From e5bf5a3ba1ce7c6d2aa09658303dcabf72bb09b9 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 9 Apr 2025 11:41:07 +0200
Subject: [PATCH 01/60] flake: bump inputs

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index d86d6b5..9e61219 100644
--- a/flake.lock
+++ b/flake.lock
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1743689281,
-        "narHash": "sha256-y7Hg5lwWhEOgflEHRfzSH96BOt26LaYfrYWzZ+VoVdg=",
+        "lastModified": 1744174375,
+        "narHash": "sha256-oxI9TLgnQbQ/WL0tIwVSIooLbXq4PW1QUhf5aQmXFgk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2bfc080955153be0be56724be6fa5477b4eefabb",
+        "rev": "ef3a956f697525883b77192cbe208233ea0f8f79",
         "type": "github"
       },
       "original": {

From 439a6bc930ea7eabb372824c71d4a9174d4588b5 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 9 Apr 2025 12:26:04 +0200
Subject: [PATCH 02/60] nixos: services: homebox: use postgres

---
 modules/nixos/services/homebox/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/modules/nixos/services/homebox/default.nix b/modules/nixos/services/homebox/default.nix
index d79e331..bde59e6 100644
--- a/modules/nixos/services/homebox/default.nix
+++ b/modules/nixos/services/homebox/default.nix
@@ -19,6 +19,11 @@ in
     services.homebox = {
       enable = true;
 
+      # Automatic PostgreSQL provisioning
+      database = {
+        createLocally = true;
+      };
+
       settings = {
         # FIXME: mailer?
         HBOX_WEB_PORT = toString cfg.port;

From 1dd1dbb917b17da7864a4ac20a977869ff752ac2 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 9 Apr 2025 12:26:42 +0200
Subject: [PATCH 03/60] nixos: services: homebox: proxy websockets

Should avoid a bunch of error logs, and ensure that e.g: adding a label
does not require a refresh to show it in a list.
---
 modules/nixos/services/homebox/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/nixos/services/homebox/default.nix b/modules/nixos/services/homebox/default.nix
index bde59e6..8ed5d77 100644
--- a/modules/nixos/services/homebox/default.nix
+++ b/modules/nixos/services/homebox/default.nix
@@ -33,6 +33,7 @@ in
     my.services.nginx.virtualHosts = {
       homebox = {
         inherit (cfg) port;
+        websocketsLocations = [ "/api" ];
       };
     };
 

From bd55ecc016eb49eca60b98ab0d2a22eca49a95ce Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 9 Apr 2025 12:27:51 +0200
Subject: [PATCH 04/60] hosts: nixos: porthos: services: enable homebox

---
 hosts/nixos/porthos/services.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hosts/nixos/porthos/services.nix b/hosts/nixos/porthos/services.nix
index 784eb31..561da27 100644
--- a/hosts/nixos/porthos/services.nix
+++ b/hosts/nixos/porthos/services.nix
@@ -51,6 +51,10 @@ in
         passwordFile = secrets."forgejo/mail-password".path;
       };
     };
+    # Home inventory
+    homebox = {
+      enable = true;
+    };
     # Jellyfin media server
     jellyfin.enable = true;
     # Gitea mirrorig service

From a28295da27b96301bba49cd68cb6ae017be4be76 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 11 Apr 2025 19:01:08 +0200
Subject: [PATCH 05/60] nixos: services: servarr: autobrr: fix comment

---
 modules/nixos/services/servarr/autobrr.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/nixos/services/servarr/autobrr.nix b/modules/nixos/services/servarr/autobrr.nix
index afb07f4..4465a78 100644
--- a/modules/nixos/services/servarr/autobrr.nix
+++ b/modules/nixos/services/servarr/autobrr.nix
@@ -1,4 +1,4 @@
-# IRC-based
+# IRC-based indexer
 { config, lib, ... }:
 let
   cfg = config.my.services.servarr.autobrr;

From a0473a5c6cd191ea649c250dc7e8f6094e74adba Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 12 Apr 2025 11:27:47 +0200
Subject: [PATCH 06/60] nixos: services: servarr: autobrr: fix fail2ban

The log line for authentication failures has been updated since the
original PR.

It also happens to be logged in JSON, and I'm a bit too lazy to match it
more properly than this.
---
 modules/nixos/services/servarr/autobrr.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/nixos/services/servarr/autobrr.nix b/modules/nixos/services/servarr/autobrr.nix
index 4465a78..398e878 100644
--- a/modules/nixos/services/servarr/autobrr.nix
+++ b/modules/nixos/services/servarr/autobrr.nix
@@ -54,7 +54,7 @@ in
     environment.etc = {
       "fail2ban/filter.d/autobrr.conf".text = ''
         [Definition]
-        failregex = ^.*Auth: invalid login \[.*\] from: <HOST>$
+        failregex = "message":"Auth: Failed login attempt username: \[.*\] ip: <HOST>"
         journalmatch = _SYSTEMD_UNIT=autobrr.service
       '';
     };

From e82ae4a2192191e2894969fe3107fdbcd36c8c92 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 14 Apr 2025 10:19:57 +0000
Subject: [PATCH 07/60] home: vim: numbertoggle: remove 'TermOpen' event

It's now part of upstream's default setup.
---
 modules/home/vim/plugin/numbertoggle.lua | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/modules/home/vim/plugin/numbertoggle.lua b/modules/home/vim/plugin/numbertoggle.lua
index 8042710..b1e3df2 100644
--- a/modules/home/vim/plugin/numbertoggle.lua
+++ b/modules/home/vim/plugin/numbertoggle.lua
@@ -22,13 +22,3 @@ vim.api.nvim_create_autocmd({ "BufLeave", "FocusLost", "InsertEnter", "WinLeave"
         end
     end,
 })
-
--- Never show the sign column in a terminal buffer
-vim.api.nvim_create_autocmd({ "TermOpen" }, {
-    pattern = "*",
-    group = numbertoggle,
-    callback = function()
-        vim.opt.number = false
-        vim.opt.relativenumber = false
-    end,
-})

From 67936af4c73f8664448efc80b072f40c568517c6 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 14 Apr 2025 10:19:57 +0000
Subject: [PATCH 08/60] home: vim: signtoggle: remove 'TermOpen' event

It's now part of upstream's default setup.
---
 modules/home/vim/plugin/signtoggle.lua | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/modules/home/vim/plugin/signtoggle.lua b/modules/home/vim/plugin/signtoggle.lua
index 9765a81..6a7640c 100644
--- a/modules/home/vim/plugin/signtoggle.lua
+++ b/modules/home/vim/plugin/signtoggle.lua
@@ -15,12 +15,3 @@ vim.api.nvim_create_autocmd({ "BufLeave", "FocusLost", "WinLeave" }, {
         vim.opt.signcolumn = "no"
     end,
 })
-
--- Never show the sign column in a terminal buffer
-vim.api.nvim_create_autocmd({ "TermOpen" }, {
-    pattern = "*",
-    group = signtoggle,
-    callback = function()
-        vim.opt.signcolumn = "no"
-    end,
-})

From 6f5ac4e55f644a5e5a473e9fda752fbebdec7455 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 14 Apr 2025 10:24:30 +0000
Subject: [PATCH 09/60] home: vim: signtoggle: only show signs if 'number'

If a buffer doesn't show a number column, I probably also don't want a
sign column to be toggled on/off in there.
---
 modules/home/vim/plugin/signtoggle.lua | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/modules/home/vim/plugin/signtoggle.lua b/modules/home/vim/plugin/signtoggle.lua
index 6a7640c..3deca34 100644
--- a/modules/home/vim/plugin/signtoggle.lua
+++ b/modules/home/vim/plugin/signtoggle.lua
@@ -1,17 +1,21 @@
 local signtoggle = vim.api.nvim_create_augroup("signtoggle", { clear = true })
 
--- Only show sign column for the currently focused buffer
+-- Only show sign column for the currently focused buffer, if it has a number column
 vim.api.nvim_create_autocmd({ "BufEnter", "FocusGained", "WinEnter" }, {
     pattern = "*",
     group = signtoggle,
     callback = function()
-        vim.opt.signcolumn = "yes"
+        if vim.opt.number:get() then
+            vim.opt.signcolumn = "yes"
+        end
     end,
 })
 vim.api.nvim_create_autocmd({ "BufLeave", "FocusLost", "WinLeave" }, {
     pattern = "*",
     group = signtoggle,
     callback = function()
-        vim.opt.signcolumn = "no"
+        if vim.opt.number:get() then
+            vim.opt.signcolumn = "no"
+        end
     end,
 })

From 26ee59ef6e4f28ccbdbcf87eb28bb4074a87c840 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 14 Apr 2025 13:54:52 +0000
Subject: [PATCH 10/60] home: atuin: use 'uk' dialect for dates

This should be for date *parsing*, from my looking at the code.

Unlikely to be relevant, but might as well set it to the saner of the
two options.
---
 modules/home/atuin/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/home/atuin/default.nix b/modules/home/atuin/default.nix
index 3f06263..8c02e69 100644
--- a/modules/home/atuin/default.nix
+++ b/modules/home/atuin/default.nix
@@ -21,6 +21,8 @@ in
       ];
 
       settings = {
+        # Reasonable date format
+        dialect = "uk";
         # The package is managed by Nix
         update_check = false;
         # I don't care for the fancy display

From c69aaa7adb604593d20d38d0037caaf24cb41f3e Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 16 Apr 2025 15:25:18 +0200
Subject: [PATCH 11/60] nixos: services: servarr: autobrr: fix websockets

I found some logs complaining about websockets before enabling this.
---
 modules/nixos/services/servarr/autobrr.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/nixos/services/servarr/autobrr.nix b/modules/nixos/services/servarr/autobrr.nix
index 398e878..c3370cb 100644
--- a/modules/nixos/services/servarr/autobrr.nix
+++ b/modules/nixos/services/servarr/autobrr.nix
@@ -40,6 +40,7 @@ in
     my.services.nginx.virtualHosts = {
       autobrr = {
         inherit (cfg) port;
+        websocketsLocations = [ "/api" ];
       };
     };
 

From e4bc0444bfe7fdc7a43afcbda1ec7379f8286301 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 16 Apr 2025 15:29:10 +0200
Subject: [PATCH 12/60] nixos: services: transmission: fix umask

I want downloads to be readable by the `media` group. The permissions
weren't correctly applied without `umask`.
---
 modules/nixos/services/transmission/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/nixos/services/transmission/default.nix b/modules/nixos/services/transmission/default.nix
index ac8b24d..16d51e3 100644
--- a/modules/nixos/services/transmission/default.nix
+++ b/modules/nixos/services/transmission/default.nix
@@ -65,6 +65,8 @@ in
         # Proxied behind Nginx.
         rpc-whitelist-enabled = true;
         rpc-whitelist = "127.0.0.1";
+
+        umask = "002"; # To go with `downloadDirPermissions`
       };
     };
 

From 1b6a48d6c27a88c98c6c99cbe642ee681c362cbd Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 16 Apr 2025 17:07:23 +0200
Subject: [PATCH 13/60] flake: bump inputs

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index 9e61219..65b8f04 100644
--- a/flake.lock
+++ b/flake.lock
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1744174375,
-        "narHash": "sha256-oxI9TLgnQbQ/WL0tIwVSIooLbXq4PW1QUhf5aQmXFgk=",
+        "lastModified": 1744777043,
+        "narHash": "sha256-O6jgTxz9BKUiaJl03JsVHvSjtCOC8gHfDvC2UCfcLMc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ef3a956f697525883b77192cbe208233ea0f8f79",
+        "rev": "7a6f7f4c1c69eee05641beaa40e7f85da8e69fb0",
         "type": "github"
       },
       "original": {

From c40090d17607efbec1d58cefa95f0745ab0806b7 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 12 Apr 2025 14:51:46 +0200
Subject: [PATCH 14/60] nixos: services: servarr: add cross-seed

