLCMuj1RK0g=,tag:S7T/CgPyu9BwVB550BALmQ==,type:str]
+sops:
+    shamir_threshold: 1
+    age:
+        - recipient: age13phpsegg6vu7a34ydtfa9s904dfpgzqhzru7epnky7glezk0xvkst9qh6h
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYbHEzRnRSRU9odHIrQ1Ev
+            bWZ1MXdpMml4Q2x1cGFGUHFjVVQ2MER5WWxFCkNsR0t1SVFhZUZpSkp3YzlkMjFY
+            cUNvTk9GVm5reXRiY0ltQXA4cUZoVlUKLS0tIENJdHdZMUd5WHlOd1ArVGt4YXZW
+            clZWbjVYVEpJNGJGaWluSWFyR0o5cGMKsieLbIERMnlzUqSSmwMiyC7S8U3iUMwi
+            P4iyIgacC+Sy3lQ9lA/ygwBkHh8WVhsznBB2ujxUfn9/sNdBzXkhSw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1kj70enq8ynqdnl04l5d0v43vcn0de0snn732wfxdxrgxhp72myeq93e9ts
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4MG1ZczFIQnhRUTJRdW96
+            b0dNWExJdFFPUGVndmJWTjNtMElrNUlwV0NNCjhWaENMTWcvQkt4YzAvQlBHOFhl
+            ck1TYklCNjR6UnFkUW9ONy91VnVOb0kKLS0tIGUvWlJCU3dFTUlwd1JQL1lYTWZW
+            aXIxaVY3OEQyaCt6RkhzY0VIMytlMlEKGrqzM0HGV4vztKoiGpRwFdS41tbiJVK4
+            xe9mRc2ug/wTbPcL60NuPNy4kdNCPe93A+Vo29VclzKlKalxQHLNCQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age186qkn94ck9lz0nmx57m37jwgwws5pgcs40q8d8uaetytz4gp6p9qlftp5x
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKTzVoMEExaTJsZlFIWkNQ
+            VUsxbS9xN1ZzRzg1MldObCtFVTlKTGVncm5zCkFlMm5scEdxNDI2Z2ZLT09yTElm
+            T1FCamNsM2FBYzJjT3E3YkFMcHFUcUkKLS0tIEtXdFpPSENlT2VMdGliTGFkcm1u
+            MTVaMTlOM2JqZnIrYWZpMFhUeENCUm8KwOgGoc4ECwg8Zngl5pb/RXX3YDJjKFxr
+            +uW2n8w485RTJcQm77Rc0cifXLloWd4jiu69QVyE+azQj9K9rFormw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1m5msm7rgqye2q9zesgedg0emga4ntehlr629786lrxs3rhk0squq0ly9je
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3c1daU2p5WTl2SVBuZXU5
+            bFhWb2hJeHhxeGJnTDVCUTJVaDJVTmpVaWlZCjNsNzA4SnM5Mkt4OTg2NUFKT2pK
+            N1d0V0VZL0hsMU1MNEl2ODBoUWx4aGsKLS0tIDBGNzRGMG8yeXFHQXdsc0szTFk1
+            VFcxU3AzOS8vVEYzaE43RFhHRnJ0WnMKdX0IrOYxGoGJNP8cxgFBKAEo5pS3th3N
+            qpgem7DkTkeuygILc5S7O1usD11Wr80I+4MPEyp2tRwcE5WbvFGkIA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1d4mqql020mpne9r3vtt4l9ywfzfq7zpa3mad33syxln2kldkjsxqgju90f
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4UjJObzlQRHRVeEZUUStC
+            QUNNSHhYakw2MHRFTHBGcGJBN1VPN2llTlhFCjd1cFR5RmZjVEdQMVRNaTY1RmE3
+            TUNjU09pR2pLc25WeDFzY3RhLytwMzQKLS0tIEl2aTR3WUFhSlVOcEFEdmp6R3hm
+            QmdSbnYrNTNUUVJlVnp5K1c3dzdOYjAKs7rMajE4imIDQIm5ypUUCR2MuzNpNy/K
+            IP7IVvrCLmcYRtyNYPLuhL5mw+E7AaopNrbrOsB/JT5Xt3fNkpLzBw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1pu952207c8cttej5pqw949gj9fzfh2hztuukqdv0a36vss8q8eaqx45wuq
