flake.lock

@@ -638,16 +638,16 @@
     },
     "lite-config": {
       "locked": {
-        "lastModified": 1752091719,
+        "lastModified": 1749323815,
-        "narHash": "sha256-N0cjol3O7SzZhaq/Y6y0rIbda233v5eD0ei5IJOMwzA=",
+        "narHash": "sha256-NAhCvl7RZDL0XiQi7GMJ4KJsakQZDpKuIb5H9m3nhSI=",
         "owner": "ataraxiasjel",
         "repo": "lite-config",
-        "rev": "2807667b2f6128c15417053ce569c282049f4555",
+        "rev": "dc6717c8fbdabf81740a26c745316a5cb40e8c70",
         "type": "github"
       },
       "original": {
         "owner": "ataraxiasjel",
-        "ref": "v0.10.1",
+        "ref": "v0.10.0",
         "repo": "lite-config",
         "type": "github"
       }

flake.nix

@@ -21,7 +21,7 @@
     nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
     nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
     flake-parts.url = "github:hercules-ci/flake-parts";
-    lite-config.url = "github:ataraxiasjel/lite-config/v0.10.1";
+    lite-config.url = "github:ataraxiasjel/lite-config/v0.10.0";
     flake-registry = {
       url = "github:nixos/flake-registry";
       flake = false;
@@ -119,6 +119,7 @@
           ];
           hostModuleDir = ./hosts;
           hosts = {
+            NixOS-VM.system = "x86_64-linux";
             # home-workstation
             andromedae = {
               system = "x86_64-linux";
@@ -143,10 +144,6 @@
               system = "x86_64-linux";
               useHomeManager = false;
             };
-            NixOS-VM = {
-              system = "x86_64-linux";
-              useHomeManager = false;
-            };
           };
         };
 

hosts/NixOS-VM/default.nix

@@ -1,4 +1,8 @@
-{ modulesPath, ... }:
+{
+  modulesPath,
+  pkgs,
+  ...
+}:
 {
   imports = [
     (modulesPath + "/profiles/qemu-guest.nix")
@@ -7,9 +11,9 @@
 
   ataraxia.defaults.role = "base";
 
-  # boot.kernelParams = [
+  boot.kernelParams = [
-  #   "systemd.setenv=SYSTEMD_SULOGIN_FORCE=1"
+    "systemd.setenv=SYSTEMD_SULOGIN_FORCE=1"
-  # ];
+  ];
 
   virtualisation.memorySize = 4096;
   virtualisation.cores = 4;
@@ -19,12 +23,48 @@
     "-vga qxl"
     "-display gtk"
   ];
-  virtualisation.diskSize = 8192;
+  users.users.test = {
+    isNormalUser = true;
+  };
 
-  boot.loader.grub.enable = false;
+  boot.supportedFilesystems = [ "zfs" ];
+  boot.zfs.forceImportRoot = false;
+  networking.hostId = "84977205";
 
-  ataraxia.virtualisation.podman = true;
+  environment.systemPackages = with pkgs; [
-  ataraxia.containers.filestash.enable = true;
+    # test overlay
+    sing-box
+  ];
 
-  system.stateVersion = "25.05";
+  # Test persist module
+  persist.enable = true;
+  persist.cache.clean.enable = true;
+  persist.state.directories = [ "/etc" ];
+  persist.cache.directories = [ "/cache" ];
+  home-manager.users.ataraxia = {
+    home.stateVersion = "24.11";
+    persist.enable = true;
+    persist.cache.clean.enable = false;
+    persist.state.directories = [ "test-home" ];
+    persist.cache.directories = [
+      "test-1"
+      "test-2"
+    ];
+    persist.state.files = [ "home" ];
+  };
+  home-manager.users.test = {
+    home.stateVersion = "24.11";
+    persist.enable = true;
+    persist.cache.clean.enable = true;
+    persist.cache.directories = [
+      "test-3"
+      "test-4"
+    ];
+    persist.cache.files = [
+      "home"
+      "home3"
+    ];
+  };
+
+  system.stateVersion = "24.11";
 }

hosts/orion/backups.nix

@@ -8,7 +8,7 @@
 {
   imports = [ inputs.ataraxiasjel-nur.nixosModules.rustic ];
 
-  sops.secrets.rustic-nas-pass.sopsFile = secretsDir + /rustic.yaml;
+  sops.secrets.rustic-vps-pass.sopsFile = secretsDir + /rustic.yaml;
   sops.secrets.rustic-backups-s3-env.sopsFile = secretsDir + /rustic.yaml;
   services.rustic.backups =
     let

hosts/orion/boot.nix

@@ -1,31 +1,14 @@
-{ pkgs, lib, ... }:
+{ pkgs, ... }:
-let
-  inherit (lib) mkForce;
-in
 {
-  # services.scx.enable = true;
+  services.scx.enable = true;
-  # services.scx.scheduler = "scx_bpfland";
+  services.scx.scheduler = "scx_bpfland";
 
   networking.hostId = "a9408846";
 
   boot = {
-    kernelPackages = pkgs.linuxPackages_hardened;
+    kernelPackages = pkgs.linuxPackages_cachyos-server;
-    # zfs.package = pkgs.zfs_unstable;
+    zfs.package = pkgs.zfs_cachyos;
     zfs.devNodes = "/dev/disk/by-id";
-    zfs.extraPools = [ "nas-pool" ];
-
-    initrd = {
-      luks.devices = {
-        "crypt-nas" = {
-          device = "/dev/disk/by-id/ata-ST4000NM0035-1V4107_ZC1A7CWN";
-          keyFile = "/nas_keyfile0.bin";
-        };
-      };
-      secrets = {
-        "/nas_keyfile0.bin" = "/etc/secrets/nas_keyfile0.bin";
-      };
-      supportedFilesystems = [ "zfs" ];
-    };
 
     loader = {
       grub = {
@@ -50,11 +33,10 @@ in
       "scsi_mod.use_blk_mq=1"
       "pti=off"
       "spectre_v2=off"
-      "systemd.setenv=SYSTEMD_SULOGIN_FORCE=1"
     ];
     kernel.sysctl = {
       "kernel.split_lock_mitigate" = 0;
-      "vm.overcommit_memory" = mkForce 1;
+      "vm.overcommit_memory" = 1;
     };
 
     tmp.useTmpfs = true;

hosts/orion/default.nix

@@ -4,9 +4,6 @@
   inputs,
   ...
 }:
-let
-  inherit (lib) concatLists unique;
-in
 {
   imports = [
     inputs.srvos.nixosModules.server
@@ -97,6 +94,7 @@ in
     mkvtoolnix-cli
     nfs-utils
     p7zip
+    podman-compose
     pwgen
     ripgrep
     rsync
@@ -104,13 +102,6 @@ in
     smartmontools
   ];
 
-  ataraxia.services.nginx.enable = true;
-  ataraxia.services.nginx.defaultSettings = {
-    useACMEHost = "ataraxiadev.com";
-    enableACME = false;
-    forceSSL = true;
-  };
-
   ataraxia.containers.filestash.enable = true;
   ataraxia.containers.media-stack.enable = true;
   ataraxia.containers.tinyproxy.enable = true;
@@ -119,57 +110,10 @@ in
   ataraxia.services.gitea.enable = true;
   ataraxia.services.syncyomi.enable = true;
   ataraxia.services.vaultwarden.enable = true;
-  ataraxia.services.headscale.enable = true;
-  ataraxia.services.headscale.extraDns = unique (
-    concatLists (
-      map
-        (name: [
-          {
-            inherit name;
-            type = "A";
-            value = "100.64.0.1";
-          }
-          {
-            inherit name;
-            type = "AAAA";
-            value = "fd7a:115c:a1e0::1";
-          }
-        ])
-        [
-          "api.ataraxiadev.com"
-          "cache.ataraxiadev.com"
-          "cal.ataraxiadev.com"
-          "code.ataraxiadev.com"
-          "docs.ataraxiadev.com"
-          "element.ataraxiadev.com"
-          "files.ataraxiadev.com"
-          "home.ataraxiadev.com"
-          "jackett.ataraxiadev.com"
-          "jellyfin.ataraxiadev.com"
-          "kavita.ataraxiadev.com"
-          "ldap.ataraxiadev.com"
-          "lib.ataraxiadev.com"
-          "matrix.ataraxiadev.com"
-          "medusa.ataraxiadev.com"
-          "pdf.ataraxiadev.com"
-          "qbit.ataraxiadev.com"
-          "radarr.ataraxiadev.com"
-          "restic.ataraxiadev.com"
-          "s3.ataraxiadev.com"
-          "sonarr.ataraxiadev.com"
-          "tools.ataraxiadev.com"
-          "turn.ataraxiadev.com"
-          "vw.ataraxiadev.com"
-          "wiki.ataraxiadev.com"
-        ]
-    )
-  );
 
