Adding globals

- hm-activate failed Existing file /home/mask/.config/hypr would be clobbered, set backupFileExtension=backup to auto-rename

configuration.nix

@@ -11,6 +11,8 @@
   imports = [
     # Include the results of the hardware scan.
     ./hardware-configuration.nix
+    ./modules/mounts.nix
+    ./modules/samba.nix
   ];
 
   boot.loader.systemd-boot.enable = true;
@@ -26,62 +28,14 @@
     "net.ipv4.conf.all.proxy_arp" = 1;
     "net.ipv4.conf.ens2.proxy_arp" = 1;
   };
+
+  fonts.packages = with pkgs; [
+    fira-code
+    fira-code-symbols
+    nerd-fonts.hack
+  ];
+
   nixpkgs.config.allowUnfree = true;
-  fileSystems = {
-    "/mnt/games" = {
-      device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
-      fsType = "btrfs";
-      options = [
-        "users"
-        "compress=zstd"
-        "subvol=@games"
-        "nofail"
-      ];
-    };
-    "/mnt/photo" = {
-      device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
-      fsType = "btrfs";
-      options = [
-        "users"
-        "compress=zstd"
-        "subvol=@Pictures"
-        "nofail"
-      ];
-    };
-
-    "/mnt/media" = {
-      device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
-      fsType = "btrfs";
-      options = [
-        "users"
-        "compress=zstd"
-        "subvol=@media"
-        "nofail"
-      ];
-    };
-
-    "/mnt/winbackup" = {
-      device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
-      fsType = "btrfs";
-      options = [
-        "users"
-        "compress=zstd"
-        "subvol=@winbackup"
-        "nofail"
-      ];
-    };
-
-    "/mnt/winhdd" = {
-      device = "/dev/sdb1";
-      fsType = "ntfs";
-      options = [
-        "users"
-        "windows_names"
-        "noatime"
-        "nofail"
-      ];
-    };
-  };
 
   virtualisation.libvirtd = {
     "enable" = true;
@@ -114,6 +68,10 @@
 
   # Enable the X11 windowing system.
   services.xserver.enable = true;
+  hardware.graphics = {
+    enable = true;
+    enable32bit = true;
+  };
   services.xserver.xkb.layout = "us";
   services.xserver.xkb.options = "caps:escape";
 
@@ -140,6 +98,7 @@
     "dedyn/dnsuser" = {};
     "github/token" = {};
     "gitlab/token" = {};
+    "mongodb/initial_password" = {};
     "namecheap/ddyn_password" = {
       restartUnits = ["ddclient.service"];
     };
@@ -222,10 +181,11 @@
 
   environment.systemPackages = with pkgs; [
     qbittorrent
+    pinentry-qt
     ddclient
     telegram-desktop
     btop
-    ungoogled-chromium
+    # ungoogled-chromium
     opencode
     doas
     lan-mouse
@@ -257,13 +217,13 @@
     wofi
     wayvnc
     pcmanfm
+    nnn
     htop
     rsync
     tmux
     git
     kitty
     python3
-    samba
     deno
     qbittorrent-nox
     sonarr
@@ -277,6 +237,7 @@
     keepassxc
     sops
     age
+    unzip
   ];
 
   # Some programs need SUID wrappers, can be configured further or are
@@ -294,14 +255,13 @@
   services.caddy = {
     enable = true;
     environmentFile = config.sops.templates."caddy.env".path;
-    globalConfig = ''
+    # globalConfig = ''
-      acme_ca https://acme.zerossl.com/v2/DV90
+    #   acme_ca https://acme.zerossl.com/v2/DV90
-      email {$ACME_EMAIL};
+    #   email {$ACME_EMAIL};
-    '';
+    # '';
 
     #tls ${config.sops.secrets.zerossl_cert.path} ${config.sops.secrets.zerossl_private_key.path}
     virtualHosts."centraldogma.site:".extraConfig = ''
-
       root * /srv/root/
       file_server
       encode zstd gzip
@@ -314,84 +274,31 @@
 
