From 9fc7d324812abc8b8aa65b7da7437a4a2b3b0fe3 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 28 Nov 2024 12:50:29 +0000
Subject: [PATCH 001/256] home: tmux: add sloppy window switching bindings

Another set of bindings which were setup by `tmux-sensible`, that I want
to enable explicitly to avoid issues when it is disabled by default.
---
 modules/home/tmux/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/home/tmux/default.nix b/modules/home/tmux/default.nix
index 23dff05..ca99fdc 100644
--- a/modules/home/tmux/default.nix
+++ b/modules/home/tmux/default.nix
@@ -84,6 +84,10 @@ in
       # Refresh configuration
       bind-key -N "Source tmux.conf" R source-file ${config.xdg.configHome}/tmux/tmux.conf \; display-message "Sourced tmux.conf!"
 
+      # Accept sloppy Ctrl key when switching windows, on top of default mapping
+      bind-key -N "Select the previous window" C-p previous-window
+      bind-key -N "Select the next window" C-n next -window
+
       # Better vim mode
       bind-key -T copy-mode-vi 'v' send -X begin-selection
       ${

From e03db8642a57b52c18e05b4862eab9eb5cd4029d Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 28 Nov 2024 19:58:50 +0000
Subject: [PATCH 002/256] nixos: system: packages: remove 'wget'

---
 modules/nixos/system/packages/default.nix | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/modules/nixos/system/packages/default.nix b/modules/nixos/system/packages/default.nix
index ebea06f..6a78ff6 100644
--- a/modules/nixos/system/packages/default.nix
+++ b/modules/nixos/system/packages/default.nix
@@ -1,5 +1,5 @@
 # Common packages
-{ config, lib, pkgs, ... }:
+{ config, lib, ... }:
 let
   cfg = config.my.system.packages;
 in
@@ -13,10 +13,6 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    environment.systemPackages = with pkgs; [
-      wget
-    ];
-
     programs = {
       vim = {
         enable = true;

From 7b21943693845d9675858b0a685b7056b9e0178d Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 28 Nov 2024 21:46:39 +0000
Subject: [PATCH 003/256] nixos: services: grocy: backup data

---
 modules/nixos/services/grocy/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/modules/nixos/services/grocy/default.nix b/modules/nixos/services/grocy/default.nix
index 9045b03..3f04959 100644
--- a/modules/nixos/services/grocy/default.nix
+++ b/modules/nixos/services/grocy/default.nix
@@ -37,6 +37,12 @@ in
       useACMEHost = config.networking.domain;
     };
 
+    my.services.backup = {
+      paths = [
+        config.services.grocy.dataDir
+      ];
+    };
+
     # NOTE: unfortunately grocy does not log connection failures for fail2ban
   };
 }

From 1dcf5a1f1c75a7b099db49328a9d054bef08c7b8 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 28 Nov 2024 21:47:06 +0000
Subject: [PATCH 004/256] nixos: services: mealie: backup data

---
 modules/nixos/services/mealie/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/modules/nixos/services/mealie/default.nix b/modules/nixos/services/mealie/default.nix
index 664d5ba..630231f 100644
--- a/modules/nixos/services/mealie/default.nix
+++ b/modules/nixos/services/mealie/default.nix
@@ -72,6 +72,12 @@ in
       };
     };
 
+    my.services.backup = {
+      paths = [
+        "/var/lib/mealie"
+      ];
+    };
+
     services.fail2ban.jails = {
       mealie = ''
         enabled = true

From e40247ed8180c6fd523dc582499258838364faaf Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 28 Nov 2024 21:47:51 +0000
Subject: [PATCH 005/256] nixos: services: tandoor-recipes: backup data

---
 modules/nixos/services/tandoor-recipes/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/modules/nixos/services/tandoor-recipes/default.nix b/modules/nixos/services/tandoor-recipes/default.nix
index 3447bee..219f4b9 100644
--- a/modules/nixos/services/tandoor-recipes/default.nix
+++ b/modules/nixos/services/tandoor-recipes/default.nix
@@ -83,6 +83,12 @@ in
       };
     };
 
+    my.services.backup = {
+      paths = [
+        "/var/lib/tandoor-recipes"
+      ];
+    };
+
     # NOTE: unfortunately tandoor-recipes does not log connection failures for fail2ban
   };
 }

From 99a3bd25873dd55c3540fdd90e34499bad73bd4d Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 11 Nov 2023 18:35:24 +0000
Subject: [PATCH 006/256] flake: add 'impermanence'

---
 flake.lock | 17 +++++++++++++++++
 flake.nix  |  7 +++++++
 2 files changed, 24 insertions(+)

diff --git a/flake.lock b/flake.lock
index cd3f50c..55d50b0 100644
--- a/flake.lock
+++ b/flake.lock
@@ -150,6 +150,22 @@
         "type": "github"
       }
     },
+    "impermanence": {
+      "locked": {
+        "lastModified": 1697303681,
+        "narHash": "sha256-caJ0rXeagaih+xTgRduYtYKL1rZ9ylh06CIrt1w5B4g=",
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "rev": "0f317c2e9e56550ce12323eb39302d251618f5b5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "master",
+        "repo": "impermanence",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1732521221,
@@ -214,6 +230,7 @@
         "flake-parts": "flake-parts",
         "futils": "futils",
         "home-manager": "home-manager",
+        "impermanence": "impermanence",
         "nixpkgs": "nixpkgs",
         "nur": "nur",
         "pre-commit-hooks": "pre-commit-hooks",
diff --git a/flake.nix b/flake.nix
index a07ee15..5a5b0ef 100644
--- a/flake.nix
+++ b/flake.nix
@@ -43,6 +43,13 @@
       };
     };
 
+    impermanence = {
+      type = "github";
+      owner = "nix-community";
+      repo = "impermanence";
+      ref = "master";
+    };
+
     nixpkgs = {
       type = "github";
       owner = "NixOS";

From fa732c88e414a5653db62fdb67feee322cacd8b2 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 22 Oct 2021 13:52:04 +0200
Subject: [PATCH 007/256] WIP: nixos: system: add persist

This is the module that takes care of configuring impermanence at the
system level.

WIP:
    * address FIXMEs
    * activate home-manager persistence?
        * set `programs.fuse.userAllowOther = true;` ?
    * point `age` to persisted paths [1] ?
    * make sure all services and modules are persisted correctly...

[1]: https://github.com/lovesegfault/nix-config/commit/b1d18d25b8cc1e50c521020442b907de377a147d
---
 modules/nixos/system/default.nix         |  1 +
 modules/nixos/system/persist/default.nix | 66 ++++++++++++++++++++++++
 2 files changed, 67 insertions(+)
 create mode 100644 modules/nixos/system/persist/default.nix

diff --git a/modules/nixos/system/default.nix b/modules/nixos/system/default.nix
index e6fb25b..3531847 100644
--- a/modules/nixos/system/default.nix
+++ b/modules/nixos/system/default.nix
@@ -9,6 +9,7 @@
     ./language
     ./nix
     ./packages
+    ./persist
     ./podman
     ./polkit
     ./printing
diff --git a/modules/nixos/system/persist/default.nix b/modules/nixos/system/persist/default.nix
new file mode 100644
index 0000000..e0a1eeb
--- /dev/null
+++ b/modules/nixos/system/persist/default.nix
@@ -0,0 +1,66 @@
+# Ephemeral root configuration
+{ config, inputs, lib, ... }:
+let
+  cfg = config.my.system.persist;
+in
+{
+  imports = [
+    inputs.impermanence.nixosModules.impermanence
+  ];
+
+  options.my.system.persist = with lib; {
+    enable = mkEnableOption "stateless system configuration";
+
+    mountPoint = lib.mkOption {
+      type = types.str;
+      default = "/persistent";
+      example = "/etc/nix/persist";
+      description = ''
+        Which mount point should be used to persist this system's files and
+        directories.
+      '';
+    };
+
+    files = lib.mkOption {
+      type = with types; listOf str;
+      default = [ ];
+      example = [
+        "/etc/nix/id_rsa"
+      ];
+      description = ''
+        Additional files in the root to link to persistent storage.
+      '';
+    };
+
+    directories = lib.mkOption {
+      type = with types; listOf str;
+      default = [ ];
+      example = [
+        "/var/lib/libvirt"
+      ];
+      description = ''
+        Additional directories in the root to link to persistent storage.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.persistence."${cfg.mountPoint}" = {
+      files = [
+        "/etc/machine-id" # Machine-specific ID
+        "/etc/adjtime" # Clock drift factor and offsets
+      ]
+      ++ cfg.files
+      ;
+
+      directories = [
+        "/etc/nixos" # In case it's storage directory of our configuration
+        "/var/log" # Logs
+        "/var/lib/nixos" # UID/GID maps
+        "/var/lib/systemd/coredump" # Coredumps
+      ]
+      ++ cfg.directories
+      ;
+    };
+  };
+}

From 2a20ecbd1e4282ed6d21b21936e3b5a17509ca3e Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 29 Nov 2024 22:24:38 +0000
Subject: [PATCH 008/256] nixos: system: persist: filter unique entries

To make sure that different modules configuring the same values don't
run into any issues (e.g: download clients sharing a download
directory).
---
 modules/nixos/system/persist/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/nixos/system/persist/default.nix b/modules/nixos/system/persist/default.nix
index e0a1eeb..212f902 100644
--- a/modules/nixos/system/persist/default.nix
+++ b/modules/nixos/system/persist/default.nix
@@ -50,7 +50,7 @@ in
         "/etc/machine-id" # Machine-specific ID
         "/etc/adjtime" # Clock drift factor and offsets
       ]
-      ++ cfg.files
+      ++ lib.unique cfg.files
       ;
 
       directories = [
@@ -59,7 +59,7 @@ in
         "/var/lib/nixos" # UID/GID maps
         "/var/lib/systemd/coredump" # Coredumps
       ]
-      ++ cfg.directories
+      ++ lib.unique cfg.directories
       ;
     };
   };

From 55fd694c69728ccd5c8f9fe8f0fbab3080b12a9f Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 7 Nov 2024 14:53:34 +0000
Subject: [PATCH 009/256] nixos: system: docker: persist data

---
 modules/nixos/system/docker/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/nixos/system/docker/default.nix b/modules/nixos/system/docker/default.nix
index f051814..cab9fb5 100644
--- a/modules/nixos/system/docker/default.nix
+++ b/modules/nixos/system/docker/default.nix
@@ -23,5 +23,9 @@ in
         ];
       };
     };
+
+    my.system.persist.directories = [
+      "/var/lib/docker"
+    ];
   };
 }

From 257c0675e26b19c951bcc646997475d9d576df4f Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 7 Nov 2024 14:53:50 +0000
Subject: [PATCH 010/256] nixos: system: podman: persist data

---
 modules/nixos/system/podman/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/nixos/system/podman/default.nix b/modules/nixos/system/podman/default.nix
index 52630c7..8400dfd 100644
--- a/modules/nixos/system/podman/default.nix
+++ b/modules/nixos/system/podman/default.nix
@@ -44,5 +44,9 @@ in
         ];
       };
     };
+
+    my.system.persist.directories = [
+      "/var/lib/containers"
+    ];
   };
 }

From 8607b3c57783a469cb798b3acea7101a086b3911 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 22 Oct 2021 14:06:26 +0200
Subject: [PATCH 011/256] nixos: hardware: bluetooth: persist connections

---
 modules/nixos/hardware/bluetooth/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/modules/nixos/hardware/bluetooth/default.nix b/modules/nixos/hardware/bluetooth/default.nix
index e9b1991..efce5c4 100644
--- a/modules/nixos/hardware/bluetooth/default.nix
+++ b/modules/nixos/hardware/bluetooth/default.nix
@@ -18,6 +18,13 @@ in
       services.blueman.enable = true;
     }
 
+    # Persist bluetooth files
+    {
+      my.system.persist.directories = [
+        "/var/lib/bluetooth"
+      ];
+    }
+
     # Support for additional bluetooth codecs
     (lib.mkIf cfg.loadExtraCodecs {
       hardware.pulseaudio = {

From 2f3b9950e19056bcc98245956fe8d7897c699cae Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 22 Oct 2021 14:06:03 +0200
Subject: [PATCH 012/256] nixos: hardware: networking persist connections

---
 modules/nixos/hardware/networking/default.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/modules/nixos/hardware/networking/default.nix b/modules/nixos/hardware/networking/default.nix
index f0806fe..dac5e9a 100644
--- a/modules/nixos/hardware/networking/default.nix
+++ b/modules/nixos/hardware/networking/default.nix
@@ -22,6 +22,16 @@ in
   config = lib.mkMerge [
     (lib.mkIf cfg.wireless.enable {
       networking.networkmanager.enable = true;
+
+      # Persist NetworkManager files
+      my.system.persist.files = [
+        "/var/lib/NetworkManager/secret_key"
+        "/var/lib/NetworkManager/seen-bssids"
+        "/var/lib/NetworkManager/timestamps"
+      ];
+      my.system.persist.directories = [
+        "/etc/NetworkManager/system-connections"
+      ];
     })
   ];
 }

From 4e2055da7f38abf60acad58e2716e2153aa913be Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 22 Oct 2021 14:05:42 +0200
Subject: [PATCH 013/256] nixos: services: ssh-server: persist host keys

---
 modules/nixos/services/ssh-server/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/modules/nixos/services/ssh-server/default.nix b/modules/nixos/services/ssh-server/default.nix
index 9ae0fa8..c4d1fd6 100644
--- a/modules/nixos/services/ssh-server/default.nix
+++ b/modules/nixos/services/ssh-server/default.nix
@@ -20,6 +20,13 @@ in
       };
     };
 
+    # Persist SSH keys
+    my.system.persist.files =
+      let
+        pubAndPrivKey = key: [ key.path "${key.path}.pub" ];
+      in
+      lib.concatMap pubAndPrivKey config.services.openssh.hostKeys;
+
     # Opens the relevant UDP ports.
     programs.mosh.enable = true;
   };

From ef88c7561ba1387c3ebb80f4c9bb1703b6d506c3 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 28 Nov 2024 21:45:43 +0000
Subject: [PATCH 014/256] nixos: services: aria: persist data

---
 modules/nixos/services/aria/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/modules/nixos/services/aria/default.nix b/modules/nixos/services/aria/default.nix
index acbf0b7..be35909 100644
--- a/modules/nixos/services/aria/default.nix
+++ b/modules/nixos/services/aria/default.nix
@@ -69,6 +69,11 @@ in
       };
     };
 
+    my.system.persist.directories = [
+      cfg.downloadDir
+      "/var/lib/aria2"
+    ];
+
     # NOTE: unfortunately aria2 does not log connection failures for fail2ban
   };
 }

From 4fb244764896acc9d945f3ab095b18787630a84f Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 28 Nov 2024 21:45:58 +0000
Subject: [PATCH 015/256] nixos: services: audiobookshelf: persist data

---
 modules/nixos/services/audiobookshelf/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/nixos/services/audiobookshelf/default.nix b/modules/nixos/services/audiobookshelf/default.nix
index 04ec8b9..5e79990 100644
--- a/modules/nixos/services/audiobookshelf/default.nix
+++ b/modules/nixos/services/audiobookshelf/default.nix
@@ -34,6 +34,10 @@ in
       };
     };
 
+    my.system.persist.directories = [
+      "/var/lib/${config.services.audiobookshelf.dataDir}"
+    ];
+
     services.fail2ban.jails = {
       audiobookshelf = ''
         enabled = true

From 7d8a18c968501852e9d5f5b7cf80a821d214d5c9 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 22 Oct 2021 14:19:57 +0200
Subject: [PATCH 016/256] nixos: services: blog: persist website data

---
 modules/nixos/services/blog/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/modules/nixos/services/blog/default.nix b/modules/nixos/services/blog/default.nix
index e4d2d42..aadc4f0 100644
--- a/modules/nixos/services/blog/default.nix
+++ b/modules/nixos/services/blog/default.nix
@@ -41,5 +41,12 @@ in
 
     # Those are all subdomains, no problem
     my.services.nginx.virtualHosts = hostsInfo;
+
+    my.system.persist.directories = [
+      "/var/www/blog"
+      "/var/www/cv"
+      "/var/www/dev"
+      "/var/www/key"
+    ];
   };
 }

From 5c5738e1d847e4a3f31c854d36477cc353441dd9 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 3 Nov 2021 14:43:05 +0100
Subject: [PATCH 017/256] nixos: services: calibre-web: persist library

---
 modules/nixos/services/calibre-web/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/modules/nixos/services/calibre-web/default.nix b/modules/nixos/services/calibre-web/default.nix
index b7bf9df..8a8af33 100644
--- a/modules/nixos/services/calibre-web/default.nix
+++ b/modules/nixos/services/calibre-web/default.nix
@@ -53,6 +53,11 @@ in
       ];
     };
 
+    my.system.persist.directories = [
+      "/var/lib/${config.services.calibre-web.dataDir}"
+      cfg.libraryPath
+    ];
+
     services.fail2ban.jails = {
       calibre-web = ''
         enabled = true

From 5f607efee8fe5076f72968b07abdb1dcdd674af9 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 28 Nov 2024 21:46:13 +0000
Subject: [PATCH 018/256] nixos: services: fail2ban: persist data

---
 modules/nixos/services/fail2ban/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/nixos/services/fail2ban/default.nix b/modules/nixos/services/fail2ban/default.nix
index be5f7da..8dcc80d 100644
--- a/modules/nixos/services/fail2ban/default.nix
+++ b/modules/nixos/services/fail2ban/default.nix
@@ -33,5 +33,9 @@ in
         bantime = "10m";
       };
     };
+
+    my.system.persist.directories = [
+      "/var/lib/fail2ban"
+    ];
   };
 }

From bdc008d0fca4726dc41042b4ab56b7798df991d8 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 28 Nov 2024 21:46:25 +0000
Subject: [PATCH 019/256] nixos: services: flood: persist data

---
 modules/nixos/services/flood/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/nixos/services/flood/default.nix b/modules/nixos/services/flood/default.nix
index f3fe90b..b129617 100644
--- a/modules/nixos/services/flood/default.nix
+++ b/modules/nixos/services/flood/default.nix
@@ -28,6 +28,10 @@ in
       };
     };
 
+    my.system.persist.directories = [
+      "/var/lib/flood"
+    ];
+
     # NOTE: unfortunately flood does not log connection failures for fail2ban
   };
 }

From 82e56bf80c58d639f4f1763e15b2336ae7e23eca Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 2 Jul 2024 16:31:54 +0000
Subject: [PATCH 020/256] nixos: services: forgejo: persist repositories

---
 modules/nixos/services/forgejo/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/modules/nixos/services/forgejo/default.nix b/modules/nixos/services/forgejo/default.nix
index 511724b..b7cc0c5 100644
--- a/modules/nixos/services/forgejo/default.nix
+++ b/modules/nixos/services/forgejo/default.nix
@@ -147,6 +147,11 @@ in
       ];
     };
 
+    my.system.persist.directories = [
+      config.services.forgejo.lfs.contentDir
+      config.services.forgejo.repositoryRoot
+    ];
+
     services.fail2ban.jails = {
       forgejo = ''
         enabled = true

From fc98fe2b3ececa983e08a1ed38139dfdd99dca4d Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 3 Nov 2021 14:43:28 +0100
Subject: [PATCH 021/256] nixos: services: gitea: persist repositories

---
 modules/nixos/services/gitea/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/modules/nixos/services/gitea/default.nix b/modules/nixos/services/gitea/default.nix
index 95bdf42..76de5dd 100644
--- a/modules/nixos/services/gitea/default.nix
+++ b/modules/nixos/services/gitea/default.nix
@@ -131,6 +131,11 @@ in
       ];
     };
 
+    my.system.persist.directories = [
+      config.services.gitea.lfs.contentDir
+      config.services.gitea.repositoryRoot
+    ];
+
     services.fail2ban.jails = {
       gitea = ''
         enabled = true

From b8f4dd33ee68d468fbc123274920b58b30469990 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 28 Nov 2024 21:46:39 +0000
Subject: [PATCH 022/256] nixos: services: grocy: persist data

---
 modules/nixos/services/grocy/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/nixos/services/grocy/default.nix b/modules/nixos/services/grocy/default.nix
index 3f04959..57295f1 100644
--- a/modules/nixos/services/grocy/default.nix
+++ b/modules/nixos/services/grocy/default.nix
@@ -43,6 +43,10 @@ in
       ];
     };
 
+    my.system.persist.directories = [
+      config.services.grocy.dataDir
+    ];
+
     # NOTE: unfortunately grocy does not log connection failures for fail2ban
   };
 }

From 4569fe8a2983d74ffaf5ce9a07599c1fa7d33459 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 5 Nov 2021 14:30:25 +0100
Subject: [PATCH 023/256] nixos: services: indexers: persist data

---
 modules/nixos/services/indexers/default.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/modules/nixos/services/indexers/default.nix b/modules/nixos/services/indexers/default.nix
index 8a42345..58f845d 100644
--- a/modules/nixos/services/indexers/default.nix
+++ b/modules/nixos/services/indexers/default.nix
@@ -33,6 +33,10 @@ in
           port = jackettPort;
         };
       };
+
+      my.system.persist.directories = [
+        config.services.jackett.dataDir
+      ];
     })
 
     (lib.mkIf cfg.nzbhydra.enable {
@@ -45,6 +49,10 @@ in
           port = nzbhydraPort;
         };
       };
+
+      my.system.persist.directories = [
+        config.services.nzbhydra2.dataDir
+      ];
     })
 
     (lib.mkIf cfg.prowlarr.enable {
@@ -58,6 +66,10 @@ in
         };
       };
 
+      my.system.persist.directories = [
+        "/var/lib/prowlarr"
+      ];
+
       services.fail2ban.jails = {
         prowlarr = ''
           enabled = true

From e4916ddb880e298478abb1f04a9a56df1cac4264 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 5 Nov 2021 15:11:05 +0100
Subject: [PATCH 024/256] nixos: services: jellyfin: persist data

---
 modules/nixos/services/jellyfin/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/nixos/services/jellyfin/default.nix b/modules/nixos/services/jellyfin/default.nix
index 6edeb67..3a421ec 100644
--- a/modules/nixos/services/jellyfin/default.nix
+++ b/modules/nixos/services/jellyfin/default.nix
@@ -38,6 +38,10 @@ in
       };
     };
 
+    my.system.persist.directories = [
+      "/var/lib/jellyfin"
+    ];
+
     services.fail2ban.jails = {
       jellyfin = ''
         enabled = true

From 6f27b1578106193f39c6dc4bda50b3a8823bea5d Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 28 Nov 2024 21:46:55 +0000
Subject: [PATCH 025/256] nixos: services: komga: persist data

---
 modules/nixos/services/komga/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/nixos/services/komga/default.nix b/modules/nixos/services/komga/default.nix
index e1dc780..15e4fbb 100644
--- a/modules/nixos/services/komga/default.nix
+++ b/modules/nixos/services/komga/default.nix
@@ -36,6 +36,10 @@ in
       };
     };
 
+    my.system.persist.directories = [
+      config.services.komga.stateDir
+    ];
+
     services.fail2ban.jails = {
       komga = ''
         enabled = true

From c7cc887322318b9c6c43bf921f367d44f230c86b Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 5 Nov 2021 15:11:12 +0100
Subject: [PATCH 026/256] nixos: services: lohr: persist data

---
 modules/nixos/services/lohr/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/nixos/services/lohr/default.nix b/modules/nixos/services/lohr/default.nix
index 21ed93b..c69075f 100644
--- a/modules/nixos/services/lohr/default.nix
+++ b/modules/nixos/services/lohr/default.nix
@@ -107,5 +107,9 @@ in
         };
       };
     };
+
+    my.system.persist.directories = [
+      "/var/lib/lohr"
+    ];
   };
 }

From 370c8354da3aab30defadab13a8d4bb0f38320e7 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 3 Nov 2021 17:12:32 +0100
Subject: [PATCH 027/256] nixos: services: matrix: persist data

---
 modules/nixos/services/matrix/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/nixos/services/matrix/default.nix b/modules/nixos/services/matrix/default.nix
index f423834..cb41a0f 100644
--- a/modules/nixos/services/matrix/default.nix
+++ b/modules/nixos/services/matrix/default.nix
@@ -214,5 +214,9 @@ in
         config.services.matrix-synapse.dataDir
       ];
     };
+
+    my.system.persist.directories = [
+      config.services.matrix-synapse.dataDir
+    ];
   };
 }

From 629e5d99f5863255551badbba9442c2c16be2885 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 5 Nov 2021 15:40:29 +0100
Subject: [PATCH 028/256] nixos: services: monitoring: persist data

---
 modules/nixos/services/monitoring/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/modules/nixos/services/monitoring/default.nix b/modules/nixos/services/monitoring/default.nix
index 49919c1..4415cb5 100644
--- a/modules/nixos/services/monitoring/default.nix
+++ b/modules/nixos/services/monitoring/default.nix
@@ -130,5 +130,10 @@ in
         inherit (cfg.grafana) port;
       };
     };
+
+    my.system.persist.directories = [
+      config.services.grafana.dataDir
+      "/var/lib/${config.services.prometheus.stateDir}"
+    ];
   };
 }

From 178f6825c0313fc6dbd28dd15817e8db226bb913 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 5 Nov 2021 15:11:23 +0100
Subject: [PATCH 029/256] nixos: services: navidrome: persist data

---
 modules/nixos/services/navidrome/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/nixos/services/navidrome/default.nix b/modules/nixos/services/navidrome/default.nix
index c513b91..0fc3539 100644
--- a/modules/nixos/services/navidrome/default.nix
+++ b/modules/nixos/services/navidrome/default.nix
@@ -53,6 +53,10 @@ in
       };
     };
 
+    my.system.persist.directories = [
+      "/var/lib/navidrome"
+    ];
+
     services.fail2ban.jails = {
       navidrome = ''
         enabled = true

From 260f1e9b5cbe2354706ea147cf39749bd5647b1d Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 5 Nov 2021 15:37:51 +0100
Subject: [PATCH 030/256] nixos: services: nginx: persist SSL certificates

---
 modules/nixos/services/nginx/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/nixos/services/nginx/default.nix b/modules/nixos/services/nginx/default.nix
index 3bba9f4..ab69efd 100644
--- a/modules/nixos/services/nginx/default.nix
+++ b/modules/nixos/services/nginx/default.nix
@@ -486,5 +486,9 @@ in
         }
       ];
     };
+
+    my.system.persist.directories = [
+      "/var/lib/acme"
+    ];
   };
 }

From 0dccde9edfb71f78038494b12357e0be87aaa863 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 5 Nov 2021 15:11:35 +0100
Subject: [PATCH 031/256] nixos: services: nextcloud: persist data

---
 modules/nixos/services/nextcloud/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/nixos/services/nextcloud/default.nix b/modules/nixos/services/nextcloud/default.nix
index fe94177..5452dac 100644
--- a/modules/nixos/services/nextcloud/default.nix
+++ b/modules/nixos/services/nextcloud/default.nix
@@ -92,6 +92,10 @@ in
       ];
     };
 
+    my.system.persist.directories = [
+      config.services.nextcloud.home
+    ];
+
     services.fail2ban.jails = {
       nextcloud = ''
         enabled = true

From b8325e8ea7dd703fa1848956efd75f058c9a0866 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 3 Nov 2021 17:12:42 +0100
Subject: [PATCH 032/256] nixos: services: paperless: persist data

---
 modules/nixos/services/paperless/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/modules/nixos/services/paperless/default.nix b/modules/nixos/services/paperless/default.nix
index c8967e1..0754721 100644
--- a/modules/nixos/services/paperless/default.nix
+++ b/modules/nixos/services/paperless/default.nix
@@ -146,5 +146,10 @@ in
         config.services.paperless.mediaDir
       ];
     };
+
+    my.system.persist.directories = [
+      config.services.paperless.dataDir
+      config.services.paperless.mediaDir
+    ];
   };
 }

From a1bc64cf48d732458416b1b60727a3ed15fab345 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 28 Nov 2024 21:47:24 +0000
Subject: [PATCH 033/256] nixos: services: pdf-edit: persist data

---
 modules/nixos/services/pdf-edit/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/nixos/services/pdf-edit/default.nix b/modules/nixos/services/pdf-edit/default.nix
index d59507b..180e520 100644
--- a/modules/nixos/services/pdf-edit/default.nix
+++ b/modules/nixos/services/pdf-edit/default.nix
@@ -54,6 +54,10 @@ in
       };
     };
 
+    my.system.persist.directories = [
+      "/var/lib/stirling-pdf"
+    ];
+
     services.fail2ban.jails = {
       stirling-pdf = ''
         enabled = true

From f860452c1c3612adf22ec82b41fce33581102987 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 5 Nov 2021 15:58:07 +0100
Subject: [PATCH 034/256] nixos: services: servarr: persist data

---
 modules/nixos/services/servarr/default.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/modules/nixos/services/servarr/default.nix b/modules/nixos/services/servarr/default.nix
index e25d9cf..c0f57df 100644
--- a/modules/nixos/services/servarr/default.nix
+++ b/modules/nixos/services/servarr/default.nix
@@ -19,6 +19,16 @@ let
       enable = true;
       group = "media";
     };
+
+    my.system.persist.directories =
+      let
+        # Bazarr breaks the mold unfortunately
+        dataDir =
+          if service != "bazarr"
+          then config.services.${service}.dataDir
+          else "/var/lib/bazarr";
+      in
+      [ dataDir ];
   };
 
   mkRedirection = service: {

From aa6baa82e8e0fc579327941a22c8af0f3c78b689 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 5 Nov 2021 15:20:11 +0100
Subject: [PATCH 035/256] nixos: services: podgrab: persist data

---
 modules/nixos/services/podgrab/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/modules/nixos/services/podgrab/default.nix b/modules/nixos/services/podgrab/default.nix
index 3ced8d3..ec6ecb2 100644
--- a/modules/nixos/services/podgrab/default.nix
+++ b/modules/nixos/services/podgrab/default.nix
@@ -51,5 +51,10 @@ in
         inherit (cfg) port;
       };
     };
+
+    my.system.persist.directories = [
+      config.systemd.services.podgrab.environment.CONFIG
+      config.systemd.services.podgrab.environment.DATA
+    ];
   };
 }

From 1f6c40c3ebe91e6870e60ee866f4cd8b56686278 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 3 Nov 2021 17:13:13 +0100
Subject: [PATCH 036/256] nixos: services: postgresql: persist data

---
 modules/nixos/services/postgresql/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/modules/nixos/services/postgresql/default.nix b/modules/nixos/services/postgresql/default.nix
index bbe46d4..cea4c88 100644
--- a/modules/nixos/services/postgresql/default.nix
+++ b/modules/nixos/services/postgresql/default.nix
@@ -18,6 +18,13 @@ in
       };
     })
 
+    # Only persist directory if the actual service is enabled
+    (lib.mkIf config.services.postgresql.enable {
+      my.system.persist.directories = [
+        config.services.postgresql.dataDir
+      ];
+    })
+
     # Taken from the manual
     (lib.mkIf cfg.upgradeScript {
       environment.systemPackages =

From b376366d7bc6ea1d75234ca64b7f6d13bd04fd7a Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 3 Nov 2021 17:12:58 +0100
Subject: [PATCH 037/256] nixos: services: postgresql-backup: persist data

---
 modules/nixos/services/postgresql-backup/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/nixos/services/postgresql-backup/default.nix b/modules/nixos/services/postgresql-backup/default.nix
index dff5494..3d6c03b 100644
--- a/modules/nixos/services/postgresql-backup/default.nix
+++ b/modules/nixos/services/postgresql-backup/default.nix
@@ -24,5 +24,9 @@ in
         (config.services.postgresqlBackup.location + "/*.prev.sql.gz")
       ];
     };
+
+    my.system.persist.directories = [
+      config.services.postgresqlBackup.location
+    ];
   };
 }

From 795026e918c1a68afdd2a8cecff9cb0d931ae958 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 28 Nov 2024 21:47:37 +0000
Subject: [PATCH 038/256] nixos: services: pyload: persist data

---
 modules/nixos/services/pyload/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/modules/nixos/services/pyload/default.nix b/modules/nixos/services/pyload/default.nix
index 7257d0f..ec5042b 100644
--- a/modules/nixos/services/pyload/default.nix
+++ b/modules/nixos/services/pyload/default.nix
@@ -53,6 +53,11 @@ in
       };
     };
 
+    my.system.persist.directories = [
+      cfg.downloadDirectory
+      "/var/lib/pyload"
+    ];
+
     services.fail2ban.jails = {
       pyload = ''
         enabled = true

From 31c20c5b1b5d83efe2db82ca140e5749663edf01 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 5 Nov 2021 21:51:04 +0100
Subject: [PATCH 039/256] nixos: services: quassel: persist data

---
 modules/nixos/services/quassel/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/nixos/services/quassel/default.nix b/modules/nixos/services/quassel/default.nix
index 695f9e0..0065195 100644
--- a/modules/nixos/services/quassel/default.nix
+++ b/modules/nixos/services/quassel/default.nix
@@ -46,5 +46,9 @@ in
       # Because Quassel does not use the socket, I simply trust its connection
       authentication = "host quassel quassel localhost trust";
     };
+
+    my.system.persist.directories = [
+      config.services.quassel.dataDir
+    ];
   };
 }

From 217c69cc9f17aebd4231155caee27b86c7e901f5 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 5 Nov 2021 15:21:42 +0100
Subject: [PATCH 040/256] nixos: services: rss-bridge: persist data

---
 modules/nixos/services/rss-bridge/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/nixos/services/rss-bridge/default.nix b/modules/nixos/services/rss-bridge/default.nix
index 52b1030..977b431 100644
--- a/modules/nixos/services/rss-bridge/default.nix
+++ b/modules/nixos/services/rss-bridge/default.nix
@@ -22,5 +22,9 @@ in
       forceSSL = true;
       useACMEHost = config.networking.domain;
     };
+
+    my.system.persist.directories = [
+      config.services.rss-bridge.dataDir
+    ];
   };
 }

From 4c12fc00947dc6bd0e470c190d992f138d122dcc Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 5 Nov 2021 15:25:44 +0100
Subject: [PATCH 041/256] nixos: services: sabnzbd: persist data

---
 modules/nixos/services/sabnzbd/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/nixos/services/sabnzbd/default.nix b/modules/nixos/services/sabnzbd/default.nix
index 9e0d9c3..86202ab 100644
--- a/modules/nixos/services/sabnzbd/default.nix
+++ b/modules/nixos/services/sabnzbd/default.nix
@@ -24,6 +24,10 @@ in
       };
     };
 
+    my.system.persist.files = [
+      config.services.sabnzbd.configFile
+    ];
+
     services.fail2ban.jails = {
       sabnzbd = ''
         enabled = true

From 6b78d89065e7e18e8c0d0348e672f061b57d72c0 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 28 Nov 2024 21:47:51 +0000
Subject: [PATCH 042/256] nixos: services: tandoor-recipes: persist data

---
 modules/nixos/services/tandoor-recipes/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/nixos/services/tandoor-recipes/default.nix b/modules/nixos/services/tandoor-recipes/default.nix
index 219f4b9..0bfa9fe 100644
--- a/modules/nixos/services/tandoor-recipes/default.nix
+++ b/modules/nixos/services/tandoor-recipes/default.nix
@@ -89,6 +89,10 @@ in
       ];
     };
 
+    my.system.persist.directories = [
+      "/var/lib/tandoor-recipes"
+    ];
+
     # NOTE: unfortunately tandoor-recipes does not log connection failures for fail2ban
   };
 }

From a0b91a5d1803e1fcbdbd59ca606f60e105c3c675 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 5 Nov 2021 15:25:50 +0100
Subject: [PATCH 043/256] nixos: services: transmission: persist data

---
 modules/nixos/services/transmission/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/modules/nixos/services/transmission/default.nix b/modules/nixos/services/transmission/default.nix
index ac8b24d..a5393eb 100644
--- a/modules/nixos/services/transmission/default.nix
+++ b/modules/nixos/services/transmission/default.nix
@@ -91,6 +91,11 @@ in
       allowedUDPPorts = [ cfg.peerPort ];
     };
 
+    my.system.persist.directories = [
+      cfg.downloadBase
+      config.services.transmission.home
+    ];
+
     # NOTE: unfortunately transmission does not log connection failures for fail2ban
   };
 }

From ac9eeea26de385a24bacabd3753fc3b65d795d88 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 3 Nov 2021 14:43:16 +0100
Subject: [PATCH 044/256] nixos: services: vikunja: persist data

---
 modules/nixos/services/vikunja/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/nixos/services/vikunja/default.nix b/modules/nixos/services/vikunja/default.nix
index 2753da3..d902449 100644
--- a/modules/nixos/services/vikunja/default.nix
+++ b/modules/nixos/services/vikunja/default.nix
@@ -100,6 +100,10 @@ in
       ];
     };
 
+    my.system.persist.directories = [
+      config.services.vikunja.settings.files.basepath
+    ];
+
     # NOTE: unfortunately vikunja does not log connection failures for fail2ban
   };
 }

From 489802efbef40e576bbde3806f4e63e4c6683534 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 3 Nov 2021 14:43:16 +0100
Subject: [PATCH 045/256] WIP: add notes for missing persistence/backup

TODO:
* Do home-manager
* Look at for more inspiration github.com:nix-community/impermanence/pull/108
* Common files github.com:nix-community/impermanence/issues/10
* Useful config: github.com:chayleaf/dotfiles/blob/f77271b249e0c08368573c22a5c34f0737d3a766/system/modules/impermanence.nix
---
 modules/nixos/services/drone/runner-docker/default.nix     | 2 ++
 modules/nixos/services/drone/runner-exec/default.nix       | 2 ++
 modules/nixos/services/drone/server/default.nix            | 2 ++
 modules/nixos/services/nextcloud/collabora.nix             | 2 ++
 modules/nixos/services/woodpecker/agent-docker/default.nix | 2 ++
 modules/nixos/services/woodpecker/agent-exec/default.nix   | 2 ++
 modules/nixos/services/woodpecker/server/default.nix       | 2 ++
 modules/nixos/system/printing/default.nix                  | 2 ++
 8 files changed, 16 insertions(+)

diff --git a/modules/nixos/services/drone/runner-docker/default.nix b/modules/nixos/services/drone/runner-docker/default.nix
index e53c608..1db263b 100644
--- a/modules/nixos/services/drone/runner-docker/default.nix
+++ b/modules/nixos/services/drone/runner-docker/default.nix
@@ -39,5 +39,7 @@ in
       extraGroups = [ "docker" ]; # Give access to the daemon
     };
     users.groups.drone-runner-docker = { };
+
+    # FIXME: persistence?
   };
 }
diff --git a/modules/nixos/services/drone/runner-exec/default.nix b/modules/nixos/services/drone/runner-exec/default.nix
index a9bb563..c30a1a2 100644
--- a/modules/nixos/services/drone/runner-exec/default.nix
+++ b/modules/nixos/services/drone/runner-exec/default.nix
@@ -63,5 +63,7 @@ in
       group = "drone-runner-exec";
     };
     users.groups.drone-runner-exec = { };
+
+    # FIXME: persistence?
   };
 }
diff --git a/modules/nixos/services/drone/server/default.nix b/modules/nixos/services/drone/server/default.nix
index a3a1e49..b5d5df7 100644
--- a/modules/nixos/services/drone/server/default.nix
+++ b/modules/nixos/services/drone/server/default.nix
@@ -50,5 +50,7 @@ in
         inherit (cfg) port;
       };
     };
+
+    # FIXME: persistence?
   };
 }
diff --git a/modules/nixos/services/nextcloud/collabora.nix b/modules/nixos/services/nextcloud/collabora.nix
index f8f42a7..dce1a99 100644
--- a/modules/nixos/services/nextcloud/collabora.nix
+++ b/modules/nixos/services/nextcloud/collabora.nix
@@ -46,5 +46,7 @@ in
         ];
       };
     };
+
+    # FIXME: persistence?
   };
 }
diff --git a/modules/nixos/services/woodpecker/agent-docker/default.nix b/modules/nixos/services/woodpecker/agent-docker/default.nix
index 79d3299..2e74b67 100644
--- a/modules/nixos/services/woodpecker/agent-docker/default.nix
+++ b/modules/nixos/services/woodpecker/agent-docker/default.nix
@@ -38,5 +38,7 @@ in
         ];
       };
     };
+
+    # FIXME: persistence?
   };
 }
diff --git a/modules/nixos/services/woodpecker/agent-exec/default.nix b/modules/nixos/services/woodpecker/agent-exec/default.nix
index 24161b0..4210242 100644
--- a/modules/nixos/services/woodpecker/agent-exec/default.nix
+++ b/modules/nixos/services/woodpecker/agent-exec/default.nix
@@ -62,5 +62,7 @@ in
         ];
       };
     };
+
+    # FIXME: persistence?
   };
 }
diff --git a/modules/nixos/services/woodpecker/server/default.nix b/modules/nixos/services/woodpecker/server/default.nix
index adf533e..5d25284 100644
--- a/modules/nixos/services/woodpecker/server/default.nix
+++ b/modules/nixos/services/woodpecker/server/default.nix
@@ -61,5 +61,7 @@ in
         port = cfg.rpcPort;
       };
     };
+
+    # FIXME: persistence
   };
 }
diff --git a/modules/nixos/system/printing/default.nix b/modules/nixos/system/printing/default.nix
index 0dfab0f..3e21b25 100644
--- a/modules/nixos/system/printing/default.nix
+++ b/modules/nixos/system/printing/default.nix
@@ -65,5 +65,7 @@ in
       # Allow resolution of '.local' addresses
       nssmdns4 = true;
     };
+
+    # FIXME: persistence?
   };
 }

From c7fc4c2c679c5f28809d6a3d7621258245a40ff2 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 28 Nov 2024 22:00:58 +0000
Subject: [PATCH 046/256] WIP: even more directories? Maybe?

---
 modules/nixos/system/persist/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/nixos/system/persist/default.nix b/modules/nixos/system/persist/default.nix
index 212f902..2e7bb07 100644
--- a/modules/nixos/system/persist/default.nix
+++ b/modules/nixos/system/persist/default.nix
@@ -58,6 +58,10 @@ in
         "/var/log" # Logs
         "/var/lib/nixos" # UID/GID maps
         "/var/lib/systemd/coredump" # Coredumps
+
+        "/var/lib/systemd" # FIXME: needed?
+        "/var/spool" # FIXME: needed?
+        "/var/tmp" # FIXME: needed?
       ]
       ++ lib.unique cfg.directories
       ;

From 5abcc66191dc5323f8b77a7aec7c31b8a17eb007 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 28 Nov 2024 22:01:38 +0000
Subject: [PATCH 047/256] WIP: add note about 'iwd'

---
 modules/nixos/hardware/networking/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/nixos/hardware/networking/default.nix b/modules/nixos/hardware/networking/default.nix
index dac5e9a..9e85966 100644
--- a/modules/nixos/hardware/networking/default.nix
+++ b/modules/nixos/hardware/networking/default.nix
@@ -23,6 +23,8 @@ in
     (lib.mkIf cfg.wireless.enable {
       networking.networkmanager.enable = true;
 
+      # IWD needs persistence if enabled
+
       # Persist NetworkManager files
       my.system.persist.files = [
         "/var/lib/NetworkManager/secret_key"

From d5337709c63b6bfc26f369647ad9073a1285c14d Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 30 Nov 2024 13:31:01 +0000
Subject: [PATCH 048/256] fixup! WIP: even more directories? Maybe?

---
 modules/nixos/system/persist/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/nixos/system/persist/default.nix b/modules/nixos/system/persist/default.nix
index 2e7bb07..6e58502 100644
--- a/modules/nixos/system/persist/default.nix
+++ b/modules/nixos/system/persist/default.nix
@@ -58,7 +58,7 @@ in
         "/var/log" # Logs
         "/var/lib/nixos" # UID/GID maps
         "/var/lib/systemd/coredump" # Coredumps
-
+        "/var/lib/systemd/coredump"
         "/var/lib/systemd" # FIXME: needed?
         "/var/spool" # FIXME: needed?
         "/var/tmp" # FIXME: needed?

From b23cd9e891dd4165828408348daeef35c4a2053d Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 30 Nov 2024 13:31:01 +0000
Subject: [PATCH 049/256] fixup! WIP: nixos: system: add persist

---
 modules/nixos/system/persist/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/modules/nixos/system/persist/default.nix b/modules/nixos/system/persist/default.nix
index 6e58502..0a4f036 100644
--- a/modules/nixos/system/persist/default.nix
+++ b/modules/nixos/system/persist/default.nix
@@ -47,8 +47,9 @@ in
   config = lib.mkIf cfg.enable {
     environment.persistence."${cfg.mountPoint}" = {
       files = [
-        "/etc/machine-id" # Machine-specific ID
-        "/etc/adjtime" # Clock drift factor and offsets
+        "/etc/machine-id"
+        "/etc/adjtime"
+        "/var/lib/systemd/timesync/clock"
       ]
       ++ lib.unique cfg.files
       ;

From d31e8a35b731ca7be1123f8253d04d41cde8c13b Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 30 Nov 2024 13:31:01 +0000
Subject: [PATCH 050/256] fixup! WIP: nixos: system: add persist

---
 modules/nixos/system/persist/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/nixos/system/persist/default.nix b/modules/nixos/system/persist/default.nix
index 0a4f036..4f1fc4a 100644
--- a/modules/nixos/system/persist/default.nix
+++ b/modules/nixos/system/persist/default.nix
@@ -56,7 +56,7 @@ in
 
       directories = [
         "/etc/nixos" # In case it's storage directory of our configuration
-        "/var/log" # Logs
+        "/var/log"
         "/var/lib/nixos" # UID/GID maps
         "/var/lib/systemd/coredump" # Coredumps
         "/var/lib/systemd/coredump"

From 3ebd6f47a322a7582ac16386fc839da69e8505d0 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 4 Dec 2024 19:59:09 +0000
Subject: [PATCH 051/256] fixup! fixup! WIP: even more directories? Maybe?

---
 modules/nixos/system/persist/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/nixos/system/persist/default.nix b/modules/nixos/system/persist/default.nix
index 4f1fc4a..f7178c2 100644
--- a/modules/nixos/system/persist/default.nix
+++ b/modules/nixos/system/persist/default.nix
@@ -58,7 +58,6 @@ in
         "/etc/nixos" # In case it's storage directory of our configuration
         "/var/log"
         "/var/lib/nixos" # UID/GID maps
-        "/var/lib/systemd/coredump" # Coredumps
         "/var/lib/systemd/coredump"
         "/var/lib/systemd" # FIXME: needed?
         "/var/spool" # FIXME: needed?

From 0a8b2b8e5500501e9efb38122ccaf8e146a7a548 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 4 Dec 2024 19:59:09 +0000
Subject: [PATCH 052/256] fixup! fixup! WIP: even more directories? Maybe?

---
 modules/nixos/system/persist/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/nixos/system/persist/default.nix b/modules/nixos/system/persist/default.nix
index f7178c2..ac1820e 100644
--- a/modules/nixos/system/persist/default.nix
+++ b/modules/nixos/system/persist/default.nix
@@ -59,6 +59,7 @@ in
         "/var/log"
         "/var/lib/nixos" # UID/GID maps
         "/var/lib/systemd/coredump"
+
         "/var/lib/systemd" # FIXME: needed?
         "/var/spool" # FIXME: needed?
         "/var/tmp" # FIXME: needed?

From 98c90d77c51b74dc5888c7e0647fdd9f35511964 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 28 Nov 2024 12:50:29 +0000
Subject: [PATCH 053/256] home: tmux: add sloppy window switching bindings

Another set of bindings which were setup by `tmux-sensible`, that I want
to enable explicitly to avoid issues when it is disabled by default.
---
 modules/home/tmux/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/home/tmux/default.nix b/modules/home/tmux/default.nix
index 23dff05..bb23b44 100644
--- a/modules/home/tmux/default.nix
+++ b/modules/home/tmux/default.nix
@@ -84,6 +84,10 @@ in
       # Refresh configuration
       bind-key -N "Source tmux.conf" R source-file ${config.xdg.configHome}/tmux/tmux.conf \; display-message "Sourced tmux.conf!"
 
+      # Accept sloppy Ctrl key when switching windows, on top of default mapping
+      bind-key -N "Select the previous window" C-p previous-window
+      bind-key -N "Select the next window" C-n next-window
+
       # Better vim mode
       bind-key -T copy-mode-vi 'v' send -X begin-selection
       ${

From c74acda957fb2fb86560e7507390b482b2705ebf Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 28 Nov 2024 19:58:50 +0000
Subject: [PATCH 054/256] nixos: system: packages: remove 'wget'

---
 modules/nixos/system/packages/default.nix | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/modules/nixos/system/packages/default.nix b/modules/nixos/system/packages/default.nix
index ebea06f..6a78ff6 100644
--- a/modules/nixos/system/packages/default.nix
+++ b/modules/nixos/system/packages/default.nix
@@ -1,5 +1,5 @@
 # Common packages
-{ config, lib, pkgs, ... }:
+{ config, lib, ... }:
 let
   cfg = config.my.system.packages;
 in
@@ -13,10 +13,6 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    environment.systemPackages = with pkgs; [
-      wget
-    ];
-
     programs = {
       vim = {
         enable = true;

From 3ac85b87623fb4d64c93c996d21ffac7fd832979 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 29 Nov 2024 14:29:32 +0000
Subject: [PATCH 055/256] home: packages: add 'tree'

---
 modules/home/packages/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/home/packages/default.nix b/modules/home/packages/default.nix
index 1362a06..b0f8d67 100644
--- a/modules/home/packages/default.nix
+++ b/modules/home/packages/default.nix
@@ -26,6 +26,7 @@ in
       fd
       file
       ripgrep
+      tree
     ] ++ cfg.additionalPackages);
 
     nixpkgs.config = {

From baa853477d78bfd63cbed78c1d9e703a4d8c3d9d Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 2 Dec 2024 20:36:37 +0000
Subject: [PATCH 056/256] nixos: hardware: sound: remove ALSA

`sound.enable` was removed from the latest release, and is unnecessary
with PulseAudio.
---
 modules/nixos/hardware/sound/default.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/modules/nixos/hardware/sound/default.nix b/modules/nixos/hardware/sound/default.nix
index e8ba7f7..1cf12cb 100644
--- a/modules/nixos/hardware/sound/default.nix
+++ b/modules/nixos/hardware/sound/default.nix
@@ -54,9 +54,6 @@ in
 
     # Pulseaudio setup
     (lib.mkIf cfg.pulse.enable {
-      # ALSA
-      sound.enable = true;
-
       hardware.pulseaudio.enable = true;
     })
   ]);

From ad1cfbd6f03e0b38f690d8563af02c1c04d8b731 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 3 Dec 2024 10:43:09 +0000
Subject: [PATCH 057/256] flake: bump inputs

Allow-list the build inputs for `sonarr` until the package is fixed
upstream [1].