---
 hosts/nixos/porthos/services.nix              |  3 +
 modules/nixos/services/servarr/cross-seed.nix | 96 +++++++++++++++++++
 modules/nixos/services/servarr/default.nix    |  1 +
 3 files changed, 100 insertions(+)
 create mode 100644 modules/nixos/services/servarr/cross-seed.nix

diff --git a/hosts/nixos/porthos/services.nix b/hosts/nixos/porthos/services.nix
index 561da27..a95840a 100644
--- a/hosts/nixos/porthos/services.nix
+++ b/hosts/nixos/porthos/services.nix
@@ -148,6 +148,9 @@ in
       autobrr = {
         sessionSecretFile = secrets."servarr/autobrr/session-secret".path;
       };
+      cross-seed = {
+        enable = false;
+      };
       # ... But not Lidarr because I don't care for music that much
       lidarr = {
         enable = false;
diff --git a/modules/nixos/services/servarr/cross-seed.nix b/modules/nixos/services/servarr/cross-seed.nix
new file mode 100644
index 0000000..74f216a
--- /dev/null
+++ b/modules/nixos/services/servarr/cross-seed.nix
@@ -0,0 +1,96 @@
+# Automatic cross-seeding for video media
+{ config, lib, ... }:
+let
+  cfg = config.my.services.servarr.cross-seed;
+in
+{
+  options.my.services.servarr.cross-seed = with lib; {
+    enable = mkEnableOption "cross-seed daemon" // {
+      default = config.my.services.servarr.enableAll;
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 2468;
+      example = 8080;
+      description = "Internal port for daemon";
+    };
+
+    linkDirectory = mkOption {
+      type = types.str;
+      default = "/data/downloads/complete/links";
+      example = "/var/lib/cross-seed/links";
+      description = "Link directory";
+    };
+
+    secretSettingsFile = mkOption {
+      type = types.str;
+      example = "/run/secrets/cross-seed-secrets.json";
+      description = ''
+        File containing secret settings.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.cross-seed = {
+      enable = true;
+      group = "media";
+
+      # Rely on recommended defaults for tracker snatches etc...
+      useGenConfigDefaults = true;
+
+      settings = {
+        inherit (cfg) port;
+        host = "127.0.0.1";
+
+        # Inject torrents to client directly
+        action = "inject";
+        # Query the client for torrents to match
+        useClientTorrents = true;
+        # Use hardlinks
+        linkType = "hardlink";
+        # Use configured link directory
+        linkDirs = [ cfg.linkDirectory ];
+        # Match as many torrents as possible
+        matchMode = "partial";
+        # Cross-seed full season if at least 50% of episodes are already downloaded
+        seasonFromEpisodes = 0.5;
+      };
+
+      settingsFile = cfg.secretSettingsFile;
+    };
+
+    systemd.services.cross-seed = {
+      serviceConfig = {
+        # Loose umask to make cross-seed links readable by `media`
+        UMask = "0002";
+      };
+    };
+
+    # Set-up media group
+    users.groups.media = { };
+
+    my.services.nginx.virtualHosts = {
+      cross-seed = {
+        inherit (cfg) port;
+      };
+    };
+
+    services.fail2ban.jails = {
+      cross-seed = ''
+        enabled = true
+        filter = cross-seed
+        action = iptables-allports
+      '';
+    };
+
+    environment.etc = {
+      "fail2ban/filter.d/cross-seed.conf".text = ''
+        [Definition]
+        failregex = ^.*Unauthorized API access attempt to .* from <HOST>$
+        journalmatch = _SYSTEMD_UNIT=cross-seed.service
+      '';
+    };
+  };
+}
diff --git a/modules/nixos/services/servarr/default.nix b/modules/nixos/services/servarr/default.nix
index 409fcdc..dca57cf 100644
--- a/modules/nixos/services/servarr/default.nix
+++ b/modules/nixos/services/servarr/default.nix
@@ -7,6 +7,7 @@
   imports = [
     ./autobrr.nix
     ./bazarr.nix
+    ./cross-seed.nix
     ./jackett.nix
     ./nzbhydra.nix
     ./prowlarr.nix

From 058096079eadcf5fb488f00156dcd6d3a5489256 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 12 Apr 2025 14:52:10 +0200
Subject: [PATCH 15/60] hosts: nixos: porthos: secrets: add cross-seed

---
 hosts/nixos/porthos/secrets/secrets.nix          |   1 +
 .../servarr/cross-seed/configuration.json.age    | Bin 0 -> 1282 bytes
 2 files changed, 1 insertion(+)
 create mode 100644 hosts/nixos/porthos/secrets/servarr/cross-seed/configuration.json.age

diff --git a/hosts/nixos/porthos/secrets/secrets.nix b/hosts/nixos/porthos/secrets/secrets.nix
index 425756c..b3812b4 100644
--- a/hosts/nixos/porthos/secrets/secrets.nix
+++ b/hosts/nixos/porthos/secrets/secrets.nix
@@ -81,6 +81,7 @@ in
   "pyload/credentials.age".publicKeys = all;
 
   "servarr/autobrr/session-secret.age".publicKeys = all;
+  "servarr/cross-seed/configuration.json.age".publicKeys = all;
 
   "sso/auth-key.age" = {
     owner = "nginx-sso";
diff --git a/hosts/nixos/porthos/secrets/servarr/cross-seed/configuration.json.age b/hosts/nixos/porthos/secrets/servarr/cross-seed/configuration.json.age
new file mode 100644
index 0000000000000000000000000000000000000000..e9af03f472da8411b7106cf733ba1d389201263a
GIT binary patch
literal 1282
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCSn_Ri1BO;^Y%D)lpW
z_Vox$^UBlD_YJRfEOs*TaI7%TamjG@@%MBN_6+q4%rlBG4CFEk(T)lZswgWlj0|@T
zOfI%GGIq@J$u08_b}~sxN^>zZ3kh=Z)~^WiGeNg4D<Ho-FI~aW$uz>R)FdraKP<?}
z&oC;dGRM6vGSbhZ($vq~ys#{{FfrAzxWv@OF`FyAJVV<&z_ZZL*f2k+B)7;vJR(0o
zGSMO+)7{b6!Ywq%tiaeguf)G3!+=XyS69I@s;r<i$W%Mg+cLx_GQiC=Eg;b;RJ%As
z+uStKLp!lJBsVS3B*`n-(Sl3Nv-?a><MIrl(x*{bjP<sxbE2Gdw_Xrkr(%C|ap?a?
z*4ol~;-*5+owM{z@1FYk<B)aL#?(CrYK<rES!w6U|JNmJcZJJWvHUZpzudiRmYMJU
zvp@Rwq`);#<fot8G4;-;Rr@krUpfAHTx*peDK>>Q?&_key4;IpeNQjT-<rU%qA}a9
z=KuZtXr<E~f%(t>={NB3)O=pQ;MLzxPQS!o<z^}Phwwg0S}|{K;nl;E=W9&wHm}iL
z)mCHqK6R<uu@>Ib3v^1Sri)Zs9eVB=lXAmyUEuZlJ%3cK^Gi!u7w2uv-`dOQZ$FXe
z3*(03pW)Xgwfh=0Gjk-(y5bwTz)`wS;CJZJWp^yK``2&nXpHTb_<S?N*Za?kW@F7s
zUYt+9PK)ADsY+r9nt1F+c6qz+^ot3yn+uJbG#<=glIrDWdn(ypVeb=L%dfEEv`fH$
z`G9PmYcINQdsYPYh)r*1H~z=SKEF{geYM<cmx5_mOA8Wat@_LSQ1<aM+h@hUUMByO
zzP11G-z`hKxeg!scK>IM9_Qkgn(YnF5BSA*H`bfRnLD#;ukQR_DQvniFx=(b?Qj2!
zjwJcLmRIPtk}o>ACGkbuS&frT;XOMSX2r>6bGA<`5MKBvH)cmpdxG$^g=^xroJ_lW
zj8(z<=7Gg4?T`5IWK_04n)k`A_^6Ro?}Rfup7}iebiiEhj^WR)BYmZDuN1^h=f3NB
z6c#wu{Eyn<b<1T{j^!xdSfYPcp3Pl#ON5p0xkilzIRgJGuYB>*Tra+3;%3F&h3x;{
z^$9+GF!jix1q_uog>SvI7|Yxv)Rh!9ZmoJe^Hct_oFjD>yg&T+$mUMnl<roY`rz_q
zOZy@{>CH0>@~5aB{o`yCkb0pdG)BVZ)G22c?)L5Mi!54$;;YvkVqAOw@6QYkJHc+T
zNuQ?QSKG(kYxG~eg5$-Dk9TiY9FCcs7awN$Li4RTlb1v|*GGSr=bP_ytXh#jaoPRb
zwqIJFxK>UPFfTilIA`aV#ZKF@6J~T=_+H2N?wKE_+oI|3g2V15M&`b+lZ*TGd$II~
zp4Y!@)U{7*rY!nfB+ayF=43{`-Tk2xT8jLvukPx;c-d-lXH&IZ+b@X|F$b9DSJ}w?
zn|)=Ec)*@~w|7Ctwy8c>9*bKP8$9m~Z2lAQOWRa0DSvOJ^E$QZQ65=0Z<x<8`6e-`
zNK9;5b<Yf`!w;husPgHzeN+^7^;&v&re@*wPP>a0753*7ZutHTFF1He;Ff2n;b$@S
zO@^oRdHR_y1$Hbr^txewUfIF>X6zzqJWZZTPgB_3-hUQrYkHDkaX$G8Gn2mmfp2fO
a3$3o2qvJ8ZJ$CJ3_b3jI6I)+s@Bjd%=|BMh

literal 0
HcmV?d00001


From ee1139713c908ab43cd86b86fc984f1824395ca2 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 12 Apr 2025 14:52:38 +0200
Subject: [PATCH 16/60] hosts: nixos: porthos: services: enable cross-seed

---
 hosts/nixos/porthos/services.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hosts/nixos/porthos/services.nix b/hosts/nixos/porthos/services.nix
index a95840a..96f15d3 100644
--- a/hosts/nixos/porthos/services.nix
+++ b/hosts/nixos/porthos/services.nix
@@ -149,7 +149,7 @@ in
         sessionSecretFile = secrets."servarr/autobrr/session-secret".path;
       };
       cross-seed = {
-        enable = false;
+        secretSettingsFile = secrets."servarr/cross-seed/configuration.json".path;
       };
       # ... But not Lidarr because I don't care for music that much
       lidarr = {

From 135cef25365c25a1efaa912489c960a5fe839663 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 16 Apr 2025 16:04:52 +0000
Subject: [PATCH 17/60] home: atuin: add daemon

Enabled by default, I probably won't have a reason *not* to use it.
---
 modules/home/atuin/default.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/modules/home/atuin/default.nix b/modules/home/atuin/default.nix
index 8c02e69..dbd9690 100644
--- a/modules/home/atuin/default.nix
+++ b/modules/home/atuin/default.nix
@@ -8,6 +8,10 @@ in
 
     # I want the full experience by default
     package = mkPackageOption pkgs "atuin" { };
+
+    daemon = {
+      enable = my.mkDisableOption "atuin daemon";
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -15,6 +19,10 @@ in
       enable = true;
       inherit (cfg) package;
 
+      daemon = lib.mkIf cfg.daemon.enable {
+        enable = true;
+      };
+
       flags = [
         # I *despise* this hijacking of the up key, even though I use Ctrl-p
         "--disable-up-arrow"

From 29b47d7f84c67428d44ccc1f385161f187702661 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 22 Apr 2025 13:04:36 +0000
Subject: [PATCH 18/60] home: tmux: rename 'mkTerminalFeature'

This is a more accurate name to describe what the function is doing.
---
 modules/home/tmux/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/home/tmux/default.nix b/modules/home/tmux/default.nix
index 08b9202..82ceb3a 100644
--- a/modules/home/tmux/default.nix
+++ b/modules/home/tmux/default.nix
@@ -6,7 +6,7 @@ let
     (config.my.home.wm.windowManager != null)
   ];
 
-  mkTerminalFlags = opt: flag:
+  mkTerminalFeature = opt: flag:
     let
       mkFlag = term: ''set -as terminal-features ",${term}:${flag}"'';
       enabledTerminals = lib.filterAttrs (_: v: v.${opt}) cfg.terminalFeatures;
@@ -123,9 +123,9 @@ in
       }
 
       # Force OSC8 hyperlinks for each relevant $TERM
-      ${mkTerminalFlags "hyperlinks" "hyperlinks"}
+      ${mkTerminalFeature "hyperlinks" "hyperlinks"}
       # Force 24-bit color for each relevant $TERM
-      ${mkTerminalFlags "trueColor" "RGB"}
+      ${mkTerminalFeature "trueColor" "RGB"}
     '';
   };
 }

From ec1c94676a727ee7b6e20c377ad0f7d05af9d69e Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 22 Apr 2025 13:15:04 +0000
Subject: [PATCH 19/60] home: vim: highlight over-extended commit subjects

---
 modules/home/vim/after/queries/gitcommit/highlights.scm | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 modules/home/vim/after/queries/gitcommit/highlights.scm

diff --git a/modules/home/vim/after/queries/gitcommit/highlights.scm b/modules/home/vim/after/queries/gitcommit/highlights.scm
new file mode 100644
index 0000000..05162c9
--- /dev/null
+++ b/modules/home/vim/after/queries/gitcommit/highlights.scm
@@ -0,0 +1,6 @@
+; extends
+
+; Highlight over-extended subject lines (rely on wrapping for message body)
+((subject) @comment.error
+  (#vim-match? @comment.error ".\{50,}")
+  (#offset! @comment.error 0 50 0 0))

From 946eab9ec00bfba393d1ed292a28f0f692048096 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 21 Feb 2025 16:26:39 +0000
Subject: [PATCH 20/60] home: git: extract 'delta' configuration

I want to be able to re-use it between different source control systems
(e.g: `jj`).