       redir /radarr /radarr/
       reverse_proxy /radarr/* 127.0.0.1:7878
-
     '';
-
+    virtualHosts."jellyfin.centraldogma.site:".extraConfig = ''
-    virtualHosts."blog.centraldogma.dedyn.io:".extraConfig = ''
+      reverse_proxy /* 127.0.0.1:8096
-      root * /srv/root/
-      file_server
-      encode zstd gzip
     '';
+    virtualHosts."sonarr.centraldogma.site:".extraConfig = ''
+      redir /sonarr /sonarr/
+      reverse_proxy /sonarr/* 127.0.0.1:8989
+    '';
+    virtualHosts."git.centraldogma.site:".extraConfig = ''
+      reverse_proxy /* 127.0.0.1:3000
+    '';
+    # virtualHosts."blog.centraldogma.dedyn.io:".extraConfig = ''
+    #   root * /srv/root/
+    #   file_server
+    #   encode zstd gzip
+    # '';
   };
   services.flaresolverr = {
     enable = true;
   };
-  services.samba = {
+
+  services.mongodb = {
     enable = true;
-    openFirewall = true;
+    package = pkgs.mongodb-ce;
-    settings = {
+    initialRootPasswordFile = config.sops.secrets."mongodb/initial_password".path;
-      global = {
-        "security" = "user";
-        "workgroup" = "WORKGROUP";
-        "server string" = "smbnix";
-        "netbios name" = "smbnix";
-        #"use sendfile" = "yes";
-        #"max protocol" = "smb2";
-        # note: localhost is the ipv6 localhost ::1
-        "hosts allow" = "192.168.1.1/24 127.0.0.1 localhost";
-        "guest account" = "nobody";
-        "map to guest" = "bad user";
-      };
-
-      "games" = {
-        "path" = "/mnt/games";
-        "browseable" = "yes";
-        "read only" = "no";
-        "guest ok" = "no";
-        "create mask" = "0644";
-        "directory mask" = "0755";
-      };
-
-      "media" = {
-        "path" = "/mnt/media";
-        "browseable" = "yes";
-        "read only" = "no";
-        "guest ok" = "no";
-        "create mask" = "0644";
-        "directory mask" = "0755";
-      };
-
-      "photos" = {
-        "path" = "/mnt/photo";
-        "browseable" = "yes";
-        "read only" = "no";
-        "guest ok" = "no";
-        "create mask" = "0644";
-        "directory mask" = "0755";
-      };
-
-      "winhdd" = {
-        "path" = "/mnt/winhdd";
-        "browseable" = "yes";
-        "read only" = "no";
-        "guest ok" = "no";
-        "create mask" = "0644";
-        "directory mask" = "0755";
-      };
-
-      "winback" = {
-        "path" = "/mnt/winbackup";
-        "browseable" = "yes";
-        "read only" = "no";
-        "guest ok" = "no";
-        "create mask" = "0644";
-        "directory mask" = "0755";
-      };
-    };
-  };
-  services.samba-wsdd = {
-    enable = true;
-    openFirewall = true;
   };
 
   networking.interfaces.enp6s0.useDHCP = false;
@@ -450,7 +357,7 @@
     server = "dynamicdns.park-your-domain.com";
     ssl = true;
     username = "centraldogma.site";
-    domains = ["@" "www"];
+    domains = ["@" "www", "*"];
     usev4 = "webv4, webv4=ipify-ipv4";
     passwordFile = config.sops.secrets."namecheap/ddyn_password".path;
     interval = "5mins";