[1]: https://github.com/NixOS/nixpkgs/issues/360592
---
 flake.lock                                 | 18 +++++++++---------
 modules/nixos/services/servarr/default.nix | 10 ++++++++++
 2 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index cd3f50c..0aeab37 100644
--- a/flake.lock
+++ b/flake.lock
@@ -136,11 +136,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1732482255,
-        "narHash": "sha256-GUffLwzawz5WRVfWaWCg78n/HrBJrOG7QadFY6rtV8A=",
+        "lastModified": 1733175814,
+        "narHash": "sha256-zFOtOaqjzZfPMsm1mwu98syv3y+jziAq5DfWygaMtLg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "a9953635d7f34e7358d5189751110f87e3ac17da",
+        "rev": "bf23fe41082aa0289c209169302afd3397092f22",
         "type": "github"
       },
       "original": {
@@ -152,11 +152,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1732521221,
-        "narHash": "sha256-2ThgXBUXAE1oFsVATK1ZX9IjPcS4nKFOAjhPNKuiMn0=",
+        "lastModified": 1733015953,
+        "narHash": "sha256-t4BBVpwG9B4hLgc6GUBuj3cjU7lP/PJfpTHuSqE+crk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4633a7c72337ea8fd23a4f2ba3972865e3ec685d",
+        "rev": "ac35b104800bff9028425fec3b6e8a41de2bbfff",
         "type": "github"
       },
       "original": {
@@ -168,11 +168,11 @@
     },
     "nur": {
       "locked": {
-        "lastModified": 1732704680,
-        "narHash": "sha256-x3NlO2qzuobU9BrynzydX7X9oskJpysv7BI7DJ5cVSE=",
+        "lastModified": 1733215745,
+        "narHash": "sha256-RIlhnKlObJ1sEdzBP6Nuy4jLUiQnmWWXVsRHRbv6SzY=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "31a30f0862fd8b5f88a6597382bb09197356b19e",
+        "rev": "251d756a74e67bda25d89327b01a3da19dddabae",
         "type": "github"
       },
       "original": {
diff --git a/modules/nixos/services/servarr/default.nix b/modules/nixos/services/servarr/default.nix
index e25d9cf..4aa0de7 100644
--- a/modules/nixos/services/servarr/default.nix
+++ b/modules/nixos/services/servarr/default.nix
@@ -96,5 +96,15 @@ in
     # Sonarr for shows
     (mkFullConfig "sonarr")
     (mkFail2Ban "sonarr")
+
+    # HACK: until https://github.com/NixOS/nixpkgs/issues/360592 is resolved
+    (lib.mkIf cfg.sonarr.enable {
+      nixpkgs.config.permittedInsecurePackages = [
+        "aspnetcore-runtime-6.0.36"
+        "aspnetcore-runtime-wrapped-6.0.36"
+        "dotnet-sdk-6.0.428"
+        "dotnet-sdk-wrapped-6.0.428"
+      ];
+    })
   ]);
 }

From 35c547a090afdf77a1fb42125170649ef1247ab8 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 3 Dec 2024 10:43:33 +0000
Subject: [PATCH 058/256] home: tmux: enable focus events

Since `tmux-sensible` was disabled by default, we should enable this
explicitly now.
---
 modules/home/tmux/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/home/tmux/default.nix b/modules/home/tmux/default.nix
index bb23b44..ae8b8f0 100644
--- a/modules/home/tmux/default.nix
+++ b/modules/home/tmux/default.nix
@@ -48,6 +48,7 @@ in
     escapeTime = 0; # Let vim do its thing instead
     historyLimit = 100000; # Bigger buffer
     mouse = false; # I dislike mouse support
+    focusEvents = true; # Report focus events
     terminal = "tmux-256color"; # I want accurate termcap info
 
     plugins = with pkgs.tmuxPlugins; [

From 19120bca2943d5a03d9116bc547f89197059694b Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 8 Dec 2024 16:08:48 -0500
Subject: [PATCH 059/256] nixos: hardware: graphics: use 'initrd' option

---
 modules/nixos/hardware/graphics/default.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/modules/nixos/hardware/graphics/default.nix b/modules/nixos/hardware/graphics/default.nix
index 89bb1cd..7d8b359 100644
--- a/modules/nixos/hardware/graphics/default.nix
+++ b/modules/nixos/hardware/graphics/default.nix
@@ -33,9 +33,8 @@ in
 
     # AMD GPU
     (lib.mkIf (cfg.gpuFlavor == "amd") {
-      boot.initrd.kernelModules = lib.mkIf cfg.amd.enableKernelModule [ "amdgpu" ];
-
       hardware.amdgpu = {
+        initrd.enable = cfg.amd.enableKernelModule;
         # Vulkan
         amdvlk = lib.mkIf cfg.amd.amdvlk {
           enable = true;

From cb5eb68d35ce1a70c8d7b8560b23586f065c79e1 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 11 Dec 2024 00:46:47 +0100
Subject: [PATCH 060/256] flake: bump inputs

And fix deprecated NUR overlay attribute.
---
 flake.lock             | 60 +++++++++++++++++++++++++++++++-----------
 flake.nix              |  4 +++
 flake/home-manager.nix |  2 +-
 flake/nixos.nix        |  2 +-
 4 files changed, 51 insertions(+), 17 deletions(-)

diff --git a/flake.lock b/flake.lock
index 0aeab37..0db428a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1730504689,
-        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
+        "lastModified": 1733312601,
+        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
+        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
         "type": "github"
       },
       "original": {
@@ -136,11 +136,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1733175814,
-        "narHash": "sha256-zFOtOaqjzZfPMsm1mwu98syv3y+jziAq5DfWygaMtLg=",
+        "lastModified": 1733873195,
+        "narHash": "sha256-dTosiZ3sZ/NKoLKQ++v8nZdEHya0eTNEsaizNp+MUPM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "bf23fe41082aa0289c209169302afd3397092f22",
+        "rev": "f26aa4b76fb7606127032d33ac73d7d507d82758",
         "type": "github"
       },
       "original": {
@@ -152,11 +152,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1733015953,
-        "narHash": "sha256-t4BBVpwG9B4hLgc6GUBuj3cjU7lP/PJfpTHuSqE+crk=",
+        "lastModified": 1733759999,
+        "narHash": "sha256-463SNPWmz46iLzJKRzO3Q2b0Aurff3U1n0nYItxq7jU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ac35b104800bff9028425fec3b6e8a41de2bbfff",
+        "rev": "a73246e2eef4c6ed172979932bc80e1404ba2d56",
         "type": "github"
       },
       "original": {
@@ -167,12 +167,21 @@
       }
     },
     "nur": {
+      "inputs": {
+        "flake-parts": [
+          "flake-parts"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "treefmt-nix": "treefmt-nix"
+      },
       "locked": {
-        "lastModified": 1733215745,
-        "narHash": "sha256-RIlhnKlObJ1sEdzBP6Nuy4jLUiQnmWWXVsRHRbv6SzY=",
+        "lastModified": 1733873876,
+        "narHash": "sha256-6YHWh0+E74hBiH0N+LeZPSWRvbmudF6mtEtFpRo3LWc=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "251d756a74e67bda25d89327b01a3da19dddabae",
+        "rev": "77c8486c65517272727884ca62b9322092f4f643",
         "type": "github"
       },
       "original": {
@@ -194,11 +203,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1732021966,
-        "narHash": "sha256-mnTbjpdqF0luOkou8ZFi2asa1N3AA2CchR/RqCNmsGE=",
+        "lastModified": 1733665616,
+        "narHash": "sha256-+XTFXYlFJBxohhMGLDpYdEnhUNdxN8dyTA8WAd+lh2A=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "3308484d1a443fc5bc92012435d79e80458fe43c",
+        "rev": "d8c02f0ffef0ef39f6063731fc539d8c71eb463a",
         "type": "github"
       },
       "original": {
@@ -235,6 +244,27 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nur",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1733222881,
+        "narHash": "sha256-JIPcz1PrpXUCbaccEnrcUS8jjEb/1vJbZz5KkobyFdM=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "49717b5af6f80172275d47a418c9719a31a78b53",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
     }
   },
   "root": "root",
diff --git a/flake.nix b/flake.nix
index a07ee15..f0bb79c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -55,6 +55,10 @@
       owner = "nix-community";
       repo = "NUR";
       ref = "master";
+      inputs = {
+        flake-parts.follows = "flake-parts";
+        nixpkgs.follows = "nixpkgs";
+      };
     };
 
     pre-commit-hooks = {
diff --git a/flake/home-manager.nix b/flake/home-manager.nix
index 34af375..add889e 100644
--- a/flake/home-manager.nix
+++ b/flake/home-manager.nix
@@ -25,7 +25,7 @@ let
       inherit system;
 
       overlays = (lib.attrValues self.overlays) ++ [
-        inputs.nur.overlay
+        inputs.nur.overlays.default
       ];
     };
 
diff --git a/flake/nixos.nix b/flake/nixos.nix
index b48b551..fa656dc 100644
--- a/flake/nixos.nix
+++ b/flake/nixos.nix
@@ -7,7 +7,7 @@ let
     }
     {
       nixpkgs.overlays = (lib.attrValues self.overlays) ++ [
-        inputs.nur.overlay
+        inputs.nur.overlays.default
       ];
     }
     # Include generic settings

From c5a375d1657cac9ed2b2aa449c9380298a390ad7 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 11 Dec 2024 00:48:54 +0100
Subject: [PATCH 061/256] nixos: services: paperless: use automatic DB setup

That way I don't have to worry about the `postgresql.service` dependency
anymore :-).
---
 modules/nixos/services/paperless/default.nix | 40 ++------------------
 1 file changed, 3 insertions(+), 37 deletions(-)

diff --git a/modules/nixos/services/paperless/default.nix b/modules/nixos/services/paperless/default.nix
index c8967e1..63f456b 100644
--- a/modules/nixos/services/paperless/default.nix
+++ b/modules/nixos/services/paperless/default.nix
@@ -61,11 +61,6 @@ in
           PAPERLESS_ENABLE_HTTP_REMOTE_USER = true;
           PAPERLESS_HTTP_REMOTE_USER_HEADER_NAME = "HTTP_X_USER";
 
-          # Use PostgreSQL
-          PAPERLESS_DBHOST = "/run/postgresql";
-          PAPERLESS_DBUSER = "paperless";
-          PAPERLESS_DBNAME = "paperless";
-
           # Security settings
           PAPERLESS_ALLOWED_HOSTS = paperlessDomain;
           PAPERLESS_CORS_ALLOWED_HOSTS = "https://${paperlessDomain}";
@@ -87,40 +82,11 @@ in
 
       # Secret key
       environmentFile = cfg.secretKeyFile;
-    };
 
-    systemd.services = {
-      paperless-scheduler = {
-        requires = [ "postgresql.service" ];
-        after = [ "postgresql.service" ];
+      # Automatic PostgreSQL provisioning
+      database = {
+        createLocally = true;
       };
-
-      paperless-consumer = {
-        requires = [ "postgresql.service" ];
-        after = [ "postgresql.service" ];
-      };
-
-      paperless-web = {
-        requires = [ "postgresql.service" ];
-        after = [ "postgresql.service" ];
-      };
-
-      paperless-task-queue = {
-        requires = [ "postgresql.service" ];
-        after = [ "postgresql.service" ];
-      };
-    };
-
-    # Set-up database
-    services.postgresql = {
-      enable = true;
-      ensureDatabases = [ "paperless" ];
-      ensureUsers = [
-        {
-          name = "paperless";
-          ensureDBOwnership = true;
-        }
-      ];
     };
 
     # Set-up media group

From b2d2ff179840437f5659102c03356a112c2c24df Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 16 Dec 2024 00:19:31 +0100
Subject: [PATCH 062/256] nixos: services: postgres: fix renamed option

---
 modules/nixos/services/postgresql/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/nixos/services/postgresql/default.nix b/modules/nixos/services/postgresql/default.nix
index bbe46d4..3dcf6d1 100644
--- a/modules/nixos/services/postgresql/default.nix
+++ b/modules/nixos/services/postgresql/default.nix
@@ -27,11 +27,11 @@ in
 
           oldPackage = if pgCfg.enableJIT then pgCfg.package.withJIT else pgCfg.package;
           oldData = pgCfg.dataDir;
-          oldBin = "${if pgCfg.extraPlugins == [] then oldPackage else oldPackage.withPackages pgCfg.extraPlugins}/bin";
+          oldBin = "${if pgCfg.extensions == [] then oldPackage else oldPackage.withPackages pgCfg.extensions}/bin";
 
           newPackage = if pgCfg.enableJIT then newPackage'.withJIT else newPackage';
           newData = "/var/lib/postgresql/${newPackage.psqlSchema}";
-          newBin = "${if pgCfg.extraPlugins == [] then newPackage else newPackage.withPackages pgCfg.extraPlugins}/bin";
+          newBin = "${if pgCfg.extensions == [] then newPackage else newPackage.withPackages pgCfg.extensions}/bin";
         in
         [
           (pkgs.writeScriptBin "upgrade-pg-cluster" ''

From dec5dabf02ed6a901f9f9feb97ffcd8973e54237 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 16 Dec 2024 00:20:18 +0100
Subject: [PATCH 063/256] modules: services: postgres: upgrade version

---
 modules/nixos/services/postgresql/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/nixos/services/postgresql/default.nix b/modules/nixos/services/postgresql/default.nix
index 3dcf6d1..1dca164 100644
--- a/modules/nixos/services/postgresql/default.nix
+++ b/modules/nixos/services/postgresql/default.nix
@@ -14,7 +14,7 @@ in
     # Let other services enable postgres when they need it
     (lib.mkIf cfg.enable {
       services.postgresql = {
-        package = pkgs.postgresql_13;
+        package = pkgs.postgresql_17;
       };
     })
 
@@ -23,7 +23,7 @@ in
       environment.systemPackages =
         let
           pgCfg = config.services.postgresql;
-          newPackage' = pkgs.postgresql_13;
+          newPackage' = pkgs.postgresql_17;
 
           oldPackage = if pgCfg.enableJIT then pgCfg.package.withJIT else pgCfg.package;
           oldData = pgCfg.dataDir;

From 747b344b766e22ac7bb3ba4152db60de49cd12be Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 15 Dec 2024 17:50:43 -0500
Subject: [PATCH 064/256] pkgs: remove 'cgt-calc'

It's been merged upstream.
---
 pkgs/cgt-calc/default.nix | 47 ---------------------------------------
 pkgs/default.nix          |  2 --
 2 files changed, 49 deletions(-)
 delete mode 100644 pkgs/cgt-calc/default.nix

diff --git a/pkgs/cgt-calc/default.nix b/pkgs/cgt-calc/default.nix
deleted file mode 100644
index 9966944..0000000
--- a/pkgs/cgt-calc/default.nix
+++ /dev/null
@@ -1,47 +0,0 @@
-{ lib
-, fetchFromGitHub
-, python3Packages
-, withTeXLive ? true
-, texliveSmall
-}:
-python3Packages.buildPythonApplication rec {
-  pname = "cgt-calc";
-  version = "1.13.0";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "KapJI";
-    repo = "capital-gains-calculator";
-    rev = "v${version}";
-    hash = "sha256-y/Y05wG89nccXyxfjqazyPJhd8dOkfwRJre+Rzx97Hw=";
-  };
-
-  build-system = with python3Packages; [
-    poetry-core
-  ];
-
-  dependencies = with python3Packages; [
-    defusedxml
-    jinja2
-    pandas
-    requests
-    types-requests
-    yfinance
-  ];
-
-  makeWrapperArgs = lib.optionals withTeXLive [
-    "--prefix"
-    "PATH"
-    ":"
-    "${lib.getBin texliveSmall}/bin"
-  ];
-
-  meta = with lib; {
-    description = "UK capital gains tax calculator";
-    homepage = "https://github.com/KapJI/capital-gains-calculator";
-    license = with licenses; [ mit ];
-    mainProgram = "cgt-calc";
-    maintainers = with maintainers; [ ambroisie ];
-    platforms = platforms.unix;
-  };
-}
diff --git a/pkgs/default.nix b/pkgs/default.nix
index 949bcf7..6b7fce1 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -2,8 +2,6 @@
 pkgs.lib.makeScope pkgs.newScope (pkgs: {
   bw-pass = pkgs.callPackage ./bw-pass { };
 
-  cgt-calc = pkgs.callPackage ./cgt-calc { };
-
   change-audio = pkgs.callPackage ./change-audio { };
 
   change-backlight = pkgs.callPackage ./change-backlight { };

From 92e5fbe7df0c74a33baccfdb9fc82859217e0b3a Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 18 Dec 2024 20:12:46 -0500
Subject: [PATCH 065/256] overlays: add 'lsp-format-nvim-indentation'

To fix the issue I reported upstream [1].

[1]: https://github.com/lukas-reineke/lsp-format.nvim/issues/94
---
 overlays/lsp-format-nvim-indentation/default.nix   |  4 ++++
 overlays/lsp-format-nvim-indentation/generated.nix | 14 ++++++++++++++
 2 files changed, 18 insertions(+)
 create mode 100644 overlays/lsp-format-nvim-indentation/default.nix
 create mode 100644 overlays/lsp-format-nvim-indentation/generated.nix

diff --git a/overlays/lsp-format-nvim-indentation/default.nix b/overlays/lsp-format-nvim-indentation/default.nix
new file mode 100644
index 0000000..832e71d
--- /dev/null
+++ b/overlays/lsp-format-nvim-indentation/default.nix
@@ -0,0 +1,4 @@
+self: prev:
+{
+  vimPlugins = prev.vimPlugins.extend (self.callPackage ./generated.nix { });
+}
diff --git a/overlays/lsp-format-nvim-indentation/generated.nix b/overlays/lsp-format-nvim-indentation/generated.nix
new file mode 100644
index 0000000..1902207
--- /dev/null
+++ b/overlays/lsp-format-nvim-indentation/generated.nix
@@ -0,0 +1,14 @@
+{ fetchpatch, ... }:
+
+_final: prev: {
+  lsp-format-nvim = prev.lsp-format-nvim.overrideAttrs (oa: {
+    patches = (oa.patches or [ ]) ++ [
+      # https://github.com/lukas-reineke/lsp-format.nvim/issues/94
+      (fetchpatch {
+        name = "use-effective-indentation";
+        url = "https://github.com/liskin/lsp-format.nvim/commit/3757ac443bdf5bd166673833794553229ee8d939.patch";
+        hash = "sha256-Dv+TvXrU/IrrPxz2MSPbLmRxch+qkHbI3AyFMj/ssDk=";
+      })
+    ];
+  });
+}

From 322fbc970b12c187eb32a3c6ea57fe81cb4625db Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 18 Dec 2024 20:14:16 -0500
Subject: [PATCH 066/256] home: vim: lsp: rely on 'bashls' formatting

I finally figured out why I was getting the wrong indentation, turns out
it was an issue in `lsp-format.nvim`. With that fixed/worked around, I
can now rely completely on `bash-language-server` for formatting.

I'll also rely on `shfmt` automatically detecting the type of file, as
(Neo)Vim cannot be made to reliably set `ft=bash` for Bash scripts and
`ft=sh` for POSIX shell.

Finally, I removed spaces after redirections, I've now come around to
liking the default (no spaces) better.
---
 .../home/vim/plugin/settings/lspconfig.lua    | 10 +++++++
 modules/home/vim/plugin/settings/null-ls.lua  | 26 -------------------
 2 files changed, 10 insertions(+), 26 deletions(-)

diff --git a/modules/home/vim/plugin/settings/lspconfig.lua b/modules/home/vim/plugin/settings/lspconfig.lua
index 9e9425c..1f9abfd 100644
--- a/modules/home/vim/plugin/settings/lspconfig.lua
+++ b/modules/home/vim/plugin/settings/lspconfig.lua
@@ -74,6 +74,16 @@ if utils.is_executable("bash-language-server") then
         filetypes = { "bash", "sh", "zsh" },
         capabilities = capabilities,
         on_attach = lsp.on_attach,
+        settings = {
+            bashIde = {
+                shfmt = {
+                    -- Simplify the code
+                    simplifyCode = true,
+                    -- Indent switch cases
+                    caseIndent = true,
+                },
+            },
+        },
     })
 end
 
diff --git a/modules/home/vim/plugin/settings/null-ls.lua b/modules/home/vim/plugin/settings/null-ls.lua
index eadf16a..258a209 100644
--- a/modules/home/vim/plugin/settings/null-ls.lua
+++ b/modules/home/vim/plugin/settings/null-ls.lua
@@ -46,29 +46,3 @@ null_ls.register({
         condition = utils.is_executable_condition("isort"),
     }),
 })
-
--- Shell (non-POSIX)
-null_ls.register({
-    null_ls.builtins.formatting.shfmt.with({
-        -- Indent with 4 spaces, simplify the code, indent switch cases,
-        -- add space after redirection, use bash dialect
-        extra_args = { "-i", "4", "-s", "-ci", "-sr", "-ln", "bash" },
-        -- Restrict to bash and zsh
-        filetypes = { "bash", "zsh" },
-        -- Only used if available
-        condition = utils.is_executable_condition("shfmt"),
-    }),
-})
-
--- Shell (POSIX)
-null_ls.register({
-    null_ls.builtins.formatting.shfmt.with({
-        -- Indent with 4 spaces, simplify the code, indent switch cases,
-        -- add space after redirection, use POSIX
-        extra_args = { "-i", "4", "-s", "-ci", "-sr", "-ln", "posix" },
-        -- Restrict to POSIX sh
-        filetypes = { "sh" },
-        -- Only used if available
-        condition = utils.is_executable_condition("shfmt"),
-    }),
-})

From f4f1aad1c08bc232908cb8ce3e3ee2a0b6c38645 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 18 Dec 2024 20:33:22 -0500
Subject: [PATCH 067/256] pkgs: fix shell formatting

Ran `shfmt --write --indent 4 --simplify --case-indent`, in accordance
with my editor settings.
---
 pkgs/bw-pass/bw-pass           |  2 +-
 pkgs/change-audio/change-audio |  2 +-
 pkgs/diff-flake/diff-flake     | 14 +++++++-------
 pkgs/osc52/osc52               |  2 +-
 pkgs/osc777/osc777             |  2 +-
 5 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/pkgs/bw-pass/bw-pass b/pkgs/bw-pass/bw-pass
index 124714a..0e974b7 100755
--- a/pkgs/bw-pass/bw-pass
+++ b/pkgs/bw-pass/bw-pass
@@ -66,7 +66,7 @@ query_password() {
     printf '%s\n' "$PASSWORD"
 }
 
-if [ $# -lt 1  ] || [ $# -gt 2 ]; then
+if [ $# -lt 1 ] || [ $# -gt 2 ]; then
     usage
     exit 1
 fi
diff --git a/pkgs/change-audio/change-audio b/pkgs/change-audio/change-audio
index 612fecf..5a1fb9c 100755
--- a/pkgs/change-audio/change-audio
+++ b/pkgs/change-audio/change-audio
@@ -62,7 +62,7 @@ do_toggle() {
 }
 
 case "$1" in
-    up|down)
+    up | down)
         do_change_volume "$@"
         ;;
     toggle)
diff --git a/pkgs/diff-flake/diff-flake b/pkgs/diff-flake/diff-flake
index 0572b4e..a2a3513 100755
--- a/pkgs/diff-flake/diff-flake
+++ b/pkgs/diff-flake/diff-flake
@@ -81,23 +81,23 @@ parse_args() {
         shift
 
         case "$opt" in
-            -h|--help)
+            -h | --help)
                 usage
                 exit
                 ;;
-            -f|--flake-output)
+            -f | --flake-output)
                 FLAKE_OUTPUTS+=("$1")
                 shift
                 ;;
-            -o|--output)
+            -o | --output)
                 OUTPUT_FILE="$1"
                 shift
                 ;;
-            -n|--new-rev)
+            -n | --new-rev)
                 NEW_REV="$(git rev-parse "$1")"
                 shift
                 ;;
-            -p|--previous-rev)
+            -p | --previous-rev)
                 PREVIOUS_REV="$(git rev-parse "$1")"
                 shift
                 ;;
@@ -157,7 +157,7 @@ list_dev_shells() {
 }
 
 diff_output() {
-    local PREV NEW;
+    local PREV NEW
     PREV="$(mktemp --dry-run)"
     NEW="$(mktemp --dry-run)"
 
@@ -169,7 +169,7 @@ diff_output() {
         printf 'Closure diff for `%s`:\n```\n' "$1"
         nix store diff-closures "$PREV" "$NEW" | sanitize_output
         printf '```\n\n'
-    } >> "$OUTPUT_FILE"
+    } >>"$OUTPUT_FILE"
 }
 
 parse_args "$@"
diff --git a/pkgs/osc52/osc52 b/pkgs/osc52/osc52
index f64ccb6..de3a982 100755
--- a/pkgs/osc52/osc52
+++ b/pkgs/osc52/osc52
@@ -15,7 +15,7 @@ usage() {
         exec 1>&2
     fi
 
-    cat << EOF
+    cat <<EOF
 Usage: $0 [options] [string]
 Send an arbitrary string to the terminal clipboard using the OSC 52 escape
 sequence as specified in xterm:
diff --git a/pkgs/osc777/osc777 b/pkgs/osc777/osc777
index 83d066f..9bcac03 100755
--- a/pkgs/osc777/osc777
+++ b/pkgs/osc777/osc777
@@ -13,7 +13,7 @@ usage() {
         exec 1>&2
     fi
 
-    cat << EOF
+    cat <<EOF
 Usage: $0 [options] <title> <message>
 Send a notification (title and message) to the host system using the OSC 777
 escape sequence:

From c75a307c58f3280fa326f764a1517a04e37898ec Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 18 Dec 2024 20:39:15 -0500
Subject: [PATCH 068/256] home: wm: i3: fix 'pavucontrol' float

---
 modules/home/wm/i3/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/wm/i3/default.nix b/modules/home/wm/i3/default.nix
index c432864..ec4f87f 100644
--- a/modules/home/wm/i3/default.nix
+++ b/modules/home/wm/i3/default.nix
@@ -127,7 +127,7 @@ in
             { class = "^Blueman-.*$"; }
             { title = "^htop$"; }
             { class = "^Thunderbird$"; instance = "Mailnews"; window_role = "filterlist"; }
-            { class = "^Pavucontrol.*$"; }
+            { class = "^pavucontrol.*$"; }
             { class = "^Arandr$"; }
             { class = ".?blueman-manager.*$"; }
           ];

From ead8101b8d94e88dd648a694d117bc8f4f10fcd7 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 18 Dec 2024 20:45:52 -0500
Subject: [PATCH 069/256] home: wm: i3: match 'blueman' float explicitly

This is more of a work-around due to the wrapper in nixpkgs' packaging
of that application, so might as well make that explicit and narrow.
---
 modules/home/wm/i3/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/wm/i3/default.nix b/modules/home/wm/i3/default.nix
index ec4f87f..92d1381 100644
--- a/modules/home/wm/i3/default.nix
+++ b/modules/home/wm/i3/default.nix
@@ -129,7 +129,7 @@ in
             { class = "^Thunderbird$"; instance = "Mailnews"; window_role = "filterlist"; }
             { class = "^pavucontrol.*$"; }
             { class = "^Arandr$"; }
-            { class = ".?blueman-manager.*$"; }
+            { class = "^\\.blueman-manager-wrapped$"; }
           ];
         };
 

From b7b6705391fccf00ca277f57bb8b730fc0e78bf1 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 18 Dec 2024 20:47:24 -0500
Subject: [PATCH 070/256] home: wm: i3: make 'arandr' float

Another work-around due to a wrapper in nixpkgs.
---
 modules/home/wm/i3/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/home/wm/i3/default.nix b/modules/home/wm/i3/default.nix
index 92d1381..029a14b 100644
--- a/modules/home/wm/i3/default.nix
+++ b/modules/home/wm/i3/default.nix
@@ -130,6 +130,7 @@ in
             { class = "^pavucontrol.*$"; }
             { class = "^Arandr$"; }
             { class = "^\\.blueman-manager-wrapped$"; }
+            { class = "^\\.arandr-wrapped$"; }
           ];
         };
 

From 5cae5632d31be145211fb927eed6af24216db3b8 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 21 Dec 2024 17:06:37 -0500
Subject: [PATCH 071/256] flake: bump inputs

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 0db428a..bc1d34b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -136,11 +136,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1733873195,
-        "narHash": "sha256-dTosiZ3sZ/NKoLKQ++v8nZdEHya0eTNEsaizNp+MUPM=",
+        "lastModified": 1734808199,
+        "narHash": "sha256-MxlUcLjE8xLbrI1SJ2B2jftlg4wdutEILa3fgqwA98I=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "f26aa4b76fb7606127032d33ac73d7d507d82758",
+        "rev": "f342df3ad938f205a913973b832f52c12546aac6",
         "type": "github"
       },
       "original": {
@@ -152,11 +152,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1733759999,
-        "narHash": "sha256-463SNPWmz46iLzJKRzO3Q2b0Aurff3U1n0nYItxq7jU=",
+        "lastModified": 1734424634,
+        "narHash": "sha256-cHar1vqHOOyC7f1+tVycPoWTfKIaqkoe1Q6TnKzuti4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a73246e2eef4c6ed172979932bc80e1404ba2d56",
+        "rev": "d3c42f187194c26d9f0309a8ecc469d6c878ce33",
         "type": "github"
       },
       "original": {
@@ -177,11 +177,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1733873876,
-        "narHash": "sha256-6YHWh0+E74hBiH0N+LeZPSWRvbmudF6mtEtFpRo3LWc=",
+        "lastModified": 1734810357,
+        "narHash": "sha256-Oa6d+y1/PVaPrZ/GYwvmTK9kSrc5Qx/8D3DFN2TzpVA=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "77c8486c65517272727884ca62b9322092f4f643",
+        "rev": "e7b7b92a7c97a91f1465ab433bbdf6d00df1db8e",
         "type": "github"
       },
       "original": {
@@ -203,11 +203,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1733665616,
-        "narHash": "sha256-+XTFXYlFJBxohhMGLDpYdEnhUNdxN8dyTA8WAd+lh2A=",
+        "lastModified": 1734797603,
+        "narHash": "sha256-ulZN7ps8nBV31SE+dwkDvKIzvN6hroRY8sYOT0w+E28=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "d8c02f0ffef0ef39f6063731fc539d8c71eb463a",
+        "rev": "f0f0dc4920a903c3e08f5bdb9246bb572fcae498",
         "type": "github"
       },
       "original": {

From e65b3ed1fc7977b9214c5bdbe1369c3decc96454 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 23 Dec 2024 22:42:42 -0500
Subject: [PATCH 072/256] home: vim: ftplugin: add query

---
 modules/home/vim/after/ftplugin/query.vim | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 modules/home/vim/after/ftplugin/query.vim

diff --git a/modules/home/vim/after/ftplugin/query.vim b/modules/home/vim/after/ftplugin/query.vim
new file mode 100644
index 0000000..fd2ac73
--- /dev/null
+++ b/modules/home/vim/after/ftplugin/query.vim
@@ -0,0 +1,6 @@
+" Create the `b:undo_ftplugin` variable if it doesn't exist
+call ftplugined#check_undo_ft()
+
+" Use a small indentation value on query files
+setlocal shiftwidth=2
+let b:undo_ftplugin.='|setlocal shiftwidth<'

From 2996481327151763beece5cc24acb7913c2a5399 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 28 Dec 2024 13:24:21 -0500
Subject: [PATCH 073/256] flake: bump inputs

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index bc1d34b..a1385ba 100644
--- a/flake.lock
+++ b/flake.lock
@@ -136,11 +136,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1734808199,
-        "narHash": "sha256-MxlUcLjE8xLbrI1SJ2B2jftlg4wdutEILa3fgqwA98I=",
+        "lastModified": 1735381016,
+        "narHash": "sha256-CyCZFhMUkuYbSD6bxB/r43EdmDE7hYeZZPTCv0GudO4=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "f342df3ad938f205a913973b832f52c12546aac6",
+        "rev": "10e99c43cdf4a0713b4e81d90691d22c6a58bdf2",
         "type": "github"
       },
       "original": {
@@ -152,11 +152,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1734424634,
-        "narHash": "sha256-cHar1vqHOOyC7f1+tVycPoWTfKIaqkoe1Q6TnKzuti4=",
+        "lastModified": 1735291276,
+        "narHash": "sha256-NYVcA06+blsLG6wpAbSPTCyLvxD/92Hy4vlY9WxFI1M=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d3c42f187194c26d9f0309a8ecc469d6c878ce33",
+        "rev": "634fd46801442d760e09493a794c4f15db2d0cbb",
         "type": "github"
       },
       "original": {
@@ -177,11 +177,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1734810357,
-        "narHash": "sha256-Oa6d+y1/PVaPrZ/GYwvmTK9kSrc5Qx/8D3DFN2TzpVA=",
+        "lastModified": 1735408823,
+        "narHash": "sha256-1VjQeMQer5nXNYtw+BG+s78ucaEoxO5oqj+yRmM8MMs=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "e7b7b92a7c97a91f1465ab433bbdf6d00df1db8e",
+        "rev": "8283ea92deac8cdb6fd63ff04049ac9e879bf5eb",
         "type": "github"
       },
       "original": {

From 9c50691ede84ad83e1d7fa4dc3334f38cee08630 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 28 Dec 2024 13:28:03 -0500
Subject: [PATCH 074/256] nixos: services: nginx: sso: use upstream module

It's finally been merged, so let's get rid of this module.
---
 modules/nixos/services/nginx/default.nix     |  4 -
 modules/nixos/services/nginx/sso/default.nix | 84 --------------------
 2 files changed, 88 deletions(-)
 delete mode 100644 modules/nixos/services/nginx/sso/default.nix

diff --git a/modules/nixos/services/nginx/default.nix b/modules/nixos/services/nginx/default.nix
index 3bba9f4..cb27604 100644
--- a/modules/nixos/services/nginx/default.nix
+++ b/modules/nixos/services/nginx/default.nix
@@ -87,10 +87,6 @@ let
   });
 in
 {
-  imports = [
-    ./sso
-  ];
-
   options.my.services.nginx = with lib; {
     enable = mkEnableOption "Nginx";
 
diff --git a/modules/nixos/services/nginx/sso/default.nix b/modules/nixos/services/nginx/sso/default.nix
deleted file mode 100644
index d60e31b..0000000
--- a/modules/nixos/services/nginx/sso/default.nix
+++ /dev/null
@@ -1,84 +0,0 @@
-# I must override the module to allow having runtime secrets
-{ config, lib, pkgs, utils, ... }:
-let
-  cfg = config.services.nginx.sso;
-  pkg = lib.getBin cfg.package;
-  confPath = "/var/lib/nginx-sso/config.json";
-in
-{
-  disabledModules = [ "services/security/nginx-sso.nix" ];
-
-
-  options.services.nginx.sso = with lib; {
-    enable = mkEnableOption "nginx-sso service";
-
-    package = mkOption {
-      type = types.package;
-      default = pkgs.nginx-sso;
-      defaultText = "pkgs.nginx-sso";
-      description = ''
-        The nginx-sso package that should be used.
-      '';
-    };
-
-    configuration = mkOption {
-      type = types.attrsOf types.unspecified;
-      default = { };
-      example = literalExample ''
-        {
-          listen = { addr = "127.0.0.1"; port = 8080; };
-
-          providers.token.tokens = {
-            myuser = "MyToken";
-          };
-
-          acl = {
-            rule_sets = [
-              {
-                rules = [ { field = "x-application"; equals = "MyApp"; } ];
-                allow = [ "myuser" ];
-              }
-            ];
-          };
-        }
-      '';
-      description = ''
-        nginx-sso configuration
-        (<link xlink:href="https://github.com/Luzifer/nginx-sso/wiki/Main-Configuration">documentation</link>)
-        as a Nix attribute set.
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    systemd.services.nginx-sso = {
-      description = "Nginx SSO Backend";
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        StateDirectory = "nginx-sso";
-        WorkingDirectory = "/var/lib/nginx-sso";
-        # The files to be merged might not have the correct permissions
-        ExecStartPre = pkgs.writeShellScript "merge-nginx-sso-config" ''
-          rm -f '${confPath}'
-          ${utils.genJqSecretsReplacementSnippet cfg.configuration confPath}
-        '';
-        ExecStart = lib.mkForce ''
-          ${lib.getExe pkg} \
-            --config ${confPath} \
-            --frontend-dir ${pkg}/share/frontend
-        '';
-        Restart = "always";
-        User = "nginx-sso";
-        Group = "nginx-sso";
-      };
-    };
-
-    users.users.nginx-sso = {
-      isSystemUser = true;
-      group = "nginx-sso";
-    };
-
-    users.groups.nginx-sso = { };
-  };
-}

From debf061dd2f03d166b543da5a182b2645d90a6b5 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 13 Jan 2025 17:35:20 +0000
Subject: [PATCH 075/256] treewide: add 'shell=bash' for '.envrc' files

Looks like the `shellcheck` pre-commit hook starting running on those
files as well.
---
 .envrc                      | 1 +
 templates/c++-cmake/.envrc  | 1 +
 templates/c++-meson/.envrc  | 1 +
 templates/rust-cargo/.envrc | 1 +
 4 files changed, 4 insertions(+)
 mode change 100644 => 100755 templates/c++-cmake/.envrc

diff --git a/.envrc b/.envrc
index f5141c2..a6b1f81 100644
--- a/.envrc
+++ b/.envrc
@@ -1,3 +1,4 @@
+# shellcheck shell=bash
 if ! has nix_direnv_version || ! nix_direnv_version 3.0.0; then
     source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/3.0.0/direnvrc" "sha256-21TMnI2xWX7HkSTjFFri2UaohXVj854mgvWapWrxRXg="
 fi
diff --git a/templates/c++-cmake/.envrc b/templates/c++-cmake/.envrc
old mode 100644
new mode 100755
index de77fcb..390d06d
--- a/templates/c++-cmake/.envrc
+++ b/templates/c++-cmake/.envrc
@@ -1,3 +1,4 @@
+# shellcheck shell=bash
 if ! has nix_direnv_version || ! nix_direnv_version 3.0.0; then
     source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/3.0.0/direnvrc" "sha256-21TMnI2xWX7HkSTjFFri2UaohXVj854mgvWapWrxRXg="
 fi
diff --git a/templates/c++-meson/.envrc b/templates/c++-meson/.envrc
index de77fcb..390d06d 100644
--- a/templates/c++-meson/.envrc
+++ b/templates/c++-meson/.envrc
@@ -1,3 +1,4 @@
+# shellcheck shell=bash
 if ! has nix_direnv_version || ! nix_direnv_version 3.0.0; then
     source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/3.0.0/direnvrc" "sha256-21TMnI2xWX7HkSTjFFri2UaohXVj854mgvWapWrxRXg="
 fi
diff --git a/templates/rust-cargo/.envrc b/templates/rust-cargo/.envrc
index de77fcb..390d06d 100644
--- a/templates/rust-cargo/.envrc
+++ b/templates/rust-cargo/.envrc
@@ -1,3 +1,4 @@
+# shellcheck shell=bash
 if ! has nix_direnv_version || ! nix_direnv_version 3.0.0; then
     source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/3.0.0/direnvrc" "sha256-21TMnI2xWX7HkSTjFFri2UaohXVj854mgvWapWrxRXg="
 fi

From 2cf14c92d33bf47db9856932e9cb4a6ce92ad4fc Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 13 Jan 2025 17:37:07 +0000
Subject: [PATCH 076/256] flake: bump inputs

---
 flake.lock | 33 +++++++++++++++------------------
 flake.nix  |  1 -
 2 files changed, 15 insertions(+), 19 deletions(-)

diff --git a/flake.lock b/flake.lock
index a1385ba..a95fb34 100644
--- a/flake.lock
+++ b/flake.lock
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1733312601,
-        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
+        "lastModified": 1736143030,
+        "narHash": "sha256-+hu54pAoLDEZT9pjHlqL9DNzWz0NbUn8NEAHP7PQPzU=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
+        "rev": "b905f6fc23a9051a6e1b741e1438dbfc0634c6de",
         "type": "github"
       },
       "original": {
@@ -136,11 +136,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1735381016,
-        "narHash": "sha256-CyCZFhMUkuYbSD6bxB/r43EdmDE7hYeZZPTCv0GudO4=",
+        "lastModified": 1736785676,
+        "narHash": "sha256-TY0jUwR3EW0fnS0X5wXMAVy6h4Z7Y6a3m+Yq++C9AyE=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "10e99c43cdf4a0713b4e81d90691d22c6a58bdf2",
+        "rev": "fc52a210b60f2f52c74eac41a8647c1573d2071d",
         "type": "github"
       },
       "original": {
@@ -152,11 +152,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1735291276,
-        "narHash": "sha256-NYVcA06+blsLG6wpAbSPTCyLvxD/92Hy4vlY9WxFI1M=",
+        "lastModified": 1736701207,
+        "narHash": "sha256-jG/+MvjVY7SlTakzZ2fJ5dC3V1PrKKrUEOEE30jrOKA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "634fd46801442d760e09493a794c4f15db2d0cbb",
+        "rev": "ed4a395ea001367c1f13d34b1e01aa10290f67d6",
         "type": "github"
       },
       "original": {
@@ -177,11 +177,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1735408823,
-        "narHash": "sha256-1VjQeMQer5nXNYtw+BG+s78ucaEoxO5oqj+yRmM8MMs=",
+        "lastModified": 1736786866,
+        "narHash": "sha256-JaWZU7wFWsI4rGAemVciyhTxadaZyubJpLqupKLZUtI=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "8283ea92deac8cdb6fd63ff04049ac9e879bf5eb",
+        "rev": "16ff3063cb4a4cf6fb5f48ca7dc55c27f2ea4891",
         "type": "github"
       },
       "original": {
@@ -197,17 +197,14 @@
         "gitignore": "gitignore",
         "nixpkgs": [
           "nixpkgs"
-        ],
-        "nixpkgs-stable": [
-          "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1734797603,
-        "narHash": "sha256-ulZN7ps8nBV31SE+dwkDvKIzvN6hroRY8sYOT0w+E28=",
+        "lastModified": 1735882644,
+        "narHash": "sha256-3FZAG+pGt3OElQjesCAWeMkQ7C/nB1oTHLRQ8ceP110=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "f0f0dc4920a903c3e08f5bdb9246bb572fcae498",
+        "rev": "a5a961387e75ae44cc20f0a57ae463da5e959656",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index f0bb79c..afd3c80 100644
--- a/flake.nix
+++ b/flake.nix
@@ -68,7 +68,6 @@
       ref = "master";
       inputs = {
         nixpkgs.follows = "nixpkgs";
-        nixpkgs-stable.follows = "nixpkgs";
       };
     };
 

From 9f2ed2ae5a5348cd2c97acc95be795a24d0bbe14 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 13 Jan 2025 17:37:41 +0000
Subject: [PATCH 077/256] nixos: hardware: fix renamed 'pulseaudio' config

---
 modules/nixos/hardware/bluetooth/default.nix | 2 +-
 modules/nixos/hardware/sound/default.nix     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/nixos/hardware/bluetooth/default.nix b/modules/nixos/hardware/bluetooth/default.nix
index e9b1991..b14ac21 100644
--- a/modules/nixos/hardware/bluetooth/default.nix
+++ b/modules/nixos/hardware/bluetooth/default.nix
@@ -20,7 +20,7 @@ in
 
     # Support for additional bluetooth codecs
     (lib.mkIf cfg.loadExtraCodecs {
-      hardware.pulseaudio = {
+      services.pulseaudio = {
         extraModules = [ pkgs.pulseaudio-modules-bt ];
         package = pkgs.pulseaudioFull;
       };
diff --git a/modules/nixos/hardware/sound/default.nix b/modules/nixos/hardware/sound/default.nix
index 1cf12cb..cd453de 100644
--- a/modules/nixos/hardware/sound/default.nix
+++ b/modules/nixos/hardware/sound/default.nix
@@ -54,7 +54,7 @@ in
 
     # Pulseaudio setup
     (lib.mkIf cfg.pulse.enable {
-      hardware.pulseaudio.enable = true;
+      services.pulseaudio.enable = true;
     })
   ]);
 }

From c99b5b2532cc1654a38bca9cd2ad7460f35aa278 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 13 Jan 2025 17:38:05 +0000
Subject: [PATCH 078/256] nixos: services: komga: use 'settings'

---
 modules/nixos/services/komga/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/nixos/services/komga/default.nix b/modules/nixos/services/komga/default.nix
index e1dc780..160d6ce 100644
--- a/modules/nixos/services/komga/default.nix
+++ b/modules/nixos/services/komga/default.nix
@@ -21,10 +21,10 @@ in
       inherit (cfg) port;
 
       group = "media";
-    };
 
-    systemd.services.komga.environment = {
-      LOGGING_LEVEL_ORG_GOTSON_KOMGA = "DEBUG"; # Needed for fail2ban
+      settings = {
+        logging.level.org.gotson.komga = "DEBUG"; # Needed for fail2ban
+      };
     };
 
     # Set-up media group

From f08787625b73ce88487303814e13e7355721dddd Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 28 Jan 2025 12:34:20 +0000
Subject: [PATCH 079/256] flake: bump inputs

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index a95fb34..8884f79 100644
--- a/flake.lock
+++ b/flake.lock
@@ -14,11 +14,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1723293904,
-        "narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
+        "lastModified": 1736955230,
+        "narHash": "sha256-uenf8fv2eG5bKM8C/UvFaiJMZ4IpUFaQxk9OH5t/1gA=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
+        "rev": "e600439ec4c273cf11e06fe4d9d906fb98fa097c",
         "type": "github"
       },
       "original": {
@@ -136,11 +136,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1736785676,
-        "narHash": "sha256-TY0jUwR3EW0fnS0X5wXMAVy6h4Z7Y6a3m+Yq++C9AyE=",
+        "lastModified": 1737968762,
+        "narHash": "sha256-xiPARGKwocaMtv+U/rgi+h2g56CZZEmrcl7ldRaslq8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "fc52a210b60f2f52c74eac41a8647c1573d2071d",
+        "rev": "e1ae908bcc30af792b0bb0a52e53b03d2577255e",
         "type": "github"
       },
       "original": {
@@ -152,11 +152,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1736701207,
-        "narHash": "sha256-jG/+MvjVY7SlTakzZ2fJ5dC3V1PrKKrUEOEE30jrOKA=",
+        "lastModified": 1737885589,
+        "narHash": "sha256-Zf0hSrtzaM1DEz8//+Xs51k/wdSajticVrATqDrfQjg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ed4a395ea001367c1f13d34b1e01aa10290f67d6",
+        "rev": "852ff1d9e153d8875a83602e03fdef8a63f0ecf8",
         "type": "github"
       },
       "original": {
@@ -177,11 +177,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1736786866,
-        "narHash": "sha256-JaWZU7wFWsI4rGAemVciyhTxadaZyubJpLqupKLZUtI=",
+        "lastModified": 1738059992,
+        "narHash": "sha256-VeNLLucQTlED2cqD3uofh968tm7u7UgwCdY5+jo/BSc=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "16ff3063cb4a4cf6fb5f48ca7dc55c27f2ea4891",
+        "rev": "c46c836963685acbd2430439f859b60f230b3643",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1735882644,
-        "narHash": "sha256-3FZAG+pGt3OElQjesCAWeMkQ7C/nB1oTHLRQ8ceP110=",
+        "lastModified": 1737465171,
+        "narHash": "sha256-R10v2hoJRLq8jcL4syVFag7nIGE7m13qO48wRIukWNg=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "a5a961387e75ae44cc20f0a57ae463da5e959656",
+        "rev": "9364dc02281ce2d37a1f55b6e51f7c0f65a75f17",
         "type": "github"
       },
       "original": {

From 1540483955f38bb57af7706c7e458378028e36f4 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 30 Jan 2025 13:06:49 +0100
Subject: [PATCH 080/256] nixos: services: komga: fix deprecated option

---
 modules/nixos/services/komga/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/nixos/services/komga/default.nix b/modules/nixos/services/komga/default.nix
index 160d6ce..9af3cd1 100644
--- a/modules/nixos/services/komga/default.nix
+++ b/modules/nixos/services/komga/default.nix
@@ -18,11 +18,11 @@ in
   config = lib.mkIf cfg.enable {
     services.komga = {
       enable = true;
-      inherit (cfg) port;
 
       group = "media";
 
       settings = {
+        server.port = cfg.port;
         logging.level.org.gotson.komga = "DEBUG"; # Needed for fail2ban
       };
     };

From 533e3b9a9f198d1a8168060db694f3a6ae6464b0 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 29 Jan 2025 19:14:54 +0100
Subject: [PATCH 081/256] nixos: services: add homebox

---
 modules/nixos/services/default.nix         |  1 +
 modules/nixos/services/homebox/default.nix | 42 ++++++++++++++++++++++
 2 files changed, 43 insertions(+)
 create mode 100644 modules/nixos/services/homebox/default.nix

diff --git a/modules/nixos/services/default.nix b/modules/nixos/services/default.nix
index 651f3f8..3992385 100644
--- a/modules/nixos/services/default.nix
+++ b/modules/nixos/services/default.nix
@@ -14,6 +14,7 @@
     ./forgejo
     ./gitea
     ./grocy
+    ./homebox
     ./indexers
     ./jellyfin
     ./komga
diff --git a/modules/nixos/services/homebox/default.nix b/modules/nixos/services/homebox/default.nix
new file mode 100644
index 0000000..d79e331
--- /dev/null
+++ b/modules/nixos/services/homebox/default.nix
@@ -0,0 +1,42 @@
+# Home inventory made easy
+{ config, lib, ... }:
+let
+  cfg = config.my.services.homebox;
+in
+{
+  options.my.services.homebox = with lib; {
+    enable = mkEnableOption "Homebox home inventory";
+
+    port = mkOption {
+      type = types.port;
+      default = 7745;
+      example = 8080;
+      description = "Internal port for webui";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.homebox = {
+      enable = true;
+
+      settings = {
+        # FIXME: mailer?
+        HBOX_WEB_PORT = toString cfg.port;
+      };
+    };
+
+    my.services.nginx.virtualHosts = {
+      homebox = {
+        inherit (cfg) port;
+      };
+    };
+
+    my.services.backup = {
+      paths = [
+        config.services.homebox.settings.HBOX_STORAGE_DATA
+      ];
+    };
+
+    # NOTE: unfortunately homebox does not log connection failures for fail2ban
+  };
+}

From 2cbcbb7b3a6819a66c7e2fb84a623e6bea087d35 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 4 Feb 2025 15:15:28 +0000
Subject: [PATCH 082/256] home: secrets: fix path to 'keys'

---
 modules/home/secrets/secrets.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/secrets/secrets.nix b/modules/home/secrets/secrets.nix
index f474342..27cdb4e 100644
--- a/modules/home/secrets/secrets.nix
+++ b/modules/home/secrets/secrets.nix
@@ -1,6 +1,6 @@
 # Common secrets
 let
-  keys = import ../../keys;
+  keys = import ../../../keys;
 
   all = builtins.attrValues keys.users;
 in

From 9c4d853037aaca039709c7bd013738b5528e31fe Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 6 Feb 2025 11:28:27 +0000
Subject: [PATCH 083/256] home: secrets: github: update token

---
 modules/home/secrets/github/token.age | Bin 369 -> 253 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/modules/home/secrets/github/token.age b/modules/home/secrets/github/token.age
index 1d36ccdc3cc89a5b9c5bd9df4e8b62445fe4b3b0..3e8bb5a8329daf21e005a46c76ade14a887d5952 100644
GIT binary patch
delta 217
zcmey!^p|mhPJO9wfw_@)QdN0wwn1o$iD_`MPquGrqD5eZwnt=ogkNHcrDcY;t7THQ
zFPCqzYm`%&fs3WThev@yg-ft$REC*}p?+?0MMZ`|NL5LoS5$JTS4Mt*B$uwPu7YEx
zn{i%RYEYhwWnN@KRgR^PTUbV9eoC5aZlYO=SypmIL{Mdjxk-U@peGk^#jIn8)9!jl
zD=c=X^7Ym#tkv=mzIfc}u-Q)8ry`Fp%Cxecmb~(l>&(K)4JmrZW=LuO*_m_GTgBny
T^33`v>=u2U1}$?cyY#C8DZ^1=

delta 334
zcmey%_>pOXPJKpUxwlJVUanhtPOxD_rb)S{n?Y5MNuIlpb6#+2q@jyRm`hSpfk|>j
zHdkbDP*spmzGYHXj+s|Usb`6&V`;9Zk%g0aqCr(^rJJdfn`KtEr&FO(AeXM4LSaf-
zS!Ax6ZhBE_VsWa1l7Y2?k)=YQf`7gaSGGyITe5p{czu#dXhEP~Mq*BgV{u|?QfgkF
zxrd{3RAgkKv42^KQCMlYSxI3*uz{0fq?fOYiFU3*sE12RMm|?YcxsMch*_$8VS#^C
zYCup?KslGLuC9W4R$57(b9hQrj-gR;L~==XRc=LYv9?c%r+c<jh`(E<k$XsDNqLoD
znE{stulrHA!@MRZV+CwQcP%jg5p?j~XF<CSLZ2qxf4}efiqb3V(`*k&RNhIGSWw5`
h(p}m8O)=@}z7rEo<&RFQkYQkL;9SJ|<kZcoUI1JWdPM*L


From b6d58a274abaa3dd77fb339b729ef5936f387bc7 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 12 Feb 2025 14:26:07 +0000
Subject: [PATCH 084/256] pkgs: lohr: use 'useFetchCargoVendor'

The previous fetcher is in the process of being deprecated.
---
 pkgs/lohr/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/lohr/default.nix b/pkgs/lohr/default.nix
index b89ccff..aeb13b1 100644
--- a/pkgs/lohr/default.nix
+++ b/pkgs/lohr/default.nix
@@ -10,7 +10,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-dunQgtap+XCK5LoSyOqIY/6p6HizBeiyPWNuCffwjDU=";
   };
 
-  cargoHash = "sha256-EUhyrhPe+mUgMmm4o+bxRIiSNReJRfw+/O1fPr8r7lo=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-R3/N/43+bGx6acE/rhBcrk6kS5zQu8NJ1sVvKJJkK9w=";
 
   meta = with lib; {
     description = "Git mirroring daemon";

From 40a841031fe465b7225927d1d493627e547cab59 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 12 Feb 2025 14:27:15 +0000
Subject: [PATCH 085/256] flake: bump inputs

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 8884f79..b7ca708 100644
--- a/flake.lock
+++ b/flake.lock
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1736143030,
-        "narHash": "sha256-+hu54pAoLDEZT9pjHlqL9DNzWz0NbUn8NEAHP7PQPzU=",
+        "lastModified": 1738453229,
+        "narHash": "sha256-7H9XgNiGLKN1G1CgRh0vUL4AheZSYzPm+zmZ7vxbJdo=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "b905f6fc23a9051a6e1b741e1438dbfc0634c6de",
+        "rev": "32ea77a06711b758da0ad9bd6a844c5740a87abd",
         "type": "github"
       },
       "original": {
@@ -136,11 +136,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1737968762,
-        "narHash": "sha256-xiPARGKwocaMtv+U/rgi+h2g56CZZEmrcl7ldRaslq8=",
+        "lastModified": 1739314552,
+        "narHash": "sha256-ggVf2BclyIW3jexc/uvgsgJH4e2cuG6Nyg54NeXgbFI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "e1ae908bcc30af792b0bb0a52e53b03d2577255e",
+        "rev": "83bd3a26ac0526ae04fa74df46738bb44b89dcdd",
         "type": "github"
       },
       "original": {
@@ -152,11 +152,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1737885589,
-        "narHash": "sha256-Zf0hSrtzaM1DEz8//+Xs51k/wdSajticVrATqDrfQjg=",
+        "lastModified": 1739214665,
+        "narHash": "sha256-26L8VAu3/1YRxS8MHgBOyOM8xALdo6N0I04PgorE7UM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "852ff1d9e153d8875a83602e03fdef8a63f0ecf8",
+        "rev": "64e75cd44acf21c7933d61d7721e812eac1b5a0a",
         "type": "github"
       },
       "original": {
@@ -177,11 +177,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1738059992,
-        "narHash": "sha256-VeNLLucQTlED2cqD3uofh968tm7u7UgwCdY5+jo/BSc=",
+        "lastModified": 1739229047,
+        "narHash": "sha256-sSTgA86wdk8d544c2+gzrfvVPHQF4mbsomvLOW2thn0=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "c46c836963685acbd2430439f859b60f230b3643",
+        "rev": "8348d89f30598a73fee7efb4b5d34c3de201e71b",
         "type": "github"
       },
       "original": {

From 374886a63f01f2f736ce4502e61ba017403a77fc Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 12 Feb 2025 14:30:00 +0000
Subject: [PATCH 086/256] nixos: services: servarr: remove build work-around

It's been fixed upstream.