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtUEZwVGI2QzhjTXN0UzJI
+            MS9yWGtCZ0hDekQxWHhiSU96SXJmUjhNY0hJCklrbTM1Z3hqVnc5WHRCZ1RoUHdL
+            WUtkaVRRREtrb3RZeWNZVU9KZ00zM1EKLS0tIGkrK05rc3gzc2xmUHNQT2J3Mk50
+            OHZ5WUY3d0hZbWhJcTNGMFo4dkVDaU0Kx0ir+kS0RFhg5/R4PiW48F1jQdX3Cp54
+            paM23I1Zv1LdYDbcIN8E6rGLIDRvxFXo8ywCkgBhUFp39pdjYrI7fQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-02-09T18:13:35Z"
+    mac: ENC[AES256_GCM,data:NQKG8hz0PWWb0eYC+OTz6pY6bFXhMIxPk8aOh+GX9BsUO4o9gb/ElzuIkVXVhQMETXb85c09JggIbVpx+eagvQt2roVouzDBDWohNwhI++q16I5RwbDrSM+AgiGPzIs6a1fTVQV6wJWIH6tpWw9NpJuSrIXKtdlR8y28KLy4I+M=,iv:izUDLBCSLHo3Qofj4GoUyEwSlDL1gv1O2qjPifIPRXo=,tag:+7k5CmSTtR1Xm61vv5Y5kA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

secrets/proxy.yaml

@@ -8,38 +8,56 @@ sops:
         - recipient: age13phpsegg6vu7a34ydtfa9s904dfpgzqhzru7epnky7glezk0xvkst9qh6h
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJczVEWTYrci9Hd3pweHh0
-            UVc1bWxhbHVUdFBmZ1RBeUZzQ1p1bFJJVkZvCjNYdUpiV3l2eGFtVkFqYkdGMUsy
-            UDhkd3Y4UGdTMEc1YkpPR3hLVVlWOG8KLS0tIGFJV1cwcC9rbXBNb29ZeWJxWVZO
-            bTkxTm5rWGY0bjViQThsK2tqV3FLQ2MKJ14uIzNUzglVIzp+SXtuOH4VFQFbKx4F
-            HWFw0izrg1d2Trgb4zCCLTim9v1WSmh7gKOp9eTZM3ThOFZDVRowTA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwajh3UTgrMDNSTmhnZHFG
+            d1NYSTl0LzNyVEtOZFAvZkN2ZjVlaGxRRndnCm95a3FUL2NyRGZuSDhVazVyY2pB
+            WjF0aWNocDMyUkFKVGE1bXVOWTZ6RTQKLS0tIE0wZyttM2hOVVA1R1ZRQ1lIM0xX
+            aCtsbjhUb251MnRXLzdYYjJrR2Mva28Kby4ookzD08VnEFpvE9KCfA2lHgsYpzl4
+            EAEpLWjI1xdOT8g+ls6QjKkgqNfBOu4vzgQpyOQeVKroVZobQ0vAOQ==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1kj70enq8ynqdnl04l5d0v43vcn0de0snn732wfxdxrgxhp72myeq93e9ts
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3ZmxKOWhwVzZLaVE4Wkw4
-            MTE1MURnYW1GcEIzWXIxRWV0YkZGM3RMWmtBCkw2aHk5ZzBseCtzUnNzcmJ5cXh4
-            d2FteDFrdk05ak0wcDRiQ1kwK09PR0UKLS0tIE9JL2NQQWhJVSs2Zm52VzVLdjR0
-            bk9yMy9FSkNHeFdpa2FyK3FGNUZuTmcKyYf33aD6QdnUlvsN46wNQmUTDJ4VAhql
-            uAljWFeOYgpTaejlHqza7Fmd1RiYd9w+Q7JGqoDJV7hciAdqEjBNHw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjZmZVay9jbVZhbnJPTk5H
+            WnJYNUJBUzJ2OHJWb3g3MjZXSno4WDA0eUMwCm5ySVZEZ3YvSXJBcGpEbmdQRDAv
+            VGdRVDlqS0xIQVZ3djN5UWhMdlgwUkEKLS0tIGV5VmtWVlVOVy9UaUp3QndRdUl0
+            SzNxNVBmSG1EZ29MR3ZyNld0dnZpRDgK1yqDzMuqVq1eLf26FPmx74ay1s1bWTZZ
+            2IlzIM8G4qhpRGw9TJ+F2MvOk4Ew74dddFBHAnfu/qEzIv4v/ZHrOQ==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age186qkn94ck9lz0nmx57m37jwgwws5pgcs40q8d8uaetytz4gp6p9qlftp5x