dotfiles/hypr/hyprland.lua

@@ -0,0 +1,363 @@
+-- This is an example Hyprland Lua config file.
+-- Refer to the wiki for more information.
+-- https://wiki.hypr.land/configuring/
+
+-- Please note not all available settings / options are set here.
+-- For a full list, see the wiki
+
+-- You can (and should!!) split this configuration into multiple files
+-- Create your files separately and then require them like this:
+-- require("myColors")
+
+------------------
+---- MONITORS ----
+------------------
+
+-- See https://wiki.hypr.land/configuring/core/monitors/
+hl.monitor({
+	output = "",
+	mode = "highrr",
+	position = "auto",
+	scale = "auto",
+})
+
+---------------------
+---- MY PROGRAMS ----
+---------------------
+
+-- Set programs that you use
+local terminal = "alacritty"
+local fileManager = "dolphin"
+local menu = "hyprlauncher"
+
+-------------------
+---- AUTOSTART ----
+-------------------
+
+-- See https://wiki.hypr.land/configuring/core/autostart/
+
+-- Autostart necessary processes (like notifications daemons, status bars, etc.)
+-- Or execute your favorite apps at launch like this:
+--
+hl.on("hyprland.start", function()
+	hl.exec_cmd("lan-mouse daemon")
+end)
+
+-------------------------------
+---- ENVIRONMENT VARIABLES ----
+-------------------------------
+
+-- See https://wiki.hypr.land/configuring/core/environment-variables/
+
+hl.env("XCURSOR_SIZE", "24")
+hl.env("HYPRCURSOR_SIZE", "24")
+
+-----------------------
+----- PERMISSIONS -----
+-----------------------
+
+-- See https://wiki.hypr.land/configuring/core/advanced-configuration/permissions/
+-- Please note permission changes here require a Hyprland restart and are not applied on-the-fly
+-- for security reasons
+
+-- hl.config({
+--   ecosystem = {
+--     enforce_permissions = true,
+--   },
+-- })
+
+-- hl.permission("/usr/(bin|local/bin)/grim", "screencopy", "allow")
+-- hl.permission("/usr/(lib|libexec|lib64)/xdg-desktop-portal-hyprland", "screencopy", "allow")
+-- hl.permission("/usr/(bin|local/bin)/hyprpm", "plugin", "allow")
+
+-----------------------
+---- LOOK AND FEEL ----
+-----------------------
+
+-- Refer to https://wiki.hypr.land/configuring/core/config-options/
+hl.config({
+	general = {
+		gaps_in = 4,
+		gaps_out = 20,
+
+		border_size = 2,
+
+		col = {
+			active_border = { colors = { "rgba(33ccffee)", "rgba(00ff99ee)" }, angle = 45 },
+			inactive_border = "rgba(595959aa)",
+		},
+
+		-- Set to true to enable resizing windows by clicking and dragging on borders and gaps
+		resize_on_border = false,
+
+		-- Please see https://wiki.hypr.land/configuring/extra/tearing/ before you turn this on
+		allow_tearing = false,
+
+		layout = "dwindle",
+	},
+
+	decoration = {
+		rounding = 10,
+		rounding_power = 2,
+
+		-- Change transparency of focused and unfocused windows
+		active_opacity = 1.0,
+		inactive_opacity = 1.0,
+
+		shadow = {
+			enabled = true,
+			range = 4,
+			render_power = 3,
+			color = 0xee1a1a1a,
+		},
+
+		blur = {
+			enabled = true,
+			size = 3,
+			passes = 1,
+			vibrancy = 0.1696,
+		},
+	},
+
+	animations = {
+		enabled = true,
+	},
+})
+
+-- Default curves and animations, see https://wiki.hypr.land/configuring/core/animations/
+hl.curve("easeOutQuint", { type = "bezier", points = { { 0.23, 1 }, { 0.32, 1 } } })
+hl.curve("easeInOutCubic", { type = "bezier", points = { { 0.65, 0.05 }, { 0.36, 1 } } })
+hl.curve("linear", { type = "bezier", points = { { 0, 0 }, { 1, 1 } } })
+hl.curve("almostLinear", { type = "bezier", points = { { 0.5, 0.5 }, { 0.75, 1 } } })
+hl.curve("quick", { type = "bezier", points = { { 0.15, 0 }, { 0.1, 1 } } })
+
+-- Default springs
+hl.curve("easy", { type = "spring", mass = 1, stiffness = 238.1191, dampening = 24.21279333 })
+
+hl.animation({ leaf = "global", enabled = true, speed = 10, bezier = "default" })
+hl.animation({ leaf = "border", enabled = true, speed = 5.39, bezier = "easeOutQuint" })