This partially reverts commit ad1cfbd6f03e0b38f690d8563af02c1c04d8b731.
---
 modules/nixos/services/servarr/default.nix | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/modules/nixos/services/servarr/default.nix b/modules/nixos/services/servarr/default.nix
index 4aa0de7..e25d9cf 100644
--- a/modules/nixos/services/servarr/default.nix
+++ b/modules/nixos/services/servarr/default.nix
@@ -96,15 +96,5 @@ in
     # Sonarr for shows
     (mkFullConfig "sonarr")
     (mkFail2Ban "sonarr")
-
-    # HACK: until https://github.com/NixOS/nixpkgs/issues/360592 is resolved
-    (lib.mkIf cfg.sonarr.enable {
-      nixpkgs.config.permittedInsecurePackages = [
-        "aspnetcore-runtime-6.0.36"
-        "aspnetcore-runtime-wrapped-6.0.36"
-        "dotnet-sdk-6.0.428"
-        "dotnet-sdk-wrapped-6.0.428"
-      ];
-    })
   ]);
 }

From 80b4c9ffcd8e610e39e473a6425001e9e939386f Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 12 Feb 2025 14:31:20 +0000
Subject: [PATCH 087/256] home: mail: accounts: use 'migadu' flavor

---
 modules/home/mail/accounts/default.nix | 15 +--------------
 1 file changed, 1 insertion(+), 14 deletions(-)

diff --git a/modules/home/mail/accounts/default.nix b/modules/home/mail/accounts/default.nix
index 202b9bc..5216ad5 100644
--- a/modules/home/mail/accounts/default.nix
+++ b/modules/home/mail/accounts/default.nix
@@ -26,20 +26,7 @@ let
   };
 
   migaduConfig = {
-    imap = {
-      host = "imap.migadu.com";
-      port = 993;
-      tls = {
-        enable = true;
-      };
-    };
-    smtp = {
-      host = "smtp.migadu.com";
-      port = 465;
-      tls = {
-        enable = true;
-      };
-    };
+    flavor = "migadu.com";
   };
 
   gmailConfig = {

From f474c033d5d89d9cf84bbc18f878eb1bb9fed4d3 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 13 Feb 2025 14:40:39 +0000
Subject: [PATCH 088/256] nixos: services: nginx: remove zstd compression

The zstd module is unmaintained and buggy, remove it preventively.

The option itself will probably be removed soon [1].

[1]: https://github.com/NixOS/nixpkgs/pull/381678
---
 modules/nixos/services/nginx/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/nixos/services/nginx/default.nix b/modules/nixos/services/nginx/default.nix
index cb27604..1e9e38a 100644
--- a/modules/nixos/services/nginx/default.nix
+++ b/modules/nixos/services/nginx/default.nix
@@ -253,7 +253,6 @@ in
       recommendedOptimisation = true;
       recommendedProxySettings = true;
       recommendedTlsSettings = true;
-      recommendedZstdSettings = true;
 
       virtualHosts =
         let

From 8f5be69a4e297c8289399ae09b805090042ebfcc Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 17 Feb 2025 15:33:40 +0100
Subject: [PATCH 089/256] flake: bump inputs

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index b7ca708..c4ae7ba 100644
--- a/flake.lock
+++ b/flake.lock
@@ -136,11 +136,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1739314552,
-        "narHash": "sha256-ggVf2BclyIW3jexc/uvgsgJH4e2cuG6Nyg54NeXgbFI=",
+        "lastModified": 1739790043,
+        "narHash": "sha256-4gK4zdNDQ4PyGFs7B6zp9iPIBy9E+bVJiZ0XAmncvgQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "83bd3a26ac0526ae04fa74df46738bb44b89dcdd",
+        "rev": "c1ea92cdfb85bd7b0995b550581d9fd1c3370bf9",
         "type": "github"
       },
       "original": {
@@ -152,11 +152,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1739214665,
-        "narHash": "sha256-26L8VAu3/1YRxS8MHgBOyOM8xALdo6N0I04PgorE7UM=",
+        "lastModified": 1739580444,
+        "narHash": "sha256-+/bSz4EAVbqz8/HsIGLroF8aNaO8bLRL7WfACN+24g4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "64e75cd44acf21c7933d61d7721e812eac1b5a0a",
+        "rev": "8bb37161a0488b89830168b81c48aed11569cb93",
         "type": "github"
       },
       "original": {
@@ -177,11 +177,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1739229047,
-        "narHash": "sha256-sSTgA86wdk8d544c2+gzrfvVPHQF4mbsomvLOW2thn0=",
+        "lastModified": 1739796551,
+        "narHash": "sha256-XcTK29rOc0WxcSJDHUK8JQege9CzSVVAcjHdswOVFPA=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "8348d89f30598a73fee7efb4b5d34c3de201e71b",
+        "rev": "827aa6eeaf92cc085f84947f6c32002792b67497",
         "type": "github"
       },
       "original": {

From 1237ef41742323d88d639877d38cd6ec05d9cf91 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 21 Feb 2025 16:22:00 +0000
Subject: [PATCH 090/256] home: git: include local configuration properly

Using `includes` ensures that the local configuration is included at the
end of the configuration file.
---
 modules/home/git/default.nix | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/modules/home/git/default.nix b/modules/home/git/default.nix
index 1bb2215..8791cb2 100644
--- a/modules/home/git/default.nix
+++ b/modules/home/git/default.nix
@@ -123,11 +123,6 @@ in
         defaultBranch = "main";
       };
 
-      # Local configuration, not-versioned
-      include = {
-        path = "config.local";
-      };
-
       merge = {
         conflictStyle = "zdiff3";
       };
@@ -167,8 +162,8 @@ in
       };
     };
 
-    # Multiple identities
     includes = [
+      # Multiple identities
       {
         condition = "gitdir:~/git/EPITA/";
         contents = {
@@ -187,6 +182,10 @@ in
           };
         };
       }
+      # Local configuration, not-versioned
+      {
+        path = "config.local";
+      }
     ];
 
     ignores =

From 337d7309c61e39bd77db6537acde9a301dade42f Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 21 Feb 2025 16:41:54 +0000
Subject: [PATCH 091/256] home: git: use 'mkAfter' for config includes

This should ensure that they will be included at the very end of the
configuration, even if other modules add more includes.

Notably, this ensures that the local configuration can override any
other setting.
---
 modules/home/git/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/git/default.nix b/modules/home/git/default.nix
index 8791cb2..c88008f 100644
--- a/modules/home/git/default.nix
+++ b/modules/home/git/default.nix
@@ -162,7 +162,7 @@ in
       };
     };
 
-    includes = [
+    includes = lib.mkAfter [
       # Multiple identities
       {
         condition = "gitdir:~/git/EPITA/";

From d3a953247c270ca2e771bac5343123c4239c0da3 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 24 Feb 2025 14:15:01 +0000
Subject: [PATCH 092/256] home: packages: disable on 'useGlobalPkgs'

It doesn't do anything when `useGlobalPkgs` is set, and has started
warning about its upcoming deprecation.
---
 modules/home/packages/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/modules/home/packages/default.nix b/modules/home/packages/default.nix
index b0f8d67..43f7111 100644
--- a/modules/home/packages/default.nix
+++ b/modules/home/packages/default.nix
@@ -1,6 +1,7 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, osConfig, ... }:
 let
   cfg = config.my.home.packages;
+  useGlobalPkgs = osConfig.home-manager.useGlobalPkgs or false;
 in
 {
   options.my.home.packages = with lib; {
@@ -29,7 +30,7 @@ in
       tree
     ] ++ cfg.additionalPackages);
 
-    nixpkgs.config = {
+    nixpkgs.config = lib.mkIf (!useGlobalPkgs) {
       inherit (cfg) allowAliases allowUnfree;
     };
   };

From 852696409a4319a9767814c4483072d4bb9cbd61 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 24 Feb 2025 17:07:43 +0000
Subject: [PATCH 093/256] home: pager: remove 'LESSKEY'

It should do the lookup in `$XDG_CONFIG_HOME/lesskey` automatically now.
---
 modules/home/pager/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/home/pager/default.nix b/modules/home/pager/default.nix
index 1119440..a35da2c 100644
--- a/modules/home/pager/default.nix
+++ b/modules/home/pager/default.nix
@@ -16,7 +16,6 @@ in
       LESS = "-R -+X -c";
       # Better XDG compliance
       LESSHISTFILE = "${config.xdg.stateHome}/less/history";
-      LESSKEY = "${config.xdg.configHome}/less/lesskey";
     };
   };
 }

From e43570fe5bfa8a6258d11c3eb8f7738cb045a5ce Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 24 Feb 2025 17:04:21 +0000
Subject: [PATCH 094/256] home: pager: allow quitting without screen clear

---
 modules/home/pager/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/modules/home/pager/default.nix b/modules/home/pager/default.nix
index a35da2c..e84dcb7 100644
--- a/modules/home/pager/default.nix
+++ b/modules/home/pager/default.nix
@@ -17,5 +17,10 @@ in
       # Better XDG compliance
       LESSHISTFILE = "${config.xdg.stateHome}/less/history";
     };
+
+    xdg.configFile."lesskey".text = ''
+      # Quit without clearing the screen on `Q`
+      Q toggle-option -!^Predraw-on-quit\nq
+    '';
   };
 }

From 84f1186b6c6888ed3ebc1fb6072a259e509b3271 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 25 Feb 2025 13:38:07 +0000
Subject: [PATCH 095/256] home: tmux: add 'enableResurrect'

To be used on the cloudtop with its frequent reboots.
---
 modules/home/tmux/default.nix | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/modules/home/tmux/default.nix b/modules/home/tmux/default.nix
index ae8b8f0..5371643 100644
--- a/modules/home/tmux/default.nix
+++ b/modules/home/tmux/default.nix
@@ -20,6 +20,8 @@ in
 
     enablePassthrough = mkEnableOption "tmux DCS passthrough sequence";
 
+    enableResurrect = mkEnableOption "tmux-resurrect plugin";
+
     terminalFeatures = mkOption {
       type = with types; attrsOf (submodule {
         options = {
@@ -51,7 +53,7 @@ in
     focusEvents = true; # Report focus events
     terminal = "tmux-256color"; # I want accurate termcap info
 
-    plugins = with pkgs.tmuxPlugins; [
+    plugins = with pkgs.tmuxPlugins; builtins.filter (attr: attr != { }) [
       # Open high-lighted files in copy mode
       open
       # Better pane management
@@ -79,6 +81,13 @@ in
           set -g status-right '#{prefix_highlight} %a %Y-%m-%d %H:%M'
         '';
       }
+      # Resurrect sessions
+      (lib.optionalAttrs cfg.enableResurrect {
+        plugin = resurrect;
+        extraConfig = ''
+          set -g @resurrect-dir '${config.xdg.stateHome}/tmux/resurrect'
+        '';
+      })
     ];
 
     extraConfig = ''

From 105bcbd53a30d349bb68276249a77793ec5f2d19 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 25 Feb 2025 13:39:46 +0000
Subject: [PATCH 096/256] hosts: home: mousqueton: enable 'tmux-resurrect'

---
 hosts/homes/ambroisie@mousqueton/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hosts/homes/ambroisie@mousqueton/default.nix b/hosts/homes/ambroisie@mousqueton/default.nix
index 44e62e6..37884d7 100644
--- a/hosts/homes/ambroisie@mousqueton/default.nix
+++ b/hosts/homes/ambroisie@mousqueton/default.nix
@@ -15,6 +15,9 @@
       # I use scripts that use the passthrough sequence often on this host
       enablePassthrough = true;
 
+      # Frequent reboots mean that session persistence can be handy
+      enableResurrect = true;
+
       terminalFeatures = {
         # HTerm uses `xterm-256color` as its `$TERM`, so use that here
         xterm-256color = { };

From edeb67238bc24dc982075bb5f6787d8035b578b3 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 25 Feb 2025 13:58:02 +0000
Subject: [PATCH 097/256] home: tmux: enable aggressive resize

Generally useful, rarely gets in the way, I'd rather have it enabled by
default.
---
 modules/home/tmux/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/home/tmux/default.nix b/modules/home/tmux/default.nix
index 5371643..08b9202 100644
--- a/modules/home/tmux/default.nix
+++ b/modules/home/tmux/default.nix
@@ -52,6 +52,7 @@ in
     mouse = false; # I dislike mouse support
     focusEvents = true; # Report focus events
     terminal = "tmux-256color"; # I want accurate termcap info
+    aggressiveResize = true; # Automatic resize when switching client size
 
     plugins = with pkgs.tmuxPlugins; builtins.filter (attr: attr != { }) [
       # Open high-lighted files in copy mode

From 0dc8ac443313724285d54447330311f3b2e0856b Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 27 Feb 2025 12:36:10 +0000
Subject: [PATCH 098/256] flake: bump inputs

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index c4ae7ba..bd5cf0a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -136,11 +136,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1739790043,
-        "narHash": "sha256-4gK4zdNDQ4PyGFs7B6zp9iPIBy9E+bVJiZ0XAmncvgQ=",
+        "lastModified": 1740624780,
+        "narHash": "sha256-8TP61AI3QBQsjzVUQFIV8NoB5nbYfJB3iHczhBikDkU=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c1ea92cdfb85bd7b0995b550581d9fd1c3370bf9",
+        "rev": "b8869e4ead721bbd4f0d6b927e8395705d4f16e6",
         "type": "github"
       },
       "original": {
@@ -152,11 +152,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1739580444,
-        "narHash": "sha256-+/bSz4EAVbqz8/HsIGLroF8aNaO8bLRL7WfACN+24g4=",
+        "lastModified": 1740560979,
+        "narHash": "sha256-Vr3Qi346M+8CjedtbyUevIGDZW8LcA1fTG0ugPY/Hic=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8bb37161a0488b89830168b81c48aed11569cb93",
+        "rev": "5135c59491985879812717f4c9fea69604e7f26f",
         "type": "github"
       },
       "original": {
@@ -177,11 +177,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1739796551,
-        "narHash": "sha256-XcTK29rOc0WxcSJDHUK8JQege9CzSVVAcjHdswOVFPA=",
+        "lastModified": 1740655932,
+        "narHash": "sha256-BSTcgL2C74x0TgVdVEWfIz2SHkwIFMN0Dvv1lCoOhCA=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "827aa6eeaf92cc085f84947f6c32002792b67497",
+        "rev": "1ca8ff37f33a560c4a292ed83774434854f0b39a",
         "type": "github"
       },
       "original": {

From 88c00bb83d7d83d9af480f9de8027175bdd32ec7 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 27 Feb 2025 12:44:10 +0000
Subject: [PATCH 099/256] home: firefox: fix deprecated option

---
 modules/home/firefox/default.nix | 28 +++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/modules/home/firefox/default.nix b/modules/home/firefox/default.nix
index 02c74f2..6346dc9 100644
--- a/modules/home/firefox/default.nix
+++ b/modules/home/firefox/default.nix
@@ -61,19 +61,21 @@ in
           "ui.systemUsesDarkTheme" = true; # Dark mode
         };
 
-        extensions = with pkgs.nur.repos.rycee.firefox-addons; ([
-          bitwarden
-          consent-o-matic
-          form-history-control
-          reddit-comment-collapser
-          reddit-enhancement-suite
-          refined-github
-          sponsorblock
-          ublock-origin
-        ]
-        ++ lib.optional (cfg.tridactyl.enable) tridactyl
-        ++ lib.optional (cfg.ff2mpv.enable) ff2mpv
-        );
+        extensions = {
+          packages = with pkgs.nur.repos.rycee.firefox-addons; ([
+            bitwarden
+            consent-o-matic
+            form-history-control
+            reddit-comment-collapser
+            reddit-enhancement-suite
+            refined-github
+            sponsorblock
+            ublock-origin
+          ]
+          ++ lib.optional (cfg.tridactyl.enable) tridactyl
+          ++ lib.optional (cfg.ff2mpv.enable) ff2mpv
+          );
+        };
       };
     };
   };

From ca618b53ccef400567eef305c634854ca16529fb Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 27 Feb 2025 16:59:15 +0000
Subject: [PATCH 100/256] home: vim: oil: explicitly remove icons

They started appearing on the latest bump, it looks like my
configuration started including `nvim-web-devicons` (see [1]).

I'll probably remove this configuration on the next nixpkgs bump (it's a
good canary to check that I *never* include icons in the future).

[1]: https://github.com/NixOS/nixpkgs/pull/382668
---
 modules/home/vim/plugin/settings/oil.lua | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/home/vim/plugin/settings/oil.lua b/modules/home/vim/plugin/settings/oil.lua
index a160725..74d5007 100644
--- a/modules/home/vim/plugin/settings/oil.lua
+++ b/modules/home/vim/plugin/settings/oil.lua
@@ -4,6 +4,8 @@ local wk = require("which-key")
 local detail = false
 
 oil.setup({
+    -- Don't show icons
+    columns = {},
     view_options = {
         -- Show files and directories that start with "." by default
         show_hidden = true,

From dc4221fc17fc3d36e75f4d47b6e1a552969ab29f Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 17 Mar 2025 13:02:02 +0000
Subject: [PATCH 101/256] flake: bump inputs

And remove the overlay for `lsp-format.nvim`, which has been fixed.

This reverts commit 92e5fbe7df0c74a33baccfdb9fc82859217e0b3a.
---
 flake.lock                                    | 30 +++++++++----------
 .../lsp-format-nvim-indentation/default.nix   |  4 ---
 .../lsp-format-nvim-indentation/generated.nix | 14 ---------
 3 files changed, 15 insertions(+), 33 deletions(-)
 delete mode 100644 overlays/lsp-format-nvim-indentation/default.nix
 delete mode 100644 overlays/lsp-format-nvim-indentation/generated.nix

diff --git a/flake.lock b/flake.lock
index bd5cf0a..6db188a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1738453229,
-        "narHash": "sha256-7H9XgNiGLKN1G1CgRh0vUL4AheZSYzPm+zmZ7vxbJdo=",
+        "lastModified": 1741352980,
+        "narHash": "sha256-+u2UunDA4Cl5Fci3m7S643HzKmIDAe+fiXrLqYsR2fs=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "32ea77a06711b758da0ad9bd6a844c5740a87abd",
+        "rev": "f4330d22f1c5d2ba72d3d22df5597d123fdb60a9",
         "type": "github"
       },
       "original": {
@@ -136,11 +136,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1740624780,
-        "narHash": "sha256-8TP61AI3QBQsjzVUQFIV8NoB5nbYfJB3iHczhBikDkU=",
+        "lastModified": 1741955947,
+        "narHash": "sha256-2lbURKclgKqBNm7hVRtWh0A7NrdsibD0EaWhahUVhhY=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "b8869e4ead721bbd4f0d6b927e8395705d4f16e6",
+        "rev": "4e12151c9e014e2449e0beca2c0e9534b96a26b4",
         "type": "github"
       },
       "original": {
@@ -152,11 +152,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1740560979,
-        "narHash": "sha256-Vr3Qi346M+8CjedtbyUevIGDZW8LcA1fTG0ugPY/Hic=",
+        "lastModified": 1742069588,
+        "narHash": "sha256-C7jVfohcGzdZRF6DO+ybyG/sqpo1h6bZi9T56sxLy+k=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5135c59491985879812717f4c9fea69604e7f26f",
+        "rev": "c80f6a7e10b39afcc1894e02ef785b1ad0b0d7e5",
         "type": "github"
       },
       "original": {
@@ -177,11 +177,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1740655932,
-        "narHash": "sha256-BSTcgL2C74x0TgVdVEWfIz2SHkwIFMN0Dvv1lCoOhCA=",
+        "lastModified": 1741294988,
+        "narHash": "sha256-3408u6q615kVTb23WtDriHRmCBBpwX7iau6rvfipcu4=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "1ca8ff37f33a560c4a292ed83774434854f0b39a",
+        "rev": "b30c245e2c44c7352a27485bfd5bc483df660f0e",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1737465171,
-        "narHash": "sha256-R10v2hoJRLq8jcL4syVFag7nIGE7m13qO48wRIukWNg=",
+        "lastModified": 1742058297,
+        "narHash": "sha256-b4SZc6TkKw8WQQssbN5O2DaCEzmFfvSTPYHlx/SFW9Y=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "9364dc02281ce2d37a1f55b6e51f7c0f65a75f17",
+        "rev": "59f17850021620cd348ad2e9c0c64f4e6325ce2a",
         "type": "github"
       },
       "original": {
diff --git a/overlays/lsp-format-nvim-indentation/default.nix b/overlays/lsp-format-nvim-indentation/default.nix
deleted file mode 100644
index 832e71d..0000000
--- a/overlays/lsp-format-nvim-indentation/default.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-self: prev:
-{
-  vimPlugins = prev.vimPlugins.extend (self.callPackage ./generated.nix { });
-}
diff --git a/overlays/lsp-format-nvim-indentation/generated.nix b/overlays/lsp-format-nvim-indentation/generated.nix
deleted file mode 100644
index 1902207..0000000
--- a/overlays/lsp-format-nvim-indentation/generated.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ fetchpatch, ... }:
-
-_final: prev: {
-  lsp-format-nvim = prev.lsp-format-nvim.overrideAttrs (oa: {
-    patches = (oa.patches or [ ]) ++ [
-      # https://github.com/lukas-reineke/lsp-format.nvim/issues/94
-      (fetchpatch {
-        name = "use-effective-indentation";
-        url = "https://github.com/liskin/lsp-format.nvim/commit/3757ac443bdf5bd166673833794553229ee8d939.patch";
-        hash = "sha256-Dv+TvXrU/IrrPxz2MSPbLmRxch+qkHbI3AyFMj/ssDk=";
-      })
-    ];
-  });
-}

From 5ae2eacd49042d3c00e3d2e666c355bcb89e10d1 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 19 Mar 2025 11:45:07 +0000
Subject: [PATCH 102/256] home: git: add 'ignoreRevsFile'

I'm surprised I hadn't configured it already.

`.git-blame-ignore-revs` is the usual name, as most forges automatically
detect and use it.
---
 modules/home/git/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/home/git/default.nix b/modules/home/git/default.nix
index c88008f..bd085b8 100644
--- a/modules/home/git/default.nix
+++ b/modules/home/git/default.nix
@@ -75,6 +75,7 @@ in
       # Makes it a bit more readable
       blame = {
         coloring = "repeatedLines";
+        ignoreRevsFile = ".git-blame-ignore-revs";
         markIgnoredLines = true;
         markUnblamables = true;
       };

From 9156a8211d6388e274698e834d010710d727d425 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 24 Mar 2025 11:47:59 +0000
Subject: [PATCH 103/256] flake: bump inputs

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 6db188a..2eff24a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -136,11 +136,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1741955947,
-        "narHash": "sha256-2lbURKclgKqBNm7hVRtWh0A7NrdsibD0EaWhahUVhhY=",
+        "lastModified": 1742771635,
+        "narHash": "sha256-HQHzQPrg+g22tb3/K/4tgJjPzM+/5jbaujCZd8s2Mls=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "4e12151c9e014e2449e0beca2c0e9534b96a26b4",
+        "rev": "ad0614a1ec9cce3b13169e20ceb7e55dfaf2a818",
         "type": "github"
       },
       "original": {
@@ -152,11 +152,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1742069588,
-        "narHash": "sha256-C7jVfohcGzdZRF6DO+ybyG/sqpo1h6bZi9T56sxLy+k=",
+        "lastModified": 1742669843,
+        "narHash": "sha256-G5n+FOXLXcRx+3hCJ6Rt6ZQyF1zqQ0DL0sWAMn2Nk0w=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c80f6a7e10b39afcc1894e02ef785b1ad0b0d7e5",
+        "rev": "1e5b653dff12029333a6546c11e108ede13052eb",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1742058297,
-        "narHash": "sha256-b4SZc6TkKw8WQQssbN5O2DaCEzmFfvSTPYHlx/SFW9Y=",
+        "lastModified": 1742649964,
+        "narHash": "sha256-DwOTp7nvfi8mRfuL1escHDXabVXFGT1VlPD1JHrtrco=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "59f17850021620cd348ad2e9c0c64f4e6325ce2a",
+        "rev": "dcf5072734cb576d2b0c59b2ac44f5050b5eac82",
         "type": "github"
       },
       "original": {

From 6fc81e45e98bcb4190641c53aad62a28cb782367 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 24 Mar 2025 11:58:56 +0000
Subject: [PATCH 104/256] home: zsh: migrate to 'initContent'

This also fixes a small ordering issue: my alias definitions used to be
defined at the very end of the file, they're now slotted _before_ the
`zshrc.local` import.
---
 modules/home/zsh/default.nix | 40 +++++++++++++++++-------------------
 1 file changed, 19 insertions(+), 21 deletions(-)

diff --git a/modules/home/zsh/default.nix b/modules/home/zsh/default.nix
index 11b6cb2..f4092d8 100644
--- a/modules/home/zsh/default.nix
+++ b/modules/home/zsh/default.nix
@@ -87,28 +87,26 @@ in
         # Modal editing is life, but CLI benefits from emacs gymnastics
         defaultKeymap = "emacs";
 
-        # Make those happen early to avoid doing double the work
-        initExtraFirst = lib.mkBefore ''
-          ${
-            lib.optionalString cfg.launchTmux ''
-              # Launch tmux unless already inside one
-              if [ -z "$TMUX" ]; then
-                exec tmux new-session
-              fi
-            ''
-          }
-        '';
+        initContent = lib.mkMerge [
+          # Make those happen early to avoid doing double the work
+          (lib.mkBefore (lib.optionalString cfg.launchTmux ''
+            # Launch tmux unless already inside one
+            if [ -z "$TMUX" ]; then
+              exec tmux new-session
+            fi
+          ''))
 
-        initExtra = lib.mkAfter ''
-          source ${./completion-styles.zsh}
-          source ${./extra-mappings.zsh}
-          source ${./options.zsh}
+          (lib.mkAfter ''
+            source ${./completion-styles.zsh}
+            source ${./extra-mappings.zsh}
+            source ${./options.zsh}
 
-          # Source local configuration
-          if [ -f "$ZDOTDIR/zshrc.local" ]; then
-            source "$ZDOTDIR/zshrc.local"
-          fi
-        '';
+            # Source local configuration
+            if [ -f "$ZDOTDIR/zshrc.local" ]; then
+              source "$ZDOTDIR/zshrc.local"
+            fi
+          '')
+        ];
 
         localVariables = {
           # I like having the full path
@@ -151,7 +149,7 @@ in
         };
 
         # Use OSC-777 to send the notification through SSH
-        initExtra = lib.mkIf cfg.notify.ssh.useOsc777 ''
+        initContent = lib.mkIf cfg.notify.ssh.useOsc777 ''
           done_send_notification() {
             local exit_status="$1"
             local title="$2"

From b2758839e8a0fe5cb613542172d6bfd36ba088ee Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 24 Mar 2025 16:51:45 +0000
Subject: [PATCH 105/256] home: vim: lspconfig: add 'harper'

Support for more languages is upcoming, I also need to check how to
handle custom words/dictionaries.
---
 modules/home/vim/plugin/settings/lspconfig.lua | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/modules/home/vim/plugin/settings/lspconfig.lua b/modules/home/vim/plugin/settings/lspconfig.lua
index 1f9abfd..f8e65d8 100644
--- a/modules/home/vim/plugin/settings/lspconfig.lua
+++ b/modules/home/vim/plugin/settings/lspconfig.lua
@@ -96,6 +96,13 @@ if utils.is_executable("starpls") then
 end
 
 -- Generic
+if utils.is_executable("harper-ls") then
+    lspconfig.harper_ls.setup({
+        capabilities = capabilities,
+        on_attach = lsp.on_attach,
+    })
+end
+
 if utils.is_executable("typos-lsp") then
     lspconfig.typos_lsp.setup({
         capabilities = capabilities,

From abec0dd226d765a54976be0a07442c4ce45b3cdb Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 25 Mar 2025 14:30:07 +0000
Subject: [PATCH 106/256] home: git: remove 'ignoreRevsFile'

I remember why I didn't set it globally now, it's because `git blame`
complains and errors out, rather than silently ignoring the setting,
when the file doesn't exist in a repo...

This reverts commit 5ae2eacd49042d3c00e3d2e666c355bcb89e10d1.
---
 modules/home/git/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/home/git/default.nix b/modules/home/git/default.nix
index bd085b8..c88008f 100644
--- a/modules/home/git/default.nix
+++ b/modules/home/git/default.nix
@@ -75,7 +75,6 @@ in
       # Makes it a bit more readable
       blame = {
         coloring = "repeatedLines";
-        ignoreRevsFile = ".git-blame-ignore-revs";
         markIgnoredLines = true;
         markUnblamables = true;
       };

From 458ea144c447cb15ed07351992f9cbe8f74489db Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 25 Mar 2025 16:52:58 +0000
Subject: [PATCH 107/256] home: vim: remove 'fastfold' configuration

I missed it in the original commit that removed the plug-in from my
configuration...
---
 modules/home/vim/plugin/settings/fastfold.lua | 5 -----
 1 file changed, 5 deletions(-)
 delete mode 100644 modules/home/vim/plugin/settings/fastfold.lua

diff --git a/modules/home/vim/plugin/settings/fastfold.lua b/modules/home/vim/plugin/settings/fastfold.lua
deleted file mode 100644
index 78ee937..0000000
--- a/modules/home/vim/plugin/settings/fastfold.lua
+++ /dev/null
@@ -1,5 +0,0 @@
--- Intercept all fold commands
--- stylua: ignore
-vim.g.fastfold_fold_command_suffixes = {
-    "x", "X", "a", "A", "o", "O", "c", "C", "r", "R", "m", "M", "i", "n", "N",
-}

From 1841ff391d13eb31b3ff670b9c9f4563ecc7140b Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 28 Mar 2025 15:27:21 +0000
Subject: [PATCH 108/256] flake: dev-shells: remove redundant 'pre-commit'

It's already being installed by the shell hook.
---
 flake/dev-shells.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/flake/dev-shells.nix b/flake/dev-shells.nix
index d5f5989..87464a4 100644
--- a/flake/dev-shells.nix
+++ b/flake/dev-shells.nix
@@ -6,7 +6,6 @@
         name = "NixOS-config";
 
         nativeBuildInputs = with pkgs; [
-          gitAndTools.pre-commit
           nixpkgs-fmt
         ];
 

From 37e88c2707072bc4cc244669c084dccb74b52ab3 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 29 Mar 2025 14:41:21 +0000
Subject: [PATCH 109/256] flake: bump inputs

And fix the small `jq` breakage.
---
 flake.lock                  | 18 +++++++++---------
 modules/home/jq/default.nix |  1 +
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 2eff24a..a2d931a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1741352980,
-        "narHash": "sha256-+u2UunDA4Cl5Fci3m7S643HzKmIDAe+fiXrLqYsR2fs=",
+        "lastModified": 1743550720,
+        "narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f4330d22f1c5d2ba72d3d22df5597d123fdb60a9",
+        "rev": "c621e8422220273271f52058f618c94e405bb0f5",
         "type": "github"
       },
       "original": {
@@ -136,11 +136,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1742771635,
-        "narHash": "sha256-HQHzQPrg+g22tb3/K/4tgJjPzM+/5jbaujCZd8s2Mls=",
+        "lastModified": 1743607567,
+        "narHash": "sha256-kTzKPDFmNzwO1cK4fiJgPB/iSw7HgBAmknRTeAPJAeI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "ad0614a1ec9cce3b13169e20ceb7e55dfaf2a818",
+        "rev": "49748c74cdbae03d70381f150b810f92617f23aa",
         "type": "github"
       },
       "original": {
@@ -152,11 +152,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1742669843,
-        "narHash": "sha256-G5n+FOXLXcRx+3hCJ6Rt6ZQyF1zqQ0DL0sWAMn2Nk0w=",
+        "lastModified": 1743448293,
+        "narHash": "sha256-bmEPmSjJakAp/JojZRrUvNcDX2R5/nuX6bm+seVaGhs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1e5b653dff12029333a6546c11e108ede13052eb",
+        "rev": "77b584d61ff80b4cef9245829a6f1dfad5afdfa3",
         "type": "github"
       },
       "original": {
diff --git a/modules/home/jq/default.nix b/modules/home/jq/default.nix
index 57e266f..53e5986 100644
--- a/modules/home/jq/default.nix
+++ b/modules/home/jq/default.nix
@@ -17,6 +17,7 @@ in
       strings = "0;32";
       arrays = "1;39";
       objects = "1;39";
+      objectKeys = "1;34";
     };
   };
 }

From dfb3c353ecc6e2152dfc2440544db2ffbd99a20b Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 29 Mar 2025 16:15:04 +0000
Subject: [PATCH 110/256] home: vim: remove 'lsp_lines'

It's been upstreamed!
---
 modules/home/vim/default.nix                   | 1 -
 modules/home/vim/plugin/settings/lsp-lines.lua | 3 ---
 2 files changed, 4 deletions(-)
 delete mode 100644 modules/home/vim/plugin/settings/lsp-lines.lua

diff --git a/modules/home/vim/default.nix b/modules/home/vim/default.nix
index 8e6bd5c..b65e935 100644
--- a/modules/home/vim/default.nix
+++ b/modules/home/vim/default.nix
@@ -59,7 +59,6 @@ in
       # LSP and linting
       nvim-lspconfig # Easy LSP configuration
       lsp-format-nvim # Simplified formatting configuration
-      lsp_lines-nvim # Show diagnostics *over* regions
       none-ls-nvim # LSP integration for linters and formatters
       nvim-treesitter.withAllGrammars # Better highlighting
       nvim-treesitter-textobjects # More textobjects
diff --git a/modules/home/vim/plugin/settings/lsp-lines.lua b/modules/home/vim/plugin/settings/lsp-lines.lua
deleted file mode 100644
index 9c79818..0000000
--- a/modules/home/vim/plugin/settings/lsp-lines.lua
+++ /dev/null
@@ -1,3 +0,0 @@
-local lsp_lines = require("lsp_lines")
-
-lsp_lines.setup()

From 274d143031cbc350673c8bed520fa0f2522319c0 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 29 Mar 2025 16:17:59 +0000
Subject: [PATCH 111/256] home: vim: fix deprecated calls

---
 modules/home/vim/lua/ambroisie/lsp.lua   | 17 +++++++----------
 modules/home/vim/lua/ambroisie/utils.lua |  2 +-
 2 files changed, 8 insertions(+), 11 deletions(-)

diff --git a/modules/home/vim/lua/ambroisie/lsp.lua b/modules/home/vim/lua/ambroisie/lsp.lua
index eb53da6..3989202 100644
--- a/modules/home/vim/lua/ambroisie/lsp.lua
+++ b/modules/home/vim/lua/ambroisie/lsp.lua
@@ -5,14 +5,15 @@ local lsp_format = require("lsp-format")
 
 --- Move to the next/previous diagnostic, automatically showing the diagnostics
 --- float if necessary.
---- @param forward bool whether to go forward or backwards
-local function goto_diagnostic(forward)
+--- @param count number whether to go count or backwards
+local function goto_diagnostic(count)
     vim.validate({
-        forward = { forward, "boolean" },
+        count = { count, "number" },
     })
 
     local opts = {
         float = false,
+        count = count,
     }
 
     -- Only show floating diagnostics if they are otherwise not displayed
@@ -21,23 +22,19 @@ local function goto_diagnostic(forward)
         opts.float = true
     end
 
-    if forward then
-        vim.diagnostic.goto_next(opts)
-    else
-        vim.diagnostic.goto_prev(opts)
-    end
+    vim.diagnostic.jump(opts)
 end
 
 --- Move to the next diagnostic, automatically showing the diagnostics float if
 --- necessary.
 M.goto_next_diagnostic = function()
-    goto_diagnostic(true)
+    goto_diagnostic(1)
 end
 
 --- Move to the previous diagnostic, automatically showing the diagnostics float
 --- if necessary.
 M.goto_prev_diagnostic = function()
-    goto_diagnostic(false)
+    goto_diagnostic(-1)
 end
 
 --- shared LSP configuration callback
diff --git a/modules/home/vim/lua/ambroisie/utils.lua b/modules/home/vim/lua/ambroisie/utils.lua
index c9e9292..0ee7c83 100644
--- a/modules/home/vim/lua/ambroisie/utils.lua
+++ b/modules/home/vim/lua/ambroisie/utils.lua
@@ -38,7 +38,7 @@ end
 --- @param bufnr int? buffer number
 --- @return table all active LSP client names
 M.list_lsp_clients = function(bufnr)
-    local clients = vim.lsp.get_active_clients({ bufnr = bufnr })
+    local clients = vim.lsp.get_clients({ bufnr = bufnr })
     local names = {}
 
     for _, client in ipairs(clients) do

From 4ef1b08f4ee444ab9dcb1513421cf78a79449242 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 29 Mar 2025 16:55:00 +0000
Subject: [PATCH 112/256] home: vim: lualine: use built-in 'branch'

It now supports worktrees correctly (or at least I can't figure out
which issue I used to have with it...).

As a bonus, it also supports showing the correct branch for an `oil`
buffer.

This reverts commit 481d5f6f53e1e6ff1d8f29d3ac996af723be2381.
---
 modules/home/vim/plugin/settings/lualine.lua | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/vim/plugin/settings/lualine.lua b/modules/home/vim/plugin/settings/lualine.lua
index 5219a95..31ad3c4 100644
--- a/modules/home/vim/plugin/settings/lualine.lua
+++ b/modules/home/vim/plugin/settings/lualine.lua
@@ -30,7 +30,7 @@ lualine.setup({
             { "mode" },
         },
         lualine_b = {
-            { "FugitiveHead" },
+            { "branch" },
             { "filename", symbols = { readonly = "🔒" } },
         },
         lualine_c = {

From c1efc4316d7fe2bedd222d02e148e9ec8f7f6707 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 29 Mar 2025 16:44:00 +0000
Subject: [PATCH 113/256] home: vim: lualine: add custom 'oil' extension

I don't like the built-in one.
---
 modules/home/vim/plugin/settings/lualine.lua | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/modules/home/vim/plugin/settings/lualine.lua b/modules/home/vim/plugin/settings/lualine.lua
index 31ad3c4..bbe4647 100644
--- a/modules/home/vim/plugin/settings/lualine.lua
+++ b/modules/home/vim/plugin/settings/lualine.lua
@@ -1,4 +1,5 @@
 local lualine = require("lualine")
+local oil = require("oil")
 local utils = require("ambroisie.utils")
 
 local function list_spell_languages()
@@ -57,5 +58,21 @@ lualine.setup({
     extensions = {
         "fugitive",
         "quickfix",
+        {
+            sections = {
+                lualine_a = {
+                    { "mode" },
+                },
+                lualine_b = {
+                    { "branch" },
+                },
+                lualine_c = {
+                    function()
+                        return vim.fn.fnamemodify(oil.get_current_dir(), ":~")
+                    end,
+                },
+            },
+            filetypes = { "oil" },
+        },
     },
 })

From 262dc48425c2b62305b5202abad20f71cf92aaed Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 2 Apr 2025 20:02:33 +0100
Subject: [PATCH 114/256] home: vim: use default 'diffopt:linematch'

It's now been defaulted to `linematch:40` on v0.11.
---
 modules/home/vim/init.vim | 2 --
 1 file changed, 2 deletions(-)

diff --git a/modules/home/vim/init.vim b/modules/home/vim/init.vim
index 0b54676..39ef32e 100644
--- a/modules/home/vim/init.vim
+++ b/modules/home/vim/init.vim
@@ -68,8 +68,6 @@ set listchars=tab:>─,trail:·,nbsp:¤
 
 " Use patience diff
 set diffopt+=algorithm:patience
-" Align similar lines in each hunk
-set diffopt+=linematch:50
 
 " Don't redraw when executing macros
 set lazyredraw

From 2583cc6c12817a9f1012ba24bfe32aeb4b7794a3 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 3 Apr 2025 21:16:58 +0100
Subject: [PATCH 115/256] home: vim: lua: lsp: add count to diagnostic maps

---
 modules/home/vim/lua/ambroisie/lsp.lua | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/home/vim/lua/ambroisie/lsp.lua b/modules/home/vim/lua/ambroisie/lsp.lua
index 3989202..e57bdaf 100644
--- a/modules/home/vim/lua/ambroisie/lsp.lua
+++ b/modules/home/vim/lua/ambroisie/lsp.lua
@@ -28,13 +28,13 @@ end
 --- Move to the next diagnostic, automatically showing the diagnostics float if
 --- necessary.
 M.goto_next_diagnostic = function()
-    goto_diagnostic(1)
+    goto_diagnostic(vim.v.count1)
 end
 
 --- Move to the previous diagnostic, automatically showing the diagnostics float
 --- if necessary.
 M.goto_prev_diagnostic = function()
-    goto_diagnostic(-1)
+    goto_diagnostic(-vim.v.count1)
 end
 
 --- shared LSP configuration callback

From 36aa641ec0d861b7abffc8204b6538b7dc0367a2 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 3 Apr 2025 21:23:30 +0100
Subject: [PATCH 116/256] home: vim: rely on built-in diagnostic jump config

This reduces the surface area of my configuration.
---
 .../vim/after/plugin/mappings/unimpaired.lua  |  4 --
 modules/home/vim/lua/ambroisie/lsp.lua        | 38 ++-----------------
 .../home/vim/plugin/settings/lspconfig.lua    |  4 ++
 3 files changed, 8 insertions(+), 38 deletions(-)

diff --git a/modules/home/vim/after/plugin/mappings/unimpaired.lua b/modules/home/vim/after/plugin/mappings/unimpaired.lua
index 82aab05..765b6b1 100644
--- a/modules/home/vim/after/plugin/mappings/unimpaired.lua
+++ b/modules/home/vim/after/plugin/mappings/unimpaired.lua
@@ -31,8 +31,6 @@ local keys = {
     { "[u", desc = "URL encode" },
     { "[x", desc = "XML encode" },
     { "[y", desc = "C string encode" },
-    -- Custom
-    { "[d", lsp.goto_prev_diagnostic, desc = "Previous diagnostic" },
 
     -- Next
     { "]", group = "Next" },
@@ -62,8 +60,6 @@ local keys = {
     { "]u", desc = "URL decode" },
     { "]x", desc = "XML decode" },
     { "]y", desc = "C string decode" },
-    -- Custom
-    { "]d", lsp.goto_next_diagnostic, desc = "Next diagnostic" },
 
     -- Enable option
     { "[o", group = "Enable option" },
diff --git a/modules/home/vim/lua/ambroisie/lsp.lua b/modules/home/vim/lua/ambroisie/lsp.lua
index e57bdaf..e48de12 100644
--- a/modules/home/vim/lua/ambroisie/lsp.lua
+++ b/modules/home/vim/lua/ambroisie/lsp.lua
@@ -3,40 +3,6 @@ local M = {}
 -- Simplified LSP formatting configuration
 local lsp_format = require("lsp-format")
 
---- Move to the next/previous diagnostic, automatically showing the diagnostics
---- float if necessary.
---- @param count number whether to go count or backwards
-local function goto_diagnostic(count)
-    vim.validate({
-        count = { count, "number" },
-    })
-
-    local opts = {
-        float = false,
-        count = count,
-    }
-
-    -- Only show floating diagnostics if they are otherwise not displayed
-    local config = vim.diagnostic.config()
-    if not (config.virtual_text or config.virtual_lines) then
-        opts.float = true
-    end
-
-    vim.diagnostic.jump(opts)
-end
-
---- Move to the next diagnostic, automatically showing the diagnostics float if
---- necessary.
-M.goto_next_diagnostic = function()
-    goto_diagnostic(vim.v.count1)
-end
-
---- Move to the previous diagnostic, automatically showing the diagnostics float
---- if necessary.
-M.goto_prev_diagnostic = function()
-    goto_diagnostic(-vim.v.count1)
-end
-
 --- shared LSP configuration callback
 --- @param client native client configuration
 --- @param bufnr int? buffer number of the attached client
@@ -76,6 +42,10 @@ M.on_attach = function(client, bufnr)
         vim.diagnostic.config({
             virtual_text = text,
             virtual_lines = lines,
+            jump = {
+                -- Show float on jump if no diagnostic text is otherwise shown
+                float = not (text or lines),
+            },
         })
     end
 
diff --git a/modules/home/vim/plugin/settings/lspconfig.lua b/modules/home/vim/plugin/settings/lspconfig.lua
index f8e65d8..7817d4c 100644
--- a/modules/home/vim/plugin/settings/lspconfig.lua
+++ b/modules/home/vim/plugin/settings/lspconfig.lua
@@ -16,6 +16,10 @@ vim.diagnostic.config({
     update_in_insert = false,
     -- Show highest severity first
     severity_sort = true,
+    jump = {
+        -- Show float on diagnostic jumps
+        float = true,
+    },
 })
 
 -- Inform servers we are able to do completion, snippets, etc...