As a first step, extract it to a proper module so that I can have it
live in a single space.
---
 modules/home/default.nix       |  1 +
 modules/home/delta/default.nix | 61 ++++++++++++++++++++++++++++++++++
 modules/home/git/default.nix   | 28 ----------------
 3 files changed, 62 insertions(+), 28 deletions(-)
 create mode 100644 modules/home/delta/default.nix

diff --git a/modules/home/default.nix b/modules/home/default.nix
index c8183cf..e642e87 100644
--- a/modules/home/default.nix
+++ b/modules/home/default.nix
@@ -8,6 +8,7 @@
     ./bluetooth
     ./calibre
     ./comma
+    ./delta
     ./dircolors
     ./direnv
     ./discord
diff --git a/modules/home/delta/default.nix b/modules/home/delta/default.nix
new file mode 100644
index 0000000..e9350bb
--- /dev/null
+++ b/modules/home/delta/default.nix
@@ -0,0 +1,61 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.my.home.delta;
+in
+{
+  options.my.home.delta = with lib; {
+    enable = my.mkDisableOption "delta configuration";
+
+    package = mkPackageOption pkgs "delta" { };
+
+    git = {
+      enable = my.mkDisableOption "git integration";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        # For its configuration
+        assertion = cfg.enable -> cfg.git.enable;
+        message = ''
+          `config.my.home.delta` must enable `config.my.home.delta.git` to be
+          properly configured.
+        '';
+      }
+    ];
+
+    home.packages = [ cfg.package ];
+
+    programs.git = lib.mkIf cfg.git.enable {
+      delta = {
+        enable = true;
+        inherit (cfg) package;
+
+        options = {
+          features = "diff-highlight decorations";
+
+          # Less jarring style for `diff-highlight` emulation
+          diff-highlight = {
+            minus-style = "red";
+            minus-non-emph-style = "red";
+            minus-emph-style = "bold red 52";
+
+            plus-style = "green";
+            plus-non-emph-style = "green";
+            plus-emph-style = "bold green 22";
+
+            whitespace-error-style = "reverse red";
+          };
+
+          # Personal preference for easier reading
+          decorations = {
+            commit-style = "raw"; # Do not recolor meta information
+            keep-plus-minus-markers = true;
+            paging = "always";
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/modules/home/git/default.nix b/modules/home/git/default.nix
index c88008f..ca59a5f 100644
--- a/modules/home/git/default.nix
+++ b/modules/home/git/default.nix
@@ -42,34 +42,6 @@ in
 
     lfs.enable = true;
 
-    delta = {
-      enable = true;
-
-      options = {
-        features = "diff-highlight decorations";
-
-        # Less jarring style for `diff-highlight` emulation
-        diff-highlight = {
-          minus-style = "red";
-          minus-non-emph-style = "red";
-          minus-emph-style = "bold red 52";
-
-          plus-style = "green";
-          plus-non-emph-style = "green";
-          plus-emph-style = "bold green 22";
-
-          whitespace-error-style = "reverse red";
-        };
-
-        # Personal preference for easier reading
-        decorations = {
-          commit-style = "raw"; # Do not recolor meta information
-          keep-plus-minus-markers = true;
-          paging = "always";
-        };
-      };
-    };
-
     # There's more
     extraConfig = {
       # Makes it a bit more readable

From 2eb2a83dca68ffd2ff5380300fbaec23e8038e6a Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 24 Apr 2025 09:29:37 +0000
Subject: [PATCH 21/60] flake: bump inputs

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index 65b8f04..6bd45a8 100644
--- a/flake.lock
+++ b/flake.lock
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743869639,
-        "narHash": "sha256-Xhe3whfRW/Ay05z9m1EZ1/AkbV1yo0tm1CbgjtCi4rQ=",
+        "lastModified": 1745439012,
+        "narHash": "sha256-TwbdiH28QK7Da2JQTqFHdb+UCJq6QbF2mtf+RxHVzEA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "d094c6763c6ddb860580e7d3b4201f8f496a6836",
+        "rev": "d31710fb2cd536b1966fee2af74e99a0816a61a8",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1744777043,
-        "narHash": "sha256-O6jgTxz9BKUiaJl03JsVHvSjtCOC8gHfDvC2UCfcLMc=",
+        "lastModified": 1745469902,
+        "narHash": "sha256-+kHgeD+3+WZZcOaIsS6XwQWb+qbYYWYXzoEjdmdW6OY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "7a6f7f4c1c69eee05641beaa40e7f85da8e69fb0",
+        "rev": "4975ac49a527b505803958595fcb191c9e889f60",
         "type": "github"
       },
       "original": {

From 89bc60609f07b4f3cff4cb4e0610f1b8243a9ad3 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 24 Apr 2025 12:46:24 +0200
Subject: [PATCH 22/60] home: firefox: tridactyl: use 'replaceVars'

---
 modules/home/firefox/tridactyl/default.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/modules/home/firefox/tridactyl/default.nix b/modules/home/firefox/tridactyl/default.nix
index 35b58c2..26ddfad 100644
--- a/modules/home/firefox/tridactyl/default.nix
+++ b/modules/home/firefox/tridactyl/default.nix
@@ -12,9 +12,7 @@ let
 in
 {
   config = lib.mkIf cfg.enable {
-    xdg.configFile."tridactyl/tridactylrc".source = pkgs.substituteAll {
-      src = ./tridactylrc;
-
+    xdg.configFile."tridactyl/tridactylrc".source = pkgs.replaceVars ./tridactylrc {
       editorcmd = lib.concatStringsSep " " [
         # Use my configured terminal
         term

From bfda64288ead8796e1f3c8a5980fabb228f2e844 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 30 Apr 2025 21:05:22 +0100
Subject: [PATCH 23/60] nix: bump inputs

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 6bd45a8..584d942 100644
--- a/flake.lock
+++ b/flake.lock
@@ -14,11 +14,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1736955230,
-        "narHash": "sha256-uenf8fv2eG5bKM8C/UvFaiJMZ4IpUFaQxk9OH5t/1gA=",
+        "lastModified": 1745630506,
+        "narHash": "sha256-bHCFgGeu8XjWlVuaWzi3QONjDW3coZDqSHvnd4l7xus=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "e600439ec4c273cf11e06fe4d9d906fb98fa097c",
+        "rev": "96e078c646b711aee04b82ba01aefbff87004ded",
         "type": "github"
       },
       "original": {
@@ -36,11 +36,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1700795494,
-        "narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
+        "lastModified": 1744478979,
+        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
+        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745439012,
-        "narHash": "sha256-TwbdiH28QK7Da2JQTqFHdb+UCJq6QbF2mtf+RxHVzEA=",
+        "lastModified": 1746040799,
+        "narHash": "sha256-osgPX/SzIpkR50vev/rqoTEAVkEcOWXoQXmbzsaI4KU=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "d31710fb2cd536b1966fee2af74e99a0816a61a8",
+        "rev": "5f217e5a319f6c186283b530f8c975e66c028433",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1745469902,
-        "narHash": "sha256-+kHgeD+3+WZZcOaIsS6XwQWb+qbYYWYXzoEjdmdW6OY=",
+        "lastModified": 1745930157,
+        "narHash": "sha256-y3h3NLnzRSiUkYpnfvnS669zWZLoqqI6NprtLQ+5dck=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4975ac49a527b505803958595fcb191c9e889f60",
+        "rev": "46e634be05ce9dc6d4db8e664515ba10b78151ae",
         "type": "github"
       },
       "original": {

From c5be292dfca50b740acf130bb0c3138fb4261a26 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 30 Apr 2025 21:34:11 +0100
Subject: [PATCH 24/60] nixos: profiles: wm: fix i3lock PAM service

This was announced as a breaking change, and would lock me out if not
set.

I wish the transition went a bit slower, by first introducing the
option for each PAM service, and *then* toggling it. Oh well.
---
 modules/nixos/profiles/wm/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/nixos/profiles/wm/default.nix b/modules/nixos/profiles/wm/default.nix
index c227328..bca4d70 100644
--- a/modules/nixos/profiles/wm/default.nix
+++ b/modules/nixos/profiles/wm/default.nix
@@ -24,6 +24,8 @@ in
       my.home.udiskie.enable = true;
       # udiskie fails if it can't find this dbus service
       services.udisks2.enable = true;
+      # Ensure i3lock can actually unlock the session
+      security.pam.services.i3lock.enable = true;
     })
   ];
 }

From 4b6f62b25ab9bccf84aa994ac8e8b79a42632e00 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 30 Apr 2025 21:36:50 +0100
Subject: [PATCH 25/60] home: gpg: fix deprecated config

---
 modules/home/gpg/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/gpg/default.nix b/modules/home/gpg/default.nix
index 51c865a..2a00baf 100644
--- a/modules/home/gpg/default.nix
+++ b/modules/home/gpg/default.nix
@@ -17,7 +17,7 @@ in
     services.gpg-agent = {
       enable = true;
       enableSshSupport = true; # One agent to rule them all
-      pinentryPackage = cfg.pinentry;
+      pinentry.package = cfg.pinentry;
       extraConfig = ''
         allow-loopback-pinentry
       '';

From e3243ebe80d7c3e55337227d1e4177022d78ca05 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 2 May 2025 17:59:03 +0100
Subject: [PATCH 26/60] nixos: services: nextcloud: simplify DB handling

I *think* the option didn't exist when I originally used this module.
---
 modules/nixos/services/nextcloud/default.nix | 22 +++++---------------
 1 file changed, 5 insertions(+), 17 deletions(-)

diff --git a/modules/nixos/services/nextcloud/default.nix b/modules/nixos/services/nextcloud/default.nix
index cf1b876..d8d4fce 100644
--- a/modules/nixos/services/nextcloud/default.nix
+++ b/modules/nixos/services/nextcloud/default.nix
@@ -44,11 +44,15 @@ in
         adminuser = cfg.admin;
         adminpassFile = cfg.passwordFile;
         dbtype = "pgsql";
-        dbhost = "/run/postgresql";
       };
 
       https = true;
 
+      # Automatic PostgreSQL provisioning
+      database = {
+        createLocally = true;
+      };
+
       settings = {
         overwriteprotocol = "https"; # Nginx only allows SSL
       };
@@ -60,22 +64,6 @@ in
       };
     };
 
-    services.postgresql = {
-      enable = true;
-      ensureDatabases = [ "nextcloud" ];
-      ensureUsers = [
-        {
-          name = "nextcloud";
-          ensureDBOwnership = true;
-        }
-      ];
-    };
-
-    systemd.services."nextcloud-setup" = {
-      requires = [ "postgresql.service" ];
-      after = [ "postgresql.service" ];
-    };
-
     # The service above configures the domain, no need for my wrapper
     services.nginx.virtualHosts."nextcloud.${config.networking.domain}" = {
       forceSSL = true;

From 921d604ebea0d265815c76c60a85efa0929bc1ce Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 2 May 2025 22:35:33 +0100
Subject: [PATCH 27/60] hosts: nixos: porthos: secrets: update cross-seed