+hl.animation({ leaf = "windows", enabled = true, speed = 4.79, spring = "easy" })
+hl.animation({ leaf = "windowsIn", enabled = true, speed = 4.1, spring = "easy", style = "popin 87%" })
+hl.animation({ leaf = "windowsOut", enabled = true, speed = 1.49, bezier = "linear", style = "popin 87%" })
+hl.animation({ leaf = "fadeIn", enabled = true, speed = 1.73, bezier = "almostLinear" })
+hl.animation({ leaf = "fadeOut", enabled = true, speed = 1.46, bezier = "almostLinear" })
+hl.animation({ leaf = "fade", enabled = true, speed = 3.03, bezier = "quick" })
+hl.animation({ leaf = "layers", enabled = true, speed = 3.81, bezier = "easeOutQuint" })
+hl.animation({ leaf = "layersIn", enabled = true, speed = 4, bezier = "easeOutQuint", style = "fade" })
+hl.animation({ leaf = "layersOut", enabled = true, speed = 1.5, bezier = "linear", style = "fade" })
+hl.animation({ leaf = "fadeLayersIn", enabled = true, speed = 1.79, bezier = "almostLinear" })
+hl.animation({ leaf = "fadeLayersOut", enabled = true, speed = 1.39, bezier = "almostLinear" })
+hl.animation({ leaf = "workspaces", enabled = true, speed = 1.94, bezier = "almostLinear", style = "fade" })
+hl.animation({ leaf = "workspacesIn", enabled = true, speed = 1.21, bezier = "almostLinear", style = "fade" })
+hl.animation({ leaf = "workspacesOut", enabled = true, speed = 1.94, bezier = "almostLinear", style = "fade" })
+hl.animation({ leaf = "zoomFactor", enabled = true, speed = 7, bezier = "quick" })
+
+-- Ref https://wiki.hypr.land/configuring/core/rules/workspace-rules/
+-- "Smart gaps" / "No gaps when only"
+-- uncomment all if you wish to use that.
+-- hl.workspace_rule({ workspace = "w[tv1]", gaps_out = 0, gaps_in = 0 })
+-- hl.workspace_rule({ workspace = "f[1]",   gaps_out = 0, gaps_in = 0 })
+-- hl.window_rule({
+--     name  = "no-gaps-wtv1",
+--     match = { float = false, workspace = "w[tv1]" },
+--     border_size = 0,
+--     rounding    = 0,
+-- })
+-- hl.window_rule({
+--     name  = "no-gaps-f1",
+--     match = { float = false, workspace = "f[1]" },
+--     border_size = 0,
+--     rounding    = 0,
+-- })
+
+-- See https://wiki.hypr.land/configuring/layouts/dwindle-layout/ for more
+hl.config({
+	dwindle = {
+		preserve_split = true, -- You probably want this
+	},
+})
+
+-- See https://wiki.hypr.land/configuring/layouts/master-layout/ for more
+hl.config({
+	master = {
+		new_status = "master",
+	},
+})
+
+-- See https://wiki.hypr.land/configuring/layouts/scrolling-layout/ for more
+hl.config({
+	scrolling = {
+		fullscreen_on_one_column = true,
+	},
+})
+
+----------------
+----  MISC  ----
+----------------
+
+hl.config({
+	misc = {
+		force_default_wallpaper = -1, -- Set to 0 or 1 to disable the anime mascot wallpapers
+		disable_hyprland_logo = false, -- If true disables the random hyprland logo / anime girl background. :(
+	},
+})
+
+---------------
+---- INPUT ----
+---------------
+
+hl.config({
+	input = {
+		kb_layout = "us",
+		kb_variant = "",
+		kb_model = "",
+		kb_options = "",
+		kb_rules = "",
+
+		follow_mouse = 1,
+
+		sensitivity = 0, -- -1.0 - 1.0, 0 means no modification.
+
+		touchpad = {
+			natural_scroll = false,
+		},
+	},
+})
+
+hl.gesture({
+	fingers = 3,
+	direction = "horizontal",
+	action = "workspace",
+})
+
+-- Example per-device config
+-- See https://wiki.hypr.land/configuring/core/devices/ for more
+hl.device({
+	name = "epic-mouse-v1",
+	sensitivity = -0.5,
+})
+
+---------------------
+---- KEYBINDINGS ----
+---------------------
+
+local mainMod = "SUPER" -- Sets "Windows" key as main modifier
+
+-- Example binds, see https://wiki.hypr.land/configuring/core/binds/ for more
+hl.bind(mainMod .. " + Q", hl.dsp.exec_cmd(terminal))
+local closeWindowBind = hl.bind(mainMod .. " + C", hl.dsp.window.close())
+-- closeWindowBind:set_enabled(false)
+hl.bind(
+	mainMod .. " + M",
+	hl.dsp.exec_cmd("command -v hyprshutdown >/dev/null 2>&1 && hyprshutdown || hyprctl dispatch 'hl.dsp.exit()'")
+)