From d48d5c45e04b67e7642ac5f36c5fd1c81f7cd19d Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 4 Apr 2025 15:24:43 +0000
Subject: [PATCH 117/256] home: vim: remove 'friendly-snippets'

I never use them...
---
 modules/home/vim/default.nix                 | 1 -
 modules/home/vim/plugin/settings/luasnip.lua | 1 -
 2 files changed, 2 deletions(-)
 delete mode 100644 modules/home/vim/plugin/settings/luasnip.lua

diff --git a/modules/home/vim/default.nix b/modules/home/vim/default.nix
index b65e935..20a74ff 100644
--- a/modules/home/vim/default.nix
+++ b/modules/home/vim/default.nix
@@ -66,7 +66,6 @@ in
 
       # Completion
       luasnip # Snippet manager compatible with LSP
-      friendly-snippets # LSP snippets collection
       nvim-cmp # Completion engine
       cmp-async-path # More responsive path completion
       cmp-buffer # Words from open buffers
diff --git a/modules/home/vim/plugin/settings/luasnip.lua b/modules/home/vim/plugin/settings/luasnip.lua
deleted file mode 100644
index 80309d7..0000000
--- a/modules/home/vim/plugin/settings/luasnip.lua
+++ /dev/null
@@ -1 +0,0 @@
-require("luasnip.loaders.from_vscode").lazy_load()

From 53569f17a6850d00856ad4788516ff947f8907ad Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 5 Apr 2025 18:27:04 +0100
Subject: [PATCH 118/256] treewide: pre-commit-hooks.nix renaming

---
 flake.lock                     | 50 +++++++++++++++++-----------------
 flake.nix                      |  4 +--
 flake/checks.nix               |  2 +-
 templates/c++-cmake/flake.nix  |  8 +++---
 templates/c++-meson/flake.nix  |  8 +++---
 templates/rust-cargo/flake.nix |  8 +++---
 6 files changed, 40 insertions(+), 40 deletions(-)

diff --git a/flake.lock b/flake.lock
index a2d931a..353a392 100644
--- a/flake.lock
+++ b/flake.lock
@@ -108,10 +108,33 @@
         "type": "github"
       }
     },
+    "git-hooks": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1742649964,
+        "narHash": "sha256-DwOTp7nvfi8mRfuL1escHDXabVXFGT1VlPD1JHrtrco=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "dcf5072734cb576d2b0c59b2ac44f5050b5eac82",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "ref": "master",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
     "gitignore": {
       "inputs": {
         "nixpkgs": [
-          "pre-commit-hooks",
+          "git-hooks",
           "nixpkgs"
         ]
       },
@@ -191,38 +214,15 @@
         "type": "github"
       }
     },
-    "pre-commit-hooks": {
-      "inputs": {
-        "flake-compat": "flake-compat",
-        "gitignore": "gitignore",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1742649964,
-        "narHash": "sha256-DwOTp7nvfi8mRfuL1escHDXabVXFGT1VlPD1JHrtrco=",
-        "owner": "cachix",
-        "repo": "pre-commit-hooks.nix",
-        "rev": "dcf5072734cb576d2b0c59b2ac44f5050b5eac82",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cachix",
-        "ref": "master",
-        "repo": "pre-commit-hooks.nix",
-        "type": "github"
-      }
-    },
     "root": {
       "inputs": {
         "agenix": "agenix",
         "flake-parts": "flake-parts",
         "futils": "futils",
+        "git-hooks": "git-hooks",
         "home-manager": "home-manager",
         "nixpkgs": "nixpkgs",
         "nur": "nur",
-        "pre-commit-hooks": "pre-commit-hooks",
         "systems": "systems"
       }
     },
diff --git a/flake.nix b/flake.nix
index afd3c80..5076729 100644
--- a/flake.nix
+++ b/flake.nix
@@ -61,10 +61,10 @@
       };
     };
 
-    pre-commit-hooks = {
+    git-hooks = {
       type = "github";
       owner = "cachix";
-      repo = "pre-commit-hooks.nix";
+      repo = "git-hooks.nix";
       ref = "master";
       inputs = {
         nixpkgs.follows = "nixpkgs";
diff --git a/flake/checks.nix b/flake/checks.nix
index 98e49bd..73e64d5 100644
--- a/flake/checks.nix
+++ b/flake/checks.nix
@@ -1,7 +1,7 @@
 { inputs, ... }:
 {
   imports = [
-    inputs.pre-commit-hooks.flakeModule
+    inputs.git-hooks.flakeModule
   ];
 
   perSystem = { ... }: {
diff --git a/templates/c++-cmake/flake.nix b/templates/c++-cmake/flake.nix
index db3b35c..36fd5ad 100644
--- a/templates/c++-cmake/flake.nix
+++ b/templates/c++-cmake/flake.nix
@@ -16,10 +16,10 @@
       ref = "nixos-unstable";
     };
 
-    pre-commit-hooks = {
+    git-hooks = {
       type = "github";
       owner = "cachix";
-      repo = "pre-commit-hooks.nix";
+      repo = "git-hooks.nix";
       ref = "master";
       inputs = {
         flake-utils.follows = "futils";
@@ -28,7 +28,7 @@
     };
   };
 
-  outputs = { self, futils, nixpkgs, pre-commit-hooks }:
+  outputs = { self, futils, nixpkgs, git-hooks }:
     {
       overlays = {
         default = final: _prev: {
@@ -69,7 +69,7 @@
           ];
         };
 
-        pre-commit = pre-commit-hooks.lib.${system}.run {
+        pre-commit = git-hooks.lib.${system}.run {
           src = self;
 
           hooks = {
diff --git a/templates/c++-meson/flake.nix b/templates/c++-meson/flake.nix
index 5957c62..961ba1f 100644
--- a/templates/c++-meson/flake.nix
+++ b/templates/c++-meson/flake.nix
@@ -16,10 +16,10 @@
       ref = "nixos-unstable";
     };
 
-    pre-commit-hooks = {
+    git-hooks = {
       type = "github";
       owner = "cachix";
-      repo = "pre-commit-hooks.nix";
+      repo = "git-hooks.nix";
       ref = "master";
       inputs = {
         flake-utils.follows = "futils";
@@ -28,7 +28,7 @@
     };
   };
 
-  outputs = { self, futils, nixpkgs, pre-commit-hooks }:
+  outputs = { self, futils, nixpkgs, git-hooks }:
     {
       overlays = {
         default = final: _prev: {
@@ -69,7 +69,7 @@
           ];
         };
 
-        pre-commit = pre-commit-hooks.lib.${system}.run {
+        pre-commit = git-hooks.lib.${system}.run {
           src = self;
 
           hooks = {
diff --git a/templates/rust-cargo/flake.nix b/templates/rust-cargo/flake.nix
index 6d50369..b9031d9 100644
--- a/templates/rust-cargo/flake.nix
+++ b/templates/rust-cargo/flake.nix
@@ -16,10 +16,10 @@
       ref = "nixos-unstable";
     };
 
-    pre-commit-hooks = {
+    git-hooks = {
       type = "github";
       owner = "cachix";
-      repo = "pre-commit-hooks.nix";
+      repo = "git-hooks.nix";
       ref = "master";
       inputs = {
         flake-utils.follows = "futils";
@@ -28,7 +28,7 @@
     };
   };
 
-  outputs = { self, futils, nixpkgs, pre-commit-hooks }:
+  outputs = { self, futils, nixpkgs, git-hooks }:
     {
       overlays = {
         default = final: _prev: {
@@ -60,7 +60,7 @@
           ];
         };
 
-        pre-commit = pre-commit-hooks.lib.${system}.run {
+        pre-commit = git-hooks.lib.${system}.run {
           src = self;
 
           hooks = {

From 418494004b3479f0e523d3f72eb995aab8dddf41 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 5 Apr 2025 18:29:51 +0100
Subject: [PATCH 119/256] templates: use 'pre-commit.enabledPackages'

---
 templates/c++-cmake/flake.nix  | 6 +++---
 templates/c++-meson/flake.nix  | 6 +++---
 templates/rust-cargo/flake.nix | 7 +++----
 3 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/templates/c++-cmake/flake.nix b/templates/c++-cmake/flake.nix
index 36fd5ad..eecb007 100644
--- a/templates/c++-cmake/flake.nix
+++ b/templates/c++-cmake/flake.nix
@@ -92,12 +92,12 @@
 
         devShells = {
           default = pkgs.mkShell {
-            inputsFrom = with self.packages.${system}; [
-              project
+            inputsFrom = [
+              self.packages.${system}.project
             ];
 
             packages = with pkgs; [
-              clang-tools
+              self.checks.${system}.pre-commit.enabledPackages
             ];
 
             inherit (pre-commit) shellHook;
diff --git a/templates/c++-meson/flake.nix b/templates/c++-meson/flake.nix
index 961ba1f..a435777 100644
--- a/templates/c++-meson/flake.nix
+++ b/templates/c++-meson/flake.nix
@@ -92,12 +92,12 @@
 
         devShells = {
           default = pkgs.mkShell {
-            inputsFrom = with self.packages.${system}; [
-              project
+            inputsFrom = [
+              self.packages.${system}.project
             ];
 
             packages = with pkgs; [
-              clang-tools
+              self.checks.${system}.pre-commit.enabledPackages
             ];
 
             inherit (pre-commit) shellHook;
diff --git a/templates/rust-cargo/flake.nix b/templates/rust-cargo/flake.nix
index b9031d9..502d902 100644
--- a/templates/rust-cargo/flake.nix
+++ b/templates/rust-cargo/flake.nix
@@ -88,14 +88,13 @@
 
         devShells = {
           default = pkgs.mkShell {
-            inputsFrom = with self.packages.${system}; [
-              project
+            inputsFrom = [
+              self.packages.${system}.project
             ];
 
             packages = with pkgs; [
-              clippy
               rust-analyzer
-              rustfmt
+              self.checks.${system}.pre-commit.enabledPackages
             ];
 
             RUST_SRC_PATH = "${pkgs.rust.packages.stable.rustPlatform.rustLibSrc}";

From 62ddec5c2346959e395b42775fbd82284bc8886f Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 5 Apr 2025 18:46:14 +0100
Subject: [PATCH 120/256] templates: remove unused 'follows'

---
 templates/c++-cmake/flake.nix  | 1 -
 templates/c++-meson/flake.nix  | 1 -
 templates/rust-cargo/flake.nix | 1 -
 3 files changed, 3 deletions(-)

diff --git a/templates/c++-cmake/flake.nix b/templates/c++-cmake/flake.nix
index eecb007..7796f5e 100644
--- a/templates/c++-cmake/flake.nix
+++ b/templates/c++-cmake/flake.nix
@@ -22,7 +22,6 @@
       repo = "git-hooks.nix";
       ref = "master";
       inputs = {
-        flake-utils.follows = "futils";
         nixpkgs.follows = "nixpkgs";
       };
     };
diff --git a/templates/c++-meson/flake.nix b/templates/c++-meson/flake.nix
index a435777..cb14eb5 100644
--- a/templates/c++-meson/flake.nix
+++ b/templates/c++-meson/flake.nix
@@ -22,7 +22,6 @@
       repo = "git-hooks.nix";
       ref = "master";
       inputs = {
-        flake-utils.follows = "futils";
         nixpkgs.follows = "nixpkgs";
       };
     };
diff --git a/templates/rust-cargo/flake.nix b/templates/rust-cargo/flake.nix
index 502d902..efd8358 100644
--- a/templates/rust-cargo/flake.nix
+++ b/templates/rust-cargo/flake.nix
@@ -22,7 +22,6 @@
       repo = "git-hooks.nix";
       ref = "master";
       inputs = {
-        flake-utils.follows = "futils";
         nixpkgs.follows = "nixpkgs";
       };
     };

From ca98b8367c2ae384acd56271696f9a57de7f82f8 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 5 Apr 2025 18:18:06 +0100
Subject: [PATCH 121/256] templates: add python-uv

---
 templates/default.nix                       |   4 +
 templates/python-uv/.envrc                  |   6 ++
 templates/python-uv/.gitignore              |   6 ++
 templates/python-uv/.woodpecker/check.yml   |  31 ++++++
 templates/python-uv/flake.nix               | 112 ++++++++++++++++++++
 templates/python-uv/pyproject.toml          |  17 +++
 templates/python-uv/src/project/__init__.py |   2 +
 7 files changed, 178 insertions(+)
 create mode 100644 templates/python-uv/.envrc
 create mode 100644 templates/python-uv/.gitignore
 create mode 100644 templates/python-uv/.woodpecker/check.yml
 create mode 100644 templates/python-uv/flake.nix
 create mode 100644 templates/python-uv/pyproject.toml
 create mode 100644 templates/python-uv/src/project/__init__.py

diff --git a/templates/default.nix b/templates/default.nix
index 44db753..51864cd 100644
--- a/templates/default.nix
+++ b/templates/default.nix
@@ -7,6 +7,10 @@
     path = ./c++-meson;
     description = "A C++ project using Meson";
   };
+  "python-uv" = {
+    path = ./python-uv;
+    description = "A Python project using uv";
+  };
   "rust-cargo" = {
     path = ./rust-cargo;
     description = "A Rust project using Cargo";
diff --git a/templates/python-uv/.envrc b/templates/python-uv/.envrc
new file mode 100644
index 0000000..390d06d
--- /dev/null
+++ b/templates/python-uv/.envrc
@@ -0,0 +1,6 @@
+# shellcheck shell=bash
+if ! has nix_direnv_version || ! nix_direnv_version 3.0.0; then
+    source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/3.0.0/direnvrc" "sha256-21TMnI2xWX7HkSTjFFri2UaohXVj854mgvWapWrxRXg="
+fi
+
+use flake
diff --git a/templates/python-uv/.gitignore b/templates/python-uv/.gitignore
new file mode 100644
index 0000000..c79d1e8
--- /dev/null
+++ b/templates/python-uv/.gitignore
@@ -0,0 +1,6 @@
+# Virtual environments
+.venv
+
+# Nix generated files
+/.pre-commit-config.yaml
+/result
diff --git a/templates/python-uv/.woodpecker/check.yml b/templates/python-uv/.woodpecker/check.yml
new file mode 100644
index 0000000..272c0e4
--- /dev/null
+++ b/templates/python-uv/.woodpecker/check.yml
@@ -0,0 +1,31 @@
+labels:
+  backend: local
+
+steps:
+- name: pre-commit check
+  image: bash
+  commands:
+  - nix develop --command pre-commit run --all
+
+- name: nix flake check
+  image: bash
+  commands:
+  - nix flake check
+
+- name: notify
+  image: bash
+  environment:
+    ADDRESS:
+      from_secret: matrix_homeserver
+    ROOM:
+      from_secret: matrix_roomid
+    USER:
+      from_secret: matrix_username
+    PASS:
+      from_secret: matrix_password
+  commands:
+  - nix run github:ambroisie/matrix-notifier
+  when:
+    status:
+    - failure
+    - success
diff --git a/templates/python-uv/flake.nix b/templates/python-uv/flake.nix
new file mode 100644
index 0000000..5059e64
--- /dev/null
+++ b/templates/python-uv/flake.nix
@@ -0,0 +1,112 @@
+{
+  description = "A Python project";
+
+  inputs = {
+    futils = {
+      type = "github";
+      owner = "numtide";
+      repo = "flake-utils";
+      ref = "main";
+    };
+
+    nixpkgs = {
+      type = "github";
+      owner = "NixOS";
+      repo = "nixpkgs";
+      ref = "nixos-unstable";
+    };
+
+    git-hooks = {
+      type = "github";
+      owner = "cachix";
+      repo = "git-hooks.nix";
+      ref = "master";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+      };
+    };
+  };
+
+  outputs = { self, futils, nixpkgs, git-hooks }:
+    {
+      overlays = {
+        default = final: _prev: {
+          project = with final; python3.pkgs.buildPythonApplication {
+            pname = "project";
+            version = (final.lib.importTOML ./pyproject.toml).project.version;
+            pyproject = true;
+
+            src = self;
+
+            build-system = with python3.pkgs; [ setuptools ];
+
+            pythonImportsCheck = [ "project" ];
+
+            meta = with lib; {
+              description = "A Python project";
+              homepage = "https://git.belanyi.fr/ambroisie/project";
+              license = licenses.mit;
+              maintainers = with maintainers; [ ambroisie ];
+            };
+          };
+        };
+      };
+    } // futils.lib.eachDefaultSystem (system:
+      let
+        pkgs = import nixpkgs {
+          inherit system;
+          overlays = [
+            self.overlays.default
+          ];
+        };
+
+        pre-commit = git-hooks.lib.${system}.run {
+          src = self;
+
+          hooks = {
+            mypy = {
+              enable = true;
+            };
+
+            nixpkgs-fmt = {
+              enable = true;
+            };
+
+            ruff = {
+              enable = true;
+            };
+
+            ruff-format = {
+              enable = true;
+            };
+          };
+        };
+      in
+      {
+        checks = {
+          inherit (self.packages.${system}) project;
+
+          inherit pre-commit;
+        };
+
+        devShells = {
+          default = pkgs.mkShell {
+            inputsFrom = [
+              self.packages.${system}.project
+            ];
+
+            packages = with pkgs; [
+              uv
+              self.checks.${system}.pre-commit.enabledPackages
+            ];
+
+            inherit (pre-commit) shellHook;
+          };
+        };
+
+        packages = futils.lib.flattenTree {
+          default = pkgs.project;
+          inherit (pkgs) project;
+        };
+      });
+}
diff --git a/templates/python-uv/pyproject.toml b/templates/python-uv/pyproject.toml
new file mode 100644
index 0000000..7b2d896
--- /dev/null
+++ b/templates/python-uv/pyproject.toml
@@ -0,0 +1,17 @@
+[build-system]
+requires = ["setuptools"]
+build-backend = "setuptools.build_meta"
+
+
+[project]
+name = "project"
+version = "0.0.0"
+description = "project description"
+requires-python = ">=3.12"
+dependencies = []
+
+[project.scripts]
+project = "project:main"
+
+[dependency-groups]
+dev = []
diff --git a/templates/python-uv/src/project/__init__.py b/templates/python-uv/src/project/__init__.py
new file mode 100644
index 0000000..b06117d
--- /dev/null
+++ b/templates/python-uv/src/project/__init__.py
@@ -0,0 +1,2 @@
+def main() -> None:
+    print("Hello, world!")

From 7791ad09073529a8b01e534928fc0c61da139d53 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 31 Mar 2025 11:00:10 +0000
Subject: [PATCH 122/256] nixos: services: servarr: fix 'enableAll' logic

I renamed the option and refactored how it worked to make it more
explicit that it enables the entire suite by default, with explicit
opt-out of individual components (or fine-grained opt-in as an
alternative).
---
 hosts/nixos/porthos/services.nix           |  2 +-
 modules/nixos/services/servarr/default.nix | 20 +++++++++-----------
 2 files changed, 10 insertions(+), 12 deletions(-)

diff --git a/hosts/nixos/porthos/services.nix b/hosts/nixos/porthos/services.nix
index ffd150a..021a6ae 100644
--- a/hosts/nixos/porthos/services.nix
+++ b/hosts/nixos/porthos/services.nix
@@ -144,7 +144,7 @@ in
     sabnzbd.enable = true;
     # The whole *arr software suite
     servarr = {
-      enable = true;
+      enableAll = true;
       # ... But not Lidarr because I don't care for music that much
       lidarr = {
         enable = false;
diff --git a/modules/nixos/services/servarr/default.nix b/modules/nixos/services/servarr/default.nix
index e25d9cf..65c409a 100644
--- a/modules/nixos/services/servarr/default.nix
+++ b/modules/nixos/services/servarr/default.nix
@@ -19,6 +19,8 @@ let
       enable = true;
       group = "media";
     };
+    # Set-up media group
+    users.groups.media = { };
   };
 
   mkRedirection = service: {
@@ -54,34 +56,30 @@ let
 in
 {
   options.my.services.servarr = {
-    enable = lib.mkEnableOption "Media automation";
+    enableAll = lib.mkEnableOption "media automation suite";
 
     bazarr = {
-      enable = lib.my.mkDisableOption "Bazarr";
+      enable = lib.mkEnableOption "Bazarr" // { default = cfg.enableAll; };;
     };
 
     lidarr = {
-      enable = lib.my.mkDisableOption "Lidarr";
+      enable = lib.mkEnableOption "Lidarr" // { default = cfg.enableAll; };
     };
 
     radarr = {
-      enable = lib.my.mkDisableOption "Radarr";
+      enable = lib.mkEnableOption "Radarr" // { default = cfg.enableAll; };
     };
 
     readarr = {
-      enable = lib.my.mkDisableOption "Readarr";
+      enable = lib.mkEnableOption "Readarr" // { default = cfg.enableAll; };
     };
 
     sonarr = {
-      enable = lib.my.mkDisableOption "Sonarr";
+      enable = lib.mkEnableOption "Sonarr" // { default = cfg.enableAll; };
     };
   };
 
-  config = lib.mkIf cfg.enable (lib.mkMerge [
-    {
-      # Set-up media group
-      users.groups.media = { };
-    }
+  config = (lib.mkMerge [
     # Bazarr does not log authentication failures...
     (mkFullConfig "bazarr")
     # Lidarr for music

From 860c13ab1f456bc37ef092453c75c09ee08fc950 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 31 Mar 2025 10:51:21 +0000
Subject: [PATCH 123/256] nixos: services: servarr: extract bazarr

It's not an actual *arr package, but closely related to them. Extract
its configuration to a sub-module.
---
 modules/nixos/services/servarr/bazarr.nix  | 29 ++++++++++++++++++++++
 modules/nixos/services/servarr/default.nix | 11 +++-----
 2 files changed, 33 insertions(+), 7 deletions(-)
 create mode 100644 modules/nixos/services/servarr/bazarr.nix

diff --git a/modules/nixos/services/servarr/bazarr.nix b/modules/nixos/services/servarr/bazarr.nix
new file mode 100644
index 0000000..2d27c95
--- /dev/null
+++ b/modules/nixos/services/servarr/bazarr.nix
@@ -0,0 +1,29 @@
+{ config, lib, ... }:
+let
+  cfg = config.my.services.servarr.bazarr;
+in
+{
+  options.my.services.servarr.bazarr = with lib; {
+    enable = lib.mkEnableOption "Bazarr" // {
+      default = config.my.services.servarr.enableAll;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.bazarr = {
+      enable = true;
+      group = "media";
+    };
+
+    # Set-up media group
+    users.groups.media = { };
+
+    my.services.nginx.virtualHosts = {
+      bazarr = {
+        port = 6767;
+      };
+    };
+
+    # Bazarr does not log authentication failures...
+  };
+}
diff --git a/modules/nixos/services/servarr/default.nix b/modules/nixos/services/servarr/default.nix
index 65c409a..53fd14b 100644
--- a/modules/nixos/services/servarr/default.nix
+++ b/modules/nixos/services/servarr/default.nix
@@ -7,7 +7,6 @@ let
   cfg = config.my.services.servarr;
 
   ports = {
-    bazarr = 6767;
     lidarr = 8686;
     radarr = 7878;
     readarr = 8787;
@@ -55,13 +54,13 @@ let
   ]);
 in
 {
+  imports = [
+    ./bazarr.nix
+  ];
+
   options.my.services.servarr = {
     enableAll = lib.mkEnableOption "media automation suite";
 
-    bazarr = {
-      enable = lib.mkEnableOption "Bazarr" // { default = cfg.enableAll; };;
-    };
-
     lidarr = {
       enable = lib.mkEnableOption "Lidarr" // { default = cfg.enableAll; };
     };
@@ -80,8 +79,6 @@ in
   };
 
   config = (lib.mkMerge [
-    # Bazarr does not log authentication failures...
-    (mkFullConfig "bazarr")
     # Lidarr for music
     (mkFullConfig "lidarr")
     (mkFail2Ban "lidarr")

From 1f876d3e214081aa3bd006a9b78fe5772473c382 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 31 Mar 2025 10:53:32 +0000
Subject: [PATCH 124/256] nixos: services: servarr: bazarr: add 'port'

---
 modules/nixos/services/servarr/bazarr.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/modules/nixos/services/servarr/bazarr.nix b/modules/nixos/services/servarr/bazarr.nix
index 2d27c95..637da0c 100644
--- a/modules/nixos/services/servarr/bazarr.nix
+++ b/modules/nixos/services/servarr/bazarr.nix
@@ -7,12 +7,20 @@ in
     enable = lib.mkEnableOption "Bazarr" // {
       default = config.my.services.servarr.enableAll;
     };
+
+    port = mkOption {
+      type = types.port;
+      default = 6767;
+      example = 8080;
+      description = "Internal port for webui";
+    };
   };
 
   config = lib.mkIf cfg.enable {
     services.bazarr = {
       enable = true;
       group = "media";
+      listenPort = cfg.port;
     };
 
     # Set-up media group
@@ -20,7 +28,7 @@ in
 
     my.services.nginx.virtualHosts = {
       bazarr = {
-        port = 6767;
+        inherit (cfg) port;
       };
     };
 

From 8e6be43817d1337df7a5169bf62ae7d05e5689fb Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 31 Mar 2025 11:07:21 +0000
Subject: [PATCH 125/256] nixox: services: servarr: refactor starr config

Makes it slightly DRY-er and more readable.
---
 modules/nixos/services/servarr/default.nix | 87 ++--------------------
 modules/nixos/services/servarr/starr.nix   | 51 +++++++++++++
 2 files changed, 56 insertions(+), 82 deletions(-)
 create mode 100644 modules/nixos/services/servarr/starr.nix

diff --git a/modules/nixos/services/servarr/default.nix b/modules/nixos/services/servarr/default.nix
index 53fd14b..398461b 100644
--- a/modules/nixos/services/servarr/default.nix
+++ b/modules/nixos/services/servarr/default.nix
@@ -2,94 +2,17 @@
 # Relevant link [1].
 #
 # [1]: https://youtu.be/I26Ql-uX6AM
-{ config, lib, ... }:
-let
-  cfg = config.my.services.servarr;
-
-  ports = {
-    lidarr = 8686;
-    radarr = 7878;
-    readarr = 8787;
-    sonarr = 8989;
-  };
-
-  mkService = service: {
-    services.${service} = {
-      enable = true;
-      group = "media";
-    };
-    # Set-up media group
-    users.groups.media = { };
-  };
-
-  mkRedirection = service: {
-    my.services.nginx.virtualHosts = {
-      ${service} = {
-        port = ports.${service};
-      };
-    };
-  };
-
-  mkFail2Ban = service: lib.mkIf cfg.${service}.enable {
-    services.fail2ban.jails = {
-      ${service} = ''
-        enabled = true
-        filter = ${service}
-        action = iptables-allports
-      '';
-    };
-
-    environment.etc = {
-      "fail2ban/filter.d/${service}.conf".text = ''
-        [Definition]
-        failregex = ^.*\|Warn\|Auth\|Auth-Failure ip <HOST> username .*$
-        journalmatch = _SYSTEMD_UNIT=${service}.service
-      '';
-    };
-  };
-
-  mkFullConfig = service: lib.mkIf cfg.${service}.enable (lib.mkMerge [
-    (mkService service)
-    (mkRedirection service)
-  ]);
-in
+{ lib, ... }:
 {
   imports = [
     ./bazarr.nix
+    (import ./starr.nix "lidarr")
+    (import ./starr.nix "radarr")
+    (import ./starr.nix "readarr")
+    (import ./starr.nix "sonarr")
   ];
 
   options.my.services.servarr = {
     enableAll = lib.mkEnableOption "media automation suite";
-
-    lidarr = {
-      enable = lib.mkEnableOption "Lidarr" // { default = cfg.enableAll; };
-    };
-
-    radarr = {
-      enable = lib.mkEnableOption "Radarr" // { default = cfg.enableAll; };
-    };
-
-    readarr = {
-      enable = lib.mkEnableOption "Readarr" // { default = cfg.enableAll; };
-    };
-
-    sonarr = {
-      enable = lib.mkEnableOption "Sonarr" // { default = cfg.enableAll; };
-    };
   };
-
-  config = (lib.mkMerge [
-    # Lidarr for music
-    (mkFullConfig "lidarr")
-    (mkFail2Ban "lidarr")
-    # Radarr for movies
-    (mkFullConfig "radarr")
-    (mkFail2Ban "radarr")
-    # Readarr for books
-    (mkFullConfig "readarr")
-    (mkFail2Ban "readarr")
-    # Sonarr for shows
-    (mkFullConfig "sonarr")
-    (mkFail2Ban "sonarr")
-  ]);
 }
diff --git a/modules/nixos/services/servarr/starr.nix b/modules/nixos/services/servarr/starr.nix
new file mode 100644
index 0000000..e9c84f9
--- /dev/null
+++ b/modules/nixos/services/servarr/starr.nix
@@ -0,0 +1,51 @@
+# Templated *arr configuration
+starr:
+{ config, lib, ... }:
+let
+  cfg = config.my.services.servarr.${starr};
+  ports = {
+    lidarr = 8686;
+    radarr = 7878;
+    readarr = 8787;
+    sonarr = 8989;
+  };
+in
+{
+  options.my.services.servarr.${starr} = with lib; {
+    enable = lib.mkEnableOption (lib.toSentenceCase starr) // {
+      default = config.my.services.servarr.enableAll;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.${starr} = {
+      enable = true;
+      group = "media";
+    };
+
+    # Set-up media group
+    users.groups.media = { };
+
+    my.services.nginx.virtualHosts = {
+      ${starr} = {
+        port = ports.${starr};
+      };
+    };
+
+    services.fail2ban.jails = {
+      ${starr} = ''
+        enabled = true
+        filter = ${starr}
+        action = iptables-allports
+      '';
+    };
+
+    environment.etc = {
+      "fail2ban/filter.d/${starr}.conf".text = ''
+        [Definition]
+        failregex = ^.*\|Warn\|Auth\|Auth-Failure ip <HOST> username .*$
+        journalmatch = _SYSTEMD_UNIT=${starr}.service
+      '';
+    };
+  };
+}

From d783b5f5ee598ddd82e585c12d8e397c55a1e3b1 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 31 Mar 2025 11:12:16 +0000
Subject: [PATCH 126/256] nixos: services: servarr: starr: add 'port'

Now that declarative configurations are supported for those
applications.
---
 modules/nixos/services/servarr/starr.nix | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/modules/nixos/services/servarr/starr.nix b/modules/nixos/services/servarr/starr.nix
index e9c84f9..2bf7c11 100644
--- a/modules/nixos/services/servarr/starr.nix
+++ b/modules/nixos/services/servarr/starr.nix
@@ -15,12 +15,25 @@ in
     enable = lib.mkEnableOption (lib.toSentenceCase starr) // {
       default = config.my.services.servarr.enableAll;
     };
+
+    port = mkOption {
+      type = types.port;
+      default = ports.${starr};
+      example = 8080;
+      description = "Internal port for webui";
+    };
   };
 
   config = lib.mkIf cfg.enable {
     services.${starr} = {
       enable = true;
       group = "media";
+
+      settings = {
+        server = {
+          port = cfg.port;
+        };
+      };
     };
 
     # Set-up media group
@@ -28,7 +41,7 @@ in
 
     my.services.nginx.virtualHosts = {
       ${starr} = {
-        port = ports.${starr};
+        port = cfg.port;
       };
     };
 

From f825d047b5f17cdff8cd096660abf48ed79e7f72 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 31 Mar 2025 11:21:24 +0000
Subject: [PATCH 127/256] nixos: services: servarr: migrate prowlarr

The configuration doesn't have `group`, so it's a slightly different
configuration to the rest of the *arr services.

I also want to move the other two indexer modules under `servarr`, as
they are all closely related.
---
 hosts/nixos/porthos/services.nix            |  4 --
 modules/nixos/services/indexers/default.nix | 30 ------------
 modules/nixos/services/servarr/default.nix  |  1 +
 modules/nixos/services/servarr/prowlarr.nix | 53 +++++++++++++++++++++
 4 files changed, 54 insertions(+), 34 deletions(-)
 create mode 100644 modules/nixos/services/servarr/prowlarr.nix

diff --git a/hosts/nixos/porthos/services.nix b/hosts/nixos/porthos/services.nix
index 021a6ae..9017894 100644
--- a/hosts/nixos/porthos/services.nix
+++ b/hosts/nixos/porthos/services.nix
@@ -51,10 +51,6 @@ in
         passwordFile = secrets."forgejo/mail-password".path;
       };
     };
-    # Meta-indexers
-    indexers = {
-      prowlarr.enable = true;
-    };
     # Jellyfin media server
     jellyfin.enable = true;
     # Gitea mirrorig service
diff --git a/modules/nixos/services/indexers/default.nix b/modules/nixos/services/indexers/default.nix
index 8a42345..00bf316 100644
--- a/modules/nixos/services/indexers/default.nix
+++ b/modules/nixos/services/indexers/default.nix
@@ -5,13 +5,11 @@ let
 
   jackettPort = 9117;
   nzbhydraPort = 5076;
-  prowlarrPort = 9696;
 in
 {
   options.my.services.indexers = with lib; {
     jackett.enable = mkEnableOption "Jackett torrent meta-indexer";
     nzbhydra.enable = mkEnableOption "NZBHydra2 usenet meta-indexer";
-    prowlarr.enable = mkEnableOption "Prowlarr torrent & usenet meta-indexer";
   };
 
   config = lib.mkMerge [
@@ -46,33 +44,5 @@ in
         };
       };
     })
-
-    (lib.mkIf cfg.prowlarr.enable {
-      services.prowlarr = {
-        enable = true;
-      };
-
-      my.services.nginx.virtualHosts = {
-        prowlarr = {
-          port = prowlarrPort;
-        };
-      };
-
-      services.fail2ban.jails = {
-        prowlarr = ''
-          enabled = true
-          filter = prowlarr
-          action = iptables-allports
-        '';
-      };
-
-      environment.etc = {
-        "fail2ban/filter.d/prowlarr.conf".text = ''
-          [Definition]
-          failregex = ^.*\|Warn\|Auth\|Auth-Failure ip <HOST> username .*$
-          journalmatch = _SYSTEMD_UNIT=prowlarr.service
-        '';
-      };
-    })
   ];
 }
diff --git a/modules/nixos/services/servarr/default.nix b/modules/nixos/services/servarr/default.nix
index 398461b..1bca773 100644
--- a/modules/nixos/services/servarr/default.nix
+++ b/modules/nixos/services/servarr/default.nix
@@ -6,6 +6,7 @@
 {
   imports = [
     ./bazarr.nix
+    ./prowlarr.nix
     (import ./starr.nix "lidarr")
     (import ./starr.nix "radarr")
     (import ./starr.nix "readarr")
diff --git a/modules/nixos/services/servarr/prowlarr.nix b/modules/nixos/services/servarr/prowlarr.nix
new file mode 100644
index 0000000..ce044c6
--- /dev/null
+++ b/modules/nixos/services/servarr/prowlarr.nix
@@ -0,0 +1,53 @@
+# Torrent and NZB indexer
+{ config, lib, ... }:
+let
+  cfg = config.my.services.servarr.prowlarr;
+in
+{
+  options.my.services.servarr.prowlarr = with lib; {
+    enable = lib.mkEnableOption "Prowlarr" // {
+      default = config.my.services.servarr.enableAll;
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 9696;
+      example = 8080;
+      description = "Internal port for webui";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.prowlarr = {
+      enable = true;
+
+      settings = {
+        server = {
+          port = cfg.port;
+        };
+      };
+    };
+
+    my.services.nginx.virtualHosts = {
+      prowlarr = {
+        inherit (cfg) port;
+      };
+    };
+
+    services.fail2ban.jails = {
+      prowlarr = ''
+        enabled = true
+        filter = prowlarr
+        action = iptables-allports
+      '';
+    };
+
+    environment.etc = {
+      "fail2ban/filter.d/prowlarr.conf".text = ''
+        [Definition]
+        failregex = ^.*\|Warn\|Auth\|Auth-Failure ip <HOST> username .*$
+        journalmatch = _SYSTEMD_UNIT=prowlarr.service
+      '';
+    };
+  };
+}

From 950cf4dd059e74d87084747b25e70138753b82d5 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 31 Mar 2025 11:27:18 +0000
Subject: [PATCH 128/256] nixos: services: servarr: migrate jackett

---
 hosts/nixos/porthos/services.nix            |  4 +++
 modules/nixos/services/indexers/default.nix | 22 --------------
 modules/nixos/services/servarr/default.nix  |  1 +
 modules/nixos/services/servarr/jackett.nix  | 33 +++++++++++++++++++++
 4 files changed, 38 insertions(+), 22 deletions(-)
 create mode 100644 modules/nixos/services/servarr/jackett.nix

diff --git a/hosts/nixos/porthos/services.nix b/hosts/nixos/porthos/services.nix
index 9017894..d45846a 100644
--- a/hosts/nixos/porthos/services.nix
+++ b/hosts/nixos/porthos/services.nix
@@ -145,6 +145,10 @@ in
       lidarr = {
         enable = false;
       };
+      # I only use Prowlarr nowadays
+      jackett = {
+        enable = false;
+      };
     };
     # Because I still need to play sysadmin
     ssh-server.enable = true;
diff --git a/modules/nixos/services/indexers/default.nix b/modules/nixos/services/indexers/default.nix
index 00bf316..5d81079 100644
--- a/modules/nixos/services/indexers/default.nix
+++ b/modules/nixos/services/indexers/default.nix
@@ -3,36 +3,14 @@
 let
   cfg = config.my.services.indexers;
 
-  jackettPort = 9117;
   nzbhydraPort = 5076;
 in
 {
   options.my.services.indexers = with lib; {
-    jackett.enable = mkEnableOption "Jackett torrent meta-indexer";
     nzbhydra.enable = mkEnableOption "NZBHydra2 usenet meta-indexer";
   };
 
   config = lib.mkMerge [
-    (lib.mkIf cfg.jackett.enable {
-      services.jackett = {
-        enable = true;
-      };
-
-      # Jackett wants to eat *all* my RAM if left to its own devices
-      systemd.services.jackett = {
-        serviceConfig = {
-          MemoryHigh = "15%";
-          MemoryMax = "25%";
-        };
-      };
-
-      my.services.nginx.virtualHosts = {
-        jackett = {
-          port = jackettPort;
-        };
-      };
-    })
-
     (lib.mkIf cfg.nzbhydra.enable {
       services.nzbhydra2 = {
         enable = true;
diff --git a/modules/nixos/services/servarr/default.nix b/modules/nixos/services/servarr/default.nix
index 1bca773..06a1cef 100644
--- a/modules/nixos/services/servarr/default.nix
+++ b/modules/nixos/services/servarr/default.nix
@@ -6,6 +6,7 @@
 {
   imports = [
     ./bazarr.nix
+    ./jackett.nix
     ./prowlarr.nix
     (import ./starr.nix "lidarr")
     (import ./starr.nix "radarr")
diff --git a/modules/nixos/services/servarr/jackett.nix b/modules/nixos/services/servarr/jackett.nix
new file mode 100644
index 0000000..756df9b
--- /dev/null
+++ b/modules/nixos/services/servarr/jackett.nix
@@ -0,0 +1,33 @@
+{ config, lib, ... }:
+let
+  cfg = config.my.services.servarr.jackett;
+in
+{
+  options.my.services.servarr.jackett = with lib; {
+    enable = lib.mkEnableOption "Jackett" // {
+      default = config.my.services.servarr.enableAll;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.jackett = {
+      enable = true;
+    };
+
+    # Jackett wants to eat *all* my RAM if left to its own devices
+    systemd.services.jackett = {
+      serviceConfig = {
+        MemoryHigh = "15%";
+        MemoryMax = "25%";
+      };
+    };
+
+    my.services.nginx.virtualHosts = {
+      jackett = {
+        port = 9117;
+      };
+    };
+
+    # Jackett does not log authentication failures...
+  };
+}

From c823edf58415c1f07eebd03a21617c09447cafbb Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 31 Mar 2025 11:28:04 +0000
Subject: [PATCH 129/256] nixos: services: servarr: jackett: add 'port'

---
 modules/nixos/services/servarr/jackett.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/modules/nixos/services/servarr/jackett.nix b/modules/nixos/services/servarr/jackett.nix
index 756df9b..481cd3d 100644
--- a/modules/nixos/services/servarr/jackett.nix
+++ b/modules/nixos/services/servarr/jackett.nix
@@ -7,11 +7,19 @@ in
     enable = lib.mkEnableOption "Jackett" // {
       default = config.my.services.servarr.enableAll;
     };
+
+    port = mkOption {
+      type = types.port;
+      default = 9117;
+      example = 8080;
+      description = "Internal port for webui";
+    };
   };
 
   config = lib.mkIf cfg.enable {
     services.jackett = {
       enable = true;
+      inherit (cfg) port;
     };
 
     # Jackett wants to eat *all* my RAM if left to its own devices
@@ -24,7 +32,7 @@ in
 
     my.services.nginx.virtualHosts = {
       jackett = {
-        port = 9117;
+        inherit (cfg) port;
       };
     };
 

From b1ade723837cbffcfc8a1ac24fa96566392e5e3d Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 31 Mar 2025 11:32:39 +0000
Subject: [PATCH 130/256] nixos: services: servarr: migrate nzbhydra

---
 hosts/nixos/porthos/services.nix            |  3 +++
 modules/nixos/services/default.nix          |  1 -
 modules/nixos/services/indexers/default.nix | 26 ---------------------
 modules/nixos/services/servarr/default.nix  |  1 +
 modules/nixos/services/servarr/nzbhydra.nix | 25 ++++++++++++++++++++
 5 files changed, 29 insertions(+), 27 deletions(-)
 delete mode 100644 modules/nixos/services/indexers/default.nix
 create mode 100644 modules/nixos/services/servarr/nzbhydra.nix

diff --git a/hosts/nixos/porthos/services.nix b/hosts/nixos/porthos/services.nix
index d45846a..7efddfa 100644
--- a/hosts/nixos/porthos/services.nix
+++ b/hosts/nixos/porthos/services.nix
@@ -149,6 +149,9 @@ in
       jackett = {
         enable = false;
       };
+      nzbhydra = {
+        enable = false;
+      };
     };
     # Because I still need to play sysadmin
     ssh-server.enable = true;
diff --git a/modules/nixos/services/default.nix b/modules/nixos/services/default.nix
index 3992385..27f8765 100644
--- a/modules/nixos/services/default.nix
+++ b/modules/nixos/services/default.nix
@@ -15,7 +15,6 @@
     ./gitea
     ./grocy
     ./homebox
-    ./indexers
     ./jellyfin
     ./komga
     ./lohr
diff --git a/modules/nixos/services/indexers/default.nix b/modules/nixos/services/indexers/default.nix
deleted file mode 100644
index 5d81079..0000000
--- a/modules/nixos/services/indexers/default.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-# Torrent and usenet meta-indexers
-{ config, lib, ... }:
-let
-  cfg = config.my.services.indexers;
-
-  nzbhydraPort = 5076;
-in
-{
-  options.my.services.indexers = with lib; {
-    nzbhydra.enable = mkEnableOption "NZBHydra2 usenet meta-indexer";
-  };
-
-  config = lib.mkMerge [
-    (lib.mkIf cfg.nzbhydra.enable {
-      services.nzbhydra2 = {
-        enable = true;
-      };
-
-      my.services.nginx.virtualHosts = {
-        nzbhydra = {
-          port = nzbhydraPort;
-        };
-      };
-    })
-  ];
-}
diff --git a/modules/nixos/services/servarr/default.nix b/modules/nixos/services/servarr/default.nix
index 06a1cef..23838fd 100644
--- a/modules/nixos/services/servarr/default.nix
+++ b/modules/nixos/services/servarr/default.nix
@@ -7,6 +7,7 @@
   imports = [
     ./bazarr.nix
     ./jackett.nix
+    ./nzbhydra.nix
     ./prowlarr.nix
     (import ./starr.nix "lidarr")
     (import ./starr.nix "radarr")
diff --git a/modules/nixos/services/servarr/nzbhydra.nix b/modules/nixos/services/servarr/nzbhydra.nix
new file mode 100644
index 0000000..4112c30
--- /dev/null
+++ b/modules/nixos/services/servarr/nzbhydra.nix
@@ -0,0 +1,25 @@
+{ config, lib, ... }:
+let
+  cfg = config.my.services.servarr.nzbhydra;
+in
+{
+  options.my.services.servarr.nzbhydra = with lib; {
+    enable = lib.mkEnableOption "NZBHydra2" // {
+      default = config.my.services.servarr.enableAll;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.nzbhydra2 = {
+      enable = true;
+    };
+
+    my.services.nginx.virtualHosts = {
+      nzbhydra = {
+        port = 5076;
+      };
+    };
+
+    # NZBHydra2 does not log authentication failures...
+  };
+}

From ec965800e4a1cd0d8a26f7e2ba50d31e85aaf9b9 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 31 Mar 2025 11:34:25 +0000
Subject: [PATCH 131/256] nixos: services: servarr: nzbhydra: fix websockets

From what I could read, NZBHydra2 *might* require proxying websockets in
new versions (better safe than sorry).
---
 modules/nixos/services/servarr/nzbhydra.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/nixos/services/servarr/nzbhydra.nix b/modules/nixos/services/servarr/nzbhydra.nix
index 4112c30..7b63986 100644
--- a/modules/nixos/services/servarr/nzbhydra.nix
+++ b/modules/nixos/services/servarr/nzbhydra.nix
@@ -17,6 +17,7 @@ in
     my.services.nginx.virtualHosts = {
       nzbhydra = {
         port = 5076;
+        websocketsLocations = [ "/" ];
       };
     };
 

From 351026418678281890d469c7d183516f34bba445 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 31 Mar 2025 22:49:11 +0200
Subject: [PATCH 132/256] flake: bump inputs

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index 353a392..d86d6b5 100644
--- a/flake.lock
+++ b/flake.lock
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743607567,
-        "narHash": "sha256-kTzKPDFmNzwO1cK4fiJgPB/iSw7HgBAmknRTeAPJAeI=",
+        "lastModified": 1743869639,
+        "narHash": "sha256-Xhe3whfRW/Ay05z9m1EZ1/AkbV1yo0tm1CbgjtCi4rQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "49748c74cdbae03d70381f150b810f92617f23aa",
+        "rev": "d094c6763c6ddb860580e7d3b4201f8f496a6836",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1743448293,
-        "narHash": "sha256-bmEPmSjJakAp/JojZRrUvNcDX2R5/nuX6bm+seVaGhs=",
+        "lastModified": 1743689281,
+        "narHash": "sha256-y7Hg5lwWhEOgflEHRfzSH96BOt26LaYfrYWzZ+VoVdg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "77b584d61ff80b4cef9245829a6f1dfad5afdfa3",
+        "rev": "2bfc080955153be0be56724be6fa5477b4eefabb",
         "type": "github"
       },
       "original": {

From 215eb4c91ac722b8da4bb38c6791695021c3b516 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 13 Feb 2025 22:59:51 +0100
Subject: [PATCH 133/256] nixos: services: servarr: add autobrr

---
 hosts/nixos/porthos/services.nix           |  3 ++
 modules/nixos/services/servarr/autobrr.nix | 62 ++++++++++++++++++++++
 modules/nixos/services/servarr/default.nix |  1 +
 3 files changed, 66 insertions(+)
 create mode 100644 modules/nixos/services/servarr/autobrr.nix

diff --git a/hosts/nixos/porthos/services.nix b/hosts/nixos/porthos/services.nix
index 7efddfa..cb77fbe 100644
--- a/hosts/nixos/porthos/services.nix
+++ b/hosts/nixos/porthos/services.nix
@@ -141,6 +141,9 @@ in
     # The whole *arr software suite
     servarr = {
       enableAll = true;
+      autobrr = {
+        enable = false;
+      };
       # ... But not Lidarr because I don't care for music that much
       lidarr = {
         enable = false;
diff --git a/modules/nixos/services/servarr/autobrr.nix b/modules/nixos/services/servarr/autobrr.nix
new file mode 100644
index 0000000..afb07f4
--- /dev/null
+++ b/modules/nixos/services/servarr/autobrr.nix
@@ -0,0 +1,62 @@
+# IRC-based
+{ config, lib, ... }:
+let
+  cfg = config.my.services.servarr.autobrr;
+in
+{
+  options.my.services.servarr.autobrr = with lib; {
+    enable = mkEnableOption "autobrr IRC announce tracker" // {
+      default = config.my.services.servarr.enableAll;
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 7474;
+      example = 8080;
+      description = "Internal port for webui";
+    };
+
+    sessionSecretFile = mkOption {
+      type = types.str;
+      example = "/run/secrets/autobrr-secret.txt";
+      description = ''
+        File containing the session secret.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.autobrr = {
+      enable = true;
+
+      settings = {
+        inherit (cfg) port;
+        checkForUpdates = false;
+      };
+
+      secretFile = cfg.sessionSecretFile;
+    };
+
+    my.services.nginx.virtualHosts = {
+      autobrr = {
+        inherit (cfg) port;
+      };
+    };
+
+    services.fail2ban.jails = {
+      autobrr = ''
+        enabled = true
+        filter = autobrr
+        action = iptables-allports
+      '';
+    };
+
+    environment.etc = {
+      "fail2ban/filter.d/autobrr.conf".text = ''
+        [Definition]
+        failregex = ^.*Auth: invalid login \[.*\] from: <HOST>$
+        journalmatch = _SYSTEMD_UNIT=autobrr.service
+      '';
+    };
+  };
+}
diff --git a/modules/nixos/services/servarr/default.nix b/modules/nixos/services/servarr/default.nix
index 23838fd..409fcdc 100644
--- a/modules/nixos/services/servarr/default.nix
+++ b/modules/nixos/services/servarr/default.nix
@@ -5,6 +5,7 @@
 { lib, ... }:
 {
   imports = [
+    ./autobrr.nix
     ./bazarr.nix
     ./jackett.nix
     ./nzbhydra.nix

From 979814e9dea51880a2ed2c3f37033b994160441d Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 13 Feb 2025 21:58:19 +0000
Subject: [PATCH 134/256] hosts: nixos: porthos: secrets: add autobrr

---
 hosts/nixos/porthos/secrets/secrets.nix                    | 2 ++
 .../porthos/secrets/servarr/autobrr/session-secret.age     | 7 +++++++
 2 files changed, 9 insertions(+)
 create mode 100644 hosts/nixos/porthos/secrets/servarr/autobrr/session-secret.age

diff --git a/hosts/nixos/porthos/secrets/secrets.nix b/hosts/nixos/porthos/secrets/secrets.nix
index 68e90f2..425756c 100644
--- a/hosts/nixos/porthos/secrets/secrets.nix
+++ b/hosts/nixos/porthos/secrets/secrets.nix
@@ -80,6 +80,8 @@ in
 
   "pyload/credentials.age".publicKeys = all;
 
+  "servarr/autobrr/session-secret.age".publicKeys = all;
+
   "sso/auth-key.age" = {
     owner = "nginx-sso";
     publicKeys = all;
diff --git a/hosts/nixos/porthos/secrets/servarr/autobrr/session-secret.age b/hosts/nixos/porthos/secrets/servarr/autobrr/session-secret.age
new file mode 100644
index 0000000..e98b94a
--- /dev/null
+++ b/hosts/nixos/porthos/secrets/servarr/autobrr/session-secret.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 cKojmg bu09lB+fjaPP31cUQZP6EqSPuseucgNK7k9vAS08iS0
++NGL+b2QD/qGo6hqHvosAXzHZtDvfodmPdcgnrKlD1o
+-> ssh-ed25519 jPowng QDCdRBGWhtdvvMCiDH52cZHz1/W7aomhTatZ4+9IKwI
+Ou3jjV/O55G1CPgGS33l3eWhhYWrVdwVNPSiE14d5rE
+--- q0ssmpG50OX1WaNSInc2hbtH3DbTwQGDU74VGEoMh94
+ ¯mCùº�Æ‘'hK.Ðì/™Xu(€«Õ×g$½'¼šM{fK˜”!ÛMZ²oR÷®ˆüÎÕ�ÍŸö;yb
\ No newline at end of file

From b8c649d5bff68813cb8589c776cf39a17cef91ea Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 30 Mar 2025 20:22:01 +0200
Subject: [PATCH 135/256] hosts: nixos: porthos: services: enable autobrr

---
 hosts/nixos/porthos/services.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hosts/nixos/porthos/services.nix b/hosts/nixos/porthos/services.nix
index cb77fbe..784eb31 100644
--- a/hosts/nixos/porthos/services.nix
+++ b/hosts/nixos/porthos/services.nix
@@ -142,7 +142,7 @@ in
     servarr = {
       enableAll = true;
       autobrr = {
-        enable = false;
+        sessionSecretFile = secrets."servarr/autobrr/session-secret".path;
       };
       # ... But not Lidarr because I don't care for music that much
       lidarr = {

From 08f7c2bd7912696047e815adbb92adf89f4e47c7 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 5 Apr 2025 20:24:21 +0200
Subject: [PATCH 136/256] nixos: services: nextcloud: bump to 31

---
 modules/nixos/services/nextcloud/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/nixos/services/nextcloud/default.nix b/modules/nixos/services/nextcloud/default.nix
index fe94177..cf1b876 100644
--- a/modules/nixos/services/nextcloud/default.nix
+++ b/modules/nixos/services/nextcloud/default.nix
@@ -35,7 +35,7 @@ in
   config = lib.mkIf cfg.enable {
     services.nextcloud = {
       enable = true;
-      package = pkgs.nextcloud30;
+      package = pkgs.nextcloud31;
       hostName = "nextcloud.${config.networking.domain}";
       home = "/var/lib/nextcloud";
       maxUploadSize = cfg.maxSize;

From 01529075369d01274302efaaa8df55aac77b1a21 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 7 Apr 2025 10:19:30 +0000
Subject: [PATCH 137/256] flake: nixos: use 'self.dirtyRev' if available

---
 flake/nixos.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/flake/nixos.nix b/flake/nixos.nix
index fa656dc..bf9eac8 100644
--- a/flake/nixos.nix
+++ b/flake/nixos.nix
@@ -3,7 +3,7 @@ let
   defaultModules = [
     {
       # Let 'nixos-version --json' know about the Git revision
-      system.configurationRevision = self.rev or "dirty";
+      system.configurationRevision = self.rev or self.dirtyRev or "dirty";
     }
     {
       nixpkgs.overlays = (lib.attrValues self.overlays) ++ [

From a1cab7f60649123658bb8df098c5eff934d0364b Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 7 Apr 2025 15:50:22 +0000
Subject: [PATCH 138/256] flake: home-manager: set overlays in module

I need to inherit `lib` to make sure it picks up my version, not the one
from `pkgs`.

I can't use `extraSpecialArgs` like NixOS, due to it missing from
upstream [1].