---
 .../servarr/cross-seed/configuration.json.age | Bin 1282 -> 1364 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/hosts/nixos/porthos/secrets/servarr/cross-seed/configuration.json.age b/hosts/nixos/porthos/secrets/servarr/cross-seed/configuration.json.age
index e9af03f472da8411b7106cf733ba1d389201263a..1499a56c21c9911f5a7111177b3458e418cb4b1c 100644
GIT binary patch
delta 1337
zcmZqTy23R<r{2dsGAl1R&CsVf!`Ro~tfEpsDzP{tveLK6H?_bqBQV>~+#=N{Kdj6(
zkju?CG(W`1q_`?PSKrs8&^6REIMFhosHDiCI6uQN-`^~&Dk-2MG@~>spG((Hp}06h
zH#Nn`)YQ;YAuAxiJTF}#B-zj1%rDG1C(EQFDzM7fuRbiR%*Qjgytq`~%%sfKHQ2B)
zIV&p6FxSX}%Pci3(7?>gG(SDeGd#u5&&15d(>chkDl^|Zr8Lzd-Q6ravLGxV#oR5D
zOIKG{A*d>)D4@V8C#1Y6B-7Nm(juua&p*OE*Uccf#3SF)#LqI&&)hxRB`~p^Yxyd>
zj1~K?AFEe4*c%Y58#y;-`z!&8)Tv=jGo`~r_eAP+vgUnQnY4O$&c(W!cUcYk)~Byu
z7Vzw@$d$U!zGgcb()tRwY`S*Zy*t7{bAo+2mn5_5`<;szWvw3^-gZ;4wr6wbV}m{m
zd#2gfbYzy8RB#p=DDJkBTcaa%;L*aG_3u~ATWG{_FFEEz{e{%6|2DLE)+t6^YG6z`
z{A5PL1Fns#@q)XPE=n6m+~kVqJ@igxBk!iS4|MwPt~j;Y#z<rpf6y@v8|P)GXUg*H
zPV83caLTFw)#u%JoJsY2<R1IKi2+~Umb6!!>|+*+yi>9=iQDHGtMxmlmx_$beugPX
zC;Bt}=|BBkD}!4icUS!ciOom#Ivr*InYoqZI92{v^Vwc!8_chE_cKSY;`RSeWPFul
z&X?ET`*duvY47@lcRoKh`e8Y7LgQ1NNpr*|*IP3%T(3NrlaO?fgQuS3;l0yGIg|F?
z{!}L(zr@krBgDYT>E`5BUmn_sn!7X~3~^2tpJcLOcJqtK2^lfZ3r}Bjtbg}%_5#Dc
zqDk?V!FnzapA{-pnoWw@EXX9*aZ2FU?%n@uHofl(KhksITjrT*E{~sAZ&>ZykP>k@
zhBG{FR`T)SXCGh595Gz;>=&N`r=!=ejvIe@x_`g<75JTLv5v#rE1e3rcP=`!Rz?4m
zgj1iKWZ`x@qp2_DpQWy0WNDJ-Z8<-u{`0#QS+Dv2GkAP<MX&HpG~QUe^<~-iuY7Ig
z>mM8Ix=voUBj3W$k#l{*-0QbL{ZE-J+QnJC>Fo*gsol04UVk^a``q54u_trU9f8|D
zo0jM{s5;GNSTlFCVb7OefzKNq*{bHwf6q{&cXOiI)9pXkwKE>R=Mp=o=s-YT;TDy5
z^KNdbFDf}(SvHYtZ5jXevMiA!!7o^w**8>XUjFyP_wgz2<%gCmICJvImNvx*|6_Sc
ztKTo5bYT83`FY!TEDjyWR=HIko%HP2pJ^whY?PS)`5ONVx_xf*(=~mX3m+^yw_&OO
zPnYN248r+y*$z+f+OWn`%%DuxQ`vk+S&!fq$Jt+Zm?w4Bx4zE1EjJ_2EP26Uj$>}E
zf99q5{9E+3{kYq<)s=;t{-jy0yYsvL)+|#|)k_`I)&<@vSC=ThFPfPa+kXGa|C?3&
zyXVAA<7!)|wXdxFcrr(Oit`Rm|2HR}Z#wv<O7_V&*K>8p3Vh4tLYSxJDgG{VwPHIo
zeaf^J!vop2KROTB)y=Hm{d)H6ef$D;Onn{)&aNpaKY#K<lKnNO-Ps9mqUN=BF5g|X
ze|g(U4{7cw-`zzk-`6czc>9d)G5+8AQE#OR7#0Z4=(_&r^bDJ`Uv34fERD`MG{=0+
zDWQe(h2f6cGk8CDwcdR7)oJG4PdmRPvwmBt)u|BJa&&H(RXdxa_pF@k=V?Y+|39{5
zpRZXh*QprkDgDa!?(xIv(!ZNuYX=;<!?^yMSJ#Q<vF;|SaaSxB^<1j_bD1Fo00>`p
A&j0`b

delta 1254
zcmcb@)x<SHr#`2s)X&`6*CQ;=D^EY)H@woZ*vZJlvBEsZCBxar-_tqRGt@6I&nUt$
zkjpGYJ1RJ+qO8O)GTb#Vx!BUk*fGl|x6D7-$s{Ey&Bf3xB*?{Ezaq%bgiF^>p}06h
zH#Nn`)YQ;YAuAxiJTG0r(aAKzuhb+hQ$H-o$<Ht<r@k`By(}`)&!f`R&)mGQEVnQ*
z)v&n4)WtEIE4(~I+dROt(9hT~Kd2<P$Ui(HKR+_jA|TV<(bvK)G{>yK*g3Dnza+ze
zOIKG{!7{3>pft!-JJH)R#3wSq%``0_(J55BI78dqG|@vlu{b0*Ezcy$E7;M3OU$$T
zOi$zTjC!Hcr%_pq^|q{YqMUTMUJzZUVt;dS=>JF7+R}RBrb5r1v-C{wp8EOYkag9@
z)IA4kjVJC|Y3IoQ*ClIrh09m5{4=J%+`Vg-neY9xKl=8hz%@_gr=Qy~_0FeN`!ZZ#
zIsSQEYn31=Hib3r>Y}T<+>2#>PcO^gn!vE4G25=@|NZ>vdZp7Hf%(t>={NB3)O=pQ
z;MLzxPQS!o<z^}Phwwg0S}|{K;nl;E=W9&wHm}iL)mCHqK6R<uu@>Ib3v^1Sri)Zs
z9eVB=lXAmyUEuZlJ%3cK^Gi!u7w2uv-`dOQZ$FXe3*(03pW)Xgwfh=0Gjk-(y5bwT
zz)`wS;CJZJWp^yK``6cR?P!ecm-u`$!`J)Iie_WYNnV^!zD|qcP^n5{2%328Ms|6-
z@AQiavYQKyn=~HGV3O+PXL~ByUSaPOTg$Jo;j~M@fBArHo@+0<Z+lh*_J~byW;g!F
z$UeVOFnzV$YnOs)S4#^LX07_m{80AsGTUdxzg{N)lfJe8@ZT*<ySWY@ssDEWXN?}`
z;+C524bBhv#dkN>o5q<tvudyI{9Y++x-l@^<=pLW|BH?!`Ms7`=(UnBI=ChAMcY}8
zlTG10I~Qif$z^l4Pb?5#_$N1JM^1Z!@U(?%;<lVjyL*gP!TRQb#VhTP`0!*@wm+Kp
z$*uUPkyP)5GdrI7JpFXQT<(tH&#oi&eWh`)6vR#EzUz1t7C6=XkJ{mN%VkxL<tX1+
zqJLJN&0Td%gq82PMvVnI0{<$neDTp-FTP{qX2sow?El{N2|j%=^~j+G43##8Z@sh_
z%iJT>l@v8@t$IB3Q~tA@BXt(MKm7N|=1$#|?pB@p;PPcl`yxH*%`*$~r>GtM<7^X<
zdZE50G)BVZ)G22c?)L5Mi!54$;;YvkVqAOw@6QYkJHc+TNuQ?QSKG(kYxG~eg5$-D
zk9TiY9FCcs7awN$Li4RTlb1v|*GGSr=bP_ytXh#jaoPRbwqIJFxK>UPFfTilIA`aV
z#ZKF@6J~T=_+H2N?wKE_+oI|3g2V15M&`b+lZ*TGyMD3sho0BJY}B<+Yo;vvTO`f2
zXy#-_zTN$y6IzP=tgr6szIfSca%WSuUE42-6EO#v=2zLs{F{Ack9feIe7AQ&#<r<G
zS00O76dOG64Q&1s@JriNFDZX-rSm$q=}{h8H*c8FF!?4isYpz0S#{40slyMW7pU^-
zw|!I;cJ*3%ccx~1;q^|tixn02=M!%D{tPcTcu3%uXQ$z3G4@S{r}TOHnJxu(EI9PK
zVSZlO!TV<HB56ELo=Q(s*xcTK7HeyIl3;N@`3W<VzW;%5Z?_Aru9~CcF~2=_?P2#Q
M4vrIBUuf_E0F5*_k^lez


From 22f97b4ac7d6e0285935f5236686c789e712ff04 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 3 May 2025 13:56:12 +0100
Subject: [PATCH 28/60] home: vim: lua: lsp: configure inlay hints

---
 modules/home/vim/lua/ambroisie/lsp.lua | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/modules/home/vim/lua/ambroisie/lsp.lua b/modules/home/vim/lua/ambroisie/lsp.lua
index e48de12..fef0487 100644
--- a/modules/home/vim/lua/ambroisie/lsp.lua
+++ b/modules/home/vim/lua/ambroisie/lsp.lua
@@ -53,6 +53,10 @@ M.on_attach = function(client, bufnr)
         vim.diagnostic.open_float(nil, { scope = "buffer" })
     end
 
+    local function toggle_inlay_hints()
+        vim.lsp.inlay_hint.enable(not vim.lsp.inlay_hint.is_enabled())
+    end
+
     local keys = {
         buffer = bufnr,
         -- LSP navigation
@@ -67,6 +71,7 @@ M.on_attach = function(client, bufnr)
         { "<leader>ca", vim.lsp.buf.code_action, desc = "Code actions" },
         { "<leader>cd", cycle_diagnostics_display, desc = "Cycle diagnostics display" },
         { "<leader>cD", show_buffer_diagnostics, desc = "Show buffer diagnostics" },
+        { "<leader>ch", toggle_inlay_hints, desc = "Toggle inlay hints" },
         { "<leader>cr", vim.lsp.buf.rename, desc = "Rename symbol" },
         { "<leader>cs", vim.lsp.buf.signature_help, desc = "Show signature" },
         { "<leader>ct", vim.lsp.buf.type_definition, desc = "Go to type definition" },

From d2a8894eb298a2fbdee409b20995c51d6dcbaf4e Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 5 May 2025 18:06:41 +0100
Subject: [PATCH 29/60] home: wm: i3: make 'firefox' history float

---
 modules/home/wm/i3/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/home/wm/i3/default.nix b/modules/home/wm/i3/default.nix
index 029a14b..5f22bbe 100644
--- a/modules/home/wm/i3/default.nix
+++ b/modules/home/wm/i3/default.nix
@@ -127,6 +127,7 @@ in
             { class = "^Blueman-.*$"; }
             { title = "^htop$"; }
             { class = "^Thunderbird$"; instance = "Mailnews"; window_role = "filterlist"; }
+            { class = "^firefox$"; instance = "Places"; window_role = "Organizer"; }
             { class = "^pavucontrol.*$"; }
             { class = "^Arandr$"; }
             { class = "^\\.blueman-manager-wrapped$"; }

From a9ba93f834db067e9d791c4299ceab483c8ef6f8 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 7 May 2025 11:27:12 +0000
Subject: [PATCH 30/60] home: delta: assert git is enabled

---
 modules/home/delta/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/modules/home/delta/default.nix b/modules/home/delta/default.nix
index e9350bb..58ee031 100644
--- a/modules/home/delta/default.nix
+++ b/modules/home/delta/default.nix
@@ -23,6 +23,13 @@ in
           properly configured.
         '';
       }
+      {
+        assertion = cfg.enable -> config.programs.git.enable;
+        message = ''
+          `config.my.home.delta` relies on `config.programs.git` to be
+          enabled.
+        '';
+      }
     ];
 
     home.packages = [ cfg.package ];