   ataraxia.virtualisation.guests = {
     omv = {
       autoStart = true;
-      user = "root";
-      group = "root";
       xmlFile = ./vm/omv.xml;
     };
   };

modules/nixos/applications/corectrl.nix

@@ -2,10 +2,10 @@
   config,
   lib,
   pkgs,
-  useHomeManager,
   ...
 }:
 let
+  inherit (builtins) hasAttr;
   inherit (lib) mkEnableOption mkIf;
   cfg = config.ataraxia.programs.corectrl;
   defaultUser = config.ataraxia.defaults.users.defaultUser;
@@ -22,7 +22,7 @@ in
       # gpuOverclock.ppfeaturemask = "0xffffffff";
     };
 
-    home-manager = mkIf useHomeManager {
+    home-manager = mkIf (hasAttr "users" config.home-manager) {
       users.${defaultUser} = {
         startupApplications = [ "${pkgs.corectrl}/bin/corectrl" ];
         persist.state.directories = [ ".config/corectrl" ];

modules/nixos/applications/steam.nix

@@ -2,10 +2,10 @@
   config,
   lib,
   pkgs,
-  useHomeManager,
   ...
 }:
 let
+  inherit (builtins) hasAttr;
   inherit (lib) mkEnableOption mkIf;
   cfg = config.ataraxia.programs.steam;
   defaultUser = config.ataraxia.defaults.users.defaultUser;
@@ -43,7 +43,7 @@ in
     };
     programs.steam.gamescopeSession.args = [ "--adaptive-sync" ];
 
-    home-manager = mkIf useHomeManager {
+    home-manager = mkIf (hasAttr "users" config.home-manager) {
       users.${defaultUser} = {
         startupApplications = [ "${config.programs.steam.package}/bin/steam" ];
         persist.state.directories = [ ".local/share/Steam" ];

modules/nixos/applications/waydroid.nix

@@ -2,10 +2,10 @@
   config,
   lib,
   pkgs,
-  useHomeManager,
   ...
 }:
 let
+  inherit (builtins) hasAttr;
   inherit (lib) mkEnableOption mkIf;
   cfg = config.ataraxia.programs.waydroid;
   defaultUser = config.ataraxia.defaults.users.defaultUser;
@@ -21,7 +21,7 @@ in
 
     persist.state.directories = [ "/var/lib/waydroid" ];
 
-    home-manager = mkIf useHomeManager {
+    home-manager = mkIf (hasAttr "users" config.home-manager) {
       users.${defaultUser} = {
         home.packages = with pkgs; [ waydroid-script ];
         persist.state.directories = [

modules/nixos/containers/filestash.nix

@@ -1,71 +1,33 @@
 { config, lib, ... }:
 let
-  inherit (lib)
+  inherit (lib) mkEnableOption mkIf;
-    mkEnableOption
-    mkIf
-    mkOption
-    recursiveUpdate
-    ;
-  inherit (lib.types) bool;
-  inherit (config.virtualisation.quadlet) networks;
 
   cfg = config.ataraxia.containers.filestash;
-  nginx = config.ataraxia.services.nginx;
   nas-path = "/media/nas/media-stack";
-  domain = "files.ataraxiadev.com";
-  port = "8334";
 in
 {
   options.ataraxia.containers.filestash = {
     enable = mkEnableOption "Enable filestash container";
-    nginxHost = mkOption {
-      type = bool;
-      default = config.ataraxia.services.nginx.enable;
-      description = "Enable nginx vHost integration";
-    };
   };
 
   config = mkIf cfg.enable {
-    virtualisation.quadlet.containers.filestash = {
+    virtualisation.oci-containers.containers.filestash = {
       autoStart = true;
-      containerConfig = {
+      environment = {
-        environments = {
+        PUID = "1000";
-          PUID = "1000";
+        PGID = "100";
-          PGID = "100";
+        UMASK = "002";
-          UMASK = "002";
+        TZ = "Europe/Moscow";
-          TZ = "Europe/Moscow";
+        APPLICATION_URL = "files.ataraxiadev.com";
-          APPLICATION_URL = domain;
+        CANARY = "true";
-          CANARY = "true";
-        };
-        # Tags: latest
-        image = "docker.io/machines/filestash@sha256:923c3399768fada3424bb6f3bc01521dad30e9a7a840cfb2eba3610b6acafffe";
-        networks = [ networks.br-services.ref ];
-        publishPorts = [ "127.0.0.1:${port}:${port}/tcp" ];
-        volumes = [
-          "${nas-path}/configs/filestash:/app/data/state"
-          "${nas-path}:/mnt"
-        ];
-      };
-    };
-
-    services.nginx.virtualHosts = mkIf cfg.nginxHost {
-      ${domain} = recursiveUpdate nginx.defaultSettings {
-        locations."/" = {
-          proxyPass = "http://127.0.0.1:${port}";
-          proxyWebsockets = true;
-          extraConfig = ''
-            allow 127.0.0.1/32;
-            allow 100.64.0.0/16;
-            allow 10.10.10.0/24;
-            allow fd7a:115c:a1e0::/64;
-            deny all;
-            proxy_busy_buffers_size 1024k;
-            proxy_buffers 32 1024k;
-            proxy_buffer_size 1024k;
-            proxy_read_timeout 86400;
-          '';
-        };
       };
+      # Tags: latest
+      image = "docker.io/machines/filestash@sha256:923c3399768fada3424bb6f3bc01521dad30e9a7a840cfb2eba3610b6acafffe";
+      ports = [ "127.0.0.1:8334:8334/tcp" ];
+      volumes = [
+        "${nas-path}/configs/filestash:/app/data/state"
+        "${nas-path}:/mnt"
+      ];
     };
   };
 }

modules/nixos/containers/media-stack/caddy.nix

@@ -8,8 +8,6 @@ let
   inherit (lib) mkEnableOption mkIf;
 
   cfg = config.ataraxia.containers.media-stack;
-  pods = config.virtualisation.quadlet.pods;
-
   nas-path = "/media/nas/media-stack";
 
   caddyconf = pkgs.writeText "Caddyfile" ''
@@ -49,23 +47,21 @@ in
   };
 
   config = mkIf cfg.caddy {
-    virtualisation.quadlet.containers.caddy = {
+    virtualisation.oci-containers.containers.media-caddy = {
       autoStart = true;
-      containerConfig = {
+      # Tags: release-20b7f25, release-2.10.0, release
-        # Tags: release-20b7f25, release-2.10.0, release
+      image = "ghcr.io/hotio/caddy@sha256:937fe02672e7ce7f189e28d45c4ccfe86b2a7d5791b4e04badb55e143e32d5b7";
-        image = "ghcr.io/hotio/caddy@sha256:937fe02672e7ce7f189e28d45c4ccfe86b2a7d5791b4e04badb55e143e32d5b7";
+      environment = {
-        pod = pods.media-stack.ref;
+        PUID = "1000";
-        environments = {
+        PGID = "100";
-          PUID = "1000";
+        UMASK = "002";
-          PGID = "100";
+        TZ = "Europe/Moscow";
-          UMASK = "002";
-          TZ = "Europe/Moscow";
-        };
-        volumes = [
-          "${nas-path}/configs/caddy:/config"
-          "${caddyconf}:/config/Caddyfile"
-        ];
       };
+      extraOptions = [ "--pod=media-stack" ];
+      volumes = [
+        "${nas-path}/configs/caddy:/config"
+        "${caddyconf}:/config/Caddyfile"
+      ];
     };
   };
 }

modules/nixos/containers/media-stack/default.nix

@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
 let
@@ -8,22 +9,16 @@ let
     mkDefault
     mkEnableOption
     mkIf
-    mkOption
+    optionals
-    recursiveUpdate
     ;
-  inherit (lib.types) bool;
 
   cfg = config.ataraxia.containers.media-stack;
-  networks = config.virtualisation.quadlet.networks;
-  nginx = config.ataraxia.services.nginx;
 