[1]: https://github.com/nix-community/home-manager/pull/3969
---
 flake/home-manager.nix | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/flake/home-manager.nix b/flake/home-manager.nix
index add889e..093ae8c 100644
--- a/flake/home-manager.nix
+++ b/flake/home-manager.nix
@@ -3,6 +3,11 @@ let
   defaultModules = [
     # Include generic settings
     "${self}/modules/home"
+    {
+      nixpkgs.overlays = (lib.attrValues self.overlays) ++ [
+        inputs.nur.overlays.default
+      ];
+    }
     {
       # Basic user information defaults
       home.username = lib.mkDefault "ambroisie";
@@ -21,18 +26,15 @@ let
     # * not letting me set `lib` as an extraSpecialArgs
     # * not respecting `nixpkgs.overlays` [1]
     # [1]: https://github.com/nix-community/home-manager/issues/2954
-    pkgs = import inputs.nixpkgs {
-      inherit system;
-
-      overlays = (lib.attrValues self.overlays) ++ [
-        inputs.nur.overlays.default
-      ];
-    };
+    pkgs = inputs.nixpkgs.legacyPackages.${system};
 
     modules = defaultModules ++ [
       "${self}/hosts/homes/${name}"
     ];
 
+    # Use my extended lib in NixOS configuration
+    inherit (self) lib;
+
     extraSpecialArgs = {
       # Inject inputs to use them in global registry
       inherit inputs;

From e5bf5a3ba1ce7c6d2aa09658303dcabf72bb09b9 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 9 Apr 2025 11:41:07 +0200
Subject: [PATCH 139/256] flake: bump inputs

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index d86d6b5..9e61219 100644
--- a/flake.lock
+++ b/flake.lock
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1743689281,
-        "narHash": "sha256-y7Hg5lwWhEOgflEHRfzSH96BOt26LaYfrYWzZ+VoVdg=",
+        "lastModified": 1744174375,
+        "narHash": "sha256-oxI9TLgnQbQ/WL0tIwVSIooLbXq4PW1QUhf5aQmXFgk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2bfc080955153be0be56724be6fa5477b4eefabb",
+        "rev": "ef3a956f697525883b77192cbe208233ea0f8f79",
         "type": "github"
       },
       "original": {

From 439a6bc930ea7eabb372824c71d4a9174d4588b5 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 9 Apr 2025 12:26:04 +0200
Subject: [PATCH 140/256] nixos: services: homebox: use postgres

---
 modules/nixos/services/homebox/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/modules/nixos/services/homebox/default.nix b/modules/nixos/services/homebox/default.nix
index d79e331..bde59e6 100644
--- a/modules/nixos/services/homebox/default.nix
+++ b/modules/nixos/services/homebox/default.nix
@@ -19,6 +19,11 @@ in
     services.homebox = {
       enable = true;
 
+      # Automatic PostgreSQL provisioning
+      database = {
+        createLocally = true;
+      };
+
       settings = {
         # FIXME: mailer?
         HBOX_WEB_PORT = toString cfg.port;

From 1dd1dbb917b17da7864a4ac20a977869ff752ac2 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 9 Apr 2025 12:26:42 +0200
Subject: [PATCH 141/256] nixos: services: homebox: proxy websockets

Should avoid a bunch of error logs, and ensure that e.g: adding a label
does not require a refresh to show it in a list.
---
 modules/nixos/services/homebox/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/nixos/services/homebox/default.nix b/modules/nixos/services/homebox/default.nix
index bde59e6..8ed5d77 100644
--- a/modules/nixos/services/homebox/default.nix
+++ b/modules/nixos/services/homebox/default.nix
@@ -33,6 +33,7 @@ in
     my.services.nginx.virtualHosts = {
       homebox = {
         inherit (cfg) port;
+        websocketsLocations = [ "/api" ];
       };
     };
 

From bd55ecc016eb49eca60b98ab0d2a22eca49a95ce Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 9 Apr 2025 12:27:51 +0200
Subject: [PATCH 142/256] hosts: nixos: porthos: services: enable homebox

---
 hosts/nixos/porthos/services.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hosts/nixos/porthos/services.nix b/hosts/nixos/porthos/services.nix
index 784eb31..561da27 100644
--- a/hosts/nixos/porthos/services.nix
+++ b/hosts/nixos/porthos/services.nix
@@ -51,6 +51,10 @@ in
         passwordFile = secrets."forgejo/mail-password".path;
       };
     };
+    # Home inventory
+    homebox = {
+      enable = true;
+    };
     # Jellyfin media server
     jellyfin.enable = true;
     # Gitea mirrorig service

From a28295da27b96301bba49cd68cb6ae017be4be76 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 11 Apr 2025 19:01:08 +0200
Subject: [PATCH 143/256] nixos: services: servarr: autobrr: fix comment

---
 modules/nixos/services/servarr/autobrr.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/nixos/services/servarr/autobrr.nix b/modules/nixos/services/servarr/autobrr.nix
index afb07f4..4465a78 100644
--- a/modules/nixos/services/servarr/autobrr.nix
+++ b/modules/nixos/services/servarr/autobrr.nix
@@ -1,4 +1,4 @@
-# IRC-based
+# IRC-based indexer
 { config, lib, ... }:
 let
   cfg = config.my.services.servarr.autobrr;

From a0473a5c6cd191ea649c250dc7e8f6094e74adba Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 12 Apr 2025 11:27:47 +0200
Subject: [PATCH 144/256] nixos: services: servarr: autobrr: fix fail2ban

The log line for authentication failures has been updated since the
original PR.

It also happens to be logged in JSON, and I'm a bit too lazy to match it
more properly than this.
---
 modules/nixos/services/servarr/autobrr.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/nixos/services/servarr/autobrr.nix b/modules/nixos/services/servarr/autobrr.nix
index 4465a78..398e878 100644
--- a/modules/nixos/services/servarr/autobrr.nix
+++ b/modules/nixos/services/servarr/autobrr.nix
@@ -54,7 +54,7 @@ in
     environment.etc = {
       "fail2ban/filter.d/autobrr.conf".text = ''
         [Definition]
-        failregex = ^.*Auth: invalid login \[.*\] from: <HOST>$
+        failregex = "message":"Auth: Failed login attempt username: \[.*\] ip: <HOST>"
         journalmatch = _SYSTEMD_UNIT=autobrr.service
       '';
     };

From e82ae4a2192191e2894969fe3107fdbcd36c8c92 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 14 Apr 2025 10:19:57 +0000
Subject: [PATCH 145/256] home: vim: numbertoggle: remove 'TermOpen' event

It's now part of upstream's default setup.
---
 modules/home/vim/plugin/numbertoggle.lua | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/modules/home/vim/plugin/numbertoggle.lua b/modules/home/vim/plugin/numbertoggle.lua
index 8042710..b1e3df2 100644
--- a/modules/home/vim/plugin/numbertoggle.lua
+++ b/modules/home/vim/plugin/numbertoggle.lua
@@ -22,13 +22,3 @@ vim.api.nvim_create_autocmd({ "BufLeave", "FocusLost", "InsertEnter", "WinLeave"
         end
     end,
 })
-
--- Never show the sign column in a terminal buffer
-vim.api.nvim_create_autocmd({ "TermOpen" }, {
-    pattern = "*",
-    group = numbertoggle,
-    callback = function()
-        vim.opt.number = false
-        vim.opt.relativenumber = false
-    end,
-})

From 67936af4c73f8664448efc80b072f40c568517c6 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 14 Apr 2025 10:19:57 +0000
Subject: [PATCH 146/256] home: vim: signtoggle: remove 'TermOpen' event

It's now part of upstream's default setup.
---
 modules/home/vim/plugin/signtoggle.lua | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/modules/home/vim/plugin/signtoggle.lua b/modules/home/vim/plugin/signtoggle.lua
index 9765a81..6a7640c 100644
--- a/modules/home/vim/plugin/signtoggle.lua
+++ b/modules/home/vim/plugin/signtoggle.lua
@@ -15,12 +15,3 @@ vim.api.nvim_create_autocmd({ "BufLeave", "FocusLost", "WinLeave" }, {
         vim.opt.signcolumn = "no"
     end,
 })
-
--- Never show the sign column in a terminal buffer
-vim.api.nvim_create_autocmd({ "TermOpen" }, {
-    pattern = "*",
-    group = signtoggle,
-    callback = function()
-        vim.opt.signcolumn = "no"
-    end,
-})

From 6f5ac4e55f644a5e5a473e9fda752fbebdec7455 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 14 Apr 2025 10:24:30 +0000
Subject: [PATCH 147/256] home: vim: signtoggle: only show signs if 'number'

If a buffer doesn't show a number column, I probably also don't want a
sign column to be toggled on/off in there.
---
 modules/home/vim/plugin/signtoggle.lua | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/modules/home/vim/plugin/signtoggle.lua b/modules/home/vim/plugin/signtoggle.lua
index 6a7640c..3deca34 100644
--- a/modules/home/vim/plugin/signtoggle.lua
+++ b/modules/home/vim/plugin/signtoggle.lua
@@ -1,17 +1,21 @@
 local signtoggle = vim.api.nvim_create_augroup("signtoggle", { clear = true })
 
--- Only show sign column for the currently focused buffer
+-- Only show sign column for the currently focused buffer, if it has a number column
 vim.api.nvim_create_autocmd({ "BufEnter", "FocusGained", "WinEnter" }, {
     pattern = "*",
     group = signtoggle,
     callback = function()
-        vim.opt.signcolumn = "yes"
+        if vim.opt.number:get() then
+            vim.opt.signcolumn = "yes"
+        end
     end,
 })
 vim.api.nvim_create_autocmd({ "BufLeave", "FocusLost", "WinLeave" }, {
     pattern = "*",
     group = signtoggle,
     callback = function()
-        vim.opt.signcolumn = "no"
+        if vim.opt.number:get() then
+            vim.opt.signcolumn = "no"
+        end
     end,
 })

From 26ee59ef6e4f28ccbdbcf87eb28bb4074a87c840 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 14 Apr 2025 13:54:52 +0000
Subject: [PATCH 148/256] home: atuin: use 'uk' dialect for dates

This should be for date *parsing*, from my looking at the code.

Unlikely to be relevant, but might as well set it to the saner of the
two options.
---
 modules/home/atuin/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/home/atuin/default.nix b/modules/home/atuin/default.nix
index 3f06263..8c02e69 100644
--- a/modules/home/atuin/default.nix
+++ b/modules/home/atuin/default.nix
@@ -21,6 +21,8 @@ in
       ];
 
       settings = {
+        # Reasonable date format
+        dialect = "uk";
         # The package is managed by Nix
         update_check = false;
         # I don't care for the fancy display

From c69aaa7adb604593d20d38d0037caaf24cb41f3e Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 16 Apr 2025 15:25:18 +0200
Subject: [PATCH 149/256] nixos: services: servarr: autobrr: fix websockets

I found some logs complaining about websockets before enabling this.
---
 modules/nixos/services/servarr/autobrr.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/nixos/services/servarr/autobrr.nix b/modules/nixos/services/servarr/autobrr.nix
index 398e878..c3370cb 100644
--- a/modules/nixos/services/servarr/autobrr.nix
+++ b/modules/nixos/services/servarr/autobrr.nix
@@ -40,6 +40,7 @@ in
     my.services.nginx.virtualHosts = {
       autobrr = {
         inherit (cfg) port;
+        websocketsLocations = [ "/api" ];
       };
     };
 

From e4bc0444bfe7fdc7a43afcbda1ec7379f8286301 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 16 Apr 2025 15:29:10 +0200
Subject: [PATCH 150/256] nixos: services: transmission: fix umask

I want downloads to be readable by the `media` group. The permissions
weren't correctly applied without `umask`.
---
 modules/nixos/services/transmission/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/nixos/services/transmission/default.nix b/modules/nixos/services/transmission/default.nix
index ac8b24d..16d51e3 100644
--- a/modules/nixos/services/transmission/default.nix
+++ b/modules/nixos/services/transmission/default.nix
@@ -65,6 +65,8 @@ in
         # Proxied behind Nginx.
         rpc-whitelist-enabled = true;
         rpc-whitelist = "127.0.0.1";
+
+        umask = "002"; # To go with `downloadDirPermissions`
       };
     };
 

From 1b6a48d6c27a88c98c6c99cbe642ee681c362cbd Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 16 Apr 2025 17:07:23 +0200
Subject: [PATCH 151/256] flake: bump inputs

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index 9e61219..65b8f04 100644
--- a/flake.lock
+++ b/flake.lock
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1744174375,
-        "narHash": "sha256-oxI9TLgnQbQ/WL0tIwVSIooLbXq4PW1QUhf5aQmXFgk=",
+        "lastModified": 1744777043,
+        "narHash": "sha256-O6jgTxz9BKUiaJl03JsVHvSjtCOC8gHfDvC2UCfcLMc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ef3a956f697525883b77192cbe208233ea0f8f79",
+        "rev": "7a6f7f4c1c69eee05641beaa40e7f85da8e69fb0",
         "type": "github"
       },
       "original": {

From c40090d17607efbec1d58cefa95f0745ab0806b7 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 12 Apr 2025 14:51:46 +0200
Subject: [PATCH 152/256] nixos: services: servarr: add cross-seed

---
 hosts/nixos/porthos/services.nix              |  3 +
 modules/nixos/services/servarr/cross-seed.nix | 96 +++++++++++++++++++
 modules/nixos/services/servarr/default.nix    |  1 +
 3 files changed, 100 insertions(+)
 create mode 100644 modules/nixos/services/servarr/cross-seed.nix

diff --git a/hosts/nixos/porthos/services.nix b/hosts/nixos/porthos/services.nix
index 561da27..a95840a 100644
--- a/hosts/nixos/porthos/services.nix
+++ b/hosts/nixos/porthos/services.nix
@@ -148,6 +148,9 @@ in
       autobrr = {
         sessionSecretFile = secrets."servarr/autobrr/session-secret".path;
       };
+      cross-seed = {
+        enable = false;
+      };
       # ... But not Lidarr because I don't care for music that much
       lidarr = {
         enable = false;
diff --git a/modules/nixos/services/servarr/cross-seed.nix b/modules/nixos/services/servarr/cross-seed.nix
new file mode 100644
index 0000000..74f216a
--- /dev/null
+++ b/modules/nixos/services/servarr/cross-seed.nix
@@ -0,0 +1,96 @@
+# Automatic cross-seeding for video media
+{ config, lib, ... }:
+let
+  cfg = config.my.services.servarr.cross-seed;
+in
+{
+  options.my.services.servarr.cross-seed = with lib; {
+    enable = mkEnableOption "cross-seed daemon" // {
+      default = config.my.services.servarr.enableAll;
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 2468;
+      example = 8080;
+      description = "Internal port for daemon";
+    };
+
+    linkDirectory = mkOption {
+      type = types.str;
+      default = "/data/downloads/complete/links";
+      example = "/var/lib/cross-seed/links";
+      description = "Link directory";
+    };
+
+    secretSettingsFile = mkOption {
+      type = types.str;
+      example = "/run/secrets/cross-seed-secrets.json";
+      description = ''
+        File containing secret settings.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.cross-seed = {
+      enable = true;
+      group = "media";
+
+      # Rely on recommended defaults for tracker snatches etc...
+      useGenConfigDefaults = true;
+
+      settings = {
+        inherit (cfg) port;
+        host = "127.0.0.1";
+
+        # Inject torrents to client directly
+        action = "inject";
+        # Query the client for torrents to match
+        useClientTorrents = true;
+        # Use hardlinks
+        linkType = "hardlink";
+        # Use configured link directory
+        linkDirs = [ cfg.linkDirectory ];
+        # Match as many torrents as possible
+        matchMode = "partial";
+        # Cross-seed full season if at least 50% of episodes are already downloaded
+        seasonFromEpisodes = 0.5;
+      };
+
+      settingsFile = cfg.secretSettingsFile;
+    };
+
+    systemd.services.cross-seed = {
+      serviceConfig = {
+        # Loose umask to make cross-seed links readable by `media`
+        UMask = "0002";
+      };
+    };
+
+    # Set-up media group
+    users.groups.media = { };
+
+    my.services.nginx.virtualHosts = {
+      cross-seed = {
+        inherit (cfg) port;
+      };
+    };
+
+    services.fail2ban.jails = {
+      cross-seed = ''
+        enabled = true
+        filter = cross-seed
+        action = iptables-allports
+      '';
+    };
+
+    environment.etc = {
+      "fail2ban/filter.d/cross-seed.conf".text = ''
+        [Definition]
+        failregex = ^.*Unauthorized API access attempt to .* from <HOST>$
+        journalmatch = _SYSTEMD_UNIT=cross-seed.service
+      '';
+    };
+  };
+}
diff --git a/modules/nixos/services/servarr/default.nix b/modules/nixos/services/servarr/default.nix
index 409fcdc..dca57cf 100644
--- a/modules/nixos/services/servarr/default.nix
+++ b/modules/nixos/services/servarr/default.nix
@@ -7,6 +7,7 @@
   imports = [
     ./autobrr.nix
     ./bazarr.nix
+    ./cross-seed.nix
     ./jackett.nix
     ./nzbhydra.nix
     ./prowlarr.nix

From 058096079eadcf5fb488f00156dcd6d3a5489256 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 12 Apr 2025 14:52:10 +0200
Subject: [PATCH 153/256] hosts: nixos: porthos: secrets: add cross-seed

---
 hosts/nixos/porthos/secrets/secrets.nix          |   1 +
 .../servarr/cross-seed/configuration.json.age    | Bin 0 -> 1282 bytes
 2 files changed, 1 insertion(+)
 create mode 100644 hosts/nixos/porthos/secrets/servarr/cross-seed/configuration.json.age

diff --git a/hosts/nixos/porthos/secrets/secrets.nix b/hosts/nixos/porthos/secrets/secrets.nix
index 425756c..b3812b4 100644
--- a/hosts/nixos/porthos/secrets/secrets.nix
+++ b/hosts/nixos/porthos/secrets/secrets.nix
@@ -81,6 +81,7 @@ in
   "pyload/credentials.age".publicKeys = all;
 
   "servarr/autobrr/session-secret.age".publicKeys = all;
+  "servarr/cross-seed/configuration.json.age".publicKeys = all;
 
   "sso/auth-key.age" = {
     owner = "nginx-sso";
diff --git a/hosts/nixos/porthos/secrets/servarr/cross-seed/configuration.json.age b/hosts/nixos/porthos/secrets/servarr/cross-seed/configuration.json.age
new file mode 100644
index 0000000000000000000000000000000000000000..e9af03f472da8411b7106cf733ba1d389201263a
GIT binary patch
literal 1282
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCSn_Ri1BO;^Y%D)lpW
z_Vox$^UBlD_YJRfEOs*TaI7%TamjG@@%MBN_6+q4%rlBG4CFEk(T)lZswgWlj0|@T
zOfI%GGIq@J$u08_b}~sxN^>zZ3kh=Z)~^WiGeNg4D<Ho-FI~aW$uz>R)FdraKP<?}
z&oC;dGRM6vGSbhZ($vq~ys#{{FfrAzxWv@OF`FyAJVV<&z_ZZL*f2k+B)7;vJR(0o
zGSMO+)7{b6!Ywq%tiaeguf)G3!+=XyS69I@s;r<i$W%Mg+cLx_GQiC=Eg;b;RJ%As
z+uStKLp!lJBsVS3B*`n-(Sl3Nv-?a><MIrl(x*{bjP<sxbE2Gdw_Xrkr(%C|ap?a?
z*4ol~;-*5+owM{z@1FYk<B)aL#?(CrYK<rES!w6U|JNmJcZJJWvHUZpzudiRmYMJU
zvp@Rwq`);#<fot8G4;-;Rr@krUpfAHTx*peDK>>Q?&_key4;IpeNQjT-<rU%qA}a9
z=KuZtXr<E~f%(t>={NB3)O=pQ;MLzxPQS!o<z^}Phwwg0S}|{K;nl;E=W9&wHm}iL
z)mCHqK6R<uu@>Ib3v^1Sri)Zs9eVB=lXAmyUEuZlJ%3cK^Gi!u7w2uv-`dOQZ$FXe
z3*(03pW)Xgwfh=0Gjk-(y5bwTz)`wS;CJZJWp^yK``2&nXpHTb_<S?N*Za?kW@F7s
zUYt+9PK)ADsY+r9nt1F+c6qz+^ot3yn+uJbG#<=glIrDWdn(ypVeb=L%dfEEv`fH$
z`G9PmYcINQdsYPYh)r*1H~z=SKEF{geYM<cmx5_mOA8Wat@_LSQ1<aM+h@hUUMByO
zzP11G-z`hKxeg!scK>IM9_Qkgn(YnF5BSA*H`bfRnLD#;ukQR_DQvniFx=(b?Qj2!
zjwJcLmRIPtk}o>ACGkbuS&frT;XOMSX2r>6bGA<`5MKBvH)cmpdxG$^g=^xroJ_lW
zj8(z<=7Gg4?T`5IWK_04n)k`A_^6Ro?}Rfup7}iebiiEhj^WR)BYmZDuN1^h=f3NB
z6c#wu{Eyn<b<1T{j^!xdSfYPcp3Pl#ON5p0xkilzIRgJGuYB>*Tra+3;%3F&h3x;{
z^$9+GF!jix1q_uog>SvI7|Yxv)Rh!9ZmoJe^Hct_oFjD>yg&T+$mUMnl<roY`rz_q
zOZy@{>CH0>@~5aB{o`yCkb0pdG)BVZ)G22c?)L5Mi!54$;;YvkVqAOw@6QYkJHc+T
zNuQ?QSKG(kYxG~eg5$-Dk9TiY9FCcs7awN$Li4RTlb1v|*GGSr=bP_ytXh#jaoPRb
zwqIJFxK>UPFfTilIA`aV#ZKF@6J~T=_+H2N?wKE_+oI|3g2V15M&`b+lZ*TGd$II~
zp4Y!@)U{7*rY!nfB+ayF=43{`-Tk2xT8jLvukPx;c-d-lXH&IZ+b@X|F$b9DSJ}w?
zn|)=Ec)*@~w|7Ctwy8c>9*bKP8$9m~Z2lAQOWRa0DSvOJ^E$QZQ65=0Z<x<8`6e-`
zNK9;5b<Yf`!w;husPgHzeN+^7^;&v&re@*wPP>a0753*7ZutHTFF1He;Ff2n;b$@S
zO@^oRdHR_y1$Hbr^txewUfIF>X6zzqJWZZTPgB_3-hUQrYkHDkaX$G8Gn2mmfp2fO
a3$3o2qvJ8ZJ$CJ3_b3jI6I)+s@Bjd%=|BMh

literal 0
HcmV?d00001


From ee1139713c908ab43cd86b86fc984f1824395ca2 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 12 Apr 2025 14:52:38 +0200
Subject: [PATCH 154/256] hosts: nixos: porthos: services: enable cross-seed

---
 hosts/nixos/porthos/services.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hosts/nixos/porthos/services.nix b/hosts/nixos/porthos/services.nix
index a95840a..96f15d3 100644
--- a/hosts/nixos/porthos/services.nix
+++ b/hosts/nixos/porthos/services.nix
@@ -149,7 +149,7 @@ in
         sessionSecretFile = secrets."servarr/autobrr/session-secret".path;
       };
       cross-seed = {
-        enable = false;
+        secretSettingsFile = secrets."servarr/cross-seed/configuration.json".path;
       };
       # ... But not Lidarr because I don't care for music that much
       lidarr = {

From 135cef25365c25a1efaa912489c960a5fe839663 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 16 Apr 2025 16:04:52 +0000
Subject: [PATCH 155/256] home: atuin: add daemon

Enabled by default, I probably won't have a reason *not* to use it.
---
 modules/home/atuin/default.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/modules/home/atuin/default.nix b/modules/home/atuin/default.nix
index 8c02e69..dbd9690 100644
--- a/modules/home/atuin/default.nix
+++ b/modules/home/atuin/default.nix
@@ -8,6 +8,10 @@ in
 
     # I want the full experience by default
     package = mkPackageOption pkgs "atuin" { };
+
+    daemon = {
+      enable = my.mkDisableOption "atuin daemon";
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -15,6 +19,10 @@ in
       enable = true;
       inherit (cfg) package;
 
+      daemon = lib.mkIf cfg.daemon.enable {
+        enable = true;
+      };
+
       flags = [
         # I *despise* this hijacking of the up key, even though I use Ctrl-p
         "--disable-up-arrow"

From 29b47d7f84c67428d44ccc1f385161f187702661 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 22 Apr 2025 13:04:36 +0000
Subject: [PATCH 156/256] home: tmux: rename 'mkTerminalFeature'

This is a more accurate name to describe what the function is doing.
---
 modules/home/tmux/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/home/tmux/default.nix b/modules/home/tmux/default.nix
index 08b9202..82ceb3a 100644
--- a/modules/home/tmux/default.nix
+++ b/modules/home/tmux/default.nix
@@ -6,7 +6,7 @@ let
     (config.my.home.wm.windowManager != null)
   ];
 
-  mkTerminalFlags = opt: flag:
+  mkTerminalFeature = opt: flag:
     let
       mkFlag = term: ''set -as terminal-features ",${term}:${flag}"'';
       enabledTerminals = lib.filterAttrs (_: v: v.${opt}) cfg.terminalFeatures;
@@ -123,9 +123,9 @@ in
       }
 
       # Force OSC8 hyperlinks for each relevant $TERM
-      ${mkTerminalFlags "hyperlinks" "hyperlinks"}
+      ${mkTerminalFeature "hyperlinks" "hyperlinks"}
       # Force 24-bit color for each relevant $TERM
-      ${mkTerminalFlags "trueColor" "RGB"}
+      ${mkTerminalFeature "trueColor" "RGB"}
     '';
   };
 }

From ec1c94676a727ee7b6e20c377ad0f7d05af9d69e Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 22 Apr 2025 13:15:04 +0000
Subject: [PATCH 157/256] home: vim: highlight over-extended commit subjects

---
 modules/home/vim/after/queries/gitcommit/highlights.scm | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 modules/home/vim/after/queries/gitcommit/highlights.scm

diff --git a/modules/home/vim/after/queries/gitcommit/highlights.scm b/modules/home/vim/after/queries/gitcommit/highlights.scm
new file mode 100644
index 0000000..05162c9
--- /dev/null
+++ b/modules/home/vim/after/queries/gitcommit/highlights.scm
@@ -0,0 +1,6 @@
+; extends
+
+; Highlight over-extended subject lines (rely on wrapping for message body)
+((subject) @comment.error
+  (#vim-match? @comment.error ".\{50,}")
+  (#offset! @comment.error 0 50 0 0))

From 946eab9ec00bfba393d1ed292a28f0f692048096 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 21 Feb 2025 16:26:39 +0000
Subject: [PATCH 158/256] home: git: extract 'delta' configuration

I want to be able to re-use it between different source control systems
(e.g: `jj`).

As a first step, extract it to a proper module so that I can have it
live in a single space.
---
 modules/home/default.nix       |  1 +
 modules/home/delta/default.nix | 61 ++++++++++++++++++++++++++++++++++
 modules/home/git/default.nix   | 28 ----------------
 3 files changed, 62 insertions(+), 28 deletions(-)
 create mode 100644 modules/home/delta/default.nix

diff --git a/modules/home/default.nix b/modules/home/default.nix
index c8183cf..e642e87 100644
--- a/modules/home/default.nix
+++ b/modules/home/default.nix
@@ -8,6 +8,7 @@
     ./bluetooth
     ./calibre
     ./comma
+    ./delta
     ./dircolors
     ./direnv
     ./discord
diff --git a/modules/home/delta/default.nix b/modules/home/delta/default.nix
new file mode 100644
index 0000000..e9350bb
--- /dev/null
+++ b/modules/home/delta/default.nix
@@ -0,0 +1,61 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.my.home.delta;
+in
+{
+  options.my.home.delta = with lib; {
+    enable = my.mkDisableOption "delta configuration";
+
+    package = mkPackageOption pkgs "delta" { };
+
+    git = {
+      enable = my.mkDisableOption "git integration";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        # For its configuration
+        assertion = cfg.enable -> cfg.git.enable;
+        message = ''
+          `config.my.home.delta` must enable `config.my.home.delta.git` to be
+          properly configured.
+        '';
+      }
+    ];
+
+    home.packages = [ cfg.package ];
+
+    programs.git = lib.mkIf cfg.git.enable {
+      delta = {
+        enable = true;
+        inherit (cfg) package;
+
+        options = {
+          features = "diff-highlight decorations";
+
+          # Less jarring style for `diff-highlight` emulation
+          diff-highlight = {
+            minus-style = "red";
+            minus-non-emph-style = "red";
+            minus-emph-style = "bold red 52";
+
+            plus-style = "green";
+            plus-non-emph-style = "green";
+            plus-emph-style = "bold green 22";
+
+            whitespace-error-style = "reverse red";
+          };
+
+          # Personal preference for easier reading
+          decorations = {
+            commit-style = "raw"; # Do not recolor meta information
+            keep-plus-minus-markers = true;
+            paging = "always";
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/modules/home/git/default.nix b/modules/home/git/default.nix
index c88008f..ca59a5f 100644
--- a/modules/home/git/default.nix
+++ b/modules/home/git/default.nix
@@ -42,34 +42,6 @@ in
 
     lfs.enable = true;
 
-    delta = {
-      enable = true;
-
-      options = {
-        features = "diff-highlight decorations";
-
-        # Less jarring style for `diff-highlight` emulation
-        diff-highlight = {
-          minus-style = "red";
-          minus-non-emph-style = "red";
-          minus-emph-style = "bold red 52";
-
-          plus-style = "green";
-          plus-non-emph-style = "green";
-          plus-emph-style = "bold green 22";
-
-          whitespace-error-style = "reverse red";
-        };
-
-        # Personal preference for easier reading
-        decorations = {
-          commit-style = "raw"; # Do not recolor meta information
-          keep-plus-minus-markers = true;
-          paging = "always";
-        };
-      };
-    };
-
     # There's more
     extraConfig = {
       # Makes it a bit more readable

From 2eb2a83dca68ffd2ff5380300fbaec23e8038e6a Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 24 Apr 2025 09:29:37 +0000
Subject: [PATCH 159/256] flake: bump inputs

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index 65b8f04..6bd45a8 100644
--- a/flake.lock
+++ b/flake.lock
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743869639,
-        "narHash": "sha256-Xhe3whfRW/Ay05z9m1EZ1/AkbV1yo0tm1CbgjtCi4rQ=",
+        "lastModified": 1745439012,
+        "narHash": "sha256-TwbdiH28QK7Da2JQTqFHdb+UCJq6QbF2mtf+RxHVzEA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "d094c6763c6ddb860580e7d3b4201f8f496a6836",
+        "rev": "d31710fb2cd536b1966fee2af74e99a0816a61a8",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1744777043,
-        "narHash": "sha256-O6jgTxz9BKUiaJl03JsVHvSjtCOC8gHfDvC2UCfcLMc=",
+        "lastModified": 1745469902,
+        "narHash": "sha256-+kHgeD+3+WZZcOaIsS6XwQWb+qbYYWYXzoEjdmdW6OY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "7a6f7f4c1c69eee05641beaa40e7f85da8e69fb0",
+        "rev": "4975ac49a527b505803958595fcb191c9e889f60",
         "type": "github"
       },
       "original": {

From 89bc60609f07b4f3cff4cb4e0610f1b8243a9ad3 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 24 Apr 2025 12:46:24 +0200
Subject: [PATCH 160/256] home: firefox: tridactyl: use 'replaceVars'

---
 modules/home/firefox/tridactyl/default.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/modules/home/firefox/tridactyl/default.nix b/modules/home/firefox/tridactyl/default.nix
index 35b58c2..26ddfad 100644
--- a/modules/home/firefox/tridactyl/default.nix
+++ b/modules/home/firefox/tridactyl/default.nix
@@ -12,9 +12,7 @@ let
 in
 {
   config = lib.mkIf cfg.enable {
-    xdg.configFile."tridactyl/tridactylrc".source = pkgs.substituteAll {
-      src = ./tridactylrc;
-
+    xdg.configFile."tridactyl/tridactylrc".source = pkgs.replaceVars ./tridactylrc {
       editorcmd = lib.concatStringsSep " " [
         # Use my configured terminal
         term

From bfda64288ead8796e1f3c8a5980fabb228f2e844 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 30 Apr 2025 21:05:22 +0100
Subject: [PATCH 161/256] nix: bump inputs

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 6bd45a8..584d942 100644
--- a/flake.lock
+++ b/flake.lock
@@ -14,11 +14,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1736955230,
-        "narHash": "sha256-uenf8fv2eG5bKM8C/UvFaiJMZ4IpUFaQxk9OH5t/1gA=",
+        "lastModified": 1745630506,
+        "narHash": "sha256-bHCFgGeu8XjWlVuaWzi3QONjDW3coZDqSHvnd4l7xus=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "e600439ec4c273cf11e06fe4d9d906fb98fa097c",
+        "rev": "96e078c646b711aee04b82ba01aefbff87004ded",
         "type": "github"
       },
       "original": {
@@ -36,11 +36,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1700795494,
-        "narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
+        "lastModified": 1744478979,
+        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
+        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745439012,
-        "narHash": "sha256-TwbdiH28QK7Da2JQTqFHdb+UCJq6QbF2mtf+RxHVzEA=",
+        "lastModified": 1746040799,
+        "narHash": "sha256-osgPX/SzIpkR50vev/rqoTEAVkEcOWXoQXmbzsaI4KU=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "d31710fb2cd536b1966fee2af74e99a0816a61a8",
+        "rev": "5f217e5a319f6c186283b530f8c975e66c028433",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1745469902,
-        "narHash": "sha256-+kHgeD+3+WZZcOaIsS6XwQWb+qbYYWYXzoEjdmdW6OY=",
+        "lastModified": 1745930157,
+        "narHash": "sha256-y3h3NLnzRSiUkYpnfvnS669zWZLoqqI6NprtLQ+5dck=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4975ac49a527b505803958595fcb191c9e889f60",
+        "rev": "46e634be05ce9dc6d4db8e664515ba10b78151ae",
         "type": "github"
       },
       "original": {

From c5be292dfca50b740acf130bb0c3138fb4261a26 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 30 Apr 2025 21:34:11 +0100
Subject: [PATCH 162/256] nixos: profiles: wm: fix i3lock PAM service

This was announced as a breaking change, and would lock me out if not
set.

I wish the transition went a bit slower, by first introducing the
option for each PAM service, and *then* toggling it. Oh well.
---
 modules/nixos/profiles/wm/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/nixos/profiles/wm/default.nix b/modules/nixos/profiles/wm/default.nix
index c227328..bca4d70 100644
--- a/modules/nixos/profiles/wm/default.nix
+++ b/modules/nixos/profiles/wm/default.nix
@@ -24,6 +24,8 @@ in
       my.home.udiskie.enable = true;
       # udiskie fails if it can't find this dbus service
       services.udisks2.enable = true;
+      # Ensure i3lock can actually unlock the session
+      security.pam.services.i3lock.enable = true;
     })
   ];
 }

From 4b6f62b25ab9bccf84aa994ac8e8b79a42632e00 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 30 Apr 2025 21:36:50 +0100
Subject: [PATCH 163/256] home: gpg: fix deprecated config

---
 modules/home/gpg/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/gpg/default.nix b/modules/home/gpg/default.nix
index 51c865a..2a00baf 100644
--- a/modules/home/gpg/default.nix
+++ b/modules/home/gpg/default.nix
@@ -17,7 +17,7 @@ in
     services.gpg-agent = {
       enable = true;
       enableSshSupport = true; # One agent to rule them all
-      pinentryPackage = cfg.pinentry;
+      pinentry.package = cfg.pinentry;
       extraConfig = ''
         allow-loopback-pinentry
       '';

From e3243ebe80d7c3e55337227d1e4177022d78ca05 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 2 May 2025 17:59:03 +0100
Subject: [PATCH 164/256] nixos: services: nextcloud: simplify DB handling

I *think* the option didn't exist when I originally used this module.
---
 modules/nixos/services/nextcloud/default.nix | 22 +++++---------------
 1 file changed, 5 insertions(+), 17 deletions(-)

diff --git a/modules/nixos/services/nextcloud/default.nix b/modules/nixos/services/nextcloud/default.nix
index cf1b876..d8d4fce 100644
--- a/modules/nixos/services/nextcloud/default.nix
+++ b/modules/nixos/services/nextcloud/default.nix
@@ -44,11 +44,15 @@ in
         adminuser = cfg.admin;
         adminpassFile = cfg.passwordFile;
         dbtype = "pgsql";
-        dbhost = "/run/postgresql";
       };
 
       https = true;
 
+      # Automatic PostgreSQL provisioning
+      database = {
+        createLocally = true;
+      };
+
       settings = {
         overwriteprotocol = "https"; # Nginx only allows SSL
       };
@@ -60,22 +64,6 @@ in
       };
     };
 
-    services.postgresql = {
-      enable = true;
-      ensureDatabases = [ "nextcloud" ];
-      ensureUsers = [
-        {
-          name = "nextcloud";
-          ensureDBOwnership = true;
-        }
-      ];
-    };
-
-    systemd.services."nextcloud-setup" = {
-      requires = [ "postgresql.service" ];
-      after = [ "postgresql.service" ];
-    };
-
     # The service above configures the domain, no need for my wrapper
     services.nginx.virtualHosts."nextcloud.${config.networking.domain}" = {
       forceSSL = true;

From 921d604ebea0d265815c76c60a85efa0929bc1ce Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 2 May 2025 22:35:33 +0100
Subject: [PATCH 165/256] hosts: nixos: porthos: secrets: update cross-seed

---
 .../servarr/cross-seed/configuration.json.age | Bin 1282 -> 1364 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/hosts/nixos/porthos/secrets/servarr/cross-seed/configuration.json.age b/hosts/nixos/porthos/secrets/servarr/cross-seed/configuration.json.age
index e9af03f472da8411b7106cf733ba1d389201263a..1499a56c21c9911f5a7111177b3458e418cb4b1c 100644
GIT binary patch
delta 1337
zcmZqTy23R<r{2dsGAl1R&CsVf!`Ro~tfEpsDzP{tveLK6H?_bqBQV>~+#=N{Kdj6(
zkju?CG(W`1q_`?PSKrs8&^6REIMFhosHDiCI6uQN-`^~&Dk-2MG@~>spG((Hp}06h
zH#Nn`)YQ;YAuAxiJTF}#B-zj1%rDG1C(EQFDzM7fuRbiR%*Qjgytq`~%%sfKHQ2B)
zIV&p6FxSX}%Pci3(7?>gG(SDeGd#u5&&15d(>chkDl^|Zr8Lzd-Q6ravLGxV#oR5D
zOIKG{A*d>)D4@V8C#1Y6B-7Nm(juua&p*OE*Uccf#3SF)#LqI&&)hxRB`~p^Yxyd>
zj1~K?AFEe4*c%Y58#y;-`z!&8)Tv=jGo`~r_eAP+vgUnQnY4O$&c(W!cUcYk)~Byu
z7Vzw@$d$U!zGgcb()tRwY`S*Zy*t7{bAo+2mn5_5`<;szWvw3^-gZ;4wr6wbV}m{m
zd#2gfbYzy8RB#p=DDJkBTcaa%;L*aG_3u~ATWG{_FFEEz{e{%6|2DLE)+t6^YG6z`
z{A5PL1Fns#@q)XPE=n6m+~kVqJ@igxBk!iS4|MwPt~j;Y#z<rpf6y@v8|P)GXUg*H
zPV83caLTFw)#u%JoJsY2<R1IKi2+~Umb6!!>|+*+yi>9=iQDHGtMxmlmx_$beugPX
zC;Bt}=|BBkD}!4icUS!ciOom#Ivr*InYoqZI92{v^Vwc!8_chE_cKSY;`RSeWPFul
z&X?ET`*duvY47@lcRoKh`e8Y7LgQ1NNpr*|*IP3%T(3NrlaO?fgQuS3;l0yGIg|F?
z{!}L(zr@krBgDYT>E`5BUmn_sn!7X~3~^2tpJcLOcJqtK2^lfZ3r}Bjtbg}%_5#Dc
zqDk?V!FnzapA{-pnoWw@EXX9*aZ2FU?%n@uHofl(KhksITjrT*E{~sAZ&>ZykP>k@
zhBG{FR`T)SXCGh595Gz;>=&N`r=!=ejvIe@x_`g<75JTLv5v#rE1e3rcP=`!Rz?4m
zgj1iKWZ`x@qp2_DpQWy0WNDJ-Z8<-u{`0#QS+Dv2GkAP<MX&HpG~QUe^<~-iuY7Ig
z>mM8Ix=voUBj3W$k#l{*-0QbL{ZE-J+QnJC>Fo*gsol04UVk^a``q54u_trU9f8|D
zo0jM{s5;GNSTlFCVb7OefzKNq*{bHwf6q{&cXOiI)9pXkwKE>R=Mp=o=s-YT;TDy5
z^KNdbFDf}(SvHYtZ5jXevMiA!!7o^w**8>XUjFyP_wgz2<%gCmICJvImNvx*|6_Sc
ztKTo5bYT83`FY!TEDjyWR=HIko%HP2pJ^whY?PS)`5ONVx_xf*(=~mX3m+^yw_&OO
zPnYN248r+y*$z+f+OWn`%%DuxQ`vk+S&!fq$Jt+Zm?w4Bx4zE1EjJ_2EP26Uj$>}E
zf99q5{9E+3{kYq<)s=;t{-jy0yYsvL)+|#|)k_`I)&<@vSC=ThFPfPa+kXGa|C?3&
zyXVAA<7!)|wXdxFcrr(Oit`Rm|2HR}Z#wv<O7_V&*K>8p3Vh4tLYSxJDgG{VwPHIo
zeaf^J!vop2KROTB)y=Hm{d)H6ef$D;Onn{)&aNpaKY#K<lKnNO-Ps9mqUN=BF5g|X
ze|g(U4{7cw-`zzk-`6czc>9d)G5+8AQE#OR7#0Z4=(_&r^bDJ`Uv34fERD`MG{=0+
zDWQe(h2f6cGk8CDwcdR7)oJG4PdmRPvwmBt)u|BJa&&H(RXdxa_pF@k=V?Y+|39{5
zpRZXh*QprkDgDa!?(xIv(!ZNuYX=;<!?^yMSJ#Q<vF;|SaaSxB^<1j_bD1Fo00>`p
A&j0`b

delta 1254
zcmcb@)x<SHr#`2s)X&`6*CQ;=D^EY)H@woZ*vZJlvBEsZCBxar-_tqRGt@6I&nUt$
zkjpGYJ1RJ+qO8O)GTb#Vx!BUk*fGl|x6D7-$s{Ey&Bf3xB*?{Ezaq%bgiF^>p}06h
zH#Nn`)YQ;YAuAxiJTG0r(aAKzuhb+hQ$H-o$<Ht<r@k`By(}`)&!f`R&)mGQEVnQ*
z)v&n4)WtEIE4(~I+dROt(9hT~Kd2<P$Ui(HKR+_jA|TV<(bvK)G{>yK*g3Dnza+ze
zOIKG{!7{3>pft!-JJH)R#3wSq%``0_(J55BI78dqG|@vlu{b0*Ezcy$E7;M3OU$$T
zOi$zTjC!Hcr%_pq^|q{YqMUTMUJzZUVt;dS=>JF7+R}RBrb5r1v-C{wp8EOYkag9@
z)IA4kjVJC|Y3IoQ*ClIrh09m5{4=J%+`Vg-neY9xKl=8hz%@_gr=Qy~_0FeN`!ZZ#
zIsSQEYn31=Hib3r>Y}T<+>2#>PcO^gn!vE4G25=@|NZ>vdZp7Hf%(t>={NB3)O=pQ
z;MLzxPQS!o<z^}Phwwg0S}|{K;nl;E=W9&wHm}iL)mCHqK6R<uu@>Ib3v^1Sri)Zs
z9eVB=lXAmyUEuZlJ%3cK^Gi!u7w2uv-`dOQZ$FXe3*(03pW)Xgwfh=0Gjk-(y5bwT
zz)`wS;CJZJWp^yK``6cR?P!ecm-u`$!`J)Iie_WYNnV^!zD|qcP^n5{2%328Ms|6-
z@AQiavYQKyn=~HGV3O+PXL~ByUSaPOTg$Jo;j~M@fBArHo@+0<Z+lh*_J~byW;g!F
z$UeVOFnzV$YnOs)S4#^LX07_m{80AsGTUdxzg{N)lfJe8@ZT*<ySWY@ssDEWXN?}`
z;+C524bBhv#dkN>o5q<tvudyI{9Y++x-l@^<=pLW|BH?!`Ms7`=(UnBI=ChAMcY}8
zlTG10I~Qif$z^l4Pb?5#_$N1JM^1Z!@U(?%;<lVjyL*gP!TRQb#VhTP`0!*@wm+Kp
z$*uUPkyP)5GdrI7JpFXQT<(tH&#oi&eWh`)6vR#EzUz1t7C6=XkJ{mN%VkxL<tX1+
zqJLJN&0Td%gq82PMvVnI0{<$neDTp-FTP{qX2sow?El{N2|j%=^~j+G43##8Z@sh_
z%iJT>l@v8@t$IB3Q~tA@BXt(MKm7N|=1$#|?pB@p;PPcl`yxH*%`*$~r>GtM<7^X<
zdZE50G)BVZ)G22c?)L5Mi!54$;;YvkVqAOw@6QYkJHc+TNuQ?QSKG(kYxG~eg5$-D
zk9TiY9FCcs7awN$Li4RTlb1v|*GGSr=bP_ytXh#jaoPRbwqIJFxK>UPFfTilIA`aV
z#ZKF@6J~T=_+H2N?wKE_+oI|3g2V15M&`b+lZ*TGyMD3sho0BJY}B<+Yo;vvTO`f2
zXy#-_zTN$y6IzP=tgr6szIfSca%WSuUE42-6EO#v=2zLs{F{Ack9feIe7AQ&#<r<G
zS00O76dOG64Q&1s@JriNFDZX-rSm$q=}{h8H*c8FF!?4isYpz0S#{40slyMW7pU^-
zw|!I;cJ*3%ccx~1;q^|tixn02=M!%D{tPcTcu3%uXQ$z3G4@S{r}TOHnJxu(EI9PK
zVSZlO!TV<HB56ELo=Q(s*xcTK7HeyIl3;N@`3W<VzW;%5Z?_Aru9~CcF~2=_?P2#Q
M4vrIBUuf_E0F5*_k^lez


From 22f97b4ac7d6e0285935f5236686c789e712ff04 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 3 May 2025 13:56:12 +0100
Subject: [PATCH 166/256] home: vim: lua: lsp: configure inlay hints

---
 modules/home/vim/lua/ambroisie/lsp.lua | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/modules/home/vim/lua/ambroisie/lsp.lua b/modules/home/vim/lua/ambroisie/lsp.lua
index e48de12..fef0487 100644
--- a/modules/home/vim/lua/ambroisie/lsp.lua
+++ b/modules/home/vim/lua/ambroisie/lsp.lua
@@ -53,6 +53,10 @@ M.on_attach = function(client, bufnr)
         vim.diagnostic.open_float(nil, { scope = "buffer" })
     end
 
+    local function toggle_inlay_hints()
+        vim.lsp.inlay_hint.enable(not vim.lsp.inlay_hint.is_enabled())
+    end
+
     local keys = {
         buffer = bufnr,
         -- LSP navigation
@@ -67,6 +71,7 @@ M.on_attach = function(client, bufnr)
         { "<leader>ca", vim.lsp.buf.code_action, desc = "Code actions" },
         { "<leader>cd", cycle_diagnostics_display, desc = "Cycle diagnostics display" },
         { "<leader>cD", show_buffer_diagnostics, desc = "Show buffer diagnostics" },
+        { "<leader>ch", toggle_inlay_hints, desc = "Toggle inlay hints" },
         { "<leader>cr", vim.lsp.buf.rename, desc = "Rename symbol" },
         { "<leader>cs", vim.lsp.buf.signature_help, desc = "Show signature" },
         { "<leader>ct", vim.lsp.buf.type_definition, desc = "Go to type definition" },

From d2a8894eb298a2fbdee409b20995c51d6dcbaf4e Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 5 May 2025 18:06:41 +0100
Subject: [PATCH 167/256] home: wm: i3: make 'firefox' history float

---
 modules/home/wm/i3/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/home/wm/i3/default.nix b/modules/home/wm/i3/default.nix
index 029a14b..5f22bbe 100644
--- a/modules/home/wm/i3/default.nix
+++ b/modules/home/wm/i3/default.nix
@@ -127,6 +127,7 @@ in
             { class = "^Blueman-.*$"; }
             { title = "^htop$"; }
             { class = "^Thunderbird$"; instance = "Mailnews"; window_role = "filterlist"; }
+            { class = "^firefox$"; instance = "Places"; window_role = "Organizer"; }
             { class = "^pavucontrol.*$"; }
             { class = "^Arandr$"; }
             { class = "^\\.blueman-manager-wrapped$"; }

From a9ba93f834db067e9d791c4299ceab483c8ef6f8 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 7 May 2025 11:27:12 +0000
Subject: [PATCH 168/256] home: delta: assert git is enabled

---
 modules/home/delta/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/modules/home/delta/default.nix b/modules/home/delta/default.nix
index e9350bb..58ee031 100644
--- a/modules/home/delta/default.nix
+++ b/modules/home/delta/default.nix
@@ -23,6 +23,13 @@ in
           properly configured.
         '';
       }
+      {
+        assertion = cfg.enable -> config.programs.git.enable;
+        message = ''
+          `config.my.home.delta` relies on `config.programs.git` to be
+          enabled.
+        '';
+      }
     ];
 
     home.packages = [ cfg.package ];

From 07d8f5a03fbc5a1e36e6425953ad30f2c7037287 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 7 May 2025 17:25:28 +0200
Subject: [PATCH 169/256] flake: nixos: use 'nixpkgs.hostPlatform'

This is the proper way to set `system` nowadays.
---
 flake/nixos.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/flake/nixos.nix b/flake/nixos.nix
index bf9eac8..0fbd3a6 100644
--- a/flake/nixos.nix
+++ b/flake/nixos.nix
@@ -15,8 +15,10 @@ let
   ];
 
   buildHost = name: system: lib.nixosSystem {
-    inherit system;
     modules = defaultModules ++ [
+      {
+        nixpkgs.hostPlatform = system;
+      }
       "${self}/hosts/nixos/${name}"
     ];
     specialArgs = {

From 8a8e4f93a513ad3aaafdbeced14a61d5f961ff1d Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 7 May 2025 17:16:44 +0000
Subject: [PATCH 170/256] flake: home-manager: remove obsolete comment

---
 flake/home-manager.nix | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/flake/home-manager.nix b/flake/home-manager.nix
index 093ae8c..88a74e8 100644
--- a/flake/home-manager.nix
+++ b/flake/home-manager.nix
@@ -22,10 +22,6 @@ let
   ];
 
   mkHome = name: system: inputs.home-manager.lib.homeManagerConfiguration {
-    # Work-around for home-manager
-    # * not letting me set `lib` as an extraSpecialArgs
-    # * not respecting `nixpkgs.overlays` [1]
-    # [1]: https://github.com/nix-community/home-manager/issues/2954
     pkgs = inputs.nixpkgs.legacyPackages.${system};
 
     modules = defaultModules ++ [

From 77839ab2ef3003c38324cade0810b41d1c84cc8c Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 8 May 2025 13:29:35 +0000
Subject: [PATCH 171/256] flake: bump inputs

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index 584d942..ef7aba8 100644
--- a/flake.lock
+++ b/flake.lock
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1745930157,
-        "narHash": "sha256-y3h3NLnzRSiUkYpnfvnS669zWZLoqqI6NprtLQ+5dck=",
+        "lastModified": 1746683680,
+        "narHash": "sha256-+5zk+UbG0+GQlKt+gIKm+OhlYvHmkAHFXvf7hl1HDeM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "46e634be05ce9dc6d4db8e664515ba10b78151ae",
+        "rev": "16762245d811fdd74b417cc922223dc8eb741e8b",
         "type": "github"
       },
       "original": {

From 0c5836bc56e9048e27db4081595ff7cb566f9c31 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 8 May 2025 23:22:11 +0200
Subject: [PATCH 172/256] nixos: services: paperless: use 'PAPERLESS_URL'