From 07d8f5a03fbc5a1e36e6425953ad30f2c7037287 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 7 May 2025 17:25:28 +0200
Subject: [PATCH 31/60] flake: nixos: use 'nixpkgs.hostPlatform'

This is the proper way to set `system` nowadays.
---
 flake/nixos.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/flake/nixos.nix b/flake/nixos.nix
index bf9eac8..0fbd3a6 100644
--- a/flake/nixos.nix
+++ b/flake/nixos.nix
@@ -15,8 +15,10 @@ let
   ];
 
   buildHost = name: system: lib.nixosSystem {
-    inherit system;
     modules = defaultModules ++ [
+      {
+        nixpkgs.hostPlatform = system;
+      }
       "${self}/hosts/nixos/${name}"
     ];
     specialArgs = {

From 8a8e4f93a513ad3aaafdbeced14a61d5f961ff1d Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 7 May 2025 17:16:44 +0000
Subject: [PATCH 32/60] flake: home-manager: remove obsolete comment

---
 flake/home-manager.nix | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/flake/home-manager.nix b/flake/home-manager.nix
index 093ae8c..88a74e8 100644
--- a/flake/home-manager.nix
+++ b/flake/home-manager.nix
@@ -22,10 +22,6 @@ let
   ];
 
   mkHome = name: system: inputs.home-manager.lib.homeManagerConfiguration {
-    # Work-around for home-manager
-    # * not letting me set `lib` as an extraSpecialArgs
-    # * not respecting `nixpkgs.overlays` [1]
-    # [1]: https://github.com/nix-community/home-manager/issues/2954
     pkgs = inputs.nixpkgs.legacyPackages.${system};
 
     modules = defaultModules ++ [

From 77839ab2ef3003c38324cade0810b41d1c84cc8c Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 8 May 2025 13:29:35 +0000
Subject: [PATCH 33/60] flake: bump inputs

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index 584d942..ef7aba8 100644
--- a/flake.lock
+++ b/flake.lock
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1745930157,
-        "narHash": "sha256-y3h3NLnzRSiUkYpnfvnS669zWZLoqqI6NprtLQ+5dck=",
+        "lastModified": 1746683680,
+        "narHash": "sha256-+5zk+UbG0+GQlKt+gIKm+OhlYvHmkAHFXvf7hl1HDeM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "46e634be05ce9dc6d4db8e664515ba10b78151ae",
+        "rev": "16762245d811fdd74b417cc922223dc8eb741e8b",
         "type": "github"
       },
       "original": {

From 0c5836bc56e9048e27db4081595ff7cb566f9c31 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 8 May 2025 23:22:11 +0200
Subject: [PATCH 34/60] nixos: services: paperless: use 'PAPERLESS_URL'

---
 modules/nixos/services/paperless/default.nix | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/modules/nixos/services/paperless/default.nix b/modules/nixos/services/paperless/default.nix
index 63f456b..9cdac38 100644
--- a/modules/nixos/services/paperless/default.nix
+++ b/modules/nixos/services/paperless/default.nix
@@ -53,17 +53,13 @@ in
       mediaDir = lib.mkIf (cfg.documentPath != null) cfg.documentPath;
 
       settings =
-        let
-          paperlessDomain = "paperless.${config.networking.domain}";
-        in
         {
           # Use SSO
           PAPERLESS_ENABLE_HTTP_REMOTE_USER = true;
           PAPERLESS_HTTP_REMOTE_USER_HEADER_NAME = "HTTP_X_USER";
 
           # Security settings
-          PAPERLESS_ALLOWED_HOSTS = paperlessDomain;
-          PAPERLESS_CORS_ALLOWED_HOSTS = "https://${paperlessDomain}";
+          PAPERLESS_URL = "https://paperless.${config.networking.domain}";
 
           # OCR settings
           PAPERLESS_OCR_LANGUAGE = "fra+eng";

From a997d36964830a96b13c99175c51165614686edf Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 8 May 2025 23:22:35 +0200
Subject: [PATCH 35/60] nixos: services: paperless: fix formatting

---
 modules/nixos/services/paperless/default.nix | 32 ++++++++++----------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/modules/nixos/services/paperless/default.nix b/modules/nixos/services/paperless/default.nix
index 9cdac38..f345e8a 100644
--- a/modules/nixos/services/paperless/default.nix
+++ b/modules/nixos/services/paperless/default.nix
@@ -52,26 +52,26 @@ in
 
       mediaDir = lib.mkIf (cfg.documentPath != null) cfg.documentPath;
 
-      settings =
-        {
-          # Use SSO
-          PAPERLESS_ENABLE_HTTP_REMOTE_USER = true;
-          PAPERLESS_HTTP_REMOTE_USER_HEADER_NAME = "HTTP_X_USER";
+      settings = {
+        # Use SSO
+        PAPERLESS_ENABLE_HTTP_REMOTE_USER = true;
+        PAPERLESS_ENABLE_HTTP_REMOTE_USER_API = true;
+        PAPERLESS_HTTP_REMOTE_USER_HEADER_NAME = "HTTP_X_USER";
 
-          # Security settings
-          PAPERLESS_URL = "https://paperless.${config.networking.domain}";
+        # Security settings
+        PAPERLESS_URL = "https://paperless.${config.networking.domain}";
 
-          # OCR settings
-          PAPERLESS_OCR_LANGUAGE = "fra+eng";
+        # OCR settings
+        PAPERLESS_OCR_LANGUAGE = "fra+eng";
 
-          # Workers
-          PAPERLESS_TASK_WORKERS = 3;
-          PAPERLESS_THREADS_PER_WORKER = 4;
+        # Workers
+        PAPERLESS_TASK_WORKERS = 3;
+        PAPERLESS_THREADS_PER_WORKER = 4;
 
-          # Misc
-          PAPERLESS_TIME_ZONE = config.time.timeZone;
-          PAPERLESS_ADMIN_USER = cfg.username;
-        };
+        # Misc
+        PAPERLESS_TIME_ZONE = config.time.timeZone;
+        PAPERLESS_ADMIN_USER = cfg.username;
+      };
 
       # Admin password
       passwordFile = cfg.passwordFile;

From 1dc65a37e7dc8041ee639dac882c5e2503708170 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 8 May 2025 23:29:30 +0200
Subject: [PATCH 36/60] nixos: services: paperless: set proxy settings

---
 modules/nixos/services/paperless/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/nixos/services/paperless/default.nix b/modules/nixos/services/paperless/default.nix
index f345e8a..b6965ca 100644
--- a/modules/nixos/services/paperless/default.nix
+++ b/modules/nixos/services/paperless/default.nix
@@ -60,6 +60,8 @@ in
 
         # Security settings
         PAPERLESS_URL = "https://paperless.${config.networking.domain}";
+        PAPERLESS_USE_X_FORWARD_HOST = true;
+        PAPERLESS_PROXY_SSL_HEADER = ''["HTTP_X_FORWARDED_PROTO", "https"]'';
 
         # OCR settings
         PAPERLESS_OCR_LANGUAGE = "fra+eng";

From 5b545a28f10c90d07f0442fb8c5823b1cb53f2f3 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 9 May 2025 00:02:07 +0200
Subject: [PATCH 37/60] nixos: services: mealie: use automatic DB setup

---
 modules/nixos/services/mealie/default.nix | 20 +++-----------------
 1 file changed, 3 insertions(+), 17 deletions(-)

diff --git a/modules/nixos/services/mealie/default.nix b/modules/nixos/services/mealie/default.nix
index 664d5ba..3b4d4f7 100644
--- a/modules/nixos/services/mealie/default.nix
+++ b/modules/nixos/services/mealie/default.nix
@@ -38,27 +38,13 @@ in
         # Make it work with socket auth
         POSTGRES_URL_OVERRIDE = "postgresql://mealie:@/mealie?host=/run/postgresql";
       };
-    };
 
-    systemd.services = {
-      mealie = {
-        after = [ "postgresql.service" ];
-        requires = [ "postgresql.service" ];
+      # Automatic PostgreSQL provisioning
+      database = {
+        createLocally = true;
       };
     };
 
-    # Set-up database
-    services.postgresql = {
-      enable = true;
-      ensureDatabases = [ "mealie" ];
-      ensureUsers = [
-        {
-          name = "mealie";
-          ensureDBOwnership = true;
-        }
-      ];
-    };
-
     my.services.nginx.virtualHosts = {
       mealie = {
         inherit (cfg) port;

From f14f5c7f8aa3e87cb025e04b3f8cac2b1315d596 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 14 May 2025 18:51:12 +0000
Subject: [PATCH 38/60] flake: bump inputs

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index ef7aba8..b90b54a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1742649964,
-        "narHash": "sha256-DwOTp7nvfi8mRfuL1escHDXabVXFGT1VlPD1JHrtrco=",
+        "lastModified": 1746537231,
+        "narHash": "sha256-Wb2xeSyOsCoTCTj7LOoD6cdKLEROyFAArnYoS+noCWo=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "dcf5072734cb576d2b0c59b2ac44f5050b5eac82",
+        "rev": "fa466640195d38ec97cf0493d6d6882bc4d14969",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746040799,
-        "narHash": "sha256-osgPX/SzIpkR50vev/rqoTEAVkEcOWXoQXmbzsaI4KU=",
+        "lastModified": 1747225851,
+        "narHash": "sha256-4IbmZrNOdXP143kZEUzxBS5SqyxUlaSHLgdpeJfP2ZU=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "5f217e5a319f6c186283b530f8c975e66c028433",
+        "rev": "6bf057fc8326e83bda05a669fc08d106547679fb",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1746683680,
-        "narHash": "sha256-+5zk+UbG0+GQlKt+gIKm+OhlYvHmkAHFXvf7hl1HDeM=",
+        "lastModified": 1746904237,
+        "narHash": "sha256-3e+AVBczosP5dCLQmMoMEogM57gmZ2qrVSrmq9aResQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "16762245d811fdd74b417cc922223dc8eb741e8b",
+        "rev": "d89fc19e405cb2d55ce7cc114356846a0ee5e956",
         "type": "github"
       },
       "original": {

From 97bcc5f34ed0b7154829f4bd0a43b485f16205b7 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 18 May 2025 02:14:36 +0200
Subject: [PATCH 39/60] hosts: nixos: porthos: secrets: update cross-seed