-  caddy-port = "8180";
+  backend = config.virtualisation.oci-containers.backend;
-  # TODO: fix caddy for medusa. Maybe change to something else
+  pod-name = "media-stack";
-  medusa-port = "8180";
   open-ports = [
     # caddy
-    "127.0.0.1:${caddy-port}:${caddy-port}"
+    "127.0.0.1:8180:8180"
-    "127.0.0.1:${medusa-port}:${medusa-port}"
     # qbittorrent
     "0.0.0.0:7000:7000"
     "0.0.0.0:7000:7000/udp"
@@ -46,11 +41,6 @@ in
 
   options.ataraxia.containers.media-stack = {
     enable = mkEnableOption "Enable media-stack containers";
-    nginxHost = mkOption {
-      type = bool;
-      default = config.ataraxia.services.nginx.enable;
-      description = "Enable nginx vHost integration";
-    };
   };
 
   config = mkIf cfg.enable {
@@ -65,59 +55,40 @@ in
     ataraxia.containers.media-stack.recyclarr = mkDefault true;
     ataraxia.containers.media-stack.sonarr = mkDefault true;
 
-    virtualisation.quadlet.pods.media-stack = {
+    systemd.services."podman-create-${pod-name}" =
-      podConfig = {
+      let
-        dns = [ pod-dns ];
+        portsMapping = lib.concatMapStrings (port: " -p " + port) open-ports;
-        networks = [ networks.br-services.ref ];
+        start = pkgs.writeShellScript "create-pod-${pod-name}" ''
-        publishPorts = open-ports;
+          podman pod exists ${pod-name} || podman pod create -n ${pod-name} ${portsMapping} --dns ${pod-dns}
-      };
-    };
-
-    services.nginx.virtualHosts = mkIf cfg.nginxHost {
-      "media-stack" = recursiveUpdate nginx.defaultSettings {
-        serverAliases = [
-          "jackett.ataraxiadev.com"
-          "kavita.ataraxiadev.com"
-          "lidarr.ataraxiadev.com"
-          "qbit.ataraxiadev.com"
-          "radarr.ataraxiadev.com"
-          "sonarr.ataraxiadev.com"
-        ];
-        locations."/" = {
-          proxyPass = "http://127.0.0.1:${caddy-port}";
-          proxyWebsockets = true;
-          extraConfig = ''
-            proxy_buffer_size 128k;
-            proxy_buffers 4 256k;
-            proxy_busy_buffers_size 256k;
-            send_timeout 15m;
-            proxy_connect_timeout 600;
-            proxy_send_timeout 600;
-            proxy_read_timeout 15m;
-          '';
-        };
-      };
-      "jellyfin.ataraxiadev.com" = recursiveUpdate nginx.defaultSettings {
-        locations."/" = {
-          proxyPass = "http://127.0.0.1:${caddy-port}";
-          extraConfig = ''
-            proxy_buffering off;
-          '';
-        };
-        locations."/socket" = {
-          proxyPass = "http://127.0.0.1:${caddy-port}";
-          proxyWebsockets = true;
-        };
-        extraConfig = ''
-          client_max_body_size 50M;
         '';
-      };
+        stop = pkgs.writeShellScript "remove-pod-${pod-name}" ''
-      "medusa.ataraxiadev.com" = recursiveUpdate nginx.defaultSettings {
+          podman pod rm -i -f ${pod-name}
-        locations."/" = {
+        '';
-          proxyPass = "http://127.0.0.1:${medusa-port}";
+      in
-          proxyWebsockets = true;
+      rec {
+        path = [
+          pkgs.coreutils
+          config.virtualisation.podman.package
+        ];
+        before =
+          [ ]
+          ++ optionals cfg.caddy [ "${backend}-media-caddy.service" ]
+          ++ optionals cfg.jackett [ "${backend}-jackett.service" ]
+          ++ optionals cfg.jellyfin [ "${backend}-jellyfin.service" ]
+          ++ optionals cfg.kavita [ "${backend}-kavita.service" ]
+          ++ optionals cfg.lidarr [ "${backend}-lidarr.service" ]
+          ++ optionals cfg.medusa [ "${backend}-medusa.service" ]
+          ++ optionals cfg.qbittorrent [ "${backend}-qbittorrent.service" ]
+          ++ optionals cfg.radarr [ "${backend}-radarr.service" ]
+          ++ optionals cfg.recyclarr [ "${backend}-recyclarr.service" ]
+          ++ optionals cfg.sonarr [ "${backend}-sonarr.service" ];
+        requiredBy = before;
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = "yes";
+          ExecStart = start;
+          ExecStop = stop;
         };
       };
-    };
   };
 }

modules/nixos/containers/media-stack/jackett.nix

@@ -3,8 +3,6 @@ let
   inherit (lib) mkEnableOption mkIf;
 
   cfg = config.ataraxia.containers.media-stack;
-  pods = config.virtualisation.quadlet.pods;
-
   nas-path = "/media/nas/media-stack";
 in
 {
@@ -13,22 +11,20 @@ in
   };
 
   config = mkIf cfg.jackett {
-    virtualisation.quadlet.containers.jackett = {
+    virtualisation.oci-containers.containers.jackett = {
       autoStart = true;
-      containerConfig = {
+      environment = {
-        # Tags: 0.22.2117, version-v0.22.2117, v0.22.2117-ls80
+        PUID = "1000";
-        image = "docker.io/linuxserver/jackett@sha256:221606b0ed7df0d66e601d0ba83f5f9cc9b9c761bafad3507d6854406b3a447b";
+        PGID = "100";
-        pod = pods.media-stack.ref;
+        UMASK = "002";
-        environments = {
+        TZ = "Europe/Moscow";
-          PUID = "1000";
-          PGID = "100";
-          UMASK = "002";
-          TZ = "Europe/Moscow";
-        };
-        volumes = [
-          "${nas-path}/configs/jackett:/config"
-        ];
       };
+      extraOptions = [ "--pod=media-stack" ];
+      # Tags: 0.22.2117, version-v0.22.2117, v0.22.2117-ls80
+      image = "docker.io/linuxserver/jackett@sha256:221606b0ed7df0d66e601d0ba83f5f9cc9b9c761bafad3507d6854406b3a447b";
+      volumes = [
+        "${nas-path}/configs/jackett:/config"
+      ];
     };
   };
 }

modules/nixos/containers/media-stack/jellyfin.nix

@@ -8,8 +8,6 @@ let
   inherit (lib) mkEnableOption mkIf;
 
   cfg = config.ataraxia.containers.media-stack;
-  pods = config.virtualisation.quadlet.pods;
-
   nas-path = "/media/nas/media-stack";
   renderGid = toString config.users.groups.render.gid;
   videoGid = toString config.users.groups.video.gid;
@@ -25,33 +23,29 @@ in
   };
 
   config = mkIf cfg.jellyfin {
-    virtualisation.quadlet.containers.jellyfin = {
+    virtualisation.oci-containers.containers.jellyfin = {
       autoStart = true;
-      containerConfig = {
+      # Tags: 10.10.7, version-10.10.7ubu2404, 10.10.7ubu2404-ls68
-        # Tags: 10.10.7, version-10.10.7ubu2404, 10.10.7ubu2404-ls68
+      image = "docker.io/linuxserver/jellyfin@sha256:d325675bce77eda246f13d0aa2bf94002d4e426e6e1783594cf9b6df164fcb23";
-        image = "docker.io/linuxserver/jellyfin@sha256:d325675bce77eda246f13d0aa2bf94002d4e426e6e1783594cf9b6df164fcb23";
+      environment = {
-        pod = pods.media-stack.ref;
+        PUID = "1000";
-        environments = {
+        PGID = "100";
-          PUID = "1000";
+        UMASK = "002";
-          PGID = "100";
+        TZ = "Europe/Moscow";
-          UMASK = "002";
+        http_proxy = "http://10.10.10.6:8888";
-          TZ = "Europe/Moscow";
+        https_proxy = "http://10.10.10.6:8888";
-          http_proxy = "http://10.10.10.6:8888";
-          https_proxy = "http://10.10.10.6:8888";
-        };
-        addGroups = [
-          renderGid
-          videoGid
-          inputGid
-        ];
-        devices = [ "/dev/dri/renderD128" ];
-        # podmanArgs = [ "--privileged" ];
-        volumes = [
-          "${nas-path}/configs/jellyfin:/config"
-          "${nas-path}/media:/data/media"
-          "${intro-skipper-fix}:/custom-cont-init.d/intro-skipper-fix:ro"
-        ];
       };
+      extraOptions = [
+        "--pod=media-stack"
+        "--device=/dev/dri/renderD128:/dev/dri/renderD128"
+        "--group-add=${renderGid},${videoGid},${inputGid}"
+        # "--privileged"
+      ];
+      volumes = [
+        "${nas-path}/configs/jellyfin:/config"
+        "${nas-path}/media:/data/media"
+        "${intro-skipper-fix}:/custom-cont-init.d/intro-skipper-fix:ro"
+      ];
     };
   };
 }