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVOEdJb2hhK1laRE1GYTA1
-            UFcycXI1cVAxVFNPcXprRmhnaXJDNlNwKzBZCmowSEFTQWM0d3hZRlJ2eW42eElt
-            a1dZWTJNRXJTUGRwZE5iVDhnZDB4TFEKLS0tIFhOdVExakJwYWpObEc5a2crOXVQ
-            NXZ3U0tQUXM0UmVJWmwvVVh2dnhxNmMKgLVAoHxZVhEmjNiDdc0ifvqWUaf3tI+3
-            DJ/dPF1jClxF8pUsXQ6+cUrG+64MglnkgtIvjP09YnJ1HY1IZ3O3lw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQbjQzdUtyTndqZE9GTm5D
+            c2g1ZzMrRS90amN0WldPNWRwT3Q1TkszU25jCm44SjgyUVpBVGVHUjB4Z3NWSkE4
+            d2ZXR0xwcExOTWRnZml0Z2tVV2c3RlUKLS0tIDF6cnpmRWVQMzlCczNRaE9sNzVE
+            SjVQNjZ2TzBqajdIdkdoVGQvQllqN1kKyed9tcIDNwvpdbVxF7zprILwzgqQh0MX
+            pOBMjmdPrLCYCuLGY0Hj6ArvtX9yJehYfdBmxk1Y8YhGSp2Fb3JaLg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1m5msm7rgqye2q9zesgedg0emga4ntehlr629786lrxs3rhk0squq0ly9je
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBVVNUYmJDOFgwcDhXbUhq
+            RTZZV1FjWGROSnhmZG9jTDVzbWZ5R1cxb3pjCmIzNXE0UXYzVW9BYXBMVnpLZy8x
+            TUtqQ1RPUktpdTZzc0VMU3FrREQ4L1UKLS0tIER5eU1jcnRsbng0QjRyMXg1bVNy
+            OU9oREQvcTg0bmZZSzkrYjRmT0FINVEKIV+ExzaUSRkjqyWDcKnL8csUP2cedysF
+            3GozgEDa5Yb63DlmJasucZjYSI0YUfkZ/E3mvT6OspFCR+9W+pWoFQ==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1d4mqql020mpne9r3vtt4l9ywfzfq7zpa3mad33syxln2kldkjsxqgju90f
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1ZFB0QmFRVUkrQnR5Zzc4
-            TC9LZmRjWE9wdCs1a1YwYkNoYVhkZTZtNGxNClhxeFZBODVxRHJtUkhxZS9BSjlz
-            Yk5Pcjg0MURKV1E0bnpkZ2J1bFBvMjgKLS0tIDRraExDb3h5bmJwaFBma3RZWTNW
-            NkV0bUNNUmV3dUNpaFF0Z2Nramc2b2MKzYGc0+rQciFzVSRpk/pwMGGQyyJqezgp
-            CzgZ8OgMaAFLeZTu9lgvPoMRuT1e48V+FksTErAuXgfsSSQdrR2dvg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyaFZrbE5MOG9OTVhEYk9C
+            OS9teTdoblF0a091TlNxY3kwdFRhY0grdFdZCkpuc0RSdDVhYnNoZTZacnJjcTI5
+            ZWZpMXZOUHBTOVQ0N0pxUVNIelFGck0KLS0tIHBqS3JlT2lZdXp3OWNsZmliN05x
+            MGFYbDNnNmljc3k0Zmo5WjR2bWpvdEEKZNrqJFFLwU8IlxPt1st4r8iB2fRrUXjq
+            STBsWS9VdLFUdaEscqFmq0g4KMWqRMVmz2spCOpWMDTCKaHq3WLflQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1pu952207c8cttej5pqw949gj9fzfh2hztuukqdv0a36vss8q8eaqx45wuq
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaUkNUVHAzc29zeFpvVDV3
+            dmFWRUJSUnFNVjdSZTBBek5VRjhTUCtpcVVVCjRvdW1qYVdobm9MeEFheXliWkZK
+            LzRHQ21aZThSNk8xdHV1NFhjbm1VRXMKLS0tIGI0L1loNGRQNTlWWGxORDd5eDZ5
+            YUsxcGNJbDE4WCtDejFzK3oyblZlTHMK8R3d42GC6V13/ZnaWzSBNDNELEVJu1vX