---
 .../servarr/cross-seed/configuration.json.age | Bin 1364 -> 1528 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/hosts/nixos/porthos/secrets/servarr/cross-seed/configuration.json.age b/hosts/nixos/porthos/secrets/servarr/cross-seed/configuration.json.age
index 1499a56c21c9911f5a7111177b3458e418cb4b1c..e319f3a823c4eb4c84b15f6630ea5fbf42f9092b 100644
GIT binary patch
delta 1502
zcmcb@^@DqYPJM)-VR?CgkBPZawo9aGMoCdYRk>4OQGumFMo6W5x^rP=Mt)AETV`3V
z1(#E4QAJ@+N^qv5r>~)BvQubgdVynQWKwEazOiRuRf$n@d4RJ~l2Kr;1(&X!LUD11
zZfc5=si~o*LRLV2d0x7LTcA^FQMP_+ScYYkbCiF2Kz*uLx|y4Yvy+>npMhItskXmS
zqIsZaWtO7}muXf=R=J;Zl8HxhR8p98WpSjBN1#htPF{*xP+m@HvU6p4X<2GTMrw)$
zm#(g^f>}hNuTxT<rJrknPiDHQrITAksefgfzl%X`c#>JMdzPPBsB^Mmo>ycf*D2@n
z37;fCdeuv+?>w+R<0Yeo{}QfuMmN)!+&k=0a;^TSYwE4IY0U~Q?{9Yfw0X#~C0&SF
zX}+aS((K$VJ-bblR?1ZG`JdIke`#ik!jg~Af1G*t+V950$FnqoQUr|mohx^EF@65T
z!^>7rb@N!fc}v>LkM#>r%T@8aynXUz(Vrc1N_9sTE>E4Nw7mX$h0l{u+OqtM1bTj@
z{(q8F`{LD`c_O|u&izgQ`QeY>?OCTZ*t+M1PUGCN>2JW}-2Va(cQ3Qqb*%S#`^L*J
zG+q`LyViT9Zd*R-NA%IVo*yc{RKzX66}P)FtGzy)v4%Z9f!XkKo!$0ChYdC^i?TxQ
zn;!e4|M;`7(CJ-Ed03yy+^*NF)SaH%BJzKE^2OXKtanWAHZ%#J&b~Tv%d`CgUAeXM
zmqgG0v{sNa#44C8s9yZV?WjFxZhl>tDqUQvv?~1K4ePy1>-d}J>u|1KJ8x&IqfYo+
zv*Wuy^8DMJ_IAY~9#8ikC1JDBo^u^VY~lYmh;NKyxvQY*wpb@t-T7Qi$XnlQ^#W44
zZ`SP8{vYOUcPhZZFKDgXN`tTQ-^=Rxdu|@>URiWR^t<<$J0G5AKAz@imKnqS{_7*H
z#FFImH@qBwus*nwkZR2-_kL^j^KWZC&P&xjDY@4u!1R1$kMd!|Dd)3Oj?a-1@bQuJ
zGhz?e+$&-I#Jc~q!JT&{OXn-=ZTu><_0+@qFGA5bx1N1jc_%AC@a99t6+hbVFjPD*
zlbM&YU~#<HhQo6+o;?&u+xum^-K1^PgFjAe4B_1D@NSQ&{W90JbDsQpcYP0QQSZMp
zgHKZ~ZBxAO8zV90SM6^8ttTd_RIgWCCwhll*=`-<TfV6`&3|4}sE%lGiu#*h*6n^c
z+CuKeq1UGM^Vgc_zdMvJ_^x}`v~!CTZkZ(?NIe_&!1TJ^mAA#5@6T`KUObD{C%ao9
zsQB~7!<(6IU(H{#H9Dqx_vb*lm0fSPuw86^tHkj8n|=t}hjgx6>mT=C-yyD6{*CAU
zbAcA213k_z6ZG$z|4<gzztNDix8}QS@5kQvK89TL_b%#HTPs=LcBIEBULelv^W8&N
z3UUv6)c=&d^rzzFmB-iSRD8F!tv$bSuk>sdxvnDiormsueVi3I=hEAwk9|GFUKP*(
zmVCWq#*6=IN3OVUo_;VjW9z5BgI6P(MYo&%yc#j-Pdb0amK!C$A9UOt4%p@|(ERo=
zklTIkm2$WJ$%@ynyzZJ(QCwgD<iX4brkhtNe>r_KO<~sq1K!1b7eBA@YG1o_ZS9v8
z<^gMpl?pxQNNIoN50~D4D9GRL(1pc$?pxUA*sb!4%qx!Ga!2Fh)W#z7ZdRxIg}XfB
zp55k34$-Wbeo<fMjXQIsWI1P8O_Y-U&Tk=W418)C{k67PNq8RS$XLIIb8kt-z54j|
z8F^vPbc6T2QdN5Tnjw0@g`*Dlk^}bl-S~C==Zl}QeqwXOe8mja>Q+va{*q&I@m&wc
zd^er?vXJvLKbtK3YbrlQ;`sKm-4o}XlD+TIschDg_~GD{&rUZ^itg#_SzfzD;_Y=d
zZS&;ktru!-w(1*&1`97TayHfcbHvdhOU!CRc)|p!BKv182~T_$y*_L?x3<D%(x<;U
zwa=8wx2}p(n4MXm=J5G*WLemfRV#O2deXk`w~dnbt|g4MjmEM@N&hzMKJN<n$g*GV
UK&(_lF5l0Z#GsIGl7St<0Qrd6V*mgE

delta 1337
zcmeyteT8d+PQ8zNWL92snxRi|hOw`|Sw*FORAO;PWTkJBZ)$;KMqsv|xkai^eps1n
zAeWnOXnu&1NpV$puD-8Fp=+pTaH3^EQAv?OaejtlzQ0*kRZ>7jXhvyNK9{bYLUD11
zZfc5=si~o*LRLV2d0x6gNV1>1nO~T3PL@eURA7~{Uwv3snU7~~d2y+}nMs+eYp`Kq
za#mEBVXlz{msx67pn;i}X?}W`XLyRApNW}^r*n{7Rc5|-N@=P^y1Q9;WI<R!in&`P
zm#(g^LQqvoQ9yxHPDpuCNT#WArA1O<o_~aSuA4z{iATPpiJxVlpSgRsOJHI-*YZ_%
z87uZ(KUS}9us0x9H*#*w_E`cFsZ+z6W=e;L?updtWX=1qGHLbhoQric@3I>7txsRS
zEa2H)kt=ndea&_>r1ceU*>vr+dv}C^<^=n4E=gw9_d6Fc%341-yzQo7ZO`V=#|C{C
z_Dr*{>BuZGso*R$P~2@Lw?;?kz@vpV>))@Kx6p{=UUJNb`U|OB|7~dTtW%7-)WDc>
z_{off2V5If;{|soU6eMCxXBgId+43YM&3<tAL#VoU2$r)jgiPI{-9$THqOgV&y?lY
zo!G6?;gnPVtIxadIFsu4$UXLd69c}yEorYd*~cstd8cG$61UGWR_k|8FBKV={R~r(
zPV{H`(|`K8RtC33?ymX?5}S|ebvnxaGjl7+ajN{U=Ci%dHke=S?q`l(#q0l{$oMM9
zoG-7v_vzST)86$9?|go2^uu!EgvO^jljev`uD51jxL$cKCn4z|2Twi6!+WQXawhG&
z{i#koeu<;KM~H!w)6L1NzC5%MHFs$~7~-5PKFMUm?B*Ad6Eb3+7oNW6SpV+j>;;B>
zMU&z!gY{e<J}XqHG@BH)S&&Jr<CMUy-MjzSY<k}nex&EZx6CusTpmBK-mu!YAtmB+
z3}<-UtmNat&py7AIbyix*)Ki?PDig_9XI~+bpL+yEATthVjYLKS2`7L?_6|dt&09B
z38y|e$-?b+MpIwPKTBQ1$kHUu+j4$R{pWWrvR?E3XYly!ieBNHXuPp_>&vq3U-{a~
z*FQGab)CFyN4|xhBj@^rxz}%h`kyjcw2QNN)7ul~Q@d?9y#8)-_qn}8V^8LyI|8?R
zHZ9R@P<5Kkux9RN!=5j{0-rZJvQ^EU|DK^l@8(3ar`vz7YiB%s&n0$F(Sd-x!YwNA
z=H1*<UsQ6ovTP#P+A{v_WmzIef?u#Uvu~)(y!`Kn@8eV4%MUGCaOUKZEp3Vs{>So?
zR=;09>A?J7^7FRwSR6W#t#Ye8I_cT3KhsW1*(fpp^ELh#bo<=qr)&B&7d}{aZo^Xl
zpDxe48HDravK^k{wPB5?m_eDWr?UBuvL3-Jj<dh+Fi+~LZ+)G2TW&_4S@MFz9LL;R
z|IADA`M2n6`*F8zt1AmP{YkT0cjtHgty!j`s+T&ZtqZ(Ut}ao0Uo<l<w*CH-|2M1l
zch8BL#?`h^YhPLU@nnwn6z3hB{%=k`-*oUzmF$ymuIK8G75J9Pg)mRcQ~X`#YQ=VF
z`jlxch6l23e{>$MtD9NB`}OSC`}hUynEE^poLy5;e*WZzB>QVlyR#GCM9pjMT)w+%
z|MIqz9@5-VzPpQ7zOP%b@b($oWBkAKquxptFf0(7(RKaL=@~X>zuXE|SsI;jXpZ@s
zQ$h>n3&S0?XYhXRYQ6dDtJBQ8pLTvpX8pEOt5YGc<>=fnt9CX;?^!w7&(n;u{(o%A
zK3}t1u2V76Q~H(d-Q$PTrGGcS)($vyhjINiudWlzW8F<u<E~gN>bX?;=Q2YG0CoF!
AMgRZ+


From c1e2114c57e9e0027b3e17b7fbf48253b22fb651 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 23 May 2025 22:56:19 +0100
Subject: [PATCH 40/60] flake: bump inputs

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index b90b54a..e0456b8 100644
--- a/flake.lock
+++ b/flake.lock
@@ -14,11 +14,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745630506,
-        "narHash": "sha256-bHCFgGeu8XjWlVuaWzi3QONjDW3coZDqSHvnd4l7xus=",
+        "lastModified": 1747575206,
+        "narHash": "sha256-NwmAFuDUO/PFcgaGGr4j3ozG9Pe5hZ/ogitWhY+D81k=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "96e078c646b711aee04b82ba01aefbff87004ded",
+        "rev": "4835b1dc898959d8547a871ef484930675cb47f1",
         "type": "github"
       },
       "original": {
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746537231,
-        "narHash": "sha256-Wb2xeSyOsCoTCTj7LOoD6cdKLEROyFAArnYoS+noCWo=",
+        "lastModified": 1747372754,
+        "narHash": "sha256-2Y53NGIX2vxfie1rOW0Qb86vjRZ7ngizoo+bnXU9D9k=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "fa466640195d38ec97cf0493d6d6882bc4d14969",
+        "rev": "80479b6ec16fefd9c1db3ea13aeb038c60530f46",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747225851,
-        "narHash": "sha256-4IbmZrNOdXP143kZEUzxBS5SqyxUlaSHLgdpeJfP2ZU=",
+        "lastModified": 1747978958,
+        "narHash": "sha256-pQQnbxWpY3IiZqgelXHIe/OAE/Yv4NSQq7fch7M6nXQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "6bf057fc8326e83bda05a669fc08d106547679fb",
+        "rev": "7419250703fd5eb50e99bdfb07a86671939103ea",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1746904237,
-        "narHash": "sha256-3e+AVBczosP5dCLQmMoMEogM57gmZ2qrVSrmq9aResQ=",
+        "lastModified": 1747744144,
+        "narHash": "sha256-W7lqHp0qZiENCDwUZ5EX/lNhxjMdNapFnbErcbnP11Q=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d89fc19e405cb2d55ce7cc114356846a0ee5e956",
+        "rev": "2795c506fe8fb7b03c36ccb51f75b6df0ab2553f",
         "type": "github"
       },
       "original": {

From 24407448d498d637b94d04d9b06816f432c9197b Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 27 May 2025 11:16:46 +0000
Subject: [PATCH 41/60] hosts: homes: mousqueton: disable 'atuin' package

The system-provided package is built without its sync functionality.

To ensure the module works as written, I can't use `pkgs.emptyDirectory`
for this unfortunately...
---
 hosts/homes/ambroisie@mousqueton/default.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/hosts/homes/ambroisie@mousqueton/default.nix b/hosts/homes/ambroisie@mousqueton/default.nix
index 37884d7..1383618 100644
--- a/hosts/homes/ambroisie@mousqueton/default.nix
+++ b/hosts/homes/ambroisie@mousqueton/default.nix
@@ -7,6 +7,20 @@
   services.gpg-agent.enable = lib.mkForce false;
 
   my.home = {
+    atuin = {
+      package = pkgs.stdenv.mkDerivation {
+        pname = "atuin";
+        version = "18.4.0";
+
+        buildCommand = ''
+          mkdir -p $out/bin
+          ln -s /usr/bin/atuin $out/bin/atuin
+        '';
+
+        meta.mainProgram = "atuin";
+      };
+    };
+
     git = {
       package = pkgs.emptyDirectory;
     };

From 9751fdb888d0d72801bff0c0381b057e0431f2a8 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 27 May 2025 11:39:15 +0000
Subject: [PATCH 42/60] hosts: homes: bazin: disable 'atuin' package

Same as on `mousqueton`.
---
 hosts/homes/ambroisie@bazin/default.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/hosts/homes/ambroisie@bazin/default.nix b/hosts/homes/ambroisie@bazin/default.nix
index f52fbce..365b70d 100644
--- a/hosts/homes/ambroisie@bazin/default.nix
+++ b/hosts/homes/ambroisie@bazin/default.nix
@@ -4,6 +4,20 @@
   services.gpg-agent.enable = lib.mkForce false;
 
   my.home = {
+    atuin = {
+      package = pkgs.stdenv.mkDerivation {
+        pname = "atuin";
+        version = "18.4.0";
+
+        buildCommand = ''
+          mkdir -p $out/bin
+          ln -s /usr/bin/atuin $out/bin/atuin
+        '';
+
+        meta.mainProgram = "atuin";
+      };
+    };
+
     git = {
       package = pkgs.emptyDirectory;
     };

From a67a54bda27092c9f89e60bf3ce75839e914f9b4 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 24 May 2025 22:33:21 +0200
Subject: [PATCH 43/60] nixos: services: paperless: use structured setting

The module should stringify it to JSON automatically, so might as well
use the more readable option.
---
 modules/nixos/services/paperless/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/nixos/services/paperless/default.nix b/modules/nixos/services/paperless/default.nix
index b6965ca..1195977 100644
--- a/modules/nixos/services/paperless/default.nix
+++ b/modules/nixos/services/paperless/default.nix
@@ -61,7 +61,7 @@ in
         # Security settings
         PAPERLESS_URL = "https://paperless.${config.networking.domain}";
         PAPERLESS_USE_X_FORWARD_HOST = true;
-        PAPERLESS_PROXY_SSL_HEADER = ''["HTTP_X_FORWARDED_PROTO", "https"]'';
+        PAPERLESS_PROXY_SSL_HEADER = [ "HTTP_X_FORWARDED_PROTO" "https" ];
 
         # OCR settings
         PAPERLESS_OCR_LANGUAGE = "fra+eng";

From 98d39717e2aa0306865982191afa200b5914426b Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 31 May 2025 22:37:21 +0100
Subject: [PATCH 44/60] home: direnv: lib: don't erase pre-existing venv

Turns out `uv venv` isn't idempotent, it removes the existing virtual
environment by default.