---
 modules/nixos/services/paperless/default.nix | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/modules/nixos/services/paperless/default.nix b/modules/nixos/services/paperless/default.nix
index 63f456b..9cdac38 100644
--- a/modules/nixos/services/paperless/default.nix
+++ b/modules/nixos/services/paperless/default.nix
@@ -53,17 +53,13 @@ in
       mediaDir = lib.mkIf (cfg.documentPath != null) cfg.documentPath;
 
       settings =
-        let
-          paperlessDomain = "paperless.${config.networking.domain}";
-        in
         {
           # Use SSO
           PAPERLESS_ENABLE_HTTP_REMOTE_USER = true;
           PAPERLESS_HTTP_REMOTE_USER_HEADER_NAME = "HTTP_X_USER";
 
           # Security settings
-          PAPERLESS_ALLOWED_HOSTS = paperlessDomain;
-          PAPERLESS_CORS_ALLOWED_HOSTS = "https://${paperlessDomain}";
+          PAPERLESS_URL = "https://paperless.${config.networking.domain}";
 
           # OCR settings
           PAPERLESS_OCR_LANGUAGE = "fra+eng";

From a997d36964830a96b13c99175c51165614686edf Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 8 May 2025 23:22:35 +0200
Subject: [PATCH 173/256] nixos: services: paperless: fix formatting

---
 modules/nixos/services/paperless/default.nix | 32 ++++++++++----------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/modules/nixos/services/paperless/default.nix b/modules/nixos/services/paperless/default.nix
index 9cdac38..f345e8a 100644
--- a/modules/nixos/services/paperless/default.nix
+++ b/modules/nixos/services/paperless/default.nix
@@ -52,26 +52,26 @@ in
 
       mediaDir = lib.mkIf (cfg.documentPath != null) cfg.documentPath;
 
-      settings =
-        {
-          # Use SSO
-          PAPERLESS_ENABLE_HTTP_REMOTE_USER = true;
-          PAPERLESS_HTTP_REMOTE_USER_HEADER_NAME = "HTTP_X_USER";
+      settings = {
+        # Use SSO
+        PAPERLESS_ENABLE_HTTP_REMOTE_USER = true;
+        PAPERLESS_ENABLE_HTTP_REMOTE_USER_API = true;
+        PAPERLESS_HTTP_REMOTE_USER_HEADER_NAME = "HTTP_X_USER";
 
-          # Security settings
-          PAPERLESS_URL = "https://paperless.${config.networking.domain}";
+        # Security settings
+        PAPERLESS_URL = "https://paperless.${config.networking.domain}";
 
-          # OCR settings
-          PAPERLESS_OCR_LANGUAGE = "fra+eng";
+        # OCR settings
+        PAPERLESS_OCR_LANGUAGE = "fra+eng";
 
-          # Workers
-          PAPERLESS_TASK_WORKERS = 3;
-          PAPERLESS_THREADS_PER_WORKER = 4;
+        # Workers
+        PAPERLESS_TASK_WORKERS = 3;
+        PAPERLESS_THREADS_PER_WORKER = 4;
 
-          # Misc
-          PAPERLESS_TIME_ZONE = config.time.timeZone;
-          PAPERLESS_ADMIN_USER = cfg.username;
-        };
+        # Misc
+        PAPERLESS_TIME_ZONE = config.time.timeZone;
+        PAPERLESS_ADMIN_USER = cfg.username;
+      };
 
       # Admin password
       passwordFile = cfg.passwordFile;

From 1dc65a37e7dc8041ee639dac882c5e2503708170 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 8 May 2025 23:29:30 +0200
Subject: [PATCH 174/256] nixos: services: paperless: set proxy settings

---
 modules/nixos/services/paperless/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/nixos/services/paperless/default.nix b/modules/nixos/services/paperless/default.nix
index f345e8a..b6965ca 100644
--- a/modules/nixos/services/paperless/default.nix
+++ b/modules/nixos/services/paperless/default.nix
@@ -60,6 +60,8 @@ in
 
         # Security settings
         PAPERLESS_URL = "https://paperless.${config.networking.domain}";
+        PAPERLESS_USE_X_FORWARD_HOST = true;
+        PAPERLESS_PROXY_SSL_HEADER = ''["HTTP_X_FORWARDED_PROTO", "https"]'';
 
         # OCR settings
         PAPERLESS_OCR_LANGUAGE = "fra+eng";

From 5b545a28f10c90d07f0442fb8c5823b1cb53f2f3 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 9 May 2025 00:02:07 +0200
Subject: [PATCH 175/256] nixos: services: mealie: use automatic DB setup

---
 modules/nixos/services/mealie/default.nix | 20 +++-----------------
 1 file changed, 3 insertions(+), 17 deletions(-)

diff --git a/modules/nixos/services/mealie/default.nix b/modules/nixos/services/mealie/default.nix
index 664d5ba..3b4d4f7 100644
--- a/modules/nixos/services/mealie/default.nix
+++ b/modules/nixos/services/mealie/default.nix
@@ -38,27 +38,13 @@ in
         # Make it work with socket auth
         POSTGRES_URL_OVERRIDE = "postgresql://mealie:@/mealie?host=/run/postgresql";
       };
-    };
 
-    systemd.services = {
-      mealie = {
-        after = [ "postgresql.service" ];
-        requires = [ "postgresql.service" ];
+      # Automatic PostgreSQL provisioning
+      database = {
+        createLocally = true;
       };
     };
 
-    # Set-up database
-    services.postgresql = {
-      enable = true;
-      ensureDatabases = [ "mealie" ];
-      ensureUsers = [
-        {
-          name = "mealie";
-          ensureDBOwnership = true;
-        }
-      ];
-    };
-
     my.services.nginx.virtualHosts = {
       mealie = {
         inherit (cfg) port;

From f14f5c7f8aa3e87cb025e04b3f8cac2b1315d596 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 14 May 2025 18:51:12 +0000
Subject: [PATCH 176/256] flake: bump inputs

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index ef7aba8..b90b54a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1742649964,
-        "narHash": "sha256-DwOTp7nvfi8mRfuL1escHDXabVXFGT1VlPD1JHrtrco=",
+        "lastModified": 1746537231,
+        "narHash": "sha256-Wb2xeSyOsCoTCTj7LOoD6cdKLEROyFAArnYoS+noCWo=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "dcf5072734cb576d2b0c59b2ac44f5050b5eac82",
+        "rev": "fa466640195d38ec97cf0493d6d6882bc4d14969",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746040799,
-        "narHash": "sha256-osgPX/SzIpkR50vev/rqoTEAVkEcOWXoQXmbzsaI4KU=",
+        "lastModified": 1747225851,
+        "narHash": "sha256-4IbmZrNOdXP143kZEUzxBS5SqyxUlaSHLgdpeJfP2ZU=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "5f217e5a319f6c186283b530f8c975e66c028433",
+        "rev": "6bf057fc8326e83bda05a669fc08d106547679fb",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1746683680,
-        "narHash": "sha256-+5zk+UbG0+GQlKt+gIKm+OhlYvHmkAHFXvf7hl1HDeM=",
+        "lastModified": 1746904237,
+        "narHash": "sha256-3e+AVBczosP5dCLQmMoMEogM57gmZ2qrVSrmq9aResQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "16762245d811fdd74b417cc922223dc8eb741e8b",
+        "rev": "d89fc19e405cb2d55ce7cc114356846a0ee5e956",
         "type": "github"
       },
       "original": {

From 97bcc5f34ed0b7154829f4bd0a43b485f16205b7 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 18 May 2025 02:14:36 +0200
Subject: [PATCH 177/256] hosts: nixos: porthos: secrets: update cross-seed

---
 .../servarr/cross-seed/configuration.json.age | Bin 1364 -> 1528 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/hosts/nixos/porthos/secrets/servarr/cross-seed/configuration.json.age b/hosts/nixos/porthos/secrets/servarr/cross-seed/configuration.json.age
index 1499a56c21c9911f5a7111177b3458e418cb4b1c..e319f3a823c4eb4c84b15f6630ea5fbf42f9092b 100644
GIT binary patch
delta 1502
zcmcb@^@DqYPJM)-VR?CgkBPZawo9aGMoCdYRk>4OQGumFMo6W5x^rP=Mt)AETV`3V
z1(#E4QAJ@+N^qv5r>~)BvQubgdVynQWKwEazOiRuRf$n@d4RJ~l2Kr;1(&X!LUD11
zZfc5=si~o*LRLV2d0x7LTcA^FQMP_+ScYYkbCiF2Kz*uLx|y4Yvy+>npMhItskXmS
zqIsZaWtO7}muXf=R=J;Zl8HxhR8p98WpSjBN1#htPF{*xP+m@HvU6p4X<2GTMrw)$
zm#(g^f>}hNuTxT<rJrknPiDHQrITAksefgfzl%X`c#>JMdzPPBsB^Mmo>ycf*D2@n
z37;fCdeuv+?>w+R<0Yeo{}QfuMmN)!+&k=0a;^TSYwE4IY0U~Q?{9Yfw0X#~C0&SF
zX}+aS((K$VJ-bblR?1ZG`JdIke`#ik!jg~Af1G*t+V950$FnqoQUr|mohx^EF@65T
z!^>7rb@N!fc}v>LkM#>r%T@8aynXUz(Vrc1N_9sTE>E4Nw7mX$h0l{u+OqtM1bTj@
z{(q8F`{LD`c_O|u&izgQ`QeY>?OCTZ*t+M1PUGCN>2JW}-2Va(cQ3Qqb*%S#`^L*J
zG+q`LyViT9Zd*R-NA%IVo*yc{RKzX66}P)FtGzy)v4%Z9f!XkKo!$0ChYdC^i?TxQ
zn;!e4|M;`7(CJ-Ed03yy+^*NF)SaH%BJzKE^2OXKtanWAHZ%#J&b~Tv%d`CgUAeXM
zmqgG0v{sNa#44C8s9yZV?WjFxZhl>tDqUQvv?~1K4ePy1>-d}J>u|1KJ8x&IqfYo+
zv*Wuy^8DMJ_IAY~9#8ikC1JDBo^u^VY~lYmh;NKyxvQY*wpb@t-T7Qi$XnlQ^#W44
zZ`SP8{vYOUcPhZZFKDgXN`tTQ-^=Rxdu|@>URiWR^t<<$J0G5AKAz@imKnqS{_7*H
z#FFImH@qBwus*nwkZR2-_kL^j^KWZC&P&xjDY@4u!1R1$kMd!|Dd)3Oj?a-1@bQuJ
zGhz?e+$&-I#Jc~q!JT&{OXn-=ZTu><_0+@qFGA5bx1N1jc_%AC@a99t6+hbVFjPD*
zlbM&YU~#<HhQo6+o;?&u+xum^-K1^PgFjAe4B_1D@NSQ&{W90JbDsQpcYP0QQSZMp
zgHKZ~ZBxAO8zV90SM6^8ttTd_RIgWCCwhll*=`-<TfV6`&3|4}sE%lGiu#*h*6n^c
z+CuKeq1UGM^Vgc_zdMvJ_^x}`v~!CTZkZ(?NIe_&!1TJ^mAA#5@6T`KUObD{C%ao9
zsQB~7!<(6IU(H{#H9Dqx_vb*lm0fSPuw86^tHkj8n|=t}hjgx6>mT=C-yyD6{*CAU
zbAcA213k_z6ZG$z|4<gzztNDix8}QS@5kQvK89TL_b%#HTPs=LcBIEBULelv^W8&N
z3UUv6)c=&d^rzzFmB-iSRD8F!tv$bSuk>sdxvnDiormsueVi3I=hEAwk9|GFUKP*(
zmVCWq#*6=IN3OVUo_;VjW9z5BgI6P(MYo&%yc#j-Pdb0amK!C$A9UOt4%p@|(ERo=
zklTIkm2$WJ$%@ynyzZJ(QCwgD<iX4brkhtNe>r_KO<~sq1K!1b7eBA@YG1o_ZS9v8
z<^gMpl?pxQNNIoN50~D4D9GRL(1pc$?pxUA*sb!4%qx!Ga!2Fh)W#z7ZdRxIg}XfB
zp55k34$-Wbeo<fMjXQIsWI1P8O_Y-U&Tk=W418)C{k67PNq8RS$XLIIb8kt-z54j|
z8F^vPbc6T2QdN5Tnjw0@g`*Dlk^}bl-S~C==Zl}QeqwXOe8mja>Q+va{*q&I@m&wc
zd^er?vXJvLKbtK3YbrlQ;`sKm-4o}XlD+TIschDg_~GD{&rUZ^itg#_SzfzD;_Y=d
zZS&;ktru!-w(1*&1`97TayHfcbHvdhOU!CRc)|p!BKv182~T_$y*_L?x3<D%(x<;U
zwa=8wx2}p(n4MXm=J5G*WLemfRV#O2deXk`w~dnbt|g4MjmEM@N&hzMKJN<n$g*GV
UK&(_lF5l0Z#GsIGl7St<0Qrd6V*mgE

delta 1337
zcmeyteT8d+PQ8zNWL92snxRi|hOw`|Sw*FORAO;PWTkJBZ)$;KMqsv|xkai^eps1n
zAeWnOXnu&1NpV$puD-8Fp=+pTaH3^EQAv?OaejtlzQ0*kRZ>7jXhvyNK9{bYLUD11
zZfc5=si~o*LRLV2d0x6gNV1>1nO~T3PL@eURA7~{Uwv3snU7~~d2y+}nMs+eYp`Kq
za#mEBVXlz{msx67pn;i}X?}W`XLyRApNW}^r*n{7Rc5|-N@=P^y1Q9;WI<R!in&`P
zm#(g^LQqvoQ9yxHPDpuCNT#WArA1O<o_~aSuA4z{iATPpiJxVlpSgRsOJHI-*YZ_%
z87uZ(KUS}9us0x9H*#*w_E`cFsZ+z6W=e;L?updtWX=1qGHLbhoQric@3I>7txsRS
zEa2H)kt=ndea&_>r1ceU*>vr+dv}C^<^=n4E=gw9_d6Fc%341-yzQo7ZO`V=#|C{C
z_Dr*{>BuZGso*R$P~2@Lw?;?kz@vpV>))@Kx6p{=UUJNb`U|OB|7~dTtW%7-)WDc>
z_{off2V5If;{|soU6eMCxXBgId+43YM&3<tAL#VoU2$r)jgiPI{-9$THqOgV&y?lY
zo!G6?;gnPVtIxadIFsu4$UXLd69c}yEorYd*~cstd8cG$61UGWR_k|8FBKV={R~r(
zPV{H`(|`K8RtC33?ymX?5}S|ebvnxaGjl7+ajN{U=Ci%dHke=S?q`l(#q0l{$oMM9
zoG-7v_vzST)86$9?|go2^uu!EgvO^jljev`uD51jxL$cKCn4z|2Twi6!+WQXawhG&
z{i#koeu<;KM~H!w)6L1NzC5%MHFs$~7~-5PKFMUm?B*Ad6Eb3+7oNW6SpV+j>;;B>
zMU&z!gY{e<J}XqHG@BH)S&&Jr<CMUy-MjzSY<k}nex&EZx6CusTpmBK-mu!YAtmB+
z3}<-UtmNat&py7AIbyix*)Ki?PDig_9XI~+bpL+yEATthVjYLKS2`7L?_6|dt&09B
z38y|e$-?b+MpIwPKTBQ1$kHUu+j4$R{pWWrvR?E3XYly!ieBNHXuPp_>&vq3U-{a~
z*FQGab)CFyN4|xhBj@^rxz}%h`kyjcw2QNN)7ul~Q@d?9y#8)-_qn}8V^8LyI|8?R
zHZ9R@P<5Kkux9RN!=5j{0-rZJvQ^EU|DK^l@8(3ar`vz7YiB%s&n0$F(Sd-x!YwNA
z=H1*<UsQ6ovTP#P+A{v_WmzIef?u#Uvu~)(y!`Kn@8eV4%MUGCaOUKZEp3Vs{>So?
zR=;09>A?J7^7FRwSR6W#t#Ye8I_cT3KhsW1*(fpp^ELh#bo<=qr)&B&7d}{aZo^Xl
zpDxe48HDravK^k{wPB5?m_eDWr?UBuvL3-Jj<dh+Fi+~LZ+)G2TW&_4S@MFz9LL;R
z|IADA`M2n6`*F8zt1AmP{YkT0cjtHgty!j`s+T&ZtqZ(Ut}ao0Uo<l<w*CH-|2M1l
zch8BL#?`h^YhPLU@nnwn6z3hB{%=k`-*oUzmF$ymuIK8G75J9Pg)mRcQ~X`#YQ=VF
z`jlxch6l23e{>$MtD9NB`}OSC`}hUynEE^poLy5;e*WZzB>QVlyR#GCM9pjMT)w+%
z|MIqz9@5-VzPpQ7zOP%b@b($oWBkAKquxptFf0(7(RKaL=@~X>zuXE|SsI;jXpZ@s
zQ$h>n3&S0?XYhXRYQ6dDtJBQ8pLTvpX8pEOt5YGc<>=fnt9CX;?^!w7&(n;u{(o%A
zK3}t1u2V76Q~H(d-Q$PTrGGcS)($vyhjINiudWlzW8F<u<E~gN>bX?;=Q2YG0CoF!
AMgRZ+


From c1e2114c57e9e0027b3e17b7fbf48253b22fb651 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 23 May 2025 22:56:19 +0100
Subject: [PATCH 178/256] flake: bump inputs

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index b90b54a..e0456b8 100644
--- a/flake.lock
+++ b/flake.lock
@@ -14,11 +14,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745630506,
-        "narHash": "sha256-bHCFgGeu8XjWlVuaWzi3QONjDW3coZDqSHvnd4l7xus=",
+        "lastModified": 1747575206,
+        "narHash": "sha256-NwmAFuDUO/PFcgaGGr4j3ozG9Pe5hZ/ogitWhY+D81k=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "96e078c646b711aee04b82ba01aefbff87004ded",
+        "rev": "4835b1dc898959d8547a871ef484930675cb47f1",
         "type": "github"
       },
       "original": {
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746537231,
-        "narHash": "sha256-Wb2xeSyOsCoTCTj7LOoD6cdKLEROyFAArnYoS+noCWo=",
+        "lastModified": 1747372754,
+        "narHash": "sha256-2Y53NGIX2vxfie1rOW0Qb86vjRZ7ngizoo+bnXU9D9k=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "fa466640195d38ec97cf0493d6d6882bc4d14969",
+        "rev": "80479b6ec16fefd9c1db3ea13aeb038c60530f46",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747225851,
-        "narHash": "sha256-4IbmZrNOdXP143kZEUzxBS5SqyxUlaSHLgdpeJfP2ZU=",
+        "lastModified": 1747978958,
+        "narHash": "sha256-pQQnbxWpY3IiZqgelXHIe/OAE/Yv4NSQq7fch7M6nXQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "6bf057fc8326e83bda05a669fc08d106547679fb",
+        "rev": "7419250703fd5eb50e99bdfb07a86671939103ea",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1746904237,
-        "narHash": "sha256-3e+AVBczosP5dCLQmMoMEogM57gmZ2qrVSrmq9aResQ=",
+        "lastModified": 1747744144,
+        "narHash": "sha256-W7lqHp0qZiENCDwUZ5EX/lNhxjMdNapFnbErcbnP11Q=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d89fc19e405cb2d55ce7cc114356846a0ee5e956",
+        "rev": "2795c506fe8fb7b03c36ccb51f75b6df0ab2553f",
         "type": "github"
       },
       "original": {

From 24407448d498d637b94d04d9b06816f432c9197b Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 27 May 2025 11:16:46 +0000
Subject: [PATCH 179/256] hosts: homes: mousqueton: disable 'atuin' package

The system-provided package is built without its sync functionality.

To ensure the module works as written, I can't use `pkgs.emptyDirectory`
for this unfortunately...
---
 hosts/homes/ambroisie@mousqueton/default.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/hosts/homes/ambroisie@mousqueton/default.nix b/hosts/homes/ambroisie@mousqueton/default.nix
index 37884d7..1383618 100644
--- a/hosts/homes/ambroisie@mousqueton/default.nix
+++ b/hosts/homes/ambroisie@mousqueton/default.nix
@@ -7,6 +7,20 @@
   services.gpg-agent.enable = lib.mkForce false;
 
   my.home = {
+    atuin = {
+      package = pkgs.stdenv.mkDerivation {
+        pname = "atuin";
+        version = "18.4.0";
+
+        buildCommand = ''
+          mkdir -p $out/bin
+          ln -s /usr/bin/atuin $out/bin/atuin
+        '';
+
+        meta.mainProgram = "atuin";
+      };
+    };
+
     git = {
       package = pkgs.emptyDirectory;
     };

From 9751fdb888d0d72801bff0c0381b057e0431f2a8 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 27 May 2025 11:39:15 +0000
Subject: [PATCH 180/256] hosts: homes: bazin: disable 'atuin' package

Same as on `mousqueton`.
---
 hosts/homes/ambroisie@bazin/default.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/hosts/homes/ambroisie@bazin/default.nix b/hosts/homes/ambroisie@bazin/default.nix
index f52fbce..365b70d 100644
--- a/hosts/homes/ambroisie@bazin/default.nix
+++ b/hosts/homes/ambroisie@bazin/default.nix
@@ -4,6 +4,20 @@
   services.gpg-agent.enable = lib.mkForce false;
 
   my.home = {
+    atuin = {
+      package = pkgs.stdenv.mkDerivation {
+        pname = "atuin";
+        version = "18.4.0";
+
+        buildCommand = ''
+          mkdir -p $out/bin
+          ln -s /usr/bin/atuin $out/bin/atuin
+        '';
+
+        meta.mainProgram = "atuin";
+      };
+    };
+
     git = {
       package = pkgs.emptyDirectory;
     };

From a67a54bda27092c9f89e60bf3ce75839e914f9b4 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 24 May 2025 22:33:21 +0200
Subject: [PATCH 181/256] nixos: services: paperless: use structured setting

The module should stringify it to JSON automatically, so might as well
use the more readable option.
---
 modules/nixos/services/paperless/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/nixos/services/paperless/default.nix b/modules/nixos/services/paperless/default.nix
index b6965ca..1195977 100644
--- a/modules/nixos/services/paperless/default.nix
+++ b/modules/nixos/services/paperless/default.nix
@@ -61,7 +61,7 @@ in
         # Security settings
         PAPERLESS_URL = "https://paperless.${config.networking.domain}";
         PAPERLESS_USE_X_FORWARD_HOST = true;
-        PAPERLESS_PROXY_SSL_HEADER = ''["HTTP_X_FORWARDED_PROTO", "https"]'';
+        PAPERLESS_PROXY_SSL_HEADER = [ "HTTP_X_FORWARDED_PROTO" "https" ];
 
         # OCR settings
         PAPERLESS_OCR_LANGUAGE = "fra+eng";

From 98d39717e2aa0306865982191afa200b5914426b Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 31 May 2025 22:37:21 +0100
Subject: [PATCH 182/256] home: direnv: lib: don't erase pre-existing venv

Turns out `uv venv` isn't idempotent, it removes the existing virtual
environment by default.

Thankfully, there's a flag to fix it.
---
 modules/home/direnv/lib/python.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/direnv/lib/python.sh b/modules/home/direnv/lib/python.sh
index b4b2bce..b1be8a9 100644
--- a/modules/home/direnv/lib/python.sh
+++ b/modules/home/direnv/lib/python.sh
@@ -46,7 +46,7 @@ layout_uv() {
     fi
 
     # create venv if it doesn't exist
-    uv venv -q
+    uv venv -q --allow-existing
 
     export VIRTUAL_ENV
     export UV_ACTIVE=1

From 151570cccaf8511688769ee0665868340054ba30 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 9 Jun 2025 10:36:33 +0000
Subject: [PATCH 183/256] flake: bump inputs

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index e0456b8..219d87d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743550720,
-        "narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
+        "lastModified": 1749398372,
+        "narHash": "sha256-tYBdgS56eXYaWVW3fsnPQ/nFlgWi/Z2Ymhyu21zVM98=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "c621e8422220273271f52058f618c94e405bb0f5",
+        "rev": "9305fe4e5c2a6fcf5ba6a3ff155720fbe4076569",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747978958,
-        "narHash": "sha256-pQQnbxWpY3IiZqgelXHIe/OAE/Yv4NSQq7fch7M6nXQ=",
+        "lastModified": 1749400020,
+        "narHash": "sha256-0nTmHO8AYgRYk5v6zw5oZ3x9nh+feb+Isn7WNe318M0=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7419250703fd5eb50e99bdfb07a86671939103ea",
+        "rev": "2835e8ba0ad99ba86d4a5e497a962ec9fa35e48f",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1747744144,
-        "narHash": "sha256-W7lqHp0qZiENCDwUZ5EX/lNhxjMdNapFnbErcbnP11Q=",
+        "lastModified": 1749285348,
+        "narHash": "sha256-frdhQvPbmDYaScPFiCnfdh3B/Vh81Uuoo0w5TkWmmjU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2795c506fe8fb7b03c36ccb51f75b6df0ab2553f",
+        "rev": "3e3afe5174c561dee0df6f2c2b2236990146329f",
         "type": "github"
       },
       "original": {

From 971f90581397286a3ffb424970cb5c1e9471a203 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 9 Jun 2025 13:52:29 +0200
Subject: [PATCH 184/256] nixos: services: mealie: remove DB settings

Looks like I missed them in the original commit to migrate to
`database.createLocally`.
---
 modules/nixos/services/mealie/default.nix | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/modules/nixos/services/mealie/default.nix b/modules/nixos/services/mealie/default.nix
index 3b4d4f7..8c02398 100644
--- a/modules/nixos/services/mealie/default.nix
+++ b/modules/nixos/services/mealie/default.nix
@@ -32,11 +32,6 @@ in
         BASE_URL = "https://mealie.${config.networking.domain}";
         TZ = config.time.timeZone;
         ALLOw_SIGNUP = "false";
-
-        # Use PostgreSQL
-        DB_ENGINE = "postgres";
-        # Make it work with socket auth
-        POSTGRES_URL_OVERRIDE = "postgresql://mealie:@/mealie?host=/run/postgresql";
       };
 
       # Automatic PostgreSQL provisioning

From 1b275e1a8a8291b3ed9789d25c2592ba52b8d9ec Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 17 Jun 2025 09:29:24 +0000
Subject: [PATCH 185/256] flake: bump inputs

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 219d87d..94ab916 100644
--- a/flake.lock
+++ b/flake.lock
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747372754,
-        "narHash": "sha256-2Y53NGIX2vxfie1rOW0Qb86vjRZ7ngizoo+bnXU9D9k=",
+        "lastModified": 1749636823,
+        "narHash": "sha256-WUaIlOlPLyPgz9be7fqWJA5iG6rHcGRtLERSCfUDne4=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "80479b6ec16fefd9c1db3ea13aeb038c60530f46",
+        "rev": "623c56286de5a3193aa38891a6991b28f9bab056",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749400020,
-        "narHash": "sha256-0nTmHO8AYgRYk5v6zw5oZ3x9nh+feb+Isn7WNe318M0=",
+        "lastModified": 1750127463,
+        "narHash": "sha256-K2xFtlD3PcKAZriOE3LaBLYmVfGQu+rIF4Jr1RFYR0Q=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "2835e8ba0ad99ba86d4a5e497a962ec9fa35e48f",
+        "rev": "28eef8722d1af18ca13e687dbf485e1c653a0402",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1749285348,
-        "narHash": "sha256-frdhQvPbmDYaScPFiCnfdh3B/Vh81Uuoo0w5TkWmmjU=",
+        "lastModified": 1749794982,
+        "narHash": "sha256-Kh9K4taXbVuaLC0IL+9HcfvxsSUx8dPB5s5weJcc9pc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3e3afe5174c561dee0df6f2c2b2236990146329f",
+        "rev": "ee930f9755f58096ac6e8ca94a1887e0534e2d81",
         "type": "github"
       },
       "original": {

From 112e3403615f65807dfcc28929b2b8a19656859e Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 17 Jun 2025 09:26:09 +0000
Subject: [PATCH 186/256] home: do not hard-code username

The flake module already sets it with `mkDefault`, making it easier to
override it for a specific host.
---
 modules/home/default.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/modules/home/default.nix b/modules/home/default.nix
index e642e87..1c40377 100644
--- a/modules/home/default.nix
+++ b/modules/home/default.nix
@@ -51,9 +51,6 @@
   # First sane reproducible version
   home.stateVersion = "20.09";
 
-  # Who am I?
-  home.username = "ambroisie";
-
   # Start services automatically
   systemd.user.startServices = "sd-switch";
 }

From 03bb62777079b4a8ecc755570cc04a45095ca013 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 2 Jul 2025 13:23:34 +0200
Subject: [PATCH 187/256] flake: bump inputs

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 94ab916..a4da84d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -14,11 +14,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747575206,
-        "narHash": "sha256-NwmAFuDUO/PFcgaGGr4j3ozG9Pe5hZ/ogitWhY+D81k=",
+        "lastModified": 1750173260,
+        "narHash": "sha256-9P1FziAwl5+3edkfFcr5HeGtQUtrSdk/MksX39GieoA=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "4835b1dc898959d8547a871ef484930675cb47f1",
+        "rev": "531beac616433bac6f9e2a19feb8e99a22a66baf",
         "type": "github"
       },
       "original": {
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749398372,
-        "narHash": "sha256-tYBdgS56eXYaWVW3fsnPQ/nFlgWi/Z2Ymhyu21zVM98=",
+        "lastModified": 1751413152,
+        "narHash": "sha256-Tyw1RjYEsp5scoigs1384gIg6e0GoBVjms4aXFfRssQ=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "9305fe4e5c2a6fcf5ba6a3ff155720fbe4076569",
+        "rev": "77826244401ea9de6e3bac47c2db46005e1f30b5",
         "type": "github"
       },
       "original": {
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749636823,
-        "narHash": "sha256-WUaIlOlPLyPgz9be7fqWJA5iG6rHcGRtLERSCfUDne4=",
+        "lastModified": 1750779888,
+        "narHash": "sha256-wibppH3g/E2lxU43ZQHC5yA/7kIKLGxVEnsnVK1BtRg=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "623c56286de5a3193aa38891a6991b28f9bab056",
+        "rev": "16ec914f6fb6f599ce988427d9d94efddf25fe6d",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750127463,
-        "narHash": "sha256-K2xFtlD3PcKAZriOE3LaBLYmVfGQu+rIF4Jr1RFYR0Q=",
+        "lastModified": 1751429452,
+        "narHash": "sha256-4s5vRtaqdNhVBnbOWOzBNKrRa0ShQTLoEPjJp3joeNI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "28eef8722d1af18ca13e687dbf485e1c653a0402",
+        "rev": "df12269039dcf752600b1bcc176bacf2786ec384",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1749794982,
-        "narHash": "sha256-Kh9K4taXbVuaLC0IL+9HcfvxsSUx8dPB5s5weJcc9pc=",
+        "lastModified": 1751271578,
+        "narHash": "sha256-P/SQmKDu06x8yv7i0s8bvnnuJYkxVGBWLWHaU+tt4YY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ee930f9755f58096ac6e8ca94a1887e0534e2d81",
+        "rev": "3016b4b15d13f3089db8a41ef937b13a9e33a8df",
         "type": "github"
       },
       "original": {

From d61840651698e3ad05325039e9aa2a6cf9ad6aa2 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 2 Jul 2025 13:24:16 +0200
Subject: [PATCH 188/256] nixos: services: use 'postgresql.target'

This is now the more correct dependency to use in service definitions,
to guarantee read-write access with users and permissions.
---
 modules/nixos/services/drone/server/default.nix      | 4 ++--
 modules/nixos/services/tandoor-recipes/default.nix   | 4 ++--
 modules/nixos/services/woodpecker/server/default.nix | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/modules/nixos/services/drone/server/default.nix b/modules/nixos/services/drone/server/default.nix
index a3a1e49..d6148f4 100644
--- a/modules/nixos/services/drone/server/default.nix
+++ b/modules/nixos/services/drone/server/default.nix
@@ -6,8 +6,8 @@ in
   config = lib.mkIf cfg.enable {
     systemd.services.drone-server = {
       wantedBy = [ "multi-user.target" ];
-      after = [ "postgresql.service" ];
-      requires = [ "postgresql.service" ];
+      after = [ "postgresql.target" ];
+      requires = [ "postgresql.target" ];
       serviceConfig = {
         EnvironmentFile = [
           cfg.secretFile
diff --git a/modules/nixos/services/tandoor-recipes/default.nix b/modules/nixos/services/tandoor-recipes/default.nix
index 3447bee..169eec8 100644
--- a/modules/nixos/services/tandoor-recipes/default.nix
+++ b/modules/nixos/services/tandoor-recipes/default.nix
@@ -49,8 +49,8 @@ in
 
     systemd.services = {
       tandoor-recipes = {
-        after = [ "postgresql.service" ];
-        requires = [ "postgresql.service" ];
+        after = [ "postgresql.target" ];
+        requires = [ "postgresql.target" ];
 
         serviceConfig = {
           EnvironmentFile = cfg.secretKeyFile;
diff --git a/modules/nixos/services/woodpecker/server/default.nix b/modules/nixos/services/woodpecker/server/default.nix
index adf533e..caf0179 100644
--- a/modules/nixos/services/woodpecker/server/default.nix
+++ b/modules/nixos/services/woodpecker/server/default.nix
@@ -24,8 +24,8 @@ in
     };
 
     systemd.services.woodpecker-server = {
-      after = [ "postgresql.service" ];
-      requires = [ "postgresql.service" ];
+      after = [ "postgresql.target" ];
+      requires = [ "postgresql.target" ];
 
       serviceConfig = {
         # Set username for DB access

From 5d8722397010e1c1ddbc4d59abe53b7a6bd55584 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 2 Jul 2025 13:26:22 +0200
Subject: [PATCH 189/256] nixos: services: transmission: use 'trgui-ng'

I like it much better than the built-in UI.
---
 modules/nixos/services/transmission/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/nixos/services/transmission/default.nix b/modules/nixos/services/transmission/default.nix
index 16d51e3..ddd77d4 100644
--- a/modules/nixos/services/transmission/default.nix
+++ b/modules/nixos/services/transmission/default.nix
@@ -47,6 +47,7 @@ in
       enable = true;
       package = pkgs.transmission_4;
       group = "media";
+      webHome = pkgs.trgui-ng-web;
 
       downloadDirPermissions = "775";
 

From 66ec807dc6729a8aabd7cb5f42797e246f36befa Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 2 Jul 2025 14:01:15 +0200
Subject: [PATCH 190/256] hosts: nixos: aramis: home: use 'trgui-ng'

It looks and works much better than the old one.

Unfortunately, it's a Tauri app.
---
 hosts/nixos/aramis/home.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hosts/nixos/aramis/home.nix b/hosts/nixos/aramis/home.nix
index 64b63ce..221b1ea 100644
--- a/hosts/nixos/aramis/home.nix
+++ b/hosts/nixos/aramis/home.nix
@@ -20,7 +20,7 @@
       element-desktop # Matrix client
       jellyfin-media-player # Wraps the webui and mpv together
       pavucontrol # Audio mixer GUI
-      transgui # Transmission remote
+      trgui-ng # Transmission remote
     ];
     # Minimal video player
     mpv.enable = true;

From 8d809e3ac3c05eb9ca6de3279fee2a8c72cdd293 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 8 Jul 2025 10:40:08 +0000
Subject: [PATCH 191/256] flake: bump inputs

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index a4da84d..dc32e95 100644
--- a/flake.lock
+++ b/flake.lock
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1751271578,
-        "narHash": "sha256-P/SQmKDu06x8yv7i0s8bvnnuJYkxVGBWLWHaU+tt4YY=",
+        "lastModified": 1751952840,
+        "narHash": "sha256-SIkjQb9PPGvR/EcZAU8UZEnO9dwY2Z/BrDWgtyZd7OA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3016b4b15d13f3089db8a41ef937b13a9e33a8df",
+        "rev": "27278798fe68d7f81131dd7ab62b8ea2b795cd56",
         "type": "github"
       },
       "original": {

From b093faf00d8066e19d144c34533a32602a4fb8f7 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 8 Jul 2025 10:42:13 +0000
Subject: [PATCH 192/256] nixos: services: tandoor-recipes: use automatic DB

---
 .../services/tandoor-recipes/default.nix      | 25 +++----------------
 1 file changed, 4 insertions(+), 21 deletions(-)

diff --git a/modules/nixos/services/tandoor-recipes/default.nix b/modules/nixos/services/tandoor-recipes/default.nix
index 169eec8..4b4ed1a 100644
--- a/modules/nixos/services/tandoor-recipes/default.nix
+++ b/modules/nixos/services/tandoor-recipes/default.nix
@@ -26,18 +26,16 @@ in
     services.tandoor-recipes = {
       enable = true;
 
+      database = {
+        createLocally = true;
+      };
+
       port = cfg.port;
       extraConfig =
         let
           tandoorRecipesDomain = "recipes.${config.networking.domain}";
         in
         {
-          # Use PostgreSQL
-          DB_ENGINE = "django.db.backends.postgresql";
-          POSTGRES_HOST = "/run/postgresql";
-          POSTGRES_USER = "tandoor_recipes";
-          POSTGRES_DB = "tandoor_recipes";
-
           # Security settings
           ALLOWED_HOSTS = tandoorRecipesDomain;
           CSRF_TRUSTED_ORIGINS = "https://${tandoorRecipesDomain}";
@@ -49,27 +47,12 @@ in
 
     systemd.services = {
       tandoor-recipes = {
-        after = [ "postgresql.target" ];
-        requires = [ "postgresql.target" ];
-
         serviceConfig = {
           EnvironmentFile = cfg.secretKeyFile;
         };
       };
     };
 
-    # Set-up database
-    services.postgresql = {
-      enable = true;
-      ensureDatabases = [ "tandoor_recipes" ];
-      ensureUsers = [
-        {
-          name = "tandoor_recipes";
-          ensureDBOwnership = true;
-        }
-      ];
-    };
-
     my.services.nginx.virtualHosts = {
       recipes = {
         inherit (cfg) port;

From 2473bca1671ddaab0ce6de70d5471bf304133af6 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 11 Jul 2025 14:24:23 +0000
Subject: [PATCH 193/256] home: vim: telescope: remove LSP handlers

The plug-in was broken with the update to 0.11, and I would like to try
using the built-in quickfixlist-based handlers for a while.

This reverts commit 8d4a1e61b4f26f7443f7c8b0b65643f0bd312e9f.
---
 modules/home/vim/default.nix                   | 1 -
 modules/home/vim/plugin/settings/telescope.lua | 1 -
 2 files changed, 2 deletions(-)

diff --git a/modules/home/vim/default.nix b/modules/home/vim/default.nix
index 20a74ff..930a853 100644
--- a/modules/home/vim/default.nix
+++ b/modules/home/vim/default.nix
@@ -80,7 +80,6 @@ in
       nvim-surround # Deal with pairs, now in Lua
       oil-nvim # Better alternative to NetrW
       telescope-fzf-native-nvim # Use 'fzf' fuzzy matching algorithm
-      telescope-lsp-handlers-nvim # Use 'telescope' for various LSP actions
       telescope-nvim # Fuzzy finder interface
       which-key-nvim # Show available mappings
     ];
diff --git a/modules/home/vim/plugin/settings/telescope.lua b/modules/home/vim/plugin/settings/telescope.lua
index 1a23928..810d51c 100644
--- a/modules/home/vim/plugin/settings/telescope.lua
+++ b/modules/home/vim/plugin/settings/telescope.lua
@@ -23,7 +23,6 @@ telescope.setup({
 })
 
 telescope.load_extension("fzf")
-telescope.load_extension("lsp_handlers")
 
 local keys = {
     { "<leader>f", group = "Fuzzy finder" },

From 979ae901c4057308ce1da3bbf2388e2addd99d7f Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 15 Jul 2025 09:52:21 +0000
Subject: [PATCH 194/256] flake: bump inputs

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index dc32e95..0f205ab 100644
--- a/flake.lock
+++ b/flake.lock
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751429452,
-        "narHash": "sha256-4s5vRtaqdNhVBnbOWOzBNKrRa0ShQTLoEPjJp3joeNI=",
+        "lastModified": 1752467539,
+        "narHash": "sha256-4kaR+xmng9YPASckfvIgl5flF/1nAZOplM+Wp9I5SMI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "df12269039dcf752600b1bcc176bacf2786ec384",
+        "rev": "1e54837569e0b80797c47be4720fab19e0db1616",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1751952840,
-        "narHash": "sha256-SIkjQb9PPGvR/EcZAU8UZEnO9dwY2Z/BrDWgtyZd7OA=",
+        "lastModified": 1752644555,
+        "narHash": "sha256-oeRcp4VEyZ/3ZgfRRoq60/08l2zy0K53l8MdfSIYd24=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "27278798fe68d7f81131dd7ab62b8ea2b795cd56",
+        "rev": "9100a4f6bf446603b9575927c8585162f9ec9aa6",
         "type": "github"
       },
       "original": {

From 13b61346f5cca39d1ba2c66717e14a6d01b99acc Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 15 Jul 2025 09:54:23 +0000
Subject: [PATCH 195/256] home: tmux: increase history scrollback

Even *longer*.
---
 modules/home/tmux/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/tmux/default.nix b/modules/home/tmux/default.nix
index 82ceb3a..3ea047a 100644
--- a/modules/home/tmux/default.nix
+++ b/modules/home/tmux/default.nix
@@ -48,7 +48,7 @@ in
     keyMode = "vi"; # Home-row keys and other niceties
     clock24 = true; # I'm one of those heathens
     escapeTime = 0; # Let vim do its thing instead
-    historyLimit = 100000; # Bigger buffer
+    historyLimit = 1000000; # Bigger buffer
     mouse = false; # I dislike mouse support
     focusEvents = true; # Report focus events
     terminal = "tmux-256color"; # I want accurate termcap info

From add796768567599e9d6b2a54c80baac84d7681b5 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 27 Jul 2025 20:49:24 +0100
Subject: [PATCH 196/256] flake: bump inputs

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 0f205ab..e96a7a0 100644
--- a/flake.lock
+++ b/flake.lock
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751413152,
-        "narHash": "sha256-Tyw1RjYEsp5scoigs1384gIg6e0GoBVjms4aXFfRssQ=",
+        "lastModified": 1753121425,
+        "narHash": "sha256-TVcTNvOeWWk1DXljFxVRp+E0tzG1LhrVjOGGoMHuXio=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "77826244401ea9de6e3bac47c2db46005e1f30b5",
+        "rev": "644e0fc48951a860279da645ba77fe4a6e814c5e",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752467539,
-        "narHash": "sha256-4kaR+xmng9YPASckfvIgl5flF/1nAZOplM+Wp9I5SMI=",
+        "lastModified": 1753617834,
+        "narHash": "sha256-WEVfKrdIdu5CpppJ0Va3vzP0DKlS+ZTLbBjugMO2Drg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "1e54837569e0b80797c47be4720fab19e0db1616",
+        "rev": "72cc1e3134a35005006f06640724319caa424737",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1752644555,
-        "narHash": "sha256-oeRcp4VEyZ/3ZgfRRoq60/08l2zy0K53l8MdfSIYd24=",
+        "lastModified": 1753429684,
+        "narHash": "sha256-9h7+4/53cSfQ/uA3pSvCaBepmZaz/dLlLVJnbQ+SJjk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9100a4f6bf446603b9575927c8585162f9ec9aa6",
+        "rev": "7fd36ee82c0275fb545775cc5e4d30542899511d",
         "type": "github"
       },
       "original": {

From 2a515754a2c8bb87fe756d9862d3bb04c6be2bbb Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 27 Jul 2025 20:48:06 +0100
Subject: [PATCH 197/256] home: zsh: use absolute path to 'XDG_CONFIG_HOME'

The path handling has been fixed upstream, which makes this module more
readable.
---
 modules/home/zsh/default.nix | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/modules/home/zsh/default.nix b/modules/home/zsh/default.nix
index f4092d8..08b4101 100644
--- a/modules/home/zsh/default.nix
+++ b/modules/home/zsh/default.nix
@@ -1,14 +1,6 @@
 { config, pkgs, lib, ... }:
 let
   cfg = config.my.home.zsh;
-
-  # Have a nice relative path for XDG_CONFIG_HOME, without leading `/`
-  relativeXdgConfig =
-    let
-      noHome = lib.removePrefix config.home.homeDirectory;
-      noSlash = lib.removePrefix "/";
-    in
-    noSlash (noHome config.xdg.configHome);
 in
 {
   options.my.home.zsh = with lib; {
@@ -57,7 +49,7 @@ in
 
       programs.zsh = {
         enable = true;
-        dotDir = "${relativeXdgConfig}/zsh"; # Don't clutter $HOME
+        dotDir = "${config.xdg.configHome}/zsh"; # Don't clutter $HOME
         enableCompletion = true;
 
         history = {

From 4b7c6c1f5eb7cbd7254a8f69050b17c9d4723837 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 29 Jul 2025 16:13:58 +0000
Subject: [PATCH 198/256] pkgs: comma: fix 'nix-locate' invocation

---
 pkgs/comma/comma | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/comma/comma b/pkgs/comma/comma
index 4367a26..857b9c9 100755
--- a/pkgs/comma/comma
+++ b/pkgs/comma/comma
@@ -12,7 +12,7 @@ usage() {
 
 find_program() {
     local CANDIDATE
-    CANDIDATE="$(nix-locate --top-level --minimal --at-root --whole-name "/bin/$1")"
+    CANDIDATE="$(nix-locate --minimal --at-root --whole-name "/bin/$1")"
     if [ "$(printf '%s\n' "$CANDIDATE" | wc -l)" -gt 1 ]; then
         CANDIDATE="$(printf '%s' "$CANDIDATE" | fzf-tmux)"
     fi

From 7786c591b5f1e5745eb73b3a60ebe5e0704669a9 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 4 Aug 2025 11:13:52 +0000
Subject: [PATCH 199/256] pkgs: comma: add 'COMMA_PICKER'

---
 pkgs/comma/comma | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/comma/comma b/pkgs/comma/comma
index 857b9c9..b03a7f2 100755
--- a/pkgs/comma/comma
+++ b/pkgs/comma/comma
@@ -14,7 +14,7 @@ find_program() {
     local CANDIDATE
     CANDIDATE="$(nix-locate --minimal --at-root --whole-name "/bin/$1")"
     if [ "$(printf '%s\n' "$CANDIDATE" | wc -l)" -gt 1 ]; then
-        CANDIDATE="$(printf '%s' "$CANDIDATE" | fzf-tmux)"
+        CANDIDATE="$(printf '%s' "$CANDIDATE" | "${COMMA_PICKER:-fzf-tmux}")"
     fi
     printf '%s' "$CANDIDATE"
 }

From f94fc468aa3c3bed51611d083d01e5adbecf75dd Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 4 Aug 2025 14:28:34 +0000
Subject: [PATCH 200/256] home: zsh: ignore more commands for notification

---
 modules/home/zsh/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/home/zsh/default.nix b/modules/home/zsh/default.nix
index 08b4101..1e85cce 100644
--- a/modules/home/zsh/default.nix
+++ b/modules/home/zsh/default.nix
@@ -14,10 +14,12 @@ in
       exclude = mkOption {
         type = with types; listOf str;
         default = [
+          "bat"
           "delta"
           "direnv reload"
           "fg"
           "git (?!push|pull|fetch)"
+          "home-manager (?!switch|build|news)"
           "htop"
           "less"
           "man"

From a10270f8e16b9e397782a8cd9297e516247b049e Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 5 Aug 2025 11:00:26 +0000
Subject: [PATCH 201/256] flake: bump inputs

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index e96a7a0..080c212 100644
--- a/flake.lock
+++ b/flake.lock
@@ -14,11 +14,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750173260,
-        "narHash": "sha256-9P1FziAwl5+3edkfFcr5HeGtQUtrSdk/MksX39GieoA=",
+        "lastModified": 1754337839,
+        "narHash": "sha256-fEc2/4YsJwtnLU7HCFMRckb0u9UNnDZmwGhXT5U5NTw=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "531beac616433bac6f9e2a19feb8e99a22a66baf",
+        "rev": "856df6f6922845abd4fd958ce21febc07ca2fa45",
         "type": "github"
       },
       "original": {
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1753121425,
-        "narHash": "sha256-TVcTNvOeWWk1DXljFxVRp+E0tzG1LhrVjOGGoMHuXio=",
+        "lastModified": 1754091436,
+        "narHash": "sha256-XKqDMN1/Qj1DKivQvscI4vmHfDfvYR2pfuFOJiCeewM=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "644e0fc48951a860279da645ba77fe4a6e814c5e",
+        "rev": "67df8c627c2c39c41dbec76a1f201929929ab0bd",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1753617834,
-        "narHash": "sha256-WEVfKrdIdu5CpppJ0Va3vzP0DKlS+ZTLbBjugMO2Drg=",
+        "lastModified": 1754365350,
+        "narHash": "sha256-NLWIkn1qM0wxtZu/2NXRaujWJ4Y1PSZlc7h0y6pOzOQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "72cc1e3134a35005006f06640724319caa424737",
+        "rev": "c5d7e957397ecb7d48b99c928611c6e780db1b56",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1753429684,
-        "narHash": "sha256-9h7+4/53cSfQ/uA3pSvCaBepmZaz/dLlLVJnbQ+SJjk=",
+        "lastModified": 1754372978,
+        "narHash": "sha256-ByII9p9ek0k9UADC/hT+i9ueM2mw0Zxiz+bOlydU6Oo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "7fd36ee82c0275fb545775cc5e4d30542899511d",
+        "rev": "9ebe222ec7ef9de52478f76cba3f0324c1d1119f",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1741294988,
-        "narHash": "sha256-3408u6q615kVTb23WtDriHRmCBBpwX7iau6rvfipcu4=",
+        "lastModified": 1753980880,
+        "narHash": "sha256-aj1pbYxL6N+XFqBHjB4B1QP0bnKRcg1AfpgT5zUFsW8=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "b30c245e2c44c7352a27485bfd5bc483df660f0e",
+        "rev": "16db3e61da7606984a05b4dfc33cd1d26d22fb22",
         "type": "github"
       },
       "original": {

From dd7b6135315c51812e6928087b20235c9fb7638d Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 5 Aug 2025 11:03:01 +0000
Subject: [PATCH 202/256] pkgs: lohr: remove 'useFetchCargoVendor'

It's now turned on by default.
---
 pkgs/lohr/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/lohr/default.nix b/pkgs/lohr/default.nix
index aeb13b1..d8545e0 100644
--- a/pkgs/lohr/default.nix
+++ b/pkgs/lohr/default.nix
@@ -10,7 +10,6 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-dunQgtap+XCK5LoSyOqIY/6p6HizBeiyPWNuCffwjDU=";
   };
 
-  useFetchCargoVendor = true;
   cargoHash = "sha256-R3/N/43+bGx6acE/rhBcrk6kS5zQu8NJ1sVvKJJkK9w=";
 
   meta = with lib; {

From f1d7da7fcb72aff435a975adfe710810ab064d93 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 3 Aug 2025 00:11:26 +0200
Subject: [PATCH 203/256] nixos: services: matrix: refactor well-knowns