+hl.bind(mainMod .. " + E", hl.dsp.exec_cmd(fileManager))
+hl.bind(mainMod .. " + V", hl.dsp.window.float({ action = "toggle" }))
+hl.bind(mainMod .. " + P", hl.dsp.window.pseudo())
+hl.bind(mainMod .. " + R", hl.dsp.exec_cmd(menu))
+hl.bind(mainMod .. " + J", hl.dsp.layout("togglesplit")) -- dwindle only
+
+-- Move focus with mainMod + arrow keys
+hl.bind(mainMod .. " + left", hl.dsp.focus({ direction = "left" }))
+hl.bind(mainMod .. " + right", hl.dsp.focus({ direction = "right" }))
+hl.bind(mainMod .. " + up", hl.dsp.focus({ direction = "up" }))
+hl.bind(mainMod .. " + down", hl.dsp.focus({ direction = "down" }))
+
+-- Switch workspaces with mainMod + [0-9]
+-- Move active window to a workspace with mainMod + SHIFT + [0-9]
+for i = 1, 10 do
+	local key = i % 10 -- 10 maps to key 0
+	hl.bind(mainMod .. " + " .. key, hl.dsp.focus({ workspace = i }))
+	hl.bind(mainMod .. " + SHIFT + " .. key, hl.dsp.window.move({ workspace = i }))
+end
+
+-- Example special workspace (scratchpad)
+hl.bind(mainMod .. " + S", hl.dsp.workspace.toggle_special("magic"))
+hl.bind(mainMod .. " + SHIFT + S", hl.dsp.window.move({ workspace = "special:magic" }))
+
+-- Scroll through existing workspaces with mainMod + scroll
+hl.bind(mainMod .. " + mouse_down", hl.dsp.focus({ workspace = "e+1" }))
+hl.bind(mainMod .. " + mouse_up", hl.dsp.focus({ workspace = "e-1" }))
+
+-- Move/resize windows with mainMod + LMB/RMB and dragging
+hl.bind(mainMod .. " + mouse:272", hl.dsp.window.drag(), { mouse = true })
+hl.bind(mainMod .. " + mouse:273", hl.dsp.window.resize(), { mouse = true })
+
+-- Laptop multimedia keys for volume and LCD brightness
+hl.bind(
+	"XF86AudioRaiseVolume",
+	hl.dsp.exec_cmd("wpctl set-volume -l 1 @DEFAULT_AUDIO_SINK@ 5%+"),
+	{ locked = true, repeating = true }
+)
+hl.bind(
+	"XF86AudioLowerVolume",
+	hl.dsp.exec_cmd("wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-"),
+	{ locked = true, repeating = true }
+)
+hl.bind(
+	"XF86AudioMute",
+	hl.dsp.exec_cmd("wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle"),
+	{ locked = true, repeating = true }
+)
+hl.bind(
+	"XF86AudioMicMute",
+	hl.dsp.exec_cmd("wpctl set-mute @DEFAULT_AUDIO_SOURCE@ toggle"),
+	{ locked = true, repeating = true }
+)
+hl.bind("XF86MonBrightnessUp", hl.dsp.exec_cmd("brightnessctl -e4 -n2 set 5%+"), { locked = true, repeating = true })
+hl.bind("XF86MonBrightnessDown", hl.dsp.exec_cmd("brightnessctl -e4 -n2 set 5%-"), { locked = true, repeating = true })
+
+-- Requires playerctl
+hl.bind("XF86AudioNext", hl.dsp.exec_cmd("playerctl next"), { locked = true })
+hl.bind("XF86AudioPause", hl.dsp.exec_cmd("playerctl play-pause"), { locked = true })
+hl.bind("XF86AudioPlay", hl.dsp.exec_cmd("playerctl play-pause"), { locked = true })
+hl.bind("XF86AudioPrev", hl.dsp.exec_cmd("playerctl previous"), { locked = true })
+
+--------------------------------
+---- WINDOWS AND WORKSPACES ----
+--------------------------------
+
+-- See https://wiki.hypr.land/configuring/core/rules/
+
+-- Example window rules that are useful
+
+local suppressMaximizeRule = hl.window_rule({
+	-- Ignore maximize requests from all apps. You'll probably like this.
+	name = "suppress-maximize-events",
+	match = { class = ".*" },
+
+	suppress_event = "maximize",
+})
+-- suppressMaximizeRule:set_enabled(false)
+
+hl.window_rule({
+	-- Fix some dragging issues with XWayland
+	name = "fix-xwayland-drags",
+	match = {
+		class = "^$",
+		title = "^$",
+		xwayland = true,
+		float = true,
+		fullscreen = false,
+		pin = false,
+	},
+
+	no_focus = true,
+})
+
+-- Layer rules also return a handle.
+-- local overlayLayerRule = hl.layer_rule({
+--     name  = "no-anim-overlay",
+--     match = { namespace = "^my-overlay$" },
+--     no_anim = true,
+-- })
+-- overlayLayerRule:set_enabled(false)
+
+-- Hyprland-run windowrule
+hl.window_rule({
+	name = "move-hyprland-run",
+	match = { class = "hyprland-run" },
+
+	move = "20 monitor_h-120",
+	float = true,
+})