Thankfully, there's a flag to fix it.
---
 modules/home/direnv/lib/python.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/direnv/lib/python.sh b/modules/home/direnv/lib/python.sh
index b4b2bce..b1be8a9 100644
--- a/modules/home/direnv/lib/python.sh
+++ b/modules/home/direnv/lib/python.sh
@@ -46,7 +46,7 @@ layout_uv() {
     fi
 
     # create venv if it doesn't exist
-    uv venv -q
+    uv venv -q --allow-existing
 
     export VIRTUAL_ENV
     export UV_ACTIVE=1

From 151570cccaf8511688769ee0665868340054ba30 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 9 Jun 2025 10:36:33 +0000
Subject: [PATCH 45/60] flake: bump inputs

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index e0456b8..219d87d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743550720,
-        "narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
+        "lastModified": 1749398372,
+        "narHash": "sha256-tYBdgS56eXYaWVW3fsnPQ/nFlgWi/Z2Ymhyu21zVM98=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "c621e8422220273271f52058f618c94e405bb0f5",
+        "rev": "9305fe4e5c2a6fcf5ba6a3ff155720fbe4076569",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747978958,
-        "narHash": "sha256-pQQnbxWpY3IiZqgelXHIe/OAE/Yv4NSQq7fch7M6nXQ=",
+        "lastModified": 1749400020,
+        "narHash": "sha256-0nTmHO8AYgRYk5v6zw5oZ3x9nh+feb+Isn7WNe318M0=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7419250703fd5eb50e99bdfb07a86671939103ea",
+        "rev": "2835e8ba0ad99ba86d4a5e497a962ec9fa35e48f",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1747744144,
-        "narHash": "sha256-W7lqHp0qZiENCDwUZ5EX/lNhxjMdNapFnbErcbnP11Q=",
+        "lastModified": 1749285348,
+        "narHash": "sha256-frdhQvPbmDYaScPFiCnfdh3B/Vh81Uuoo0w5TkWmmjU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2795c506fe8fb7b03c36ccb51f75b6df0ab2553f",
+        "rev": "3e3afe5174c561dee0df6f2c2b2236990146329f",
         "type": "github"
       },
       "original": {

From 971f90581397286a3ffb424970cb5c1e9471a203 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 9 Jun 2025 13:52:29 +0200
Subject: [PATCH 46/60] nixos: services: mealie: remove DB settings

Looks like I missed them in the original commit to migrate to
`database.createLocally`.
---
 modules/nixos/services/mealie/default.nix | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/modules/nixos/services/mealie/default.nix b/modules/nixos/services/mealie/default.nix
index 3b4d4f7..8c02398 100644
--- a/modules/nixos/services/mealie/default.nix
+++ b/modules/nixos/services/mealie/default.nix
@@ -32,11 +32,6 @@ in
         BASE_URL = "https://mealie.${config.networking.domain}";
         TZ = config.time.timeZone;
         ALLOw_SIGNUP = "false";
-
-        # Use PostgreSQL
-        DB_ENGINE = "postgres";
-        # Make it work with socket auth
-        POSTGRES_URL_OVERRIDE = "postgresql://mealie:@/mealie?host=/run/postgresql";
       };
 
       # Automatic PostgreSQL provisioning

From 1b275e1a8a8291b3ed9789d25c2592ba52b8d9ec Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 17 Jun 2025 09:29:24 +0000
Subject: [PATCH 47/60] flake: bump inputs

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 219d87d..94ab916 100644
--- a/flake.lock
+++ b/flake.lock
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747372754,
-        "narHash": "sha256-2Y53NGIX2vxfie1rOW0Qb86vjRZ7ngizoo+bnXU9D9k=",
+        "lastModified": 1749636823,
+        "narHash": "sha256-WUaIlOlPLyPgz9be7fqWJA5iG6rHcGRtLERSCfUDne4=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "80479b6ec16fefd9c1db3ea13aeb038c60530f46",
+        "rev": "623c56286de5a3193aa38891a6991b28f9bab056",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749400020,
-        "narHash": "sha256-0nTmHO8AYgRYk5v6zw5oZ3x9nh+feb+Isn7WNe318M0=",
+        "lastModified": 1750127463,
+        "narHash": "sha256-K2xFtlD3PcKAZriOE3LaBLYmVfGQu+rIF4Jr1RFYR0Q=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "2835e8ba0ad99ba86d4a5e497a962ec9fa35e48f",
+        "rev": "28eef8722d1af18ca13e687dbf485e1c653a0402",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1749285348,
-        "narHash": "sha256-frdhQvPbmDYaScPFiCnfdh3B/Vh81Uuoo0w5TkWmmjU=",
+        "lastModified": 1749794982,
+        "narHash": "sha256-Kh9K4taXbVuaLC0IL+9HcfvxsSUx8dPB5s5weJcc9pc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3e3afe5174c561dee0df6f2c2b2236990146329f",
+        "rev": "ee930f9755f58096ac6e8ca94a1887e0534e2d81",
         "type": "github"
       },
       "original": {

From 112e3403615f65807dfcc28929b2b8a19656859e Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 17 Jun 2025 09:26:09 +0000
Subject: [PATCH 48/60] home: do not hard-code username

The flake module already sets it with `mkDefault`, making it easier to
override it for a specific host.
---
 modules/home/default.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/modules/home/default.nix b/modules/home/default.nix
index e642e87..1c40377 100644
--- a/modules/home/default.nix
+++ b/modules/home/default.nix
@@ -51,9 +51,6 @@
   # First sane reproducible version
   home.stateVersion = "20.09";
 
-  # Who am I?
-  home.username = "ambroisie";
-
   # Start services automatically
   systemd.user.startServices = "sd-switch";
 }

From 03bb62777079b4a8ecc755570cc04a45095ca013 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 2 Jul 2025 13:23:34 +0200
Subject: [PATCH 49/60] flake: bump inputs

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 94ab916..a4da84d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -14,11 +14,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747575206,
-        "narHash": "sha256-NwmAFuDUO/PFcgaGGr4j3ozG9Pe5hZ/ogitWhY+D81k=",
+        "lastModified": 1750173260,
+        "narHash": "sha256-9P1FziAwl5+3edkfFcr5HeGtQUtrSdk/MksX39GieoA=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "4835b1dc898959d8547a871ef484930675cb47f1",
+        "rev": "531beac616433bac6f9e2a19feb8e99a22a66baf",
         "type": "github"
       },
       "original": {
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749398372,
-        "narHash": "sha256-tYBdgS56eXYaWVW3fsnPQ/nFlgWi/Z2Ymhyu21zVM98=",
+        "lastModified": 1751413152,
+        "narHash": "sha256-Tyw1RjYEsp5scoigs1384gIg6e0GoBVjms4aXFfRssQ=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "9305fe4e5c2a6fcf5ba6a3ff155720fbe4076569",
+        "rev": "77826244401ea9de6e3bac47c2db46005e1f30b5",
         "type": "github"
       },
       "original": {
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749636823,
-        "narHash": "sha256-WUaIlOlPLyPgz9be7fqWJA5iG6rHcGRtLERSCfUDne4=",
+        "lastModified": 1750779888,
+        "narHash": "sha256-wibppH3g/E2lxU43ZQHC5yA/7kIKLGxVEnsnVK1BtRg=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "623c56286de5a3193aa38891a6991b28f9bab056",
+        "rev": "16ec914f6fb6f599ce988427d9d94efddf25fe6d",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750127463,
-        "narHash": "sha256-K2xFtlD3PcKAZriOE3LaBLYmVfGQu+rIF4Jr1RFYR0Q=",
+        "lastModified": 1751429452,
+        "narHash": "sha256-4s5vRtaqdNhVBnbOWOzBNKrRa0ShQTLoEPjJp3joeNI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "28eef8722d1af18ca13e687dbf485e1c653a0402",
+        "rev": "df12269039dcf752600b1bcc176bacf2786ec384",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1749794982,
-        "narHash": "sha256-Kh9K4taXbVuaLC0IL+9HcfvxsSUx8dPB5s5weJcc9pc=",
+        "lastModified": 1751271578,
+        "narHash": "sha256-P/SQmKDu06x8yv7i0s8bvnnuJYkxVGBWLWHaU+tt4YY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ee930f9755f58096ac6e8ca94a1887e0534e2d81",
+        "rev": "3016b4b15d13f3089db8a41ef937b13a9e33a8df",
         "type": "github"
       },
       "original": {

From d61840651698e3ad05325039e9aa2a6cf9ad6aa2 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 2 Jul 2025 13:24:16 +0200
Subject: [PATCH 50/60] nixos: services: use 'postgresql.target'

This is now the more correct dependency to use in service definitions,
to guarantee read-write access with users and permissions.
---
 modules/nixos/services/drone/server/default.nix      | 4 ++--
 modules/nixos/services/tandoor-recipes/default.nix   | 4 ++--
 modules/nixos/services/woodpecker/server/default.nix | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/modules/nixos/services/drone/server/default.nix b/modules/nixos/services/drone/server/default.nix
index a3a1e49..d6148f4 100644
--- a/modules/nixos/services/drone/server/default.nix
+++ b/modules/nixos/services/drone/server/default.nix
@@ -6,8 +6,8 @@ in
   config = lib.mkIf cfg.enable {
     systemd.services.drone-server = {
       wantedBy = [ "multi-user.target" ];
-      after = [ "postgresql.service" ];
-      requires = [ "postgresql.service" ];
+      after = [ "postgresql.target" ];
+      requires = [ "postgresql.target" ];
       serviceConfig = {
         EnvironmentFile = [
           cfg.secretFile
diff --git a/modules/nixos/services/tandoor-recipes/default.nix b/modules/nixos/services/tandoor-recipes/default.nix
index 3447bee..169eec8 100644
--- a/modules/nixos/services/tandoor-recipes/default.nix
+++ b/modules/nixos/services/tandoor-recipes/default.nix
@@ -49,8 +49,8 @@ in
 
     systemd.services = {
       tandoor-recipes = {
-        after = [ "postgresql.service" ];
-        requires = [ "postgresql.service" ];
+        after = [ "postgresql.target" ];
+        requires = [ "postgresql.target" ];
 
         serviceConfig = {
           EnvironmentFile = cfg.secretKeyFile;
diff --git a/modules/nixos/services/woodpecker/server/default.nix b/modules/nixos/services/woodpecker/server/default.nix
index adf533e..caf0179 100644
--- a/modules/nixos/services/woodpecker/server/default.nix
+++ b/modules/nixos/services/woodpecker/server/default.nix
@@ -24,8 +24,8 @@ in
     };
 
     systemd.services.woodpecker-server = {
-      after = [ "postgresql.service" ];
-      requires = [ "postgresql.service" ];
+      after = [ "postgresql.target" ];
+      requires = [ "postgresql.target" ];
 
       serviceConfig = {
         # Set username for DB access

From 5d8722397010e1c1ddbc4d59abe53b7a6bd55584 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 2 Jul 2025 13:26:22 +0200
Subject: [PATCH 51/60] nixos: services: transmission: use 'trgui-ng'

I like it much better than the built-in UI.
---
 modules/nixos/services/transmission/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/nixos/services/transmission/default.nix b/modules/nixos/services/transmission/default.nix
index 16d51e3..ddd77d4 100644
--- a/modules/nixos/services/transmission/default.nix
+++ b/modules/nixos/services/transmission/default.nix
@@ -47,6 +47,7 @@ in
       enable = true;
       package = pkgs.transmission_4;
       group = "media";
+      webHome = pkgs.trgui-ng-web;
 
       downloadDirPermissions = "775";
 

From 66ec807dc6729a8aabd7cb5f42797e246f36befa Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 2 Jul 2025 14:01:15 +0200
Subject: [PATCH 52/60] hosts: nixos: aramis: home: use 'trgui-ng'

It looks and works much better than the old one.