+            zQCG1Fui7azp+X5LWB1lKC6UWj0jiDq/ySoQeFCgORIMpoxMEfcrVA==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2025-05-30T18:08:11Z"
     mac: ENC[AES256_GCM,data:rAAY1CHJ2EZTPL/QAHysCEaprAIH/t7zaMVv74ORdXl74bfau7L2KhquX2KEkdmTLBFxvJ4PIpSG2JGmM0MsHe9n/SkQDMglHPgeR/DGhyGXTBmDdG3HU26t0v0Nea7aTwwFqhKshWA0S9/8sIaHC7tdYDZhFN+ZbLukp78335s=,iv:eUCfEYXrmBKyQGDatVc6ze/YoKd0KV4ke/XljrGfgX8=,tag:fgwGAWO/KygLpyPHiRFgvA==,type:str]

secrets/rustic.yaml

@@ -13,38 +13,56 @@ sops:
         - recipient: age13phpsegg6vu7a34ydtfa9s904dfpgzqhzru7epnky7glezk0xvkst9qh6h
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQWmZKOUMzdUttMjNhMDdn
-            Rzdvek1vaEFPTWI2V1NjbllQYW1WMDltdWlnCkFuMmlJVmhsZGpMMThFSnB5NHZR
-            UGFHMjNrcXNVRXlZNmhMNzZIQ2dRZDQKLS0tIHlYRGlycWpwZDZpWXB4QkJaZHhK
-            d0prY25HUWpkcW5ieVFXR0dLV29ReVEK1AbWCfgR5To43PXD/KUn2X4SFe/Wz18d
-            p40f6D56CKxmi9pb3lQriTipsxVqTXq/U1oDZP3YoeLWfxL4IHCSZA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKTVlKQVh2RktvTlJVWkJ0
+            THhXWk5Mc0hmTG5CQ0xWVzcvZzFCM2xCYWxBCnFnbDJrVUI1TGs3MFdOUTFrM1dB
+            Q28wTlBJV29IbVNiTzhZSk5kc2JPMlEKLS0tIElJWThoWVVSbkdIWGVNcE4vaERX
+            dDJDanJDTFRFenNwQWp3RTh0Tm5oTFkKJUv+61UTP/5PMS9vOjAyWZrcDrBq5CPY
+            PAoXe1ewzH7CewUJ1dSGBMP2Vacm0LXQjKiJnh18ksa9kNsW6ETQqw==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1kj70enq8ynqdnl04l5d0v43vcn0de0snn732wfxdxrgxhp72myeq93e9ts
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3SVIwR1czazExOXN6Mkoz
-            TzRUT3Z0cnlLbThsVXB2RE1VRGxOcVdzdnhVClo2ay96QTBQRHFqTlJrZnZOQ1FN
-            RTV6WDdFQXY0KzRwUHozMTJpdmdxUk0KLS0tIDFUQ2Z1a3J0azRGbEJuWlVXUEQv
-            OTBuTWgvQWd4Mk5ycjhhM3U4Rkxnb00Ku8magoehW+QD8NS0f6bS1blFUoFRZhNc
-            704vrRVSUeweOcumjDSr4aep4KjJWRHUBgbIv2NX5O3ArLIkWTuyTg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0THVCQXRXQjlpQXAyZ0Ji
+            dGxDaW9FSFFhQXlrK1Bsd25vVzdKVDNlR1NRCjZnYlJMVnZZN0d6Sm1qcnF3WVdK
+            M0ZpaTFjK1MzYkxZM2g0bElhU1h2RFEKLS0tIEFXVVN4dVhKalpYK2xYSERHbW1Y
+            SENTakVaT2dVclM2ckdqTUpSbVFLZDgKN+AjmDwJAUk6juVW/paAw+Iwc6H6zcTf
+            F72nuuxl2jTvzfuesFdo8LbUFYKj3sYobtv72qDTOdoO1Bk6LwxdNQ==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age186qkn94ck9lz0nmx57m37jwgwws5pgcs40q8d8uaetytz4gp6p9qlftp5x
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlL2wrN1hvMmU2eWNFeVdD
-            cXVGdVR5eHR2SDc2cGE3bThDSzBaTnk0R0RNCkFTQ2RSVTNpSnNRRUh6LzBCWFZ0
-            S2hGbDlqbWYwV0JiSTdlRVFiZmxkQ2cKLS0tIEIzRmlsWksveVAyaU9kWmMvNitR
-            WkVVTGUxWGVrL0ZKQ2RXbE5wK0w0eGsKHz2PcPvOsygtbMZkapmbBUKoJUYGUwWq