dotfiles/nvim/lua/config/lazy.lua

@@ -18,6 +18,13 @@ require("lazy").setup({
   spec = {
     -- add LazyVim and import its plugins
     { "LazyVim/LazyVim", import = "lazyvim.plugins" },
+    { import = "lazyvim.plugins.extras.lang.python" },
+    { import = "lazyvim.plugins.extras.lang.typescript" },
+    { import = "lazyvim.plugins.extras.lang.php" },
+    { import = "lazyvim.plugins.extras.lang.rust" },
+    { import = "lazyvim.plugins.extras.lang.nix" },
+    { import = "lazyvim.plugins.extras.lang.json" },
+    { import = "lazyvim.plugins.extras.lang.docker" },
     -- import/override with your plugins
     { import = "plugins" },
   },

dotfiles/nvim/lua/config/options.lua

@@ -1,3 +1,5 @@
 -- Options are automatically loaded before lazy.nvim startup
 -- Default options that are always set: https://github.com/LazyVim/LazyVim/blob/main/lua/lazyvim/config/options.lua
 -- Add any additional options here
+--
+vim.g.lazyvim_python_lsp = "basedpyright"

dotfiles/nvim/lua/plugins/conform.lua

@@ -1,14 +0,0 @@
-return {
-  "stevearc/conform.nvim",
-  opts = {
-    formatters_by_ft = {
-      nix = {
-        "alejandra",
-      },
-    },
-    format_on_save = {
-      timeout_ms = 1000,
-      lsp_format = "fallback",
-    },
-  },
-}

dotfiles/nvim/lua/plugins/lsp.lua

@@ -0,0 +1,16 @@
+return {
+  "neovim/nvim-lspconfig",
+  opts = {
+    servers = {
+      lua_ls = {
+        settings = {
+          Lua = {
+            diagnostics = {
+              globals = { "hl", "vim" },
+            },
+          },
+        },
+      },
+    },
+  },
+}

dotfiles/nvim/lua/plugins/mason-disable.lua

@@ -0,0 +1,4 @@
+return {
+  { "williamboman/mason-lspconfig", enabled = false },
+  { "williamboman/mason", enabled = false },
+}

flake.lock

@@ -23,6 +23,27 @@
         "type": "github"
       }
     },
+    "configarr": {
+      "inputs": {
+        "flake-parts": "flake-parts",
+        "nixpkgs": "nixpkgs",
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1789645849,
+        "narHash": "sha256-cK6OX+BjeT2cl7NEi+cL8qBWtPEKtfV4IZyIIUWtYII=",
+        "owner": "raydak-labs",
+        "repo": "configarr",
+        "rev": "44fef304c1abd63cc28b32bec6bcb42950a51586",
+        "type": "github"
+      },
+      "original": {
+        "owner": "raydak-labs",
+        "repo": "configarr",
+        "rev": "44fef304c1abd63cc28b32bec6bcb42950a51586",
+        "type": "github"
+      }
+    },
     "fenix": {
       "inputs": {
         "nixpkgs": [
@@ -45,9 +66,43 @@
         "type": "github"
       }
     },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib"
+      },
+      "locked": {
+        "lastModified": 1782949081,
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "inputs": {
-        "systems": "systems"
+        "systems": "systems_2"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -86,11 +141,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1789352311,
+        "lastModified": 1791227480,
-        "narHash": "sha256-E9hlcRNSRQ1vb+UicOusX/ucroGlBAz/pYhCBorLOn4=",
+        "narHash": "sha256-+lrD+sxc2RKUWXRBAcggn7uBCFeJgnV75jD/cz7gJRA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "cfcda3f99334c8459fa4cd46cce87502e0b48f0a",
+        "rev": "aa23f720d022187228bc264f759aef6b80233bcf",
         "type": "github"
       },
       "original": {
@@ -102,7 +157,7 @@
     "lazyvim": {
       "inputs": {
         "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs_2"
       },
       "locked": {
         "lastModified": 1788971242,
@@ -118,7 +173,60 @@
         "type": "github"
       }
     },
+    "nixos-wsl": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1789164534,
+        "narHash": "sha256-DoYGPM6QpnYBLWj9gGw6ZwAzIX+HrAVov1BoT+8Jixo=",
+        "owner": "nix-community",
+        "repo": "NixOS-WSL",
+        "rev": "72c92b11bb8289e6651c7fef29cc0a885fd6a255",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "main",
+        "repo": "NixOS-WSL",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
+      "locked": {
+        "lastModified": 1784783405,
+        "narHash": "sha256-4IHyyLgLBdKefkljdKod4IMn023pQiDXAWJA187cmdY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "7525d999cd850b9a488817abc89c75dc733acf17",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-lib": {
+      "locked": {
+        "lastModified": 1782614948,
+        "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
       "locked": {
         "lastModified": 1752480373,
         "narHash": "sha256-JHQbm+OcGp32wAsXTE/FLYGNpb+4GLi5oTvCxwSoBOA=",
@@ -134,13 +242,13 @@
         "type": "github"
       }
     },
-    "nixpkgs_2": {
+    "nixpkgs_3": {
       "locked": {
-        "lastModified": 1789149629,
+        "lastModified": 1791260994,
-        "narHash": "sha256-H6GwaZzZf+4npqv0tph94w9tZddSjFjmQrVsW0z78uk=",
+        "narHash": "sha256-Miqqk/ammqnTUxaoCyvtwoPeLbI1ksFyLxi/CazZpWY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "eaad089433ca2bb662274377d33df3d0e51ef28b",
+        "rev": "151fa4e8ddfdd8dd25d945ad94ed54a13de9f6e4",
         "type": "github"
       },
       "original": {
@@ -153,9 +261,11 @@
     "root": {
       "inputs": {
         "alejandra": "alejandra",
+        "configarr": "configarr",
         "home-manager": "home-manager",
         "lazyvim": "lazyvim",
-        "nixpkgs": "nixpkgs_2",
+        "nixos-wsl": "nixos-wsl",
+        "nixpkgs": "nixpkgs_3",
         "sops-nix": "sops-nix"
       }
     },
@@ -183,11 +293,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788914643,
+        "lastModified": 1791103873,
-        "narHash": "sha256-4GuMPW90JSxXWDPUB9M+1m7fYbe3H0apOd86/zBQ2Kw=",
+        "narHash": "sha256-nFxM+pKoZ8LJAEnUXARyCaOAloWgaW9kZQOSjWzKcTE=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "13616fff713a9f94055c66f15687ebdc17a335df",
+        "rev": "dcd241ba97088c22569d1573286e1b9daad340c0",
         "type": "github"
       },
       "original": {
@@ -210,6 +320,21 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -14,6 +14,15 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    nixos-wsl = {
+      url = "github:nix-community/NixOS-WSL/main";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    configarr = {
+      url = "github:raydak-labs/configarr/44fef304c1abd63cc28b32bec6bcb42950a51586";
+    };
+
     alejandra.url = "github:kamadorueda/alejandra/4.0.0";
     alejandra.inputs.nixpkgs.follows = "nixpkgs";
 