Unfortunately, it's a Tauri app.
---
 hosts/nixos/aramis/home.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hosts/nixos/aramis/home.nix b/hosts/nixos/aramis/home.nix
index 64b63ce..221b1ea 100644
--- a/hosts/nixos/aramis/home.nix
+++ b/hosts/nixos/aramis/home.nix
@@ -20,7 +20,7 @@
       element-desktop # Matrix client
       jellyfin-media-player # Wraps the webui and mpv together
       pavucontrol # Audio mixer GUI
-      transgui # Transmission remote
+      trgui-ng # Transmission remote
     ];
     # Minimal video player
     mpv.enable = true;

From 8d809e3ac3c05eb9ca6de3279fee2a8c72cdd293 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 8 Jul 2025 10:40:08 +0000
Subject: [PATCH 53/60] flake: bump inputs

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index a4da84d..dc32e95 100644
--- a/flake.lock
+++ b/flake.lock
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1751271578,
-        "narHash": "sha256-P/SQmKDu06x8yv7i0s8bvnnuJYkxVGBWLWHaU+tt4YY=",
+        "lastModified": 1751952840,
+        "narHash": "sha256-SIkjQb9PPGvR/EcZAU8UZEnO9dwY2Z/BrDWgtyZd7OA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3016b4b15d13f3089db8a41ef937b13a9e33a8df",
+        "rev": "27278798fe68d7f81131dd7ab62b8ea2b795cd56",
         "type": "github"
       },
       "original": {

From b093faf00d8066e19d144c34533a32602a4fb8f7 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 8 Jul 2025 10:42:13 +0000
Subject: [PATCH 54/60] nixos: services: tandoor-recipes: use automatic DB

---
 .../services/tandoor-recipes/default.nix      | 25 +++----------------
 1 file changed, 4 insertions(+), 21 deletions(-)

diff --git a/modules/nixos/services/tandoor-recipes/default.nix b/modules/nixos/services/tandoor-recipes/default.nix
index 169eec8..4b4ed1a 100644
--- a/modules/nixos/services/tandoor-recipes/default.nix
+++ b/modules/nixos/services/tandoor-recipes/default.nix
@@ -26,18 +26,16 @@ in
     services.tandoor-recipes = {
       enable = true;
 
+      database = {
+        createLocally = true;
+      };
+
       port = cfg.port;
       extraConfig =
         let
           tandoorRecipesDomain = "recipes.${config.networking.domain}";
         in
         {
-          # Use PostgreSQL
-          DB_ENGINE = "django.db.backends.postgresql";
-          POSTGRES_HOST = "/run/postgresql";
-          POSTGRES_USER = "tandoor_recipes";
-          POSTGRES_DB = "tandoor_recipes";
-
           # Security settings
           ALLOWED_HOSTS = tandoorRecipesDomain;
           CSRF_TRUSTED_ORIGINS = "https://${tandoorRecipesDomain}";
@@ -49,27 +47,12 @@ in
 
     systemd.services = {
       tandoor-recipes = {
-        after = [ "postgresql.target" ];
-        requires = [ "postgresql.target" ];
-
         serviceConfig = {
           EnvironmentFile = cfg.secretKeyFile;
         };
       };
     };
 
-    # Set-up database
-    services.postgresql = {
-      enable = true;
-      ensureDatabases = [ "tandoor_recipes" ];
-      ensureUsers = [
-        {
-          name = "tandoor_recipes";
-          ensureDBOwnership = true;
-        }
-      ];
-    };
-
     my.services.nginx.virtualHosts = {
       recipes = {
         inherit (cfg) port;

From 2473bca1671ddaab0ce6de70d5471bf304133af6 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 11 Jul 2025 14:24:23 +0000
Subject: [PATCH 55/60] home: vim: telescope: remove LSP handlers

The plug-in was broken with the update to 0.11, and I would like to try
using the built-in quickfixlist-based handlers for a while.

This reverts commit 8d4a1e61b4f26f7443f7c8b0b65643f0bd312e9f.
---
 modules/home/vim/default.nix                   | 1 -
 modules/home/vim/plugin/settings/telescope.lua | 1 -
 2 files changed, 2 deletions(-)

diff --git a/modules/home/vim/default.nix b/modules/home/vim/default.nix
index 20a74ff..930a853 100644
--- a/modules/home/vim/default.nix
+++ b/modules/home/vim/default.nix
@@ -80,7 +80,6 @@ in
       nvim-surround # Deal with pairs, now in Lua
       oil-nvim # Better alternative to NetrW
       telescope-fzf-native-nvim # Use 'fzf' fuzzy matching algorithm
-      telescope-lsp-handlers-nvim # Use 'telescope' for various LSP actions
       telescope-nvim # Fuzzy finder interface
       which-key-nvim # Show available mappings
     ];
diff --git a/modules/home/vim/plugin/settings/telescope.lua b/modules/home/vim/plugin/settings/telescope.lua
index 1a23928..810d51c 100644
--- a/modules/home/vim/plugin/settings/telescope.lua
+++ b/modules/home/vim/plugin/settings/telescope.lua
@@ -23,7 +23,6 @@ telescope.setup({
 })
 
 telescope.load_extension("fzf")
-telescope.load_extension("lsp_handlers")
 
 local keys = {
     { "<leader>f", group = "Fuzzy finder" },

From 979ae901c4057308ce1da3bbf2388e2addd99d7f Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 15 Jul 2025 09:52:21 +0000
Subject: [PATCH 56/60] flake: bump inputs

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index dc32e95..0f205ab 100644
--- a/flake.lock
+++ b/flake.lock
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751429452,
-        "narHash": "sha256-4s5vRtaqdNhVBnbOWOzBNKrRa0ShQTLoEPjJp3joeNI=",
+        "lastModified": 1752467539,
+        "narHash": "sha256-4kaR+xmng9YPASckfvIgl5flF/1nAZOplM+Wp9I5SMI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "df12269039dcf752600b1bcc176bacf2786ec384",
+        "rev": "1e54837569e0b80797c47be4720fab19e0db1616",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1751952840,
-        "narHash": "sha256-SIkjQb9PPGvR/EcZAU8UZEnO9dwY2Z/BrDWgtyZd7OA=",
+        "lastModified": 1752644555,
+        "narHash": "sha256-oeRcp4VEyZ/3ZgfRRoq60/08l2zy0K53l8MdfSIYd24=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "27278798fe68d7f81131dd7ab62b8ea2b795cd56",
+        "rev": "9100a4f6bf446603b9575927c8585162f9ec9aa6",
         "type": "github"
       },
       "original": {

From 13b61346f5cca39d1ba2c66717e14a6d01b99acc Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 15 Jul 2025 09:54:23 +0000
Subject: [PATCH 57/60] home: tmux: increase history scrollback

Even *longer*.
---
 modules/home/tmux/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/tmux/default.nix b/modules/home/tmux/default.nix
index 82ceb3a..3ea047a 100644
--- a/modules/home/tmux/default.nix
+++ b/modules/home/tmux/default.nix
@@ -48,7 +48,7 @@ in
     keyMode = "vi"; # Home-row keys and other niceties
     clock24 = true; # I'm one of those heathens
     escapeTime = 0; # Let vim do its thing instead
-    historyLimit = 100000; # Bigger buffer
+    historyLimit = 1000000; # Bigger buffer
     mouse = false; # I dislike mouse support
     focusEvents = true; # Report focus events
     terminal = "tmux-256color"; # I want accurate termcap info

From b4f9db9a678bb2b31bb8d761a9eb28b5bc616ea8 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 31 Oct 2024 14:09:23 +0000
Subject: [PATCH 58/60] flake: add 'nixgl'

There's now a home-manager module for it, let's try it out.
---
 flake.lock | 25 +++++++++++++++++++++++++
 flake.nix  | 11 +++++++++++
 2 files changed, 36 insertions(+)

diff --git a/flake.lock b/flake.lock
index 0f205ab..ad01b76 100644
--- a/flake.lock
+++ b/flake.lock
@@ -173,6 +173,30 @@
         "type": "github"
       }
     },
+    "nixgl": {
+      "inputs": {
+        "flake-utils": [
+          "futils"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1752054764,
+        "narHash": "sha256-Ob/HuUhANoDs+nvYqyTKrkcPXf4ZgXoqMTQoCK0RFgQ=",
+        "owner": "nix-community",
+        "repo": "nixGL",
+        "rev": "a8e1ce7d49a149ed70df676785b07f63288f53c5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "main",
+        "repo": "nixGL",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1752644555,
@@ -221,6 +245,7 @@
         "futils": "futils",
         "git-hooks": "git-hooks",
         "home-manager": "home-manager",
+        "nixgl": "nixgl",
         "nixpkgs": "nixpkgs",
         "nur": "nur",
         "systems": "systems"
diff --git a/flake.nix b/flake.nix
index 5076729..403f308 100644
--- a/flake.nix
+++ b/flake.nix
@@ -43,6 +43,17 @@
       };
     };
 
+    nixgl = {
+      type = "github";
+      owner = "nix-community";
+      repo = "nixGL";
+      ref = "main";
+      inputs = {
+        flake-utils.follows = "futils";
+        nixpkgs.follows = "nixpkgs";
+      };
+    };
+
     nixpkgs = {
       type = "github";
       owner = "NixOS";

From 84c49405b6500739b08addaf590b1ff59d0abd11 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 31 Oct 2024 14:14:59 +0000
Subject: [PATCH 59/60] home: add 'nix-gl'

---
 modules/home/default.nix        |  1 +
 modules/home/nix-gl/default.nix | 17 +++++++++++++++++
 2 files changed, 18 insertions(+)
 create mode 100644 modules/home/nix-gl/default.nix

diff --git a/modules/home/default.nix b/modules/home/default.nix
index 1c40377..c85e34f 100644
--- a/modules/home/default.nix
+++ b/modules/home/default.nix
@@ -28,6 +28,7 @@
     ./mail
     ./mpv
     ./nix
+    ./nix-gl
     ./nix-index
     ./nixpkgs
     ./nm-applet
diff --git a/modules/home/nix-gl/default.nix b/modules/home/nix-gl/default.nix
new file mode 100644
index 0000000..e7b9a4f
--- /dev/null
+++ b/modules/home/nix-gl/default.nix
@@ -0,0 +1,17 @@
+{ config, inputs, lib, ... }:
+let
+  cfg = config.my.home.nix-gl;
+in
+{
+  options.my.home.nix-gl = with lib; {
+    enable = mkEnableOption "nixGL configuration";
+  };
+
+  config = lib.mkIf cfg.enable (lib.mkMerge [
+    {
+      nixGL = {
+        inherit (inputs.nixgl) packages;
+      };
+    }
+  ]);
+}

From 22efa99f5f0a7aae1ceaedcfd0f0be10ca8cef95 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 7 Apr 2025 16:15:16 +0000
Subject: [PATCH 60/60] WIP: nixgl wrappers

---
 modules/home/nix-gl/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/home/nix-gl/default.nix b/modules/home/nix-gl/default.nix
index e7b9a4f..0f261f9 100644
--- a/modules/home/nix-gl/default.nix
+++ b/modules/home/nix-gl/default.nix
@@ -11,6 +11,10 @@ in
     {
       nixGL = {
         inherit (inputs.nixgl) packages;
+
+        defaultWrapper = "mesa";
+
+        installScripts = [ "mesa" ];
       };
     }
   ]);