modules/nixos/containers/media-stack/kavita.nix

@@ -3,8 +3,6 @@ let
   inherit (lib) mkEnableOption mkIf;
 
   cfg = config.ataraxia.containers.media-stack;
-  pods = config.virtualisation.quadlet.pods;
-
   nas-path = "/media/nas/media-stack";
 in
 {
@@ -13,27 +11,25 @@ in
   };
 
   config = mkIf cfg.kavita {
-    virtualisation.quadlet.containers.kavita = {
+    virtualisation.oci-containers.containers.kavita = {
       autoStart = true;
-      containerConfig = {
+      # Tags: 0.8.6, version-v0.8.6.2, v0.8.6.2-ls79
-        # Tags: 0.8.6, version-v0.8.6.2, v0.8.6.2-ls79
+      image = "docker.io/linuxserver/kavita@sha256:b222e4b2137db2301756d018076d0bfee858077d8af24d709f1f4003d628e580";
-        image = "docker.io/linuxserver/kavita@sha256:b222e4b2137db2301756d018076d0bfee858077d8af24d709f1f4003d628e580";
+      environment = {
-        pod = pods.media-stack.ref;
+        PUID = "1000";
-        environments = {
+        PGID = "100";
-          PUID = "1000";
+        TZ = "Europe/Moscow";
-          PGID = "100";
+        DOTNET_SYSTEM_GLOBALIZATION_INVARIANT = "true";
-          TZ = "Europe/Moscow";
-          DOTNET_SYSTEM_GLOBALIZATION_INVARIANT = "true";
-        };
-        volumes = [
-          "${nas-path}/configs/kavita:/config"
-          "${nas-path}/media/books:/data/books"
-          "${nas-path}/media/comics:/data/comics"
-          "${nas-path}/media/fanfics:/data/fanfics"
-          "${nas-path}/media/manga:/data/manga"
-          "${nas-path}/media/novels:/data/novels"
-        ];
       };
+      extraOptions = [ "--pod=media-stack" ];
+      volumes = [
+        "${nas-path}/configs/kavita:/config"
+        "${nas-path}/media/books:/data/books"
+        "${nas-path}/media/comics:/data/comics"
+        "${nas-path}/media/fanfics:/data/fanfics"
+        "${nas-path}/media/manga:/data/manga"
+        "${nas-path}/media/novels:/data/novels"
+      ];
     };
   };
 }

modules/nixos/containers/media-stack/lidarr.nix

@@ -3,8 +3,6 @@ let
   inherit (lib) mkEnableOption mkIf;
 
   cfg = config.ataraxia.containers.media-stack;
-  pods = config.virtualisation.quadlet.pods;
-
   nas-path = "/media/nas/media-stack";
 in
 {
@@ -13,24 +11,22 @@ in
   };
 
   config = mkIf cfg.lidarr {
-    virtualisation.quadlet.containers.lidarr = {
+    virtualisation.oci-containers.containers.lidarr = {
       autoStart = true;
-      containerConfig = {
+      environment = {
-        # Tags: 2.12.4, version-2.12.4.4658, 2.12.4.4658-ls45
+        PUID = "1000";
-        image = "docker.io/linuxserver/lidarr@sha256:71fe6d5702691c6ac8961b9b1042fdea1ff833a49c82c5e165346fa88999a48a";
+        PGID = "100";
-        pod = pods.media-stack.ref;
+        TZ = "Europe/Moscow";
-        environments = {
-          PUID = "1000";
-          PGID = "100";
-          TZ = "Europe/Moscow";
-        };
-        volumes = [
-          "${nas-path}/configs/lidarr/config:/config"
-          "${nas-path}/configs/lidarr/custom-services.d:/custom-services.d"
-          "${nas-path}/configs/lidarr/custom-cont-init.d:/custom-cont-init.d"
-          "${nas-path}:/data"
-        ];
       };
+      extraOptions = [ "--pod=media-stack" ];
+      # Tags: 2.12.4, version-2.12.4.4658, 2.12.4.4658-ls45
+      image = "docker.io/linuxserver/lidarr@sha256:71fe6d5702691c6ac8961b9b1042fdea1ff833a49c82c5e165346fa88999a48a";
+      volumes = [
+        "${nas-path}/configs/lidarr/config:/config"
+        "${nas-path}/configs/lidarr/custom-services.d:/custom-services.d"
+        "${nas-path}/configs/lidarr/custom-cont-init.d:/custom-cont-init.d"
+        "${nas-path}:/data"
+      ];
     };
   };
 }

modules/nixos/containers/media-stack/medusa.nix

@@ -3,8 +3,6 @@ let
   inherit (lib) mkEnableOption mkIf;
 
   cfg = config.ataraxia.containers.media-stack;
-  pods = config.virtualisation.quadlet.pods;
-
   nas-path = "/media/nas/media-stack";
 in
 {
@@ -13,22 +11,20 @@ in
   };
 
   config = mkIf cfg.medusa {
-    virtualisation.quadlet.containers.medusa = {
+    virtualisation.oci-containers.containers.medusa = {
       autoStart = true;
-      containerConfig = {
+      # Tags: 1.0.22, version-v1.0.22, v1.0.22-ls230
-        # Tags: 1.0.22, version-v1.0.22, v1.0.22-ls230
+      image = "docker.io/linuxserver/medusa@sha256:89d7397b64b079050d8d20284fc692aee36a196885f57e5d9a396455d58a130d";
-        image = "docker.io/linuxserver/medusa@sha256:89d7397b64b079050d8d20284fc692aee36a196885f57e5d9a396455d58a130d";
+      environment = {
-        pod = pods.media-stack.ref;
+        PUID = "1000";
-        environments = {
+        PGID = "100";
-          PUID = "1000";
+        TZ = "Europe/Moscow";
-          PGID = "100";
-          TZ = "Europe/Moscow";
-        };
-        volumes = [
-          "${nas-path}/configs/medusa:/config"
-          "${nas-path}:/data"
-        ];
       };
+      extraOptions = [ "--pod=media-stack" ];
+      volumes = [
+        "${nas-path}/configs/medusa:/config"
+        "${nas-path}:/data"
+      ];
     };
   };
 }

modules/nixos/containers/media-stack/qbittorrent.nix

@@ -1,12 +1,17 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   inherit (lib) mkEnableOption mkIf;
 
   cfg = config.ataraxia.containers.media-stack;
-  volumes = config.virtualisation.quadlet.volumes;
-  pods = config.virtualisation.quadlet.pods;
 