@@ -24,37 +33,58 @@
     self,
     nixpkgs,
     sops-nix,
+    configarr,
     lazyvim,
     alejandra,
     ...
-  }: {
+  }: let
-    nixosConfigurations.dogma-nixos = nixpkgs.lib.nixosSystem {
+    mkHost = {
-      system = "x86_64-linux";
+      hostname,
+      system ? "x86_64-linux",
+      extraModules ? [],
+      homeFile ? ./home/${hostname}.nix,
+    }:
+      nixpkgs.lib.nixosSystem {
+        inherit system;
+        specialArgs = {inherit inputs;};
+        modules =
+          [
+            ./hosts/${hostname}/default.nix
+            inputs.home-manager.nixosModules.default
+            {
+              environment.systemPackages = [alejandra.defaultPackage.${system}];
+            }
+            configarr.nixosModules.default
 
-      specialArgs = {
+            {
-        inherit inputs;
+              home-manager.useGlobalPkgs = true;
+              home-manager.useUserPackages = true;
+              home-manager.backupFileExtension = "backup";
+              home-manager.extraSpecialArgs = {inherit inputs;};
+              home-manager.sharedModules = [
+                inputs.sops-nix.homeManagerModules.sops
+              ];
+              home-manager.users.mask = homeFile;
+            }
+
+            inputs.sops-nix.nixosModules.sops
+          ]
+          ++ extraModules;
+      };
+  in {
+    nixosConfigurations = {
+      dogma-nixos = mkHost {
+        hostname = "dogma-nixos";
+        extraModules = [./modules/nvidia-gtx1060.nix];
+      };
+      dogma-nixos-rtx = mkHost {
+        hostname = "dogma-nixos-rtx";
+        extraModules = [./modules/nvidia-rtx3070.nix];
+      };
+      dogma-wsl = mkHost {
+        hostname = "dogma-wsl";
+        extraModules = [inputs.nixos-wsl.nixosModules.default];
       };
-
-      modules = [
-        ./configuration.nix
-        inputs.home-manager.nixosModules.default
-        {
-          environment.systemPackages = [alejandra.defaultPackage.${"x86_64-linux"}];
-        }
-
-        {
-          home-manager.useGlobalPkgs = true;
-          home-manager.useUserPackages = true;
-
-          home-manager.extraSpecialArgs = {
-            inherit inputs;
-          };
-
-          home-manager.users.mask = ./home.nix;
-        }
-
-        inputs.sops-nix.nixosModules.sops
-      ];
     };
   };
 }