---
 modules/nixos/services/matrix/default.nix | 54 ++++++++++-------------
 1 file changed, 23 insertions(+), 31 deletions(-)

diff --git a/modules/nixos/services/matrix/default.nix b/modules/nixos/services/matrix/default.nix
index f423834..b43dbcc 100644
--- a/modules/nixos/services/matrix/default.nix
+++ b/modules/nixos/services/matrix/default.nix
@@ -14,6 +14,26 @@ let
   clientPort = { public = 443; private = 11339; };
   domain = config.networking.domain;
   matrixDomain = "matrix.${domain}";
+
+  serverConfig = {
+    "m.server" = "${matrixDomain}:${toString federationPort.public}";
+  };
+  clientConfig = {
+    "m.homeserver" = {
+      "base_url" = "https://${matrixDomain}";
+      "server_name" = domain;
+    };
+    "m.identity_server" = {
+      "base_url" = "https://vector.im";
+    };
+  };
+
+  # ACAO required to allow element-web on any URL to request this json file
+  mkWellKnown = data: ''
+    default_type application/json;
+    add_header Access-Control-Allow-Origin *;
+    return 200 '${builtins.toJSON data}';
+  '';
 in
 {
   options.my.services.matrix = with lib; {
@@ -96,15 +116,7 @@ in
       chat = {
         root = pkgs.element-web.override {
           conf = {
-            default_server_config = {
-              "m.homeserver" = {
-                "base_url" = "https://${matrixDomain}";
-                "server_name" = domain;
-              };
-              "m.identity_server" = {
-                "base_url" = "https://vector.im";
-              };
-            };
+            default_server_config = clientConfig;
             showLabsSettings = true;
             defaultCountryCode = "FR"; # cocorico
             roomDirectory = {
@@ -176,28 +188,8 @@ in
         forceSSL = true;
         useACMEHost = domain;
 
-        locations."= /.well-known/matrix/server".extraConfig =
-          let
-            server = { "m.server" = "${matrixDomain}:${toString federationPort.public}"; };
-          in
-          ''
-            add_header Content-Type application/json;
-            return 200 '${builtins.toJSON server}';
-          '';
-
-        locations."= /.well-known/matrix/client".extraConfig =
-          let
-            client = {
-              "m.homeserver" = { "base_url" = "https://${matrixDomain}"; };
-              "m.identity_server" = { "base_url" = "https://vector.im"; };
-            };
-            # ACAO required to allow element-web on any URL to request this json file
-          in
-          ''
-            add_header Content-Type application/json;
-            add_header Access-Control-Allow-Origin *;
-            return 200 '${builtins.toJSON client}';
-          '';
+        locations."= /.well-known/matrix/server".extraConfig = mkWellKnown serverConfig;
+        locations."= /.well-known/matrix/client".extraConfig = mkWellKnown clientConfig;
       };
     };
 

From 0792e8c7cb1b75e608372e44fb36a885f28a998e Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 3 Aug 2025 00:34:40 +0200
Subject: [PATCH 204/256] nixos: services: matrix: fix element-web config

---
 modules/nixos/services/matrix/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/modules/nixos/services/matrix/default.nix b/modules/nixos/services/matrix/default.nix
index b43dbcc..42f7b4e 100644
--- a/modules/nixos/services/matrix/default.nix
+++ b/modules/nixos/services/matrix/default.nix
@@ -117,10 +117,11 @@ in
         root = pkgs.element-web.override {
           conf = {
             default_server_config = clientConfig;
-            showLabsSettings = true;
-            defaultCountryCode = "FR"; # cocorico
-            roomDirectory = {
+            show_labs_settings = true;
+            default_country_code = "FR"; # cocorico
+            room_directory = {
               "servers" = [
+                domain
                 "matrix.org"
                 "mozilla.org"
               ];

From bd019258cb4f15e028bc4cb7a68353abe270e6ac Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 3 Aug 2025 10:39:55 +0200
Subject: [PATCH 205/256] nixos: services: matrix: simplify listeners

---
 modules/nixos/services/matrix/default.nix | 93 ++++++++---------------
 1 file changed, 30 insertions(+), 63 deletions(-)

diff --git a/modules/nixos/services/matrix/default.nix b/modules/nixos/services/matrix/default.nix
index 42f7b4e..83dac7c 100644
--- a/modules/nixos/services/matrix/default.nix
+++ b/modules/nixos/services/matrix/default.nix
@@ -10,13 +10,11 @@
 let
   cfg = config.my.services.matrix;
 
-  federationPort = { public = 8448; private = 11338; };
-  clientPort = { public = 443; private = 11339; };
   domain = config.networking.domain;
   matrixDomain = "matrix.${domain}";
 
   serverConfig = {
-    "m.server" = "${matrixDomain}:${toString federationPort.public}";
+    "m.server" = "${matrixDomain}:443";
   };
   clientConfig = {
     "m.homeserver" = {
@@ -39,6 +37,13 @@ in
   options.my.services.matrix = with lib; {
     enable = mkEnableOption "Matrix Synapse";
 
+    port = mkOption {
+      type = types.port;
+      default = 8448;
+      example = 8008;
+      description = "Internal port for listeners";
+    };
+
     secretFile = mkOption {
       type = with types; nullOr str;
       default = null;
@@ -78,22 +83,22 @@ in
         enable_registration = false;
 
         listeners = [
-          # Federation
           {
+            inherit (cfg) port;
             bind_addresses = [ "::1" ];
-            port = federationPort.private;
-            tls = false; # Terminated by nginx.
+            type = "http";
+            tls = false;
             x_forwarded = true;
-            resources = [{ names = [ "federation" ]; compress = false; }];
-          }
-
-          # Client
-          {
-            bind_addresses = [ "::1" ];
-            port = clientPort.private;
-            tls = false; # Terminated by nginx.
-            x_forwarded = true;
-            resources = [{ names = [ "client" ]; compress = false; }];
+            resources = [
+              {
+                names = [ "client" ];
+                compress = true;
+              }
+              {
+                names = [ "federation" ];
+                compress = false;
+              }
+            ];
           }
         ];
 
@@ -130,11 +135,8 @@ in
         };
       };
       # Dummy VHosts for port collision detection
-      matrix-federation = {
-        port = federationPort.private;
-      };
-      matrix-client = {
-        port = clientPort.private;
+      matrix-dummy = {
+        inherit (cfg) port;
       };
     };
 
@@ -144,45 +146,15 @@ in
         onlySSL = true;
         useACMEHost = domain;
 
-        locations =
-          let
-            proxyToClientPort = {
-              proxyPass = "http://[::1]:${toString clientPort.private}";
-            };
-          in
-          {
-            # Or do a redirect instead of the 404, or whatever is appropriate
-            # for you. But do not put a Matrix Web client here! See the
-            # Element web section below.
-            "/".return = "404";
+        locations = {
+          # Or do a redirect instead of the 404, or whatever is appropriate
+          # for you. But do not put a Matrix Web client here! See the
+          # Element web section below.
+          "/".return = "404";
 
-            "/_matrix" = proxyToClientPort;
-            "/_synapse/client" = proxyToClientPort;
-          };
-
-        listen = [
-          { addr = "0.0.0.0"; port = clientPort.public; ssl = true; }
-          { addr = "[::]"; port = clientPort.public; ssl = true; }
-        ];
-
-      };
-
-      # same as above, but listening on the federation port
-      "${matrixDomain}_federation" = {
-        onlySSL = true;
-        serverName = matrixDomain;
-        useACMEHost = domain;
-
-        locations."/".return = "404";
-
-        locations."/_matrix" = {
-          proxyPass = "http://[::1]:${toString federationPort.private}";
+          "/_matrix".proxyPass = "http://[::1]:${toString cfg.port}";
+          "/_synapse/client".proxyPass = "http://[::1]:${toString cfg.port}";
         };
-
-        listen = [
-          { addr = "0.0.0.0"; port = federationPort.public; ssl = true; }
-          { addr = "[::]"; port = federationPort.public; ssl = true; }
-        ];
       };
 
       "${domain}" = {
@@ -197,11 +169,6 @@ in
     # For administration tools.
     environment.systemPackages = [ pkgs.matrix-synapse ];
 
-    networking.firewall.allowedTCPPorts = [
-      clientPort.public
-      federationPort.public
-    ];
-
     my.services.backup = {
       paths = [
         config.services.matrix-synapse.dataDir

From 1e31b2dfea4e2161c371806b262b924349ab31f5 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 3 Aug 2025 10:42:23 +0200
Subject: [PATCH 206/256] nixos: services: matrix: simplify VHost

---
 modules/nixos/services/matrix/default.nix | 31 ++++++++++-------------
 1 file changed, 14 insertions(+), 17 deletions(-)

diff --git a/modules/nixos/services/matrix/default.nix b/modules/nixos/services/matrix/default.nix
index 83dac7c..763d9b1 100644
--- a/modules/nixos/services/matrix/default.nix
+++ b/modules/nixos/services/matrix/default.nix
@@ -134,29 +134,26 @@ in
           };
         };
       };
-      # Dummy VHosts for port collision detection
-      matrix-dummy = {
+      matrix = {
+        # Somewhat unused, but necessary for port collision detection
         inherit (cfg) port;
+
+        extraConfig = {
+          locations = {
+            # Or do a redirect instead of the 404, or whatever is appropriate
+            # for you. But do not put a Matrix Web client here! See the
+            # Element web section below.
+            "/".return = "404";
+
+            "/_matrix".proxyPass = "http://[::1]:${toString cfg.port}";
+            "/_synapse/client".proxyPass = "http://[::1]:${toString cfg.port}";
+          };
+        };
       };
     };
 
     # Those are too complicated to use my wrapper...
     services.nginx.virtualHosts = {
-      ${matrixDomain} = {
-        onlySSL = true;
-        useACMEHost = domain;
-
-        locations = {
-          # Or do a redirect instead of the 404, or whatever is appropriate
-          # for you. But do not put a Matrix Web client here! See the
-          # Element web section below.
-          "/".return = "404";
-
-          "/_matrix".proxyPass = "http://[::1]:${toString cfg.port}";
-          "/_synapse/client".proxyPass = "http://[::1]:${toString cfg.port}";
-        };
-      };
-
       "${domain}" = {
         forceSSL = true;
         useACMEHost = domain;

From fa7b4910f5cac8bc1f50cc396174ecceae8b1fd5 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 3 Aug 2025 11:06:04 +0200
Subject: [PATCH 207/256] nixos: services: matrix: fix proxy to synapse

I want to make use of the `/_synapse/matrix/` sub-path, so just proxy
the whole of `/_synapse/`.
---
 modules/nixos/services/matrix/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/nixos/services/matrix/default.nix b/modules/nixos/services/matrix/default.nix
index 763d9b1..dfd5b50 100644
--- a/modules/nixos/services/matrix/default.nix
+++ b/modules/nixos/services/matrix/default.nix
@@ -146,7 +146,7 @@ in
             "/".return = "404";
 
             "/_matrix".proxyPass = "http://[::1]:${toString cfg.port}";
-            "/_synapse/client".proxyPass = "http://[::1]:${toString cfg.port}";
+            "/_synapse".proxyPass = "http://[::1]:${toString cfg.port}";
           };
         };
       };

From 9cadbe6256b8ea9db3c2acc3eeb0e02b903d7579 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 3 Aug 2025 11:07:37 +0200
Subject: [PATCH 208/256] nixos: services: matrix: add admin interface

---
 modules/nixos/services/matrix/default.nix | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/modules/nixos/services/matrix/default.nix b/modules/nixos/services/matrix/default.nix
index dfd5b50..837d150 100644
--- a/modules/nixos/services/matrix/default.nix
+++ b/modules/nixos/services/matrix/default.nix
@@ -10,6 +10,8 @@
 let
   cfg = config.my.services.matrix;
 
+  adminPkg = pkgs.synapse-admin-etkecc;
+
   domain = config.networking.domain;
   matrixDomain = "matrix.${domain}";
 
@@ -147,6 +149,22 @@ in
 
             "/_matrix".proxyPass = "http://[::1]:${toString cfg.port}";
             "/_synapse".proxyPass = "http://[::1]:${toString cfg.port}";
+
+            "= /admin".return = "307 /admin/";
+            "/admin/" = {
+              alias = "${adminPkg}/";
+              priority = 500;
+              tryFiles = "$uri $uri/ /index.html";
+            };
+            "~ ^/admin/.*\\.(?:css|js|jpg|jpeg|gif|png|svg|ico|woff|woff2|ttf|eot|webp)$" = {
+              priority = 400;
+              root = adminPkg;
+              extraConfig = ''
+                rewrite ^/admin/(.*)$ /$1 break;
+                expires 30d;
+                more_set_headers "Cache-Control: public";
+              '';
+            };
           };
         };
       };

From 7a85a4440716f752c8f004330c9e2aa1a3c9886f Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 3 Aug 2025 20:06:40 +0200
Subject: [PATCH 209/256] nixos: services: matrix: remove obsolete comment

---
 modules/nixos/services/matrix/default.nix | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/modules/nixos/services/matrix/default.nix b/modules/nixos/services/matrix/default.nix
index 837d150..483a72a 100644
--- a/modules/nixos/services/matrix/default.nix
+++ b/modules/nixos/services/matrix/default.nix
@@ -1,10 +1,4 @@
-# Matrix homeserver setup, using different endpoints for federation and client
-# traffic. The main trick for this is defining two nginx servers endpoints for
-# matrix.domain.com, each listening on different ports.
-#
-# Configuration shamelessly stolen from [1]
-#
-# [1]: https://github.com/alarsyo/nixos-config/blob/main/services/matrix.nix
+# Matrix homeserver setup.
 { config, lib, pkgs, ... }:
 
 let

From 30348a1e193318b1d8bbb8f6d828226f49e8eaa7 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 3 Aug 2025 22:28:22 +0200
Subject: [PATCH 210/256] nixos: services: matrix: add Facebook bridge

I probably won't actually use it, after test-driving it quickly.

But now that the effort has been expanded, might as well keep it if only
as a future reference.
---
 modules/nixos/services/matrix/bridges.nix | 143 ++++++++++++++++++++++
 modules/nixos/services/matrix/default.nix |   4 +
 2 files changed, 147 insertions(+)
 create mode 100644 modules/nixos/services/matrix/bridges.nix

diff --git a/modules/nixos/services/matrix/bridges.nix b/modules/nixos/services/matrix/bridges.nix
new file mode 100644
index 0000000..70f4118
--- /dev/null
+++ b/modules/nixos/services/matrix/bridges.nix
@@ -0,0 +1,143 @@
+# Matrix bridges for some services I use
+{ config, lib, ... }:
+let
+  cfg = config.my.services.matrix.bridges;
+  synapseCfg = config.services.matrix-synapse;
+
+  domain = config.networking.domain;
+  serverName = synapseCfg.settings.server_name;
+
+  mkBridgeOption = n: lib.mkEnableOption "${n} bridge" // { default = cfg.enable; };
+  mkPortOption = n: default: lib.mkOption {
+    type = lib.types.port;
+    inherit default;
+    example = 8080;
+    description = "${n} bridge port";
+  };
+  mkEnvironmentFileOption = n: lib.mkOption {
+    type = lib.types.str;
+    example = "/run/secret/matrix/${lib.toLower n}-bridge-secrets.env";
+    description = ''
+      Path to a file which should contain the secret values for ${n} bridge.
+
+      Using through the following format:
+
+      ```
+      MATRIX_APPSERVICE_AS_TOKEN=<the_as_value>
+      MATRIX_APPSERVICE_HS_TOKEN=<the_hs_value>
+      ```
+
+      Each bridge should use a different set of secrets, as they each register
+      their own independent double-puppetting appservice.
+    '';
+  };
+in
+{
+  options.my.services.matrix.bridges = with lib; {
+    enable = mkEnableOption "bridges configuration";
+
+    admin = mkOption {
+      type = types.str;
+      default = "ambroisie";
+      example = "admin";
+      description = "Local username for the admin";
+    };
+
+    facebook = {
+      enable = mkBridgeOption "Facebook";
+
+      port = mkPortOption "Facebook" 29321;
+
+      environmentFile = mkEnvironmentFileOption "Facebook";
+    };
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf cfg.facebook.enable {
+      services.mautrix-meta.instances.facebook = {
+        enable = true;
+        # Automatically register the bridge with synapse
+        registerToSynapse = true;
+
+        # Provide `AS_TOKEN`, `HS_TOKEN`
+        inherit (cfg.facebook) environmentFile;
+
+        settings = {
+          homeserver = {
+            domain = serverName;
+            address = "http://localhost:${toString config.my.services.matrix.port}";
+          };
+
+          appservice = {
+            hostname = "localhost";
+            inherit (cfg.facebook) port;
+            address = "http://localhost:${toString cfg.facebook.port}";
+            public_address = "https://facebook-bridge.${domain}";
+
+            as_token = "$MATRIX_APPSERVICE_AS_TOKEN";
+            hs_token = "$MATRIX_APPSERVICE_HS_TOKEN";
+
+            bot = {
+              username = "fbbot";
+            };
+          };
+
+          backfill = {
+            enabled = true;
+          };
+
+          bridge = {
+            delivery_receipts = true;
+            permissions = {
+              "*" = "relay";
+              ${serverName} = "user";
+              "@${cfg.admin}:${serverName}" = "admin";
+            };
+          };
+
+          database = {
+            type = "postgres";
+            uri = "postgres:///mautrix-meta-facebook?host=/var/run/postgresql/";
+          };
+
+          double_puppet = {
+            secrets = {
+              ${serverName} = "as_token:$MATRIX_APPSERVICE_AS_TOKEN";
+            };
+          };
+
+          network = {
+            # Don't be picky on Facebook/Messenger
+            allow_messenger_com_on_fb = true;
+            displayname_template = ''{{or .DisplayName .Username "Unknown user"}} (FB)'';
+          };
+
+          provisioning = {
+            shared_secret = "disable";
+          };
+        };
+      };
+
+      services.postgresql = {
+        enable = true;
+        ensureDatabases = [ "mautrix-meta-facebook" ];
+        ensureUsers = [{
+          name = "mautrix-meta-facebook";
+          ensureDBOwnership = true;
+        }];
+      };
+
+      systemd.services.mautrix-meta-facebook = {
+        wants = [ "postgres.service" ];
+        after = [ "postgres.service" ];
+      };
+
+      my.services.nginx.virtualHosts = {
+        # Proxy to the bridge
+        "facebook-bridge" = {
+          inherit (cfg.facebook) port;
+        };
+      };
+    })
+  ];
+}
diff --git a/modules/nixos/services/matrix/default.nix b/modules/nixos/services/matrix/default.nix
index 483a72a..04d24a0 100644
--- a/modules/nixos/services/matrix/default.nix
+++ b/modules/nixos/services/matrix/default.nix
@@ -30,6 +30,10 @@ let
   '';
 in
 {
+  imports = [
+    ./bridges.nix
+  ];
+
   options.my.services.matrix = with lib; {
     enable = mkEnableOption "Matrix Synapse";
 

From b1c9279c637956d134793431e0760d71a0e8bd97 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 2 Aug 2025 14:46:32 +0200
Subject: [PATCH 211/256] nixos: services: add thelounge

---
 modules/nixos/services/default.nix           |  1 +
 modules/nixos/services/thelounge/default.nix | 59 ++++++++++++++++++++
 2 files changed, 60 insertions(+)
 create mode 100644 modules/nixos/services/thelounge/default.nix

diff --git a/modules/nixos/services/default.nix b/modules/nixos/services/default.nix
index 27f8765..e03eca1 100644
--- a/modules/nixos/services/default.nix
+++ b/modules/nixos/services/default.nix
@@ -38,6 +38,7 @@
     ./servarr
     ./ssh-server
     ./tandoor-recipes
+    ./thelounge
     ./tlp
     ./transmission
     ./vikunja
diff --git a/modules/nixos/services/thelounge/default.nix b/modules/nixos/services/thelounge/default.nix
new file mode 100644
index 0000000..e224839
--- /dev/null
+++ b/modules/nixos/services/thelounge/default.nix
@@ -0,0 +1,59 @@
+# Web IRC client
+{ config, lib, ... }:
+let
+  cfg = config.my.services.thelounge;
+in
+{
+  options.my.services.thelounge = with lib; {
+    enable = mkEnableOption "The Lounge, a self-hosted web IRC client";
+
+    port = mkOption {
+      type = types.port;
+      default = 9050;
+      example = 4242;
+      description = "The port on which The Lounge will listen for incoming HTTP traffic.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.thelounge = {
+      enable = true;
+      inherit (cfg) port;
+
+      extraConfig = {
+        reverseProxy = true;
+      };
+    };
+
+    my.services.nginx.virtualHosts = {
+      irc = {
+        inherit (cfg) port;
+        # Proxy websockets for RPC
+        websocketsLocations = [ "/" ];
+
+        extraConfig = {
+          locations."/".extraConfig = ''
+            proxy_read_timeout 1d;
+          '';
+        };
+      };
+    };
+
+    services.fail2ban.jails = {
+      thelounge = ''
+        enabled = true
+        filter = thelounge
+        port = http,https
+      '';
+    };
+
+    environment.etc = {
+      "fail2ban/filter.d/thelounge.conf".text = ''
+        [Definition]
+        failregex = Authentication failed for user .* from <HOST>$
+                    Authentication for non existing user attempted from <HOST>$
+        journalmatch = _SYSTEMD_UNIT=thelounge.service
+      '';
+    };
+  };
+}

From 17ceaa5620c49c5445b99945475c477122637ce7 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 6 Aug 2025 15:37:08 +0000
Subject: [PATCH 212/256] nixos: services: matrix: fix out-dated comments

---
 modules/nixos/services/matrix/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/nixos/services/matrix/default.nix b/modules/nixos/services/matrix/default.nix
index 04d24a0..97dec2e 100644
--- a/modules/nixos/services/matrix/default.nix
+++ b/modules/nixos/services/matrix/default.nix
@@ -142,7 +142,7 @@ in
           locations = {
             # Or do a redirect instead of the 404, or whatever is appropriate
             # for you. But do not put a Matrix Web client here! See the
-            # Element web section below.
+            # Element web section above.
             "/".return = "404";
 
             "/_matrix".proxyPass = "http://[::1]:${toString cfg.port}";
@@ -168,7 +168,7 @@ in
       };
     };
 
-    # Those are too complicated to use my wrapper...
+    # Setup well-known locations
     services.nginx.virtualHosts = {
       "${domain}" = {
         forceSSL = true;

From 8688206ff530dc8fc6da6d2e6e68dcc56dc77622 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 11 Aug 2025 10:05:13 +0000
Subject: [PATCH 213/256] flake: bump inputs

---
 flake.lock | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index 080c212..7ee0f96 100644
--- a/flake.lock
+++ b/flake.lock
@@ -14,11 +14,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754337839,
-        "narHash": "sha256-fEc2/4YsJwtnLU7HCFMRckb0u9UNnDZmwGhXT5U5NTw=",
+        "lastModified": 1754433428,
+        "narHash": "sha256-NA/FT2hVhKDftbHSwVnoRTFhes62+7dxZbxj5Gxvghs=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "856df6f6922845abd4fd958ce21febc07ca2fa45",
+        "rev": "9edb1787864c4f59ae5074ad498b6272b3ec308d",
         "type": "github"
       },
       "original": {
@@ -53,11 +53,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1696426674,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "lastModified": 1747046372,
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
         "type": "github"
       },
       "original": {
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754091436,
-        "narHash": "sha256-XKqDMN1/Qj1DKivQvscI4vmHfDfvYR2pfuFOJiCeewM=",
+        "lastModified": 1754487366,
+        "narHash": "sha256-pHYj8gUBapuUzKV/kN/tR3Zvqc7o6gdFB9XKXIp1SQ8=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "67df8c627c2c39c41dbec76a1f201929929ab0bd",
+        "rev": "af66ad14b28a127c5c0f3bbb298218fc63528a18",
         "type": "github"
       },
       "original": {
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750779888,
-        "narHash": "sha256-wibppH3g/E2lxU43ZQHC5yA/7kIKLGxVEnsnVK1BtRg=",
+        "lastModified": 1754416808,
+        "narHash": "sha256-c6yg0EQ9xVESx6HGDOCMcyRSjaTpNJP10ef+6fRcofA=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "16ec914f6fb6f599ce988427d9d94efddf25fe6d",
+        "rev": "9c52372878df6911f9afc1e2a1391f55e4dfc864",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754365350,
-        "narHash": "sha256-NLWIkn1qM0wxtZu/2NXRaujWJ4Y1PSZlc7h0y6pOzOQ=",
+        "lastModified": 1754886238,
+        "narHash": "sha256-LTQomWOwG70lZR+78ZYSZ9sYELWNq3HJ7/tdHzfif/s=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c5d7e957397ecb7d48b99c928611c6e780db1b56",
+        "rev": "0d492b89d1993579e63b9dbdaed17fd7824834da",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1754372978,
-        "narHash": "sha256-ByII9p9ek0k9UADC/hT+i9ueM2mw0Zxiz+bOlydU6Oo=",
+        "lastModified": 1754725699,
+        "narHash": "sha256-iAcj9T/Y+3DBy2J0N+yF9XQQQ8IEb5swLFzs23CdP88=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9ebe222ec7ef9de52478f76cba3f0324c1d1119f",
+        "rev": "85dbfc7aaf52ecb755f87e577ddbe6dbbdbc1054",
         "type": "github"
       },
       "original": {

From 8c506ea03cfcbbc805eb5e9b26863fa5a0260400 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 8 Aug 2025 09:56:33 +0000
Subject: [PATCH 214/256] home: xdg: enable 'preferXdgDirectories'

At the moment this only makes a difference for `dircolors`.
---
 modules/home/xdg/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/modules/home/xdg/default.nix b/modules/home/xdg/default.nix
index 803167f..7a0c517 100644
--- a/modules/home/xdg/default.nix
+++ b/modules/home/xdg/default.nix
@@ -56,4 +56,7 @@ in
     XCOMPOSECACHE = "${dataHome}/X11/xcompose";
     _JAVA_OPTIONS = "-Djava.util.prefs.userRoot=${configHome}/java";
   };
+
+  # Some modules *optionally* use `XDG_*_HOME` when told to
+  config.home.preferXdgDirectories = lib.mkIf cfg.enable true;
 }

From 5f073875e63aadc7ac925b4fd078248d94f565cd Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 11 Aug 2025 10:18:35 +0000
Subject: [PATCH 215/256] home: tmux: use consistent commenting style

---
 modules/home/tmux/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/home/tmux/default.nix b/modules/home/tmux/default.nix
index 3ea047a..e3e3daf 100644
--- a/modules/home/tmux/default.nix
+++ b/modules/home/tmux/default.nix
@@ -61,8 +61,8 @@ in
       pain-control
       # Better session management
       sessionist
+      # X clipboard integration
       {
-        # X clipboard integration
         plugin = yank;
         extraConfig = ''
           # Use 'clipboard' because of misbehaving apps (e.g: firefox)
@@ -71,8 +71,8 @@ in
           set -g @yank_action 'copy-pipe'
         '';
       }
+      # Show when prefix has been pressed
       {
-        # Show when prefix has been pressed
         plugin = prefix-highlight;
         extraConfig = ''
           # Also show when I'm in copy or sync mode

From e2ae3e02d91291327f883db2bf6fc6a14e269828 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 18 Aug 2025 11:00:38 +0000
Subject: [PATCH 216/256] flake: bump inputs

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 7ee0f96..f4d5f57 100644
--- a/flake.lock
+++ b/flake.lock
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754416808,
-        "narHash": "sha256-c6yg0EQ9xVESx6HGDOCMcyRSjaTpNJP10ef+6fRcofA=",
+        "lastModified": 1755446520,
+        "narHash": "sha256-I0Ok1OGDwc1jPd8cs2VvAYZsHriUVFGIUqW+7uSsOUM=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "9c52372878df6911f9afc1e2a1391f55e4dfc864",
+        "rev": "4b04db83821b819bbbe32ed0a025b31e7971f22e",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754886238,
-        "narHash": "sha256-LTQomWOwG70lZR+78ZYSZ9sYELWNq3HJ7/tdHzfif/s=",
+        "lastModified": 1755491080,
+        "narHash": "sha256-ib1Xi13NEalrFqQAHceRsb+6aIPANFuQq80SS/bY10M=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "0d492b89d1993579e63b9dbdaed17fd7824834da",
+        "rev": "f8af2cbe386f9b96dd9efa57ab15a09377f38f4d",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1754725699,
-        "narHash": "sha256-iAcj9T/Y+3DBy2J0N+yF9XQQQ8IEb5swLFzs23CdP88=",
+        "lastModified": 1755186698,
+        "narHash": "sha256-wNO3+Ks2jZJ4nTHMuks+cxAiVBGNuEBXsT29Bz6HASo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "85dbfc7aaf52ecb755f87e577ddbe6dbbdbc1054",
+        "rev": "fbcf476f790d8a217c3eab4e12033dc4a0f6d23c",
         "type": "github"
       },
       "original": {

From f3af8f9ba8b0042875d9c856cb6ec5b37889ddcb Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 21 Aug 2025 12:06:37 +0000
Subject: [PATCH 217/256] home: atuin: remove bad comment

Most likely a copy-paste error.
---
 modules/home/atuin/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/home/atuin/default.nix b/modules/home/atuin/default.nix
index dbd9690..40d2b04 100644
--- a/modules/home/atuin/default.nix
+++ b/modules/home/atuin/default.nix
@@ -6,7 +6,6 @@ in
   options.my.home.atuin = with lib; {
     enable = my.mkDisableOption "atuin configuration";
 
-    # I want the full experience by default
     package = mkPackageOption pkgs "atuin" { };
 
     daemon = {

From 1a109b6b1f48919cc07a2a3c853858e5900eede4 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 26 Aug 2025 11:39:23 +0000
Subject: [PATCH 218/256] flake: bump inputs

And fix a renamed package.
---
 flake.lock                           | 18 +++++++++---------
 modules/nixos/profiles/x/default.nix |  2 +-
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/flake.lock b/flake.lock
index f4d5f57..ca1b422 100644
--- a/flake.lock
+++ b/flake.lock
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755446520,
-        "narHash": "sha256-I0Ok1OGDwc1jPd8cs2VvAYZsHriUVFGIUqW+7uSsOUM=",
+        "lastModified": 1755960406,
+        "narHash": "sha256-RF7j6C1TmSTK9tYWO6CdEMtg6XZaUKcvZwOCD2SICZs=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "4b04db83821b819bbbe32ed0a025b31e7971f22e",
+        "rev": "e891a93b193fcaf2fc8012d890dc7f0befe86ec2",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755491080,
-        "narHash": "sha256-ib1Xi13NEalrFqQAHceRsb+6aIPANFuQq80SS/bY10M=",
+        "lastModified": 1756022458,
+        "narHash": "sha256-J1i35r4HfNDdPpwL0vOBaZopQudAUVtartEerc1Jryc=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "f8af2cbe386f9b96dd9efa57ab15a09377f38f4d",
+        "rev": "9e3a33c0bcbc25619e540b9dfea372282f8a9740",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1755186698,
-        "narHash": "sha256-wNO3+Ks2jZJ4nTHMuks+cxAiVBGNuEBXsT29Bz6HASo=",
+        "lastModified": 1756125398,
+        "narHash": "sha256-XexyKZpf46cMiO5Vbj+dWSAXOnr285GHsMch8FBoHbc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "fbcf476f790d8a217c3eab4e12033dc4a0f6d23c",
+        "rev": "3b9f00d7a7bf68acd4c4abb9d43695afb04e03a5",
         "type": "github"
       },
       "original": {
diff --git a/modules/nixos/profiles/x/default.nix b/modules/nixos/profiles/x/default.nix
index ea77939..874f36f 100644
--- a/modules/nixos/profiles/x/default.nix
+++ b/modules/nixos/profiles/x/default.nix
@@ -13,7 +13,7 @@ in
     # Nice wallpaper
     services.xserver.displayManager.lightdm.background =
       let
-        wallpapers = "${pkgs.plasma5Packages.plasma-workspace-wallpapers}/share/wallpapers";
+        wallpapers = "${pkgs.kdePackages.plasma-workspace-wallpapers}/share/wallpapers";
       in
       "${wallpapers}/summer_1am/contents/images/2560x1600.jpg";
 

From a889dfbb1a9ce76410e6655ba82616a4c20a3e71 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 26 Aug 2025 11:40:40 +0000
Subject: [PATCH 219/256] home: nix: fix renamed option

---
 modules/home/nix/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/nix/default.nix b/modules/home/nix/default.nix
index c67cc6a..2f435a8 100644
--- a/modules/home/nix/default.nix
+++ b/modules/home/nix/default.nix
@@ -69,7 +69,7 @@ in
         automatic = true;
 
         # Every week, with some wiggle room
-        frequency = "weekly";
+        dates = "weekly";
         randomizedDelaySec = "10min";
 
         # Use a persistent timer for e.g: laptops

From 31147abd9176c9b8afbfa4924df0f589f041b3fc Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 26 Aug 2025 13:07:41 +0000
Subject: [PATCH 220/256] home: add trgui

---
 modules/home/default.nix       |  1 +
 modules/home/trgui/default.nix | 17 +++++++++++++++++
 2 files changed, 18 insertions(+)
 create mode 100644 modules/home/trgui/default.nix

diff --git a/modules/home/default.nix b/modules/home/default.nix
index 1c40377..ad3b979 100644
--- a/modules/home/default.nix
+++ b/modules/home/default.nix
@@ -38,6 +38,7 @@
     ./ssh
     ./terminal
     ./tmux
+    ./trgui
     ./udiskie
     ./vim
     ./wget
diff --git a/modules/home/trgui/default.nix b/modules/home/trgui/default.nix
new file mode 100644
index 0000000..ee545a9
--- /dev/null
+++ b/modules/home/trgui/default.nix
@@ -0,0 +1,17 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.my.home.trgui;
+in
+{
+  options.my.home.trgui = with lib; {
+    enable = mkEnableOption "Transmission GUI onfiguration";
+
+    package = mkPackageOption pkgs "TrguiNG" { default = "trgui-ng"; };
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = with pkgs; [
+      cfg.package
+    ];
+  };
+}

From 1800cb9daa62bf87d55b98baf84a0d2d9a70129c Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 26 Aug 2025 13:08:58 +0000
Subject: [PATCH 221/256] hosts: nixos: aramis: use 'trgui' module

---
 hosts/nixos/aramis/home.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hosts/nixos/aramis/home.nix b/hosts/nixos/aramis/home.nix
index 221b1ea..7578582 100644
--- a/hosts/nixos/aramis/home.nix
+++ b/hosts/nixos/aramis/home.nix
@@ -20,7 +20,6 @@
       element-desktop # Matrix client
       jellyfin-media-player # Wraps the webui and mpv together
       pavucontrol # Audio mixer GUI
-      trgui-ng # Transmission remote
     ];
     # Minimal video player
     mpv.enable = true;
@@ -28,6 +27,8 @@
     nm-applet.enable = true;
     # Terminal
     terminal.program = "alacritty";
+    # Transmission remote
+    trgui.enable = true;
     # Zathura document viewer
     zathura.enable = true;
   };

From 3fa1664b5c574632c67848e44c167c77cf638ccb Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 21 Feb 2025 16:47:11 +0000
Subject: [PATCH 222/256] home: delta: use stand-alone configuration file

Ideally, I'd like for `delta` to just read a configuration file at
`$XDG_CONFIG_HOME/delta/config` by default, but upstream seems somewhat
reticent to the idea :-/.

So instead, let's keep relying on `git` being enabled, but rather than
inlining the configuration, let's store it where I think it should
belong and include it into `gitconfig`.
---
 modules/home/delta/default.nix | 59 ++++++++++++++++++++--------------
 1 file changed, 35 insertions(+), 24 deletions(-)

diff --git a/modules/home/delta/default.nix b/modules/home/delta/default.nix
index 58ee031..16d3d59 100644
--- a/modules/home/delta/default.nix
+++ b/modules/home/delta/default.nix
@@ -1,6 +1,9 @@
 { config, pkgs, lib, ... }:
 let
   cfg = config.my.home.delta;
+
+  configFormat = pkgs.formats.gitIni { };
+  configPath = "${config.xdg.configHome}/delta/config";
 in
 {
   options.my.home.delta = with lib; {
@@ -34,35 +37,43 @@ in
 
     home.packages = [ cfg.package ];
 
+    xdg.configFile."delta/config".source = configFormat.generate "delta-config" {
+      delta = {
+        features = "diff-highlight decorations";
+
+        # Less jarring style for `diff-highlight` emulation
+        diff-highlight = {
+          minus-style = "red";
+          minus-non-emph-style = "red";
+          minus-emph-style = "bold red 52";
+
+          plus-style = "green";
+          plus-non-emph-style = "green";
+          plus-emph-style = "bold green 22";
+
+          whitespace-error-style = "reverse red";
+        };
+
+        # Personal preference for easier reading
+        decorations = {
+          commit-style = "raw"; # Do not recolor meta information
+          keep-plus-minus-markers = true;
+          paging = "always";
+        };
+      };
+    };
+
     programs.git = lib.mkIf cfg.git.enable {
       delta = {
         enable = true;
         inherit (cfg) package;
-
-        options = {
-          features = "diff-highlight decorations";
-
-          # Less jarring style for `diff-highlight` emulation
-          diff-highlight = {
-            minus-style = "red";
-            minus-non-emph-style = "red";
-            minus-emph-style = "bold red 52";
-
-            plus-style = "green";
-            plus-non-emph-style = "green";
-            plus-emph-style = "bold green 22";
-
-            whitespace-error-style = "reverse red";
-          };
-
-          # Personal preference for easier reading
-          decorations = {
-            commit-style = "raw"; # Do not recolor meta information
-            keep-plus-minus-markers = true;
-            paging = "always";
-          };
-        };
       };
+
+      includes = [
+        {
+          path = configPath;
+        }
+      ];
     };
   };
 }

From 3dd4f07609a8d8c9f15530745aa68ba458b943f3 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 4 Sep 2025 11:35:39 +0000
Subject: [PATCH 223/256] hosts: nixos: aramis: home: drop
 'jellyfin-media-player'

It's about to be made broken due to using QtWebEngine 5, which is EOL
and marked insecure in new nixpkgs.
---
 hosts/nixos/aramis/home.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hosts/nixos/aramis/home.nix b/hosts/nixos/aramis/home.nix
index 7578582..e8c99e4 100644
--- a/hosts/nixos/aramis/home.nix
+++ b/hosts/nixos/aramis/home.nix
@@ -18,7 +18,6 @@
     # Machine specific packages
     packages.additionalPackages = with pkgs; [
       element-desktop # Matrix client
-      jellyfin-media-player # Wraps the webui and mpv together
       pavucontrol # Audio mixer GUI
     ];
     # Minimal video player

From b9bc37d365c607bdda473c9f2a0a992f0e8f6cc0 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 4 Sep 2025 11:14:25 +0000
Subject: [PATCH 224/256] flake: bump inputs

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index ca1b422..e86674e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754487366,
-        "narHash": "sha256-pHYj8gUBapuUzKV/kN/tR3Zvqc7o6gdFB9XKXIp1SQ8=",
+        "lastModified": 1756770412,
+        "narHash": "sha256-+uWLQZccFHwqpGqr2Yt5VsW/PbeJVTn9Dk6SHWhNRPw=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "af66ad14b28a127c5c0f3bbb298218fc63528a18",
+        "rev": "4524271976b625a4a605beefd893f270620fd751",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756022458,
-        "narHash": "sha256-J1i35r4HfNDdPpwL0vOBaZopQudAUVtartEerc1Jryc=",
+        "lastModified": 1756954499,
+        "narHash": "sha256-Pg4xBHzvzNY8l9x/rLWoJMnIR8ebG+xeU+IyqThIkqU=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "9e3a33c0bcbc25619e540b9dfea372282f8a9740",
+        "rev": "ed1a98c375450dfccf427adacd2bfd1a7b22eb25",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1756125398,
-        "narHash": "sha256-XexyKZpf46cMiO5Vbj+dWSAXOnr285GHsMch8FBoHbc=",
+        "lastModified": 1756936398,
+        "narHash": "sha256-/o1TTpMIICpjrMHBilL9lYm/r69uhdK1L8j1pfY6tWU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3b9f00d7a7bf68acd4c4abb9d43695afb04e03a5",
+        "rev": "47f28ad9378956563df9a884fd1b209b64336ba3",
         "type": "github"
       },
       "original": {

From e6c95245b27e5ac6fbac237d222c56a39ba401f9 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 4 Sep 2025 11:17:27 +0000
Subject: [PATCH 225/256] home: ssh: disable default config

It's been deprecated.

This also makes my `addKeysToAgent` configuration more explicit.
---
 modules/home/ssh/default.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/modules/home/ssh/default.nix b/modules/home/ssh/default.nix
index 748b195..b0b4167 100644
--- a/modules/home/ssh/default.nix
+++ b/modules/home/ssh/default.nix
@@ -17,6 +17,7 @@ in
     {
       programs.ssh = {
         enable = true;
+        enableDefaultConfig = false;
 
         includes = [
           # Local configuration, not-versioned
@@ -53,11 +54,12 @@ in
             identityFile = "~/.ssh/shared_rsa";
             user = "ambroisie";
           };
-        };
 
-        extraConfig = ''
-          AddKeysToAgent yes
-        '';
+          # `*` is automatically made the last match block by the module
+          "*" = {
+            addKeysToAgent = "yes";
+          };
+        };
       };
     }
 

From fa6bcabf95d8d1d860612880198271b6d31cbb0a Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 11 Sep 2025 13:33:27 +0000
Subject: [PATCH 226/256] flake: bump inputs

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index e86674e..d510422 100644
--- a/flake.lock
+++ b/flake.lock
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755960406,
-        "narHash": "sha256-RF7j6C1TmSTK9tYWO6CdEMtg6XZaUKcvZwOCD2SICZs=",
+        "lastModified": 1757588530,
+        "narHash": "sha256-tJ7A8mID3ct69n9WCvZ3PzIIl3rXTdptn/lZmqSS95U=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "e891a93b193fcaf2fc8012d890dc7f0befe86ec2",
+        "rev": "b084b2c2b6bc23e83bbfe583b03664eb0b18c411",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756954499,
-        "narHash": "sha256-Pg4xBHzvzNY8l9x/rLWoJMnIR8ebG+xeU+IyqThIkqU=",
+        "lastModified": 1757578556,
+        "narHash": "sha256-w1PGkTGow5XzsjccV364No46rkuGxTqo7m/4cfhnkIk=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "ed1a98c375450dfccf427adacd2bfd1a7b22eb25",
+        "rev": "b7112b12ea5b8c3aa6af344498ed9ca27dd03ba3",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1756936398,
-        "narHash": "sha256-/o1TTpMIICpjrMHBilL9lYm/r69uhdK1L8j1pfY6tWU=",
+        "lastModified": 1757487488,
+        "narHash": "sha256-zwE/e7CuPJUWKdvvTCB7iunV4E/+G0lKfv4kk/5Izdg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "47f28ad9378956563df9a884fd1b209b64336ba3",
+        "rev": "ab0f3607a6c7486ea22229b92ed2d355f1482ee0",
         "type": "github"
       },
       "original": {

From 27da55519c74d63010d67153041aed789b9add97 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 25 Jul 2025 17:57:07 +0200
Subject: [PATCH 227/256] hosts: nixos: porthos: secrets: update cross-seed

---
 .../servarr/cross-seed/configuration.json.age | Bin 1528 -> 2031 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/hosts/nixos/porthos/secrets/servarr/cross-seed/configuration.json.age b/hosts/nixos/porthos/secrets/servarr/cross-seed/configuration.json.age
index e319f3a823c4eb4c84b15f6630ea5fbf42f9092b..94fdf975d6418d394c62c42e572374b24865a776 100644
GIT binary patch
delta 2009
zcmeyt{hoh<PJMcLre#oasYR)2SyphVrMA9_e|k}hWu;qyQ&CBpb69$SZ>edfX?k{`
z1y`7VVx&c?t9gk}QGTLxrkh!^t9em@esE}{g_)bXV|KY;V0m7Fd!m_FI+w1ULUD11
zZfc5=si~o*LRLV2d0x7Lc4U~PQL39qp1E1MdzE&0T786jgi(<}SWvRRr>}W=NOneY
zrcYjImWfk2S4vnwc0qtaN}6SkajCw(qj8|KuW4wYg<rmDmRW8{zJGF6MS6~>etwcC
zm#(g^f^l-HWw5zNc~GcZlw(O$j#rLXR7JXTSaMlrp{u)Zm9JTfp`lNNdw8ZVSDWh2
z#!s*K@6<=xMe<IuJ$3G7_6@FgA->C=_?o%thNw!FzUK4zk}9+{djIX+e!sW%u-<*K
zg`x6<({7nAg+QS)2}b2ZmsR#`cpQHtgw@qh{oS4Gr>yq1s#KP78(f|7M(2v?f%cFe
zdK+w(Zm`yo-MD;X``@U5HMtds3LFpZa5q1Cf75z}isUzQ>VLkt(ynF|81>FrXLCH$
z&Wg1ktsTOTJ1K~>PqjR-D6s8Rtp3~@hpFB>^wx-#gs$M}+jXGsy0-4(1ewXs50~V9
zigIN*cem<AkL`o0l9`=CTW4B09J%5&Ym&Ilo|Cc@m)D(QIeh;nbBU#fvHju5w&tsH
zf(Jt<JotOgSU4z(Pg%D9?7NkwoB;|8?%m%VX3um$c<1p>0SAT8vTwG@xF2&}V%g5S
zbvLK-3d;z?W9>pkOWr#(XkWXVVP|5$)ZhG+qZ8B2YbTa}`trR_>-1!U!(B7G11<l*
zGhd&tx$Ugj@%Gr3y<XNb;hskn*bc1;Je7HB-MTNYxS3a<N@4jaQM~+iy<C0p)2z+6
z9XoaweldD0dQnd4>l{bt?>D>|=Kub_=9QkS@T}J?SIitfI~6^tt!|Y)v2h;1n)1`V
z^%<7OY!&Qdwto1vAxZbHfJdh+7gNxYqZbm7g{+Ugy6ZIe(uq2;z6)gUTv&2mIwWs}
z`Jb6(eo-4|_i@JaeX8Aga9R4TNoQQjnCdU9=-tg%yWXYGos)OrL|50Lsa>f#I|Tn(
zm;8>rDZ-*VTesuU&gWORr%Bgeue7<G_q}&*(ah=p7keJn>R^~XAzs7N@4HA;{rsO9
z(lcKkSH8CF)vc%7PI{P}PhjU&yYZyV>r;N$oW#dc`PN(KH6K_c*=RX)jl4ik>7nF)
zi}y3+>-Q_2J1E(mqogFoT;R$fBa%KTE2z-p=sQbU3)SaQ8?7D|xwkx1+x=<HuDefz
zzPp`EDdUw~F}d);vXz(5p7&YwrRKU>Ulwobr`hivkGzlMSL?8Q-sbhbg}o$K$mIIH
zn0HrR$J-qIx@KYe{<}(PTLeqJn~Z~X9<@w9f4_O%`H!FKAJtY##bwWRs!*8z{MRC`
zI-BiZr>zmYS)<CDxZOT~miWQPp~cmy1<s3Ia&qE+Yt8Mw9GM+_MC!Z9v2)oUOBj>$
z*m*YGcj9~FFg0lr+tj)MjT`d&KJjcaDB}82=PS>xrn-*l#vVq~IgZkasoUcwy?*9n
zH#I<enor5TUb&tpCiNeGGKg@5cGRYq-->WykeL|GQm@(g<#EC39dVNl8!f#inVDF<
z$!ubHtf#Ue)$W-%d&^UW%1wOYr(Dfmq<ENKY|x25KgWu9+Kif&b9e2E<P$2Htp13<
z;fz#<NZ`qzX<?orhsug&-{l^N|2bpVkxzonPnpkt>(9@P%IEI)U~jA!nzX*@t#PvD
zDtUul9?IUFi#z5V4msEVsjKen0zdPe`3<|x6EvO#&f&HE_d~?})olj5HA3MR%BGr2
z_*Z=pntyD?-8F6pjf9_a2=2euvi3vMm(aqg=Y$zvh(BeT)V|(D)9IV@nu9!v*JR{n
z&M`7N^;$&l_*0NFLr7&|#!U16tojWXxUPF{dfv<5`Qu`Q$PKIfAJ1iO80l}nptO9+
z?i90~zY5O$PSC#n$>b|9fBch~(ckU}{JdRZUvsv-eaW*k$0Qn;-O6fSw@bnP-KruH
z#&1F$=Wd>1*mhZ}{V-cHgW<pJRUXF$cb(gjwa{7rG>hihiEFIvEw?Hz_}LitY2LL*
zt@Z1oj|R+tZ+Ggb>@tQY@q5qN3J5UR2b!JHXuRSz#rx+HDSvbIJ)7;%?4Q(sVDEgB
zDX|yxcpJEV-JA|Od%LWCbNvl}&yV&e`Toj}<<?I)|7~@C?XQi6PhOo}yJpI+d9u1c
zK1REhiEm8(^&|G;U1PJ;(`7hPcK7e^(p~e<JZZxdg?e$x86UodW%V0wd2s*1Z_T4q
z7h2mIRRvZvq)pZ7na^yujBj3A`o}LN0SpH<w)Edi<`X%bzWr*@BR6ga(XjNDv&FP|
z=IvIyp17d)`PJOJ_u5lu&fWfCo!zX8i)q>$%nuu`;S@J6{<D1ZJEc8$)fgTbzKHWk
zWq709X6Lr}^xZwd_3gcrUN=0Lz9?me@#WVgFO%+E_|>!d_~ppE)|WJbR<50BIXQa&
z+@HM~=S~$}b5jXYU(#)V<;K6#-sL<TB8mlC8|u8P)R@b^30}`BTv5^+QkZ;f*)CsG
z&Nnd|JtgL3@UoUMAH3qs=DR71wX$6xj_>^Wip$!Eo@>XN<vz)rHd`tvV2bm>quY$E
z7<db3?Dx68(^#34HLSe$q5pKDnivk<xtx)kXO%9r)bFlK%KR6W;q7&YD^Qea&kn`S
ep}SKJk4IMQyW>?Hu=vv9MR$YZ_<ho}z5xI`<Et_N

delta 1502
zcmaFQ|ATviPJM)-VR?CgkBPZawo9aGMoCdYRk>4OQGumFMo6W5x^rP=Mt)AETV`3V
z1(#E4QAJ@+N^qv5r>~)BvQubgdVynQWKwEazOiRuRf$n@d4RJ~l2Kr;1(&X!LUD11
zZfc5=si~o*LRLV2d0x7LTcA^FQMP_+ScYYkbCiF2Kz*uLx|y4Yvy+>npMhItskXmS
zqIsZaWtO7}muXf=R=J;Zl8HxhR8p98WpSjBN1#htPF{*xP+m@HvU6p4X<2GTMrw)$
zm#(g^f>}hNuTxT<rJrknPiDHQrITAksefgfzl%X`c#>JMdzPPBsB^Mmo>ycf*D2@n
z37;fCdeuv+?>w+R<0Yeo{}QfuMmN)!+&k=0a;^TSYwE4IY0U~Q?{9Yfw0X#~C0&SF
zX}+aS((K$VJ-bblR?1ZG`JdIke`#ik!jg~Af1G*t+V950$FnqoQUr|mohx^EF@65T
z!^>7rb@N!fc}v>LkM#>r%T@8aynXUz(Vrc1N_9sTE>E4Nw7mX$h0l{u+OqtM1bTj@
z{(q8F`{LD`c_O|u&izgQ`QeY>?OCTZ*t+M1PUGCN>2JW}-2Va(cQ3Qqb*%S#`^L*J
zG+q`LyViT9Zd*R-NA%IVo*yc{RKzX66}P)FtGzy)v4%Z9f!XkKo!$0ChYdC^i?TxQ
zn;!e4|M;`7(CJ-Ed03yy+^*NF)SaH%BJzKE^2OXKtanWAHZ%#J&b~Tv%d`CgUAeXM
zmqgG0v{sNa#44C8s9yZV?WjFxZhl>tDqUQvv?~1K4ePy1>-d}J>u|1KJ8x&IqfYo+
zv*Wuy^8DMJ_IAY~9#8ikC1JDBo^u^VY~lYmh;NKyxvQY*wpb@t-T7Qi$XnlQ^#W44
zZ`SP8{vYOUcPhZZFKDgXN`tTQ-^=Rxdu|@>URiWR^t<<$J0G5AKAz@imKnqS{_7*H
z#FFImH@qBwus*nwkZR2-_kL^j^KWZC&P&xjDY@4u!1R1$kMd!|Dd)3Oj?a-1@bQuJ
zGhz?e+$&-I#Jc~q!JT&{OXn-=ZTu><_0+@qFGA5bx1N1jc_%AC@a99t6+hbVFjPD*
zlbM&YU~#<HhQo6+o;?&u+xum^-K1^PgFjAe4B_1D@NSQ&{W90JbDsQpcYP0QQSZMp
zgHKZ~ZBxAO8zV90SM6^8ttTd_RIgWCCwhll*=`-<TfV6`&3|4}sE%lGiu#*h*6n^c
z+CuKeq1UGM^Vgc_zdMvJ_^x}`v~!CTZkZ(?NIe_&!1TJ^mAA#5@6T`KUObD{C%ao9
zsQB~7!<(6IU(H{#H9Dqx_vb*lm0fSPuw86^tHkj8n|=t}hjgx6>mT=C-yyD6{*CAU
zbAcA213k_z6ZG$z|4<gzztNDix8}QS@5kQvK89TL_b%#HTPs=LcBIEBULelv^W8&N
z3UUv6)c=&d^rzzFmB-iSRD8F!tv$bSuk>sdxvnDiormsueVi3I=hEAwk9|GFUKP*(
zmVCWq#*6=IN3OVUo_;VjW9z5BgI6P(MYo&%yc#j-Pdb0amK!C$A9UOt4%p@|(ERo=
zklTIkm2$WJ$%@ynyzZJ(QCwgD<iX4brkhtNe>r_KO<~sq1K!1b7eBA@YG1o_ZS9v8
z<^gMpl?pxQNNIoN50~D4D9GRL(1pc$?pxUA*sb!4%qx!Ga!2Fh)W#z7ZdRxIg}XfB
zp55k34$-Wbeo<fMjXQIsWI1P8O_Y-U&Tk=W418)C{k67PNq8RS$XLIIb8kt-z54j|
z8F^vPbc6T2QdN5Tnjw0@g`*Dlk^}bl-S~C==Zl}QeqwXOe8mja>Q+va{*q&I@m&wc
zd^er?vXJvLKbtK3YbrlQ;`sKm-4o}XlD+TIschDg_~GD{&rUZ^itg#_SzfzD;_Y=d
zZS&;ktru!-w(1*&1`97TayHfcbHvdhOU!CRc)|p!BKv182~T_$y*_L?x3<D%(x<;U
zwa=8wx2}p(n4MXm=J5G*WLemfRV#O2deXk`w~dnbt|g4MjmEM@N&hzMKJN<n$g*GV
UK&(_lF5l0Z#GsIGl7St<0JT!sg8%>k


From 4c3e3d471fa61dcd5de24f0338b36e3b29c83f1f Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 13 Sep 2025 19:10:39 +0200
Subject: [PATCH 228/256] modules: services: nginx: fix SSL renewal, again

I'd previously fixed this in 1e10c6630b2c46bd40c2b23fa6a4f7c8fa751823,
however NixOS has recently updated how the renewal units work [1], which
broke it.