+  backend = "podman";
   nas-path = "/media/nas/media-stack";
+  volume = "local-nfs";
   nfs-share = "10.10.10.11:/";
 in
 {
@@ -15,35 +20,40 @@ in
   };
 
   config = mkIf cfg.qbittorrent {
-    virtualisation.quadlet.containers.qbittorrent = {
+    virtualisation.oci-containers.containers.qbittorrent = {
       autoStart = true;
-      containerConfig = {
+      # Tags: 5.1.2, version-5.1.2-r0, 5.1.2-r0-ls402
-        # Tags: 5.1.2, version-5.1.2-r0, 5.1.2-r0-ls402
+      image = "docker.io/linuxserver/qbittorrent@sha256:94c8c82291c4fcf86084a6efb9f806786296fad48739e4723dc9a5393073a2ae";
-        image = "docker.io/linuxserver/qbittorrent@sha256:94c8c82291c4fcf86084a6efb9f806786296fad48739e4723dc9a5393073a2ae";
+      environment = {
-        pod = pods.media-stack.ref;
+        PUID = "1000";
-        environments = {
+        PGID = "100";
-          PUID = "1000";
+        UMASK = "002";
-          PGID = "100";
+        TZ = "Europe/Moscow";
-          UMASK = "002";
+        TORRENTING_PORT = "7000";
-          TZ = "Europe/Moscow";
+        DOCKER_MODS = "ghcr.io/gabe565/linuxserver-mod-vuetorrent";
-          TORRENTING_PORT = "7000";
+      };
-          DOCKER_MODS = "ghcr.io/gabe565/linuxserver-mod-vuetorrent";
+      extraOptions = [ "--pod=media-stack" ];
+      volumes = [
+        "${nas-path}/configs/qbittorrent:/config"
+        "${nas-path}:/data"
+        "${volume}:/nfs"
+      ];
+    };
+
+    systemd.services."podman-create-volume-${volume}" =
+      let
+        start = pkgs.writeShellScript "create-volume-${volume}" ''
+          podman volume exists ${volume} || podman volume create --opt type=nfs4 --opt o=rw --opt device=${nfs-share} ${volume}
+        '';
+      in
+      rec {
+        path = [ config.virtualisation.podman.package ];
+        before = [ "${backend}-qbittorrent.service" ];
+        requiredBy = before;
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = start;
         };
-
-        volumes = [
-          "${nas-path}/configs/qbittorrent:/config"
-          "${nas-path}:/data"
-          "${volumes.nfs-share.ref}:/nfs"
-        ];
       };
-    };
-
-    virtualisation.quadlet.volumes.nfs-share = {
-      volumeConfig = {
-        device = nfs-share;
-        type = "nfs4";
-        options = "rw";
-      };
-    };
   };
 }

modules/nixos/containers/media-stack/radarr.nix

@@ -3,8 +3,6 @@ let
   inherit (lib) mkEnableOption mkIf;
 
   cfg = config.ataraxia.containers.media-stack;
-  pods = config.virtualisation.quadlet.pods;
-
   nas-path = "/media/nas/media-stack";
 in
 {
@@ -13,23 +11,21 @@ in
   };
 
   config = mkIf cfg.radarr {
-    virtualisation.quadlet.containers.radarr = {
+    virtualisation.oci-containers.containers.radarr = {
       autoStart = true;
-      containerConfig = {
+      environment = {
-        # Tags: 5.26.2, version-5.26.2.10099, 5.26.2.10099-ls276
+        PUID = "1000";
-        image = "docker.io/linuxserver/radarr@sha256:07a474b61394553e047ad43a1a78c1047fc99be0144c509dd91e3877f402ebcb";
+        PGID = "100";
-        pod = pods.media-stack.ref;
+        UMASK = "002";
-        environments = {
+        TZ = "Europe/Moscow";
-          PUID = "1000";
-          PGID = "100";
-          UMASK = "002";
-          TZ = "Europe/Moscow";
-        };
-        volumes = [
-          "${nas-path}/configs/radarr:/config"
-          "${nas-path}:/data"
-        ];
       };
+      extraOptions = [ "--pod=media-stack" ];
+      # Tags: 5.26.2, version-5.26.2.10099, 5.26.2.10099-ls276
+      image = "docker.io/linuxserver/radarr@sha256:07a474b61394553e047ad43a1a78c1047fc99be0144c509dd91e3877f402ebcb";
+      volumes = [
+        "${nas-path}/configs/radarr:/config"
+        "${nas-path}:/data"
+      ];
     };
   };
 }

modules/nixos/containers/media-stack/recyclarr.nix

@@ -3,8 +3,6 @@ let
   inherit (lib) mkEnableOption mkIf;
 
   cfg = config.ataraxia.containers.media-stack;
-  pods = config.virtualisation.quadlet.pods;
-
   nas-path = "/media/nas/media-stack";
 in
 {
@@ -13,21 +11,19 @@ in
   };
 
   config = mkIf cfg.recyclarr {
-    virtualisation.quadlet.containers.recyclarr = {
+    virtualisation.oci-containers.containers.recyclarr = {
       autoStart = true;
-      containerConfig = {
+      environment = {
-        # Tags: 7.4.1, 7.4, 7
+        CRON_SCHEDULE = "@daily";
-        image = "ghcr.io/recyclarr/recyclarr@sha256:759540877f95453eca8a26c1a93593e783a7a824c324fbd57523deffb67f48e1";
+        TZ = "Europe/Moscow";
-        pod = pods.media-stack.ref;
-        user = "1000:100";
-        environments = {
-          CRON_SCHEDULE = "@daily";
-          TZ = "Europe/Moscow";
-        };
-        volumes = [
-          "${nas-path}/configs/recyclarr:/config"
-        ];
       };
+      extraOptions = [ "--pod=media-stack" ];
+      # Tags: 7.4.1, 7.4, 7
+      image = "ghcr.io/recyclarr/recyclarr@sha256:759540877f95453eca8a26c1a93593e783a7a824c324fbd57523deffb67f48e1";
+      volumes = [
+        "${nas-path}/configs/recyclarr:/config"
+      ];
+      user = "1000:100";
     };
   };
 }

modules/nixos/containers/media-stack/sonarr.nix

@@ -3,8 +3,6 @@ let
   inherit (lib) mkEnableOption mkIf;
 
   cfg = config.ataraxia.containers.media-stack;
-  pods = config.virtualisation.quadlet.pods;
-
   nas-path = "/media/nas/media-stack";
 in
 {
@@ -13,23 +11,21 @@ in
   };
 
   config = mkIf cfg.sonarr {
-    virtualisation.quadlet.containers.sonarr = {
+    virtualisation.oci-containers.containers.sonarr = {
       autoStart = true;
-      containerConfig = {
+      environment = {
-        # Tags: 4.0.15, version-4.0.15.2941, 4.0.15.2941-ls285
+        PUID = "1000";
-        image = "docker.io/linuxserver/sonarr@sha256:1156329d544b38bd1483add75c9b72c559f20e1ca043fd2d6376c2589d38951f";
+        PGID = "100";
-        pod = pods.media-stack.ref;
+        UMASK = "002";
-        environments = {
+        TZ = "Europe/Moscow";
-          PUID = "1000";
-          PGID = "100";
-          UMASK = "002";
-          TZ = "Europe/Moscow";
-        };
-        volumes = [
-          "${nas-path}/configs/sonarr:/config"
-          "${nas-path}:/data"
-        ];
       };
+      extraOptions = [ "--pod=media-stack" ];
+      # Tags: 4.0.15, version-4.0.15.2941, 4.0.15.2941-ls285
+      image = "docker.io/linuxserver/sonarr@sha256:1156329d544b38bd1483add75c9b72c559f20e1ca043fd2d6376c2589d38951f";
+      volumes = [
+        "${nas-path}/configs/sonarr:/config"
+        "${nas-path}:/data"
+      ];
     };
   };
 }

modules/nixos/containers/tinyproxy.nix

@@ -50,7 +50,7 @@ in
               RuntimeDirectoryMode = "0700";
               ExecStart = [
                 ""
-                "${lib.getExe pkgs.sing-box} -D \${STATE_DIRECTORY} -C \${RUNTIME_DIRECTORY} run"
+                "${lib.getExe cfg.package} -D \${STATE_DIRECTORY} -C \${RUNTIME_DIRECTORY} run"
               ];
             };
             wantedBy = [ "multi-user.target" ];
@@ -70,7 +70,6 @@ in
               rejectPackets = false;
             };
           };
-          system.stateVersion = "25.05";
         };
     };
   };

modules/nixos/roles/default.nix

@@ -3,7 +3,6 @@
   lib,
   pkgs,
   inputs,
-  useHomeManager,
   ...
 }:
 let
@@ -47,7 +46,6 @@ in
         ataraxia.defaults.nix.enable = mkDefault true;
         ataraxia.defaults.ssh.enable = mkDefault true;
         ataraxia.defaults.users.enable = mkDefault true;
-        ataraxia.defaults.zsh.enable = mkDefault (!useHomeManager);
 