home.nix

@@ -18,10 +18,10 @@
   # want to update the value, then make sure to first check the Home Manager
   # release notes.
   home.stateVersion = "25.11"; # Please read the comment before changing.
-
   # The home.packages option allows you to install Nix packages into your
   # environment.
   home.packages = with pkgs; [
+    fish
     # # It is sometimes useful to fine-tune packages, for example, by applying
     # # overrides. You can do that directly here, just don't forget the
     # # parentheses. Maybe you want to install Nerd Fonts with a limited number of
@@ -40,6 +40,8 @@
   # plain files is through 'home.file'.
   home.file = {
     ".config/nvim".source = ./dotfiles/nvim;
+    ".config/hypr".source = ./dotfiles/hypr;
+    ".config/lan-mouse".source = ./dotfiles/lan-mouse;
     # # Building this configuration will create a copy of 'dotfiles/screenrc' in
     # # the Nix store. Activating the configuration will then make '~/.screenrc' a
     # # symlink to the Nix store copy.
@@ -56,8 +58,19 @@
     shell = "${pkgs.zsh}/bin/zsh";
   };
 
+  programs.kitty = {
+    enable = true;
+    settings = {
+      font_family = "Hack Nerd Font Mono";
+      font_size = "";
+      bold_font = "auto";
+      italic_font = "auto";
+      bold_italic_font = "auto";
+    };
+  };
+
   home.shellAliases = {
-    dogma-rebuild = "sudo nixos-rebuild switch --flake ${config.home.homeDirectory}#dogma-nixos";
+    dogma-rebuild = "sudo nixos-rebuild switch --flake ${config.home.homeDirectory}/nixos/#dogma-nixos";
     cdproj = "cd ${config.home.homeDirectory}/projects/nixos-dogma";
   };
 
@@ -82,6 +95,8 @@
     SOPS_EDITOR = "nvim";
     EDITOR = "nvim";
     VISUAL = "nvim";
+    TEST = "test";
+    TEST_A = "testa";
   };
 
   # Let Home Manager install and manage itself.
@@ -92,6 +107,29 @@
     syntaxHighlighting.enable = true;
   };
 
+  sops = {
+    age.keyFile = "/home/mask/.config/sops/age/keys.txt";
+    defaultSopsFile = ./secrets/secrets.yaml;
+    secrets = {
+      "github/token" = {};
+      "github/username" = {};
+      "gitlab/token" = {};
+      "gitea/token" = {};
+      "gitea/password" = {};
+      "gitea/username" = {};
+    };
+    templates = {
+      ".git-credentials" = {
+        path = "${config.home.homeDirectory}/.git-credentials";
+        mode = "0600";
+        content = ''
+          https://${config.sops.placeholder."gitea/username"}:${config.sops.placeholder."gitea/token"}@git.centraldogma.site
+          https://${config.sops.placeholder."github/username"}:${config.sops.placeholder."github/token"}@github.com
+        '';
+      };
+    };
+  };
+
   programs.git = {
     enable = true;
     settings = {
@@ -101,8 +139,11 @@
       };
       alias = {
         #Add and commit
-        ac = "!git add $1 && git commit -m '$2'";
+        ac = "!git add $1 && git commit -m $2";
       };
+      # credential-helper = {
+      #
+      # };
     };
   };
 

home/common.nix

@@ -0,0 +1,189 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  # Home Manager needs a bit of information about you and the paths it should
+  # manage.
+  imports = [
+  ];
+  home.username = "mask";
+  home.homeDirectory = "/home/mask";
+
+  # This value determines the Home Manager release that your configuration is
+  # compatible with. This helps avoid breakage when a new Home Manager release
+  # introduces backwards incompatible changes.
+  #
+  # You should not change this value, even if you update Home Manager. If you do
+  # want to update the value, then make sure to first check the Home Manager
+  # release notes.
+  home.stateVersion = "25.11"; # Please read the comment before changing.
+  # The home.packages option allows you to install Nix packages into your
+  # environment.
+  home.packages = with pkgs; [
+    fish
+    alacritty
+    starship
+    yazi
+    # # It is sometimes useful to fine-tune packages, for example, by applying
+    # # overrides. You can do that directly here, just don't forget the
+    # # parentheses. Maybe you want to install Nerd Fonts with a limited number of
+    # # fonts?
+    # (pkgs.nerdfonts.override { fonts = [ "FantasqueSansMono" ]; })
+
+    # # You can also create simple shell scripts directly inside your
+    # # configuration. For example, this adds a command 'my-hello' to your
+    # # environment:
+    # (pkgs.writeShellScriptBin "my-hello" ''
+    #   echo "Hello, ${config.home.username}!"
+    # '')
+  ];
+
+  # Home Manager is pretty good at managing dotfiles. The primary way to manage
+  # plain files is through 'home.file'.
+  home.file = {
+    ".config/nvim".source = ../dotfiles/nvim;
+    ".config/nvim/lazy-lock.json" = {
+      text = "{}";
+      onChange = "