[1]: https://github.com/NixOS/nixpkgs/pull/422076
---
 modules/nixos/services/nginx/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/nixos/services/nginx/default.nix b/modules/nixos/services/nginx/default.nix
index 1e9e38a..ff530b0 100644
--- a/modules/nixos/services/nginx/default.nix
+++ b/modules/nixos/services/nginx/default.nix
@@ -444,7 +444,7 @@ in
         };
     };
 
-    systemd.services."acme-${domain}" = {
+    systemd.services."acme-order-renew-${domain}" = {
       serviceConfig = {
         Environment = [
           # Since I do a "weird" setup with a wildcard CNAME

From 445b3d1422651d1604eda311f74ff0260386f76e Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 18 Sep 2025 10:03:06 +0000
Subject: [PATCH 229/256] flake: bump inputs

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index d510422..b9c0fd5 100644
--- a/flake.lock
+++ b/flake.lock
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757588530,
-        "narHash": "sha256-tJ7A8mID3ct69n9WCvZ3PzIIl3rXTdptn/lZmqSS95U=",
+        "lastModified": 1758108966,
+        "narHash": "sha256-ytw7ROXaWZ7OfwHrQ9xvjpUWeGVm86pwnEd1QhzawIo=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "b084b2c2b6bc23e83bbfe583b03664eb0b18c411",
+        "rev": "54df955a695a84cd47d4a43e08e1feaf90b1fd9b",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757578556,
-        "narHash": "sha256-w1PGkTGow5XzsjccV364No46rkuGxTqo7m/4cfhnkIk=",
+        "lastModified": 1758184248,
+        "narHash": "sha256-TOazVsj8D1LTGQ6q8xdtfoPs9Z+PiqUS952WvZPssR0=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "b7112b12ea5b8c3aa6af344498ed9ca27dd03ba3",
+        "rev": "bf7056c6a2d893d80db18d06d7e730d6515aaae8",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1757487488,
-        "narHash": "sha256-zwE/e7CuPJUWKdvvTCB7iunV4E/+G0lKfv4kk/5Izdg=",
+        "lastModified": 1758035966,
+        "narHash": "sha256-qqIJ3yxPiB0ZQTT9//nFGQYn8X/PBoJbofA7hRKZnmE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ab0f3607a6c7486ea22229b92ed2d355f1482ee0",
+        "rev": "8d4ddb19d03c65a36ad8d189d001dc32ffb0306b",
         "type": "github"
       },
       "original": {

From 9f9c1e571b7a871db4a19d9bfe7fc3ebf9b24875 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 15 Sep 2025 13:22:30 +0000
Subject: [PATCH 230/256] home: zsh: do not notify on 'home-manager news'

---
 modules/home/zsh/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/zsh/default.nix b/modules/home/zsh/default.nix
index 1e85cce..3c1e515 100644
--- a/modules/home/zsh/default.nix
+++ b/modules/home/zsh/default.nix
@@ -19,7 +19,7 @@ in
           "direnv reload"
           "fg"
           "git (?!push|pull|fetch)"
-          "home-manager (?!switch|build|news)"
+          "home-manager (?!switch|build)"
           "htop"
           "less"
           "man"

From 5b47fc63656b7583fb427386339c7adce3cc7e97 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 3 Oct 2025 12:23:54 +0200
Subject: [PATCH 231/256] flake: bump inputs

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index b9c0fd5..1889e0c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756770412,
-        "narHash": "sha256-+uWLQZccFHwqpGqr2Yt5VsW/PbeJVTn9Dk6SHWhNRPw=",
+        "lastModified": 1759362264,
+        "narHash": "sha256-wfG0S7pltlYyZTM+qqlhJ7GMw2fTF4mLKCIVhLii/4M=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "4524271976b625a4a605beefd893f270620fd751",
+        "rev": "758cf7296bee11f1706a574c77d072b8a7baa881",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758184248,
-        "narHash": "sha256-TOazVsj8D1LTGQ6q8xdtfoPs9Z+PiqUS952WvZPssR0=",
+        "lastModified": 1759337100,
+        "narHash": "sha256-CcT3QvZ74NGfM+lSOILcCEeU+SnqXRvl1XCRHenZ0Us=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "bf7056c6a2d893d80db18d06d7e730d6515aaae8",
+        "rev": "004753ae6b04c4b18aa07192c1106800aaacf6c3",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1758035966,
-        "narHash": "sha256-qqIJ3yxPiB0ZQTT9//nFGQYn8X/PBoJbofA7hRKZnmE=",
+        "lastModified": 1759422813,
+        "narHash": "sha256-WNkZqscW/dPLK5NMKH/jCkYMaVm/3KWgPmKMq65IXxk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8d4ddb19d03c65a36ad8d189d001dc32ffb0306b",
+        "rev": "2a7c84e1e740f004e0fe5c2577a63d1e659a496c",
         "type": "github"
       },
       "original": {

From 62533d435b9d86cf0c1271cd0a14ed73a67584f2 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 3 Oct 2025 12:18:38 +0000
Subject: [PATCH 232/256] home: vim: lspconfig: use native configuration

The `nvim-lspconfig` "framework" is being deprecated to use the native
`vim.lsp.config` and `vim.lsp.enable` functionality.

I _could_ remove the `is_executable` checks, as native LSP handling does
_not_ loudly error out when enabling a server which isn't executable.
However I think `:LspInfo` is more readable if I don't.
---
 .../home/vim/plugin/settings/lspconfig.lua    | 57 ++++++-------------
 1 file changed, 17 insertions(+), 40 deletions(-)

diff --git a/modules/home/vim/plugin/settings/lspconfig.lua b/modules/home/vim/plugin/settings/lspconfig.lua
index 7817d4c..68158b2 100644
--- a/modules/home/vim/plugin/settings/lspconfig.lua
+++ b/modules/home/vim/plugin/settings/lspconfig.lua
@@ -1,4 +1,3 @@
-local lspconfig = require("lspconfig")
 local lsp = require("ambroisie.lsp")
 local utils = require("ambroisie.utils")
 
@@ -25,59 +24,45 @@ vim.diagnostic.config({
 -- Inform servers we are able to do completion, snippets, etc...
 local capabilities = require("cmp_nvim_lsp").default_capabilities()
 
+-- Shared configuration
+vim.lsp.config("*", {
+    capabilities = capabilities,
+    on_attach = lsp.on_attach,
+})
+
 -- C/C++
 if utils.is_executable("clangd") then
-    lspconfig.clangd.setup({
-        capabilities = capabilities,
-        on_attach = lsp.on_attach,
-    })
+    vim.lsp.enable("clangd")
 end
 
 -- Haskell
 if utils.is_executable("haskell-language-server-wrapper") then
-    lspconfig.hls.setup({
-        capabilities = capabilities,
-        on_attach = lsp.on_attach,
-    })
+    vim.lsp.enable("hls")
 end
 
 -- Nix
 if utils.is_executable("nil") then
-    lspconfig.nil_ls.setup({
-        capabilities = capabilities,
-        on_attach = lsp.on_attach,
-    })
+    vim.lsp.enable("nil_ls")
 end
 
 -- Python
 if utils.is_executable("pyright") then
-    lspconfig.pyright.setup({
-        capabilities = capabilities,
-        on_attach = lsp.on_attach,
-    })
+    vim.lsp.enable("pyright")
 end
 
 if utils.is_executable("ruff") then
-    lspconfig.ruff.setup({
-        capabilities = capabilities,
-        on_attach = lsp.on_attach,
-    })
+    vim.lsp.enable("ruff")
 end
 
 -- Rust
 if utils.is_executable("rust-analyzer") then
-    lspconfig.rust_analyzer.setup({
-        capabilities = capabilities,
-        on_attach = lsp.on_attach,
-    })
+    vim.lsp.enable("rust_analyzer")
 end
 
 -- Shell
 if utils.is_executable("bash-language-server") then
-    lspconfig.bashls.setup({
+    vim.lsp.config("bashls", {
         filetypes = { "bash", "sh", "zsh" },
-        capabilities = capabilities,
-        on_attach = lsp.on_attach,
         settings = {
             bashIde = {
                 shfmt = {
@@ -89,27 +74,19 @@ if utils.is_executable("bash-language-server") then
             },
         },
     })
+    vim.lsp.enable("bashls")
 end
 
 -- Starlark
 if utils.is_executable("starpls") then
-    lspconfig.starpls.setup({
-        capabilities = capabilities,
-        on_attach = lsp.on_attach,
-    })
+    vim.lsp.enable("starpls")
 end
 
 -- Generic
 if utils.is_executable("harper-ls") then
-    lspconfig.harper_ls.setup({
-        capabilities = capabilities,
-        on_attach = lsp.on_attach,
-    })
+    vim.lsp.enable("harper_ls")
 end
 
 if utils.is_executable("typos-lsp") then
-    lspconfig.typos_lsp.setup({
-        capabilities = capabilities,
-        on_attach = lsp.on_attach,
-    })
+    vim.lsp.enable("typos_lsp")
 end

From 6b1b5300cdc275422e1eab5cdc24b7f6f6798d1b Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 3 Oct 2025 12:39:18 +0000
Subject: [PATCH 233/256] home: vim: lspconfig: simplify LSP config

Despite what I just said in the previous commit, I decided to remove the
`is_executable` checks and always enable all servers.

I figured out that NeoVim actually handles `PATH` modifications pretty
well in this scenario: making a previously unavailable server executable
will automatically enable it.
---
 .../home/vim/plugin/settings/lspconfig.lua    | 73 +++++++------------
 1 file changed, 26 insertions(+), 47 deletions(-)

diff --git a/modules/home/vim/plugin/settings/lspconfig.lua b/modules/home/vim/plugin/settings/lspconfig.lua
index 68158b2..1596e84 100644
--- a/modules/home/vim/plugin/settings/lspconfig.lua
+++ b/modules/home/vim/plugin/settings/lspconfig.lua
@@ -30,38 +30,20 @@ vim.lsp.config("*", {
     on_attach = lsp.on_attach,
 })
 
--- C/C++
-if utils.is_executable("clangd") then
-    vim.lsp.enable("clangd")
-end
-
--- Haskell
-if utils.is_executable("haskell-language-server-wrapper") then
-    vim.lsp.enable("hls")
-end
-
--- Nix
-if utils.is_executable("nil") then
-    vim.lsp.enable("nil_ls")
-end
-
--- Python
-if utils.is_executable("pyright") then
-    vim.lsp.enable("pyright")
-end
-
-if utils.is_executable("ruff") then
-    vim.lsp.enable("ruff")
-end
-
--- Rust
-if utils.is_executable("rust-analyzer") then
-    vim.lsp.enable("rust_analyzer")
-end
-
--- Shell
-if utils.is_executable("bash-language-server") then
-    vim.lsp.config("bashls", {
+local servers = {
+    -- C/C++
+    clangd = {},
+    -- Haskell
+    hls = {},
+    -- Nix
+    nil_ls = {},
+    -- Python
+    pyright = {},
+    ruff = {},
+    -- Rust
+    rust_analyzer = {},
+    -- Shell
+    bashls = {
         filetypes = { "bash", "sh", "zsh" },
         settings = {
             bashIde = {
@@ -73,20 +55,17 @@ if utils.is_executable("bash-language-server") then
                 },
             },
         },
-    })
-    vim.lsp.enable("bashls")
-end
+    },
+    -- Starlark
+    starpls = {},
+    -- Generic
+    harper_ls = {},
+    typos_lsp = {},
+}
 
--- Starlark
-if utils.is_executable("starpls") then
-    vim.lsp.enable("starpls")
-end
-
--- Generic
-if utils.is_executable("harper-ls") then
-    vim.lsp.enable("harper_ls")
-end
-
-if utils.is_executable("typos-lsp") then
-    vim.lsp.enable("typos_lsp")
+for server, config in pairs(servers) do
+    if not vim.tbl_isempty(config) then
+        vim.lsp.config(server, config)
+    end
+    vim.lsp.enable(server)
 end

From 2df05aaa1a2f85601df107f16bfec70b9239eab4 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 20 Oct 2025 09:33:49 +0000
Subject: [PATCH 234/256] flake: bump inputs

And fix a breaking change leading to an evaluation failure.
---
 flake.lock                                 | 36 +++++++++++-----------
 modules/nixos/services/homebox/default.nix |  2 +-
 2 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/flake.lock b/flake.lock
index 1889e0c..1a8a934 100644
--- a/flake.lock
+++ b/flake.lock
@@ -14,11 +14,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754433428,
-        "narHash": "sha256-NA/FT2hVhKDftbHSwVnoRTFhes62+7dxZbxj5Gxvghs=",
+        "lastModified": 1760836749,
+        "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "9edb1787864c4f59ae5074ad498b6272b3ec308d",
+        "rev": "2f0f812f69f3eb4140157fe15e12739adf82e32a",
         "type": "github"
       },
       "original": {
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759362264,
-        "narHash": "sha256-wfG0S7pltlYyZTM+qqlhJ7GMw2fTF4mLKCIVhLii/4M=",
+        "lastModified": 1760948891,
+        "narHash": "sha256-TmWcdiUUaWk8J4lpjzu4gCGxWY6/Ok7mOK4fIFfBuU4=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "758cf7296bee11f1706a574c77d072b8a7baa881",
+        "rev": "864599284fc7c0ba6357ed89ed5e2cd5040f0c04",
         "type": "github"
       },
       "original": {
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758108966,
-        "narHash": "sha256-ytw7ROXaWZ7OfwHrQ9xvjpUWeGVm86pwnEd1QhzawIo=",
+        "lastModified": 1760663237,
+        "narHash": "sha256-BflA6U4AM1bzuRMR8QqzPXqh8sWVCNDzOdsxXEguJIc=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "54df955a695a84cd47d4a43e08e1feaf90b1fd9b",
+        "rev": "ca5b894d3e3e151ffc1db040b6ce4dcc75d31c37",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759337100,
-        "narHash": "sha256-CcT3QvZ74NGfM+lSOILcCEeU+SnqXRvl1XCRHenZ0Us=",
+        "lastModified": 1760969583,
+        "narHash": "sha256-vsf5mvR0xxK4GsfLx5bMJAQ4ysdrKymMIifNw+4TP7g=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "004753ae6b04c4b18aa07192c1106800aaacf6c3",
+        "rev": "c9d758b500e53db5b74aa02d17dc45b65229e8e9",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1759422813,
-        "narHash": "sha256-WNkZqscW/dPLK5NMKH/jCkYMaVm/3KWgPmKMq65IXxk=",
+        "lastModified": 1760878510,
+        "narHash": "sha256-K5Osef2qexezUfs0alLvZ7nQFTGS9DL2oTVsIXsqLgs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2a7c84e1e740f004e0fe5c2577a63d1e659a496c",
+        "rev": "5e2a59a5b1a82f89f2c7e598302a9cacebb72a67",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1753980880,
-        "narHash": "sha256-aj1pbYxL6N+XFqBHjB4B1QP0bnKRcg1AfpgT5zUFsW8=",
+        "lastModified": 1759781536,
+        "narHash": "sha256-v/X5gKmgVoGtu5elYyUu2w037PyWVhrqnWzXkLJ9xnY=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "16db3e61da7606984a05b4dfc33cd1d26d22fb22",
+        "rev": "c30a53a5947bcc874b3f8842e6fe5c34bc81d8dd",
         "type": "github"
       },
       "original": {
diff --git a/modules/nixos/services/homebox/default.nix b/modules/nixos/services/homebox/default.nix
index 8ed5d77..524a6d7 100644
--- a/modules/nixos/services/homebox/default.nix
+++ b/modules/nixos/services/homebox/default.nix
@@ -39,7 +39,7 @@ in
 
     my.services.backup = {
       paths = [
-        config.services.homebox.settings.HBOX_STORAGE_DATA
+        (lib.removePrefix "file://" config.services.homebox.settings.HBOX_STORAGE_CONN_STRING)
       ];
     };
 

From 9ddc77958ab4c647df7173a3a5eee08ae88f926b Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 20 Oct 2025 09:35:02 +0000
Subject: [PATCH 235/256] home: git: fix deprecated config

---
 modules/home/git/default.nix | 38 +++++++++++++++++++-----------------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/modules/home/git/default.nix b/modules/home/git/default.nix
index ca59a5f..c3a51a0 100644
--- a/modules/home/git/default.nix
+++ b/modules/home/git/default.nix
@@ -21,29 +21,31 @@ in
   config.programs.git = lib.mkIf cfg.enable {
     enable = true;
 
-    # Who am I?
-    userEmail = mkMailAddress "bruno" "belanyi.fr";
-    userName = "Bruno BELANYI";
-
     inherit (cfg) package;
 
-    aliases = {
-      git = "!git";
-      lol = "log --graph --decorate --pretty=oneline --abbrev-commit --topo-order";
-      lola = "lol --all";
-      assume = "update-index --assume-unchanged";
-      unassume = "update-index --no-assume-unchanged";
-      assumed = "!git ls-files -v | grep ^h | cut -c 3-";
-      pick = "log -p -G";
-      push-new = "!git push -u origin "
-        + ''"$(git branch | grep '^* ' | cut -f2- -d' ')"'';
-      root = "git rev-parse --show-toplevel";
-    };
-
     lfs.enable = true;
 
     # There's more
-    extraConfig = {
+    settings = {
+      # Who am I?
+      user = {
+        email = mkMailAddress "bruno" "belanyi.fr";
+        name = "Bruno BELANYI";
+      };
+
+      alias = {
+        git = "!git";
+        lol = "log --graph --decorate --pretty=oneline --abbrev-commit --topo-order";
+        lola = "lol --all";
+        assume = "update-index --assume-unchanged";
+        unassume = "update-index --no-assume-unchanged";
+        assumed = "!git ls-files -v | grep ^h | cut -c 3-";
+        pick = "log -p -G";
+        push-new = "!git push -u origin "
+          + ''"$(git branch | grep '^* ' | cut -f2- -d' ')"'';
+        root = "git rev-parse --show-toplevel";
+      };
+
       # Makes it a bit more readable
       blame = {
         coloring = "repeatedLines";

From 4000a848ef21903b7d593160b509173c2fe81736 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 20 Oct 2025 09:39:19 +0000
Subject: [PATCH 236/256] home: delta: use upstream module

---
 modules/home/delta/default.nix | 42 +++++-----------------------------
 1 file changed, 6 insertions(+), 36 deletions(-)

diff --git a/modules/home/delta/default.nix b/modules/home/delta/default.nix
index 16d3d59..e76edc6 100644
--- a/modules/home/delta/default.nix
+++ b/modules/home/delta/default.nix
@@ -1,9 +1,6 @@
 { config, pkgs, lib, ... }:
 let
   cfg = config.my.home.delta;
-
-  configFormat = pkgs.formats.gitIni { };
-  configPath = "${config.xdg.configHome}/delta/config";
 in
 {
   options.my.home.delta = with lib; {
@@ -17,28 +14,14 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        # For its configuration
-        assertion = cfg.enable -> cfg.git.enable;
-        message = ''
-          `config.my.home.delta` must enable `config.my.home.delta.git` to be
-          properly configured.
-        '';
-      }
-      {
-        assertion = cfg.enable -> config.programs.git.enable;
-        message = ''
-          `config.my.home.delta` relies on `config.programs.git` to be
-          enabled.
-        '';
-      }
-    ];
+    programs.delta = {
+      enable = true;
 
-    home.packages = [ cfg.package ];
+      inherit (cfg) package;
 
-    xdg.configFile."delta/config".source = configFormat.generate "delta-config" {
-      delta = {
+      enableGitIntegration = cfg.git.enable;
+
+      options = {
         features = "diff-highlight decorations";
 
         # Less jarring style for `diff-highlight` emulation
@@ -62,18 +45,5 @@ in
         };
       };
     };
-
-    programs.git = lib.mkIf cfg.git.enable {
-      delta = {
-        enable = true;
-        inherit (cfg) package;
-      };
-
-      includes = [
-        {
-          path = configPath;
-        }
-      ];
-    };
   };
 }

From a20c8f820dcf77e0b0a75c67d2edf38d97488ba2 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 27 Oct 2025 12:30:49 +0000
Subject: [PATCH 237/256] flake: bump inputs

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index 1a8a934..f56e8f2 100644
--- a/flake.lock
+++ b/flake.lock
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760969583,
-        "narHash": "sha256-vsf5mvR0xxK4GsfLx5bMJAQ4ysdrKymMIifNw+4TP7g=",
+        "lastModified": 1761530345,
+        "narHash": "sha256-+9+YCK9Lh6GThkXu/8JTxMFUnImIdZpb8ElUh6/F5Y8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c9d758b500e53db5b74aa02d17dc45b65229e8e9",
+        "rev": "bbaeb9f1c29e79bb1653b32c3d73244cdf4bd888",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1760878510,
-        "narHash": "sha256-K5Osef2qexezUfs0alLvZ7nQFTGS9DL2oTVsIXsqLgs=",
+        "lastModified": 1761373498,
+        "narHash": "sha256-Q/uhWNvd7V7k1H1ZPMy/vkx3F8C13ZcdrKjO7Jv7v0c=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5e2a59a5b1a82f89f2c7e598302a9cacebb72a67",
+        "rev": "6a08e6bb4e46ff7fcbb53d409b253f6bad8a28ce",
         "type": "github"
       },
       "original": {

From c536ee0136969aa1715e07939dfac9b02342f60d Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 27 Oct 2025 12:31:12 +0000
Subject: [PATCH 238/256] home: zsh: add 'zsh-completion-sync'

It's gated behind `completionSync.enable`, as it does make
entering/leaving direnv-enabled projects slower (due to the calls to
`compinit`).

This might need a bit more work to avoid multiple `compinit`s at shell
startup, will refine in the future if necessary.
---
 modules/home/zsh/default.nix | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/modules/home/zsh/default.nix b/modules/home/zsh/default.nix
index 3c1e515..6c6a469 100644
--- a/modules/home/zsh/default.nix
+++ b/modules/home/zsh/default.nix
@@ -8,6 +8,10 @@ in
 
     launchTmux = mkEnableOption "auto launch tmux at shell start";
 
+    completionSync = {
+      enable = mkEnableOption "zsh-completion-sync plugin";
+    };
+
     notify = {
       enable = mkEnableOption "zsh-done notification";
 
@@ -118,6 +122,18 @@ in
       };
     }
 
+    (lib.mkIf cfg.completionSync.enable {
+      programs.zsh = {
+        plugins = [
+          {
+            name = "zsh-completion-sync";
+            file = "share/zsh-completion-sync/zsh-completion-sync.plugin.zsh";
+            src = pkgs.zsh-completion-sync;
+          }
+        ];
+      };
+    })
+
     (lib.mkIf cfg.notify.enable {
       programs.zsh = {
         plugins = [

From 983bf0f7646ea2ebdff895751eea7054b9140b3a Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 3 Nov 2025 17:22:29 +0100
Subject: [PATCH 239/256] nixos: services: nextcloud: bump to 32

---
 modules/nixos/services/nextcloud/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/nixos/services/nextcloud/default.nix b/modules/nixos/services/nextcloud/default.nix
index d8d4fce..dd3b386 100644
--- a/modules/nixos/services/nextcloud/default.nix
+++ b/modules/nixos/services/nextcloud/default.nix
@@ -35,7 +35,7 @@ in
   config = lib.mkIf cfg.enable {
     services.nextcloud = {
       enable = true;
-      package = pkgs.nextcloud31;
+      package = pkgs.nextcloud32;
       hostName = "nextcloud.${config.networking.domain}";
       home = "/var/lib/nextcloud";
       maxUploadSize = cfg.maxSize;

From 41c506749ef389c9a2f11dd3f3d17493892820f2 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 6 Nov 2025 14:39:11 +0000
Subject: [PATCH 240/256] flake: overlays: use 'lib'

It's a `lib` function, not _really_ a Nixpkgs one.

Also it's about to break after the next flake update :-).
---
 flake/overlays.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/flake/overlays.nix b/flake/overlays.nix
index 0c47989..c10afc3 100644
--- a/flake/overlays.nix
+++ b/flake/overlays.nix
@@ -1,4 +1,4 @@
-{ self, ... }:
+{ self, lib, ... }:
 let
   default-overlays = import "${self}/overlays";
 
@@ -8,7 +8,7 @@ let
 
     # Expose my custom packages
     pkgs = _final: prev: {
-      ambroisie = prev.recurseIntoAttrs (import "${self}/pkgs" { pkgs = prev; });
+      ambroisie = lib.recurseIntoAttrs (import "${self}/pkgs" { pkgs = prev; });
     };
   };
 in

From 44246b4ea146b1ca7b4687b35e0b833decb35b89 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 8 Nov 2025 11:56:25 +0000
Subject: [PATCH 241/256] flake: NUR has renamed its branch to 'main'

---
 flake.lock | 2 +-
 flake.nix  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/flake.lock b/flake.lock
index f56e8f2..50f38e4 100644
--- a/flake.lock
+++ b/flake.lock
@@ -209,7 +209,7 @@
       },
       "original": {
         "owner": "nix-community",
-        "ref": "master",
+        "ref": "main",
         "repo": "NUR",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 5076729..0bdd180 100644
--- a/flake.nix
+++ b/flake.nix
@@ -54,7 +54,7 @@
       type = "github";
       owner = "nix-community";
       repo = "NUR";
-      ref = "master";
+      ref = "main";
       inputs = {
         flake-parts.follows = "flake-parts";
         nixpkgs.follows = "nixpkgs";

From fe681d3f16eea4d87d55d02c1e8e915eaaf415e6 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 6 Nov 2025 14:35:53 +0000
Subject: [PATCH 242/256] flake: bump inputs

---
 flake.lock | 54 ++++++++++++++++--------------------------------------
 1 file changed, 16 insertions(+), 38 deletions(-)

diff --git a/flake.lock b/flake.lock
index 50f38e4..d95de52 100644
--- a/flake.lock
+++ b/flake.lock
@@ -14,11 +14,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760836749,
-        "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=",
+        "lastModified": 1761656077,
+        "narHash": "sha256-lsNWuj4Z+pE7s0bd2OKicOFq9bK86JE0ZGeKJbNqb94=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "2f0f812f69f3eb4140157fe15e12739adf82e32a",
+        "rev": "9ba0d85de3eaa7afeab493fed622008b6e4924f5",
         "type": "github"
       },
       "original": {
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760948891,
-        "narHash": "sha256-TmWcdiUUaWk8J4lpjzu4gCGxWY6/Ok7mOK4fIFfBuU4=",
+        "lastModified": 1762040540,
+        "narHash": "sha256-z5PlZ47j50VNF3R+IMS9LmzI5fYRGY/Z5O5tol1c9I4=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "864599284fc7c0ba6357ed89ed5e2cd5040f0c04",
+        "rev": "0010412d62a25d959151790968765a70c436598b",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761530345,
-        "narHash": "sha256-+9+YCK9Lh6GThkXu/8JTxMFUnImIdZpb8ElUh6/F5Y8=",
+        "lastModified": 1762435363,
+        "narHash": "sha256-BTmHXtuuwVO1dRs6jPHcHCoO6+A7G3+GzrgeluiSkww=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "bbaeb9f1c29e79bb1653b32c3d73244cdf4bd888",
+        "rev": "432bc8a5da66638b5f139588efd6c4bd327e4cdc",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1761373498,
-        "narHash": "sha256-Q/uhWNvd7V7k1H1ZPMy/vkx3F8C13ZcdrKjO7Jv7v0c=",
+        "lastModified": 1762111121,
+        "narHash": "sha256-4vhDuZ7OZaZmKKrnDpxLZZpGIJvAeMtK6FKLJYUtAdw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6a08e6bb4e46ff7fcbb53d409b253f6bad8a28ce",
+        "rev": "b3d51a0365f6695e7dd5cdf3e180604530ed33b4",
         "type": "github"
       },
       "original": {
@@ -196,15 +196,14 @@
         ],
         "nixpkgs": [
           "nixpkgs"
-        ],
-        "treefmt-nix": "treefmt-nix"
+        ]
       },
       "locked": {
-        "lastModified": 1759781536,
-        "narHash": "sha256-v/X5gKmgVoGtu5elYyUu2w037PyWVhrqnWzXkLJ9xnY=",
+        "lastModified": 1762602346,
+        "narHash": "sha256-BVzjmS25ihrfnfpfLD6gzXqMp9vP0hOyjIWkV0LP6E0=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "c30a53a5947bcc874b3f8842e6fe5c34bc81d8dd",
+        "rev": "fe5118da8d7e09651e0362ff130d194bc1441185",
         "type": "github"
       },
       "original": {
@@ -241,27 +240,6 @@
         "repo": "default",
         "type": "github"
       }
-    },
-    "treefmt-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "nur",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1733222881,
-        "narHash": "sha256-JIPcz1PrpXUCbaccEnrcUS8jjEb/1vJbZz5KkobyFdM=",
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "rev": "49717b5af6f80172275d47a418c9719a31a78b53",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "type": "github"
-      }
     }
   },
   "root": "root",

From 0ac983a71f8cec556babe577e65b513173143417 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 9 Oct 2025 10:47:23 +0000
Subject: [PATCH 243/256] home: vim: do not set 'background' explicitly

Rely on the new behaviour from v0.10 which detects it more
intelligently.
---
 modules/home/vim/init.vim | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/modules/home/vim/init.vim b/modules/home/vim/init.vim
index 39ef32e..1142925 100644
--- a/modules/home/vim/init.vim
+++ b/modules/home/vim/init.vim
@@ -81,9 +81,6 @@ set updatetime=250
 " Disable all mouse integrations
 set mouse=
 
-" Set dark mode by default
-set background=dark
-
 " Setup some overrides for gruvbox
 lua << EOF
 local gruvbox = require("gruvbox")

From bbdbc1e55cb8b2125b2ece2ff1c9d4c5922d821b Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 28 Oct 2025 12:43:53 +0000
Subject: [PATCH 244/256] home: vim: ftdetect: remove glsl

GLSL is now correctly detected starting with v0.11.

This reverts commit b8b64bed8e4b3d8d109e7dcf38f69a4242142ec3.
---
 modules/home/vim/ftdetect/glsl.lua | 7 -------
 1 file changed, 7 deletions(-)
 delete mode 100644 modules/home/vim/ftdetect/glsl.lua

diff --git a/modules/home/vim/ftdetect/glsl.lua b/modules/home/vim/ftdetect/glsl.lua
deleted file mode 100644
index 2f4f1dd..0000000
--- a/modules/home/vim/ftdetect/glsl.lua
+++ /dev/null
@@ -1,7 +0,0 @@
--- Use GLSL filetype for common shader file extensions
-vim.filetype.add({
-    extension = {
-        frag = "glsl",
-        vert = "glsl",
-    },
-})

From 6e73c936b09d46c8427963b5139588804aceddaa Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 7 Nov 2025 14:48:49 +0000
Subject: [PATCH 245/256] home: zsh: fix plug-in path

The upstream commit [1] said it was a non-breaking change, but didn't
actually setup the symlinks for this package...

[1]: 10f01ded353d5a76c6acbecaa0ac5e5063f60c13
---
 modules/home/zsh/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/zsh/default.nix b/modules/home/zsh/default.nix
index 6c6a469..9524262 100644
--- a/modules/home/zsh/default.nix
+++ b/modules/home/zsh/default.nix
@@ -72,7 +72,7 @@ in
         plugins = [
           {
             name = "fast-syntax-highlighting";
-            file = "share/zsh/site-functions/fast-syntax-highlighting.plugin.zsh";
+            file = "share/zsh/plugins/fast-syntax-highlighting/fast-syntax-highlighting.plugin.zsh";
             src = pkgs.zsh-fast-syntax-highlighting;
           }
           {

From 1b4111e28fc68d5b4592f3238854ba1164443c7e Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 8 Nov 2025 22:12:42 +0100
Subject: [PATCH 246/256] nixos: services: nextcloud: use declarative apps

Now that the `notify_push` module declaratively installs _its_ app [1],
I should declaratively install _all_ apps.

[1]: https://github.com/NixOS/nixpkgs/pull/451501
---
 modules/nixos/services/nextcloud/collabora.nix |  6 ++++++
 modules/nixos/services/nextcloud/default.nix   | 10 ++++++++++
 2 files changed, 16 insertions(+)

diff --git a/modules/nixos/services/nextcloud/collabora.nix b/modules/nixos/services/nextcloud/collabora.nix
index f8f42a7..408b232 100644
--- a/modules/nixos/services/nextcloud/collabora.nix
+++ b/modules/nixos/services/nextcloud/collabora.nix
@@ -16,6 +16,12 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    services.nextcloud = {
+      extraApps = {
+        inherit (config.services.nextcloud.package.packages.apps) richdocuments;
+      };
+    };
+
     services.collabora-online = {
       enable = true;
       inherit (cfg) port;
diff --git a/modules/nixos/services/nextcloud/default.nix b/modules/nixos/services/nextcloud/default.nix
index dd3b386..24515ff 100644
--- a/modules/nixos/services/nextcloud/default.nix
+++ b/modules/nixos/services/nextcloud/default.nix
@@ -62,6 +62,16 @@ in
         # Allow using the push service without hard-coding my IP in the configuration
         bendDomainToLocalhost = true;
       };
+
+      extraApps = {
+        inherit (config.services.nextcloud.package.packages.apps)
+          calendar
+          contacts
+          deck
+          tasks
+          ;
+        # notify_push is automatically installed by the module
+      };
     };
 
     # The service above configures the domain, no need for my wrapper

From 6124d07c1b846d316e03e78a3cb65a77ce2e9832 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 17 Nov 2025 12:35:54 +0100
Subject: [PATCH 247/256] flake: bump inputs

---
 flake.lock | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index d95de52..b041409 100644
--- a/flake.lock
+++ b/flake.lock
@@ -14,11 +14,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761656077,
-        "narHash": "sha256-lsNWuj4Z+pE7s0bd2OKicOFq9bK86JE0ZGeKJbNqb94=",
+        "lastModified": 1762618334,
+        "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "9ba0d85de3eaa7afeab493fed622008b6e4924f5",
+        "rev": "fcdea223397448d35d9b31f798479227e80183f6",
         "type": "github"
       },
       "original": {
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762040540,
-        "narHash": "sha256-z5PlZ47j50VNF3R+IMS9LmzI5fYRGY/Z5O5tol1c9I4=",
+        "lastModified": 1762980239,
+        "narHash": "sha256-8oNVE8TrD19ulHinjaqONf9QWCKK+w4url56cdStMpM=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "0010412d62a25d959151790968765a70c436598b",
+        "rev": "52a2caecc898d0b46b2b905f058ccc5081f842da",
         "type": "github"
       },
       "original": {
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760663237,
-        "narHash": "sha256-BflA6U4AM1bzuRMR8QqzPXqh8sWVCNDzOdsxXEguJIc=",
+        "lastModified": 1763319842,
+        "narHash": "sha256-YG19IyrTdnVn0l3DvcUYm85u3PaqBt6tI6VvolcuHnA=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "ca5b894d3e3e151ffc1db040b6ce4dcc75d31c37",
+        "rev": "7275fa67fbbb75891c16d9dee7d88e58aea2d761",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762435363,
-        "narHash": "sha256-BTmHXtuuwVO1dRs6jPHcHCoO6+A7G3+GzrgeluiSkww=",
+        "lastModified": 1763313531,
+        "narHash": "sha256-yvdCYUL85zEDp2NzPUBmaNBXP6KnWEOhAk3j7PTfsKw=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "432bc8a5da66638b5f139588efd6c4bd327e4cdc",
+        "rev": "3670a78eee49deebe4825fc8ecc46b172d1a8391",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1762111121,
-        "narHash": "sha256-4vhDuZ7OZaZmKKrnDpxLZZpGIJvAeMtK6FKLJYUtAdw=",
+        "lastModified": 1763283776,
+        "narHash": "sha256-Y7TDFPK4GlqrKrivOcsHG8xSGqQx3A6c+i7novT85Uk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b3d51a0365f6695e7dd5cdf3e180604530ed33b4",
+        "rev": "50a96edd8d0db6cc8db57dab6bb6d6ee1f3dc49a",
         "type": "github"
       },
       "original": {
@@ -199,11 +199,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762602346,
-        "narHash": "sha256-BVzjmS25ihrfnfpfLD6gzXqMp9vP0hOyjIWkV0LP6E0=",
+        "lastModified": 1763378400,
+        "narHash": "sha256-9eZj8GNTBYnI8PQf9n8m9XbFCA/ugQ5r7sylY9DEx9M=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "fe5118da8d7e09651e0362ff130d194bc1441185",
+        "rev": "6bd477535ba71aa22d2712c8735c92812a1c74dc",
         "type": "github"
       },
       "original": {

From ad6a0bf4d3e5c5914160b2f427ef153d534b1030 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 6 Nov 2025 22:36:18 +0100
Subject: [PATCH 248/256] nixos: services: mealie: extend session timeout

---
 modules/nixos/services/mealie/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/nixos/services/mealie/default.nix b/modules/nixos/services/mealie/default.nix
index 8c02398..837bff2 100644
--- a/modules/nixos/services/mealie/default.nix
+++ b/modules/nixos/services/mealie/default.nix
@@ -32,6 +32,7 @@ in
         BASE_URL = "https://mealie.${config.networking.domain}";
         TZ = config.time.timeZone;
         ALLOw_SIGNUP = "false";
+        TOKEN_TIME = 24 * 180; # 180 days
       };
 
       # Automatic PostgreSQL provisioning

From 127e26b259624c6a57bc839abdde4f245c3099b8 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 17 Nov 2025 12:38:30 +0100
Subject: [PATCH 249/256] nixos: services: transmission: use high file limit

Seeding a lot of files means keeping them all open.

The actual limit was cargo-culted from an open issue.
---
 modules/nixos/services/transmission/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/modules/nixos/services/transmission/default.nix b/modules/nixos/services/transmission/default.nix
index ddd77d4..2ed01fd 100644
--- a/modules/nixos/services/transmission/default.nix
+++ b/modules/nixos/services/transmission/default.nix
@@ -71,10 +71,12 @@ in
       };
     };
 
-    # Transmission wants to eat *all* my RAM if left to its own devices
     systemd.services.transmission = {
       serviceConfig = {
+        # Transmission wants to eat *all* my RAM if left to its own devices
         MemoryMax = "33%";
+        # Avoid errors due to high number of open files.
+        LimitNOFILE = 1048576;
       };
     };
 

From b37bde6eaf150033149d0bbd5d924d0f9fb4b145 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 17 Nov 2025 12:45:22 +0100
Subject: [PATCH 250/256] nixos: services: transmission: use longer timeout

It looks like Transmission takes time roughly proportional with the
number of open files to stop, so let's increase the timeout slightly.
---
 modules/nixos/services/transmission/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/nixos/services/transmission/default.nix b/modules/nixos/services/transmission/default.nix
index 2ed01fd..6a7fbc7 100644
--- a/modules/nixos/services/transmission/default.nix
+++ b/modules/nixos/services/transmission/default.nix
@@ -77,6 +77,8 @@ in
         MemoryMax = "33%";
         # Avoid errors due to high number of open files.
         LimitNOFILE = 1048576;
+        # Longer stop timeout to finish all torrents
+        TimeoutStopSec = "5m";
       };
     };
 

From 29fb7c5066132e12b98a6cb7a7f9ba3c5460d8c1 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 17 Nov 2025 13:57:48 +0000
Subject: [PATCH 251/256] home: discord: use upstream module

---
 modules/home/discord/default.nix | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/modules/home/discord/default.nix b/modules/home/discord/default.nix
index bfa5d40..f9892df 100644
--- a/modules/home/discord/default.nix
+++ b/modules/home/discord/default.nix
@@ -1,8 +1,6 @@
 { config, lib, pkgs, ... }:
 let
   cfg = config.my.home.discord;
-
-  jsonFormat = pkgs.formats.json { };
 in
 {
   options.my.home.discord = with lib; {
@@ -12,14 +10,15 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    home.packages = with pkgs; [
-      cfg.package
-    ];
+    programs.discord = {
+      enable = true;
 
-    xdg.configFile."discord/settings.json".source =
-      jsonFormat.generate "discord.json" {
+      inherit (cfg) package;
+
+      settings = {
         # Do not keep me from using the app just to force an update
         SKIP_HOST_UPDATE = true;
       };
+    };
   };
 }

From 3020c6433b0056aa805cdabd8d4c30f82cfb47e4 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 30 Nov 2025 00:20:07 +0100
Subject: [PATCH 252/256] flake: bump inputs

---
 flake.lock | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index b041409..b84e16d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -53,11 +53,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1747046372,
-        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
+        "lastModified": 1761588595,
+        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
+        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
         "type": "github"
       },
       "original": {
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762980239,
-        "narHash": "sha256-8oNVE8TrD19ulHinjaqONf9QWCKK+w4url56cdStMpM=",
+        "lastModified": 1763759067,
+        "narHash": "sha256-LlLt2Jo/gMNYAwOgdRQBrsRoOz7BPRkzvNaI/fzXi2Q=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "52a2caecc898d0b46b2b905f058ccc5081f842da",
+        "rev": "2cccadc7357c0ba201788ae99c4dfa90728ef5e0",
         "type": "github"
       },
       "original": {
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763319842,
-        "narHash": "sha256-YG19IyrTdnVn0l3DvcUYm85u3PaqBt6tI6VvolcuHnA=",
+        "lastModified": 1763988335,
+        "narHash": "sha256-QlcnByMc8KBjpU37rbq5iP7Cp97HvjRP0ucfdh+M4Qc=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "7275fa67fbbb75891c16d9dee7d88e58aea2d761",
+        "rev": "50b9238891e388c9fdc6a5c49e49c42533a1b5ce",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763313531,
-        "narHash": "sha256-yvdCYUL85zEDp2NzPUBmaNBXP6KnWEOhAk3j7PTfsKw=",
+        "lastModified": 1764361670,
+        "narHash": "sha256-jgWzgpIaHbL3USIq0gihZeuy1lLf2YSfwvWEwnfAJUw=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3670a78eee49deebe4825fc8ecc46b172d1a8391",
+        "rev": "780be8ef503a28939cf9dc7996b48ffb1a3e04c6",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1763283776,
-        "narHash": "sha256-Y7TDFPK4GlqrKrivOcsHG8xSGqQx3A6c+i7novT85Uk=",
+        "lastModified": 1764242076,
+        "narHash": "sha256-sKoIWfnijJ0+9e4wRvIgm/HgE27bzwQxcEmo2J/gNpI=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "50a96edd8d0db6cc8db57dab6bb6d6ee1f3dc49a",
+        "rev": "2fad6eac6077f03fe109c4d4eb171cf96791faa4",
         "type": "github"
       },
       "original": {
@@ -199,11 +199,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763378400,
-        "narHash": "sha256-9eZj8GNTBYnI8PQf9n8m9XbFCA/ugQ5r7sylY9DEx9M=",
+        "lastModified": 1764449851,
+        "narHash": "sha256-VnodC1+3KML8MYLLnK84E6U2Fz4ioNacOeQd1pMCSTw=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "6bd477535ba71aa22d2712c8735c92812a1c74dc",
+        "rev": "b1781c0aa8935d8d1f35d228bcc7127fcebcd363",
         "type": "github"
       },
       "original": {

From f546f85037bf23f105a721132f06ab3a562d38f7 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 22 Nov 2025 23:34:06 +0100
Subject: [PATCH 253/256] hosts: nixos: porthos: secrets: sso: remove owner

Now that the service uses `LoadCredential` [1], I can make the files
root-owned.

[1]: https://github.com/NixOS/nixpkgs/pull/460305
---
 hosts/nixos/porthos/secrets/secrets.nix | 15 +++------------
 1 file changed, 3 insertions(+), 12 deletions(-)

diff --git a/hosts/nixos/porthos/secrets/secrets.nix b/hosts/nixos/porthos/secrets/secrets.nix
index b3812b4..f1842b4 100644
--- a/hosts/nixos/porthos/secrets/secrets.nix
+++ b/hosts/nixos/porthos/secrets/secrets.nix
@@ -83,18 +83,9 @@ in
   "servarr/autobrr/session-secret.age".publicKeys = all;
   "servarr/cross-seed/configuration.json.age".publicKeys = all;
 
-  "sso/auth-key.age" = {
-    owner = "nginx-sso";
-    publicKeys = all;
-  };
-  "sso/ambroisie/password-hash.age" = {
-    owner = "nginx-sso";
-    publicKeys = all;
-  };
-  "sso/ambroisie/totp-secret.age" = {
-    owner = "nginx-sso";
-    publicKeys = all;
-  };
+  "sso/auth-key.age".publicKeys = all;
+  "sso/ambroisie/password-hash.age".publicKeys = all;
+  "sso/ambroisie/totp-secret.age".publicKeys = all;
 
   "tandoor-recipes/secret-key.age".publicKeys = all;
 

From 5cd9155a5838d54c3606f6b0851e54252ea0774c Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 23 Nov 2025 17:08:35 +0100
Subject: [PATCH 254/256] nixos: services: mealie: backup state directory

Somehow forgot to do this when first writing the module.
---
 modules/nixos/services/mealie/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/modules/nixos/services/mealie/default.nix b/modules/nixos/services/mealie/default.nix
index 837bff2..f3774e1 100644
--- a/modules/nixos/services/mealie/default.nix
+++ b/modules/nixos/services/mealie/default.nix
@@ -54,6 +54,12 @@ in
       };
     };
 
+    my.services.backup = {
+      paths = [
+        "/var/lib/mealie"
+      ];
+    };
+
     services.fail2ban.jails = {
       mealie = ''
         enabled = true

From ddc6cd37adbb80960e8c99ddbb549057b64126ed Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 11 Dec 2025 21:00:17 +0100
Subject: [PATCH 255/256] flake: bump inputs

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index b84e16d..fd6173b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763988335,
-        "narHash": "sha256-QlcnByMc8KBjpU37rbq5iP7Cp97HvjRP0ucfdh+M4Qc=",
+        "lastModified": 1765464257,
+        "narHash": "sha256-dixPWKiHzh80PtD0aLuxYNQ0xP+843dfXG/yM3OzaYQ=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "50b9238891e388c9fdc6a5c49e49c42533a1b5ce",
+        "rev": "09e45f2598e1a8499c3594fe11ec2943f34fe509",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764361670,
-        "narHash": "sha256-jgWzgpIaHbL3USIq0gihZeuy1lLf2YSfwvWEwnfAJUw=",
+        "lastModified": 1765480374,
+        "narHash": "sha256-HlbvQAqLx7WqZFFQZ8nu5UUJAVlXiV/kqKbyueA8srw=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "780be8ef503a28939cf9dc7996b48ffb1a3e04c6",
+        "rev": "39cb677ed9e908e90478aa9fe5f3383dfc1a63f3",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1764242076,
-        "narHash": "sha256-sKoIWfnijJ0+9e4wRvIgm/HgE27bzwQxcEmo2J/gNpI=",
+        "lastModified": 1765186076,
+        "narHash": "sha256-hM20uyap1a0M9d344I692r+ik4gTMyj60cQWO+hAYP8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2fad6eac6077f03fe109c4d4eb171cf96791faa4",
+        "rev": "addf7cf5f383a3101ecfba091b98d0a1263dc9b8",
         "type": "github"
       },
       "original": {
@@ -199,11 +199,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764449851,
-        "narHash": "sha256-VnodC1+3KML8MYLLnK84E6U2Fz4ioNacOeQd1pMCSTw=",
+        "lastModified": 1765481746,
+        "narHash": "sha256-oWDp4EMOXvPZSC5ZVdg90K7EFgUGvxmrFAwA/1hJ/j4=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "b1781c0aa8935d8d1f35d228bcc7127fcebcd363",
+        "rev": "2b2d6d53d6a66d1be2d8620024cc61ad986bcee2",
         "type": "github"
       },
       "original": {

From bf428aaeca03be801b53396eeba5ab73fab7c297 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 2 Dec 2025 12:34:42 +0000
Subject: [PATCH 256/256] nixos: hardware: graphics: remove 'amdvlk'

It's been fully deprecated, the package was removed.
---
 modules/nixos/hardware/graphics/default.nix | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/modules/nixos/hardware/graphics/default.nix b/modules/nixos/hardware/graphics/default.nix
index 7d8b359..4b6eb37 100644
--- a/modules/nixos/hardware/graphics/default.nix
+++ b/modules/nixos/hardware/graphics/default.nix
@@ -15,8 +15,6 @@ in
 
     amd = {
       enableKernelModule = lib.my.mkDisableOption "Kernel driver module";
-
-      amdvlk = lib.mkEnableOption "Use AMDVLK instead of Mesa RADV driver";
     };
 
     intel = {
@@ -35,13 +33,6 @@ in
     (lib.mkIf (cfg.gpuFlavor == "amd") {
       hardware.amdgpu = {
         initrd.enable = cfg.amd.enableKernelModule;
-        # Vulkan
-        amdvlk = lib.mkIf cfg.amd.amdvlk {
-          enable = true;
-          support32Bit = {
-            enable = true;
-          };
-        };
       };
 
       hardware.graphics = {