-            1RbhZGFi2bzqKWGJl08cTXaEvZ25i3aFt88doZAw1B1WiNI3XpYBaA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnNUFHbnFjUk9xbkZCYXAy
+            YUp2UWhDdVJ6OWJEQkV5TStOUEVBaXpUWTE0CjRsazVPOEF5ZUh6SkNBcUs2NWd1
+            eWU3R0FzeFBZTVBpNUNMS255UGV5ZlEKLS0tIEt2Q3E0aHJmTUs4YWE4eUxXbmtt
+            MHNaYVdyblc2Qy93c1NXRFA5amx5aU0KFjrf9+3Fskdj46gmWpBUDGMPTY9wiurR
+            d9LkHhLp+e3tejmEG5mkj3uyO66n75QoH22CT6qvlniiixmVfGASqQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1m5msm7rgqye2q9zesgedg0emga4ntehlr629786lrxs3rhk0squq0ly9je
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1NmpvbUE2TlJsZ3A1Ly81
+            VmljZ3l3T3NmSzRwU2hGMHpOalhUMEpySWgwCk5CT20vVUJheURxbkNEQ1ZTQVI0
+            YWpEcmpnWUQxZlBkU3BwY3luNEVjbUEKLS0tIHFwaXdLcDFFamNqYWNXSFhONHpr
+            OGVYcDdTejMvWlg1enIrZjhLclFuOEkKCzA29bUZr5u2QYvH/l7cq6jxb1qEndKH
+            1PvwcevvD3aHuZTA4xnKrHI6g1Kay4IRNi72Lxx1OsA3dTCGdCmXfQ==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1d4mqql020mpne9r3vtt4l9ywfzfq7zpa3mad33syxln2kldkjsxqgju90f
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAza1o1K0QwVzM1OXZjT1N0
-            TFRHbUNIZTRiaUEzcHNMSmNramprMmdpckJnCklZck14Qis5TXJSTTkyem9FR2JZ
-            VUd1azZQM0REd3lmSGlTZ3YyTXR0R2sKLS0tIHVTSlBIc05aOWtDeVFrV1FDNXBT
-            OGlGTzRHWSs5OUJZb0V5VTIzNGc4UjAKFOfZX4UrbtzXGKYJ8c0TgDY+kvY1pRWH
-            ETslhYtbtnaqI1a4rdRv+sKFbuEOV38sJZ6NuKR0Lfqw1GohWyA1vQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlQmNmdjlEeldLeHc3Zmcr
+            YmxuZmNQdW82VjhvT3VOQXdncUpvYlcyZDI4CjJMWXRBS1dhMHdFR1djUDV1ckdz
+            cFFoaVVJSXBRQXN0bkJTTEJaK0FyaE0KLS0tIGlBdEt3NGV0MWJibjNYeEFkbEZ4
+            bXI3TVZ6L1k3RG1pRWptRzdNNjBySTAKY6n92DBy3ZI10LQR0RNRDrLztfLI9ySz
+            dqeBY86p1Y5uyp5ZjePDe7qWRkrJKXmQ0J0ytWtL01uLfZPz/Z+btQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1pu952207c8cttej5pqw949gj9fzfh2hztuukqdv0a36vss8q8eaqx45wuq
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkOUVUODlleWgvSUlMcEZY
+            WGVMOUE3RGJORmYxWkNadjFiVUFOZzc3YkNVCisyckVsVHZtMlVndzlScEhYY0hT
+            TjNiVXFBeHFDVXkzalpmLzNpUmUyUmcKLS0tIHFuWCtPT0h1NDlZekwrdERLRFEx
+            T3dLVm82SlF0L0x6aUw2dDBpZ0R5ZGMKB9sEYOZ6rs4VdWj72X6jI+5iEgPhhB/+
+            MBb2j7Un9iEVCJ7s3y8xayiWUJASzp/pXuuhl26ugixGexohO03mJg==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2024-06-08T15:01:54Z"
     mac: ENC[AES256_GCM,data:euc66CxC9LHiJYKiMaEWunIZCHd2ZGl1YcFIJWmv2/x1pMRSnQ85yCL5Fpu8crjaayDYGJJVmMBVeU8trmaoqzYE1pWtUSIQo2QligJ1k8T5erdakSwv6keHrxczS1gEkS1Ygl6xieZUY5mcwY1Wyz7ZMeAeiIpIaraSf8Uydu8=,iv:OMGVEmOHnJbFzVpfCtvt3jrw6vP5dCib/HfcKpbSZ7k=,tag:wTtzNCE6BB3S7x2wWNYq1A==,type:str]