         programs.nix-index.enable = mkDefault true;
         programs.nix-index-database.comma.enable = mkDefault true;
@@ -89,6 +87,7 @@ in
         ataraxia.profiles.minimal = mkDefault true;
         ataraxia.virtualisation.podman = mkDefault true;
         ataraxia.virtualisation.libvirt = mkDefault true;
+        virtualisation.quadlet.enable = mkDefault true;
 
         boot.supportedFilesystems = [ "nfs" ];
 

modules/nixos/security/acme.nix

@@ -1,15 +1,13 @@
 {
   config,
   lib,
-  secretsDir,
+  inputs,
   ...
 }:
 let
   inherit (lib) mkEnableOption mkIf;
 
   cfg = config.ataraxia.security.acme;
-  nginxEnabled = config.ataraxia.services.nginx.enable;
-  nginxGroup = config.services.nginx.group;
 in
 {
   options.ataraxia.security.acme = {
@@ -18,7 +16,7 @@ in
 
   config = mkIf cfg.enable {
     sops.secrets.cf-dns-api = {
-      sopsFile = secretsDir + /misc.yaml;
+      sopsFile = inputs.self.secretsDir + /misc.yaml;
       owner = "acme";
     };
     security.acme = {
@@ -27,7 +25,6 @@ in
       defaults.server = "https://acme-v02.api.letsencrypt.org/directory"; # production
       defaults.email = "admin@ataraxiadev.com";
       defaults.renewInterval = "weekly";
-      defaults.group = mkIf nginxEnabled nginxGroup;
       certs = {
         "ataraxiadev.com" = {
           extraDomainNames = [ "*.ataraxiadev.com" ];

modules/nixos/services/authentik.nix

@@ -6,17 +6,10 @@
   ...
 }:
 let
-  inherit (lib)
+  inherit (lib) mkEnableOption mkIf mkOption;
-    mkEnableOption
+  inherit (lib.types) str;
-    mkIf
-    mkOption
-    recursiveUpdate
-    ;
-  inherit (lib.types) bool str;
 
   cfg = config.ataraxia.services.authentik;
-  nginx = config.ataraxia.services.nginx;
-  domain = "auth.ataraxiadev.com";
 in
 {
   imports = [ inputs.ataraxiasjel-nur.nixosModules.authentik ];
@@ -30,11 +23,6 @@ in
         Name for sops secrets directory. Defaults to hostname.
       '';
     };
-    nginxHost = mkOption {
-      type = bool;
-      default = config.ataraxia.services.nginx.enable;
-      description = "Enable nginx vHost integration";
-    };
   };
 
   config = mkIf cfg.enable {
@@ -57,21 +45,12 @@ in
       environmentFile = config.sops.secrets.authentik-env.path;
       outposts.ldap = {
         enable = true;
-        host = "https://${domain}";
+        host = "https://auth.ataraxiadev.com";
         environmentFile = config.sops.secrets.authentik-ldap.path;
         listen.address = "127.0.0.1";
         listen.ldap = 3389;
         listen.ldaps = 6636;
       };
     };
-
-    services.nginx.virtualHosts = mkIf cfg.nginxHost {
-      ${domain} = recursiveUpdate nginx.defaultSettings {
-        locations."/" = {
-          proxyPass = "http://127.0.0.1:${toString config.services.authentik.listen.http}";
-          proxyWebsockets = true;
-        };
-      };
-    };
   };
 }

modules/nixos/services/gitea.nix

@@ -6,17 +6,10 @@
   ...
 }:
 let
-  inherit (lib)
+  inherit (lib) mkEnableOption mkIf mkOption;
-    mkEnableOption
+  inherit (lib.types) str;
-    mkIf
-    mkOption
-    recursiveUpdate
-    ;
-  inherit (lib.types) bool str;
 
   cfg = config.ataraxia.services.gitea;
-  nginx = config.ataraxia.services.nginx;
-  domain = "code.ataraxiadev.com";
 
   gitea-user = config.services.gitea.user;
   # gitea-group = "gitea";
@@ -44,11 +37,6 @@ in
         Name for sops secrets directory. Defaults to hostname.
       '';
     };
-    nginxHost = mkOption {
-      type = bool;
-      default = config.ataraxia.services.nginx.enable;
-      description = "Enable nginx vHost integration";
-    };
   };
 
   config = mkIf cfg.enable {
@@ -82,10 +70,10 @@ in
       mailerPasswordFile = config.sops.secrets.gitea-mailer.path;
       settings = {
         server = {
-          DOMAIN = domain;
+          DOMAIN = "code.ataraxiadev.com";
           HTTP_ADDRESS = "127.0.0.1";
           HTTP_PORT = 6000;
-          ROOT_URL = "https://${domain}";
+          ROOT_URL = "https://code.ataraxiadev.com";
         };
         actions = {
           ENABLED = false;
@@ -140,14 +128,6 @@ in
       };
     };
 
-    services.nginx.virtualHosts = mkIf cfg.nginxHost {
-      ${domain} = recursiveUpdate nginx.defaultSettings {
-        locations."/" = {
-          proxyPass = "http://127.0.0.1:${toString config.services.gitea.settings.server.HTTP_PORT}";
-        };
-      };
-    };
-
     systemd.services.gitea-dump-clean =
       let
         older-than = "3"; # in days

modules/nixos/services/headscale.nix

@@ -1,158 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  secretsDir,
-  ...
-}:
-let
-  inherit (lib)
-    mkEnableOption
-    mkIf
-    mkOption
-    recursiveUpdate
-    ;
-  inherit (lib.types)
-    bool
-    enum
-    listOf
-    str
-    submodule
-    ;
-
-  cfg = config.ataraxia.services.headscale;
-  nginx = config.ataraxia.services.nginx;
-  domain = "wg.ataraxiadev.com";
-
-  dnsEntry = submodule {
-    options = {
-      name = mkOption {
-        type = str;
-      };
-      type = mkOption {
-        type = enum [
-          "A"
-          "AAAA"
-        ];
-      };
-      value = mkOption {
-        type = str;
-      };
-    };
-  };
-in
-{
-  options.ataraxia.services.headscale = {
-    enable = mkEnableOption "Enable headscale service";
-    sopsDir = mkOption {
-      type = str;
-      default = config.networking.hostName;
-      description = ''
-        Name for sops secrets directory. Defaults to hostname.
-      '';
-    };
-    nginxHost = mkOption {
-      type = bool;
-      default = config.ataraxia.services.nginx.enable;
-      description = "Enable nginx vHost integration";
-    };
-    extraDns = mkOption {
-      type = listOf dnsEntry;
-      description = ''
-        Extra dns records for headscale.
-      '';
-    };
-  };
-
-  config = mkIf cfg.enable {
-    services.headscale = {
-      enable = true;
-      address = "0.0.0.0";
-      port = 8005;
-      settings = {
-        server_url = "https://${domain}";
-        ip_prefixes = [
-          "fd7a:115c:a1e0::/64"
-          "100.64.0.0/16"
-        ];
-        dns = {
-          override_local_dns = true;
-          base_domain = "tailnet.ataraxiadev.com";
-          nameservers.global = [ "127.0.0.1" ];
-          extra_records = cfg.extraDns;
-        };
-        oidc = {
-          only_start_if_oidc_is_available = true;
-          issuer = "https://auth.ataraxiadev.com/application/o/headscale/";
-          client_id = "n6UBhK8PahexLPb7GkU1xzoFLcYxQX0HWDytpUoi";
-          client_secret_path = config.sops.secrets.headscale-oidc.path;
-          scope = [
-            "openid"
-            "profile"
-            "email"
-            "groups"
-          ];
-          allowed_groups = [ "headscale" ];
-        };
-        grpc_listen_addr = "127.0.0.1:50443";
-        grpc_allow_insecure = true;
-        disable_check_updates = true;
-        ephemeral_node_inactivity_timeout = "4h";
-      };
-    };
-
-    services.nginx.virtualHosts = mkIf cfg.nginxHost {
-      ${domain} = recursiveUpdate nginx.defaultSettings {
-        locations."/headscale." = {
-          extraConfig = ''
-            grpc_pass grpc://${config.services.headscale.settings.grpc_listen_addr};
-          '';
-          priority = 1;
-        };
-        locations."/metrics" = {
-          proxyPass = "http://127.0.0.1:${toString config.services.headscale.port}";
-          extraConfig = ''
-            allow 100.64.0.0/16;
-            allow 10.10.10.0/24;
-            deny all;
-          '';
-          priority = 2;
-        };
-        locations."/" = {
-          proxyPass = "http://127.0.0.1:${toString config.services.headscale.port}";
-          proxyWebsockets = true;
-          priority = 3;
-        };
-      };
-    };
-
-    sops.secrets.headscale-oidc = {
-      sopsFile = secretsDir + /${cfg.sopsDir}/headscale.yaml;
-      owner = "headscale";
-      restartUnits = [ "headscale.service" ];
-    };
-    systemd.services.headscale = {
-      serviceConfig.TimeoutStopSec = 15;
-      serviceConfig.ExecStartPre =
-        let
-          waitAuthnetikReady = pkgs.writeShellScript "waitAuthnetikReady" ''
-            # Check until authentik is alive
-            max_retry=100
-            counter=0
-            until ${lib.getExe pkgs.curl} -fsSL http://auth.ataraxiadev.com/-/health/ready/
-            do
-              echo "Waiting for the authentik..."
-              sleep 3
-              [[ counter -eq $max_retry ]] && echo "Could not connect to authentik!" && exit 1
-              echo "Trying again. Try #$counter"
-              ((counter++))
-            done
-            echo "Authentik is alive!"
-          '';
-        in
-        waitAuthnetikReady;
-    };
-
-    persist.state.directories = [ "/var/lib/headscale" ];
-  };
-}

modules/nixos/services/nginx.nix

@@ -1,60 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  inherit (lib) mkEnableOption mkIf mkOption;
-  inherit (lib.types) attrs;
-
-  cfg = config.ataraxia.services.nginx;
-in
-{
-  options.ataraxia.services.nginx = {
-    enable = mkEnableOption "Enable nginx service";
-    defaultSettings = mkOption {
-      type = attrs;
-      default = { };
-      description = ''
-        Default settings to append to virtualHosts. Does not apllied automatically.
-        Usage example: `your-host = recursiveUpdate defaultSettings { };`
-      '';
-    };
-    # extraConfig = mkOption {
-    #   type = str;
-    #   default = "";
-    #   description = ''
-    #     Default settings to append to extraConfig of virtual host's location. Does not apllied automatically.
-    #     Usage example: `extraConfig = recursiveUpdate extraConfig "";`
-    #   '';
-    # };
-  };
-
-  config = mkIf cfg.enable {
-    services.nginx = {
-      enable = true;
-      package = pkgs.nginxQuic;
-      recommendedBrotliSettings = true;
-      recommendedGzipSettings = true;
-      recommendedOptimisation = true;
-      recommendedProxySettings = true;
-      recommendedTlsSettings = true;
-      recommendedUwsgiSettings = true;
-      recommendedZstdSettings = true;
-      clientMaxBodySize = "250m";
-      commonHttpConfig = ''
-        proxy_hide_header X-Frame-Options;
-      '';
-    };
-
-    networking.firewall.allowedTCPPorts = [
-      80
-      443
-    ];
-    networking.firewall.allowedUDPPorts = [
-      80
-      443
-    ];
-  };
-}

modules/nixos/services/syncyomi.nix

@@ -30,7 +30,5 @@ in
     services.syncyomi.enable = true;
     services.syncyomi.configFile = config.sops.secrets.syncyomi.path;
     networking.firewall.allowedTCPPorts = [ 8282 ];
-
-    persist.state.directories = [ config.services.syncyomi.dataDir ];
   };
 }

modules/nixos/services/vaultwarden.nix

@@ -5,17 +5,10 @@
   ...
 }:
 let
-  inherit (lib)
+  inherit (lib) mkEnableOption mkIf mkOption;
-    mkEnableOption
+  inherit (lib.types) str;
-    mkIf
-    mkOption
-    recursiveUpdate
-    ;
-  inherit (lib.types) bool str;
 
   cfg = config.ataraxia.services.vaultwarden;
-  nginx = config.ataraxia.services.nginx;
-  domain = "vw.ataraxiadev.com";
 in
 {
   options.ataraxia.services.vaultwarden = {
@@ -27,11 +20,6 @@ in
         Name for sops secrets directory. Defaults to hostname.
       '';
     };
-    nginxHost = mkOption {
-      type = bool;
-      default = config.ataraxia.services.nginx.enable;
-      description = "Enable nginx vHost integration";
-    };
   };
 
   config = mkIf cfg.enable {
@@ -43,7 +31,7 @@ in
       enable = true;
       backupDir = "/srv/vaultwarden";
       config = {
-        domain = "https://${domain}";
+        domain = "https://vw.ataraxiadev.com";
         extendedLogging = true;
         invitationsAllowed = false;
         useSyslog = true;
@@ -68,20 +56,11 @@ in
       environmentFile = config.sops.secrets.vaultwarden.path;
     };
 
-    services.nginx.virtualHosts = mkIf cfg.nginxHost {
+    # We need to do this to successufully create backup folder
-      ${domain} = recursiveUpdate nginx.defaultSettings {
+    # systemd.services.backup-vaultwarden.serviceConfig = {
-        locations."/" = {
+    #   User = "root";
-          proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.rocketPort}";
+    #   Group = "root";
-        };
+    # };
-        locations."/notifications/hub" = {
-          proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.websocketPort}";
-          proxyWebsockets = true;
-        };
-        locations."/notifications/hub/negotiate" = {
-          proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.rocketPort}";
-        };
-      };
-    };
 
     persist.state.directories = [
       "/var/lib/vaultwarden"

modules/nixos/virtualisation/virtualisation.nix

@@ -2,11 +2,15 @@
   config,
   lib,
   pkgs,
-  useHomeManager,
   ...
 }:
 let
-  inherit (lib) mkEnableOption mkIf optionals;
+  inherit (lib)
+    hasAttr
+    mkEnableOption
+    mkIf
+    optionals
+    ;
   cfg = config.ataraxia.virtualisation;
 
   defaultUser = config.ataraxia.defaults.users.defaultUser;
@@ -35,14 +39,6 @@ in
         defaultNetwork.settings.dns_enabled = true;
         dockerSocket.enable = !config.virtualisation.docker.enable;
       };
-      containers.containersConf.settings = {
-        network = {
-          dns_servers = [
-            "10.10.10.1"
-            "host"
-          ];
-        };
-      };
       containers.registries.search = [
         "docker.io"
         "ghcr.io"
@@ -73,29 +69,8 @@ in
       };
 
       spiceUSBRedirection.enable = cfg.libvirt;
-
-      quadlet = {
-        enable = true;
-        autoEscape = true;
-        autoUpdate.enable = false;
-        networks = {
-          br-services.networkConfig = {
-            # TODO: enable dns, fix dns resolution
-            # dns = [ "10.10.10.1" ];
-            disableDns = true;
-            driver = "bridge";
-            ipamDriver = "host-local";
-            ipv6 = false;
-            name = "br-services";
-            podmanArgs = [ "--interface-name=br-services" ];
-            subnets = [ "10.99.0.0/16" ];
-          };
-        };
-      };
     };
 
-    boot.enableContainers = true;
-
     environment.systemPackages =
       [ ]
       ++ optionals cfg.docker [ pkgs.docker-compose ]
@@ -104,9 +79,8 @@ in
 
     users.users."qemu-libvirtd" = mkIf cfg.libvirt {
       extraGroups = lib.optionals (!config.virtualisation.libvirtd.qemu.runAsRoot) [
-        "input"
         "kvm"
-        "libvitrd"
+        "input"
       ];
     };
 
@@ -118,7 +92,7 @@ in
       "/var/lib/containers"
     ];
 
-    home-manager = mkIf useHomeManager {
+    home-manager = mkIf (hasAttr "users" config.home-manager) {
       users.${defaultUser} = {
         home.file.".config/containers/storage.conf".text = ''
           [storage]

modules/nixos/workspace/wayland.nix

@@ -1,10 +1,6 @@
-{
+{ config, lib, ... }:
-  config,
-  lib,
-  useHomeManager,
-  ...
-}:
 let
+  inherit (builtins) hasAttr;
   inherit (lib) getExe mkEnableOption mkIf;
   cfg = config.ataraxia.wayland;
 
@@ -35,7 +31,7 @@ in
       };
     };
 
-    home-manager = mkIf useHomeManager {
+    home-manager = mkIf (hasAttr "users" config.home-manager) {
       users.${defaultUser} = {
         ataraxia.wayland.hyprland.enable = cfg.hyprland.enable;
       };

modules/nixos/workspace/zsh/default.nix

@@ -1,115 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  useHomeManager,
-  ...
-}:
-let
-  inherit (lib) mkEnableOption mkIf;
-  cfg = config.ataraxia.defaults.zsh;
-  defaultUser = config.ataraxia.defaults.users.defaultUser;
-in
-{
-  options.ataraxia.defaults.zsh = {
-    enable = mkEnableOption "Default zsh settings";
-  };
-
-  config = mkIf cfg.enable {
-    environment.systemPackages = with pkgs; [
-      eza
-      libqalculate
-      rsync
-    ];
-
-    programs.zsh = {
-      enable = true;
-      enableCompletion = true;
-      enableBashCompletion = true;
-      autosuggestions.enable = true;
-      syntaxHighlighting.enable = true;
-
-      histFile = "$HOME/.zsh/history";
-      histSize = 1000000;
-      setOptions = [
-        "AUTO_CD"
-        "HIST_IGNORE_SPACE"
-      ];
-      promptInit = ''
-        source ${pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k/powerlevel10k.zsh-theme
-        source ${./p10k.zsh}
-      '';
-      shellAliases = {
-        "_" = "doas";
-        "clr" = "clear";
-        "rcp" = "rsync -ah --partial --no-whole-file --info=progress2";
-        "rrcp" = "_ rsync -ah --partial --no-whole-file --info=progress2";
-        "ncg" = "_ nix-collect-garbage";
-        "ncgd" = "_ nix-collect-garbage -d";
-        "show-packages" = "_ nix-store -q --references /run/current-system/sw";
-        "nsp" = "nix-shell --run zsh -p";
-        "nd" = "nix develop -c zsh";
-        "nb" = "nix build";
-        "nr" = "nix run";
-        "e" = "$EDITOR";
-        "q" = "qalc";
-        "man" = "pinfo";
-        "l" = "eza -lag";
-        "tree" = "eza -T";
-        "ltree" = "eza -lgT";
-        "atree" = "eza -aT";
-        "latree" = "eza -lagT";
-        # systemd
-        "ctl" = "systemctl";
-        "ctlsp" = "systemctl stop";
-        "ctlst" = "systemctl start";
-        "ctlrt" = "systemctl restart";
-        "ctls" = "systemctl status";
-        "ctlu" = "systemctl --user";
-        "ctlusp" = "systemctl --user stop";
-        "ctlust" = "systemctl --user start";
-        "ctlurt" = "systemctl --user restart";
-        "ctlus" = "systemctl --user status";
-        "ctlfailed" = "systemctl --failed --all";
-        "ctlrf" = "systemctl reset-failed";
-        "ctldrd" = "systemctl daemon-reload";
-        "j" = "journalctl";
-        "ju" = "journalctl -xe -u";
-        "juu" = "journalctl -xe --user-unit";
-      };
-      interactiveShellInit = ''
-        # Start and then view status of service
-        ctlsts () {
-          systemctl start "$1"
-          systemctl status "$1"
-        }
-        ctlusts () {
-          systemctl --user start "$1"
-          systemctl --user status "$1"
-        }
-        # Restart and then view status of service
-        ctlrts () {
-          systemctl restart "$1"
-          systemctl status "$1"
-        }
-        ctlurts () {
-          systemctl --user restart "$1"
-          systemctl --user status "$1"
-        }
-      '';
-    };
-
-    # TODO: permissions
-    persist.state.directories = mkIf (!useHomeManager) [ "/home/${defaultUser}/.zsh" ];
-
-    home-manager = mkIf useHomeManager {
-      users.${defaultUser} = {
-        persist.state.directories = [ ".zsh" ];
-      };
-    };
-
-    systemd.tmpfiles.rules = [
-      "f /home/${defaultUser}/.zshrc 0644 ${defaultUser} users -"
-    ];
-  };
-}

secrets/orion/headscale.yaml

@@ -1,27 +0,0 @@
-headscale-oidc: ENC[AES256_GCM,data:lu1c/XSD7/fV1MuwAETDV1PCn3C7zr0UKK0u4/5Z2AoQXHLsUES3Yvu7B9kStFd3M+GoOq6Y0xYVGLS9x5TcEVFDKSsdRRgGYlu2C/x+NUOlP0cEKKq222NYIZ6iA9emP6A2ZVy1ZpM1UE65vJHk1NHHbS4zYiiJMskOacwW1bs=,iv:o9/TG+9/MU6mchYtj6navG97eJhP/4kUlWcx/xjhvK0=,tag:l2xQhGn1vkcBZvBZevpTOg==,type:str]
-headscale-oidc-env: ENC[AES256_GCM,data:LX26VJfqImj5hHGSczey4okdPsNdxsIQ4OD3kRhwRt4P2MAdlVWiBQl47Jj5lk1Nm/yZejf4GXARLoQf3TK1ie4aDaWJx8Yhl8aSpy1s3h/1lcM7OCNb9WhUB+ZmikXaA6sOui4sQfGEtf0ydeIE0CwH04WL+Qomu+WxFzUVSzPW3baR2AKSqKiLGLGB0mZrRmdbhSdxCJN85j2i/Q==,iv:9b4pMMLj9huMg2RnrU10xqjRoA3NCWUKn4rc956Gm+s=,tag:+XN0KzJqWvTS/8ufGooNfg==,type:str]
-sops:
-    shamir_threshold: 1
-    age:
-        - recipient: age13phpsegg6vu7a34ydtfa9s904dfpgzqhzru7epnky7glezk0xvkst9qh6h
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhdWVNQVRkYUwvVkRnUlJV
-            ZFI3K1NsTzBFWDZXSU5Md0NQRTlsUTlCTHhZCjFObFNMSENXN2NIZlQ1ZHBEZ3Fu
-            R0JhVXdsRThUS3ZDWXV2OTFkODdQUGMKLS0tIEZiZ1ZEWTBaMnlIc2lTWGQxSW1W
-            bjNGQnFnOFVwbHdsVkpuNHJlRVc2c1kK/IQzoSi17GU8D6LP+4ccxq+Ip3lary62
-            0dkRYgMOf+jR21VA+1jhyFFYkwzZl7ajnM+pXYKf+/togQv6MnML/g==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1m5msm7rgqye2q9zesgedg0emga4ntehlr629786lrxs3rhk0squq0ly9je
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSZFdCQmltbnduUklHdTJB
-            OGR6WllGaS8xUUhNT0t6cU1JVHF0V0tsSlF3CmlSYlNDZEJvRzdCT3hrRGFPeGdZ
-            eFRCVUFtbFJBUnNPREd2RzR1eUYyOFkKLS0tIGZBWGJURE5Cb2lreWdPYjJWL0FV
-            VzBXZTNORldzcGo2KzVhTmQ5dERMMjAKMEV+wMtClLbgur/Qx/xLaQNjjqNtm1sf
-            5z+Hi/D0aqgA09k5iAxGdfez0rFJAX32w6vJouMTfYzCLqC6iaaomQ==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-01-24T20:09:29Z"
-    mac: ENC[AES256_GCM,data:akcHfxJrGSPINI28sQdxcz4s6P9Va+GAvF0TC7adgf2mgVtqkZdaZPJZ/BaVlxccWf3tFgBMKwLVHcfmxMi93KnxFxOuA3DWYnjmBfHzxHFq+jWke7BHzRhPvVsKOKKHdfkXPCZnqyHLwRPp0jUyrANw9m9Ub2JTomfHy3j2+FA=,iv:784bnpb7v0z3KewsnH+RXYkdml+o2sj/qvR7qqn/om0=,tag:L1c/p8GcUlT+4sLyr0T5fA==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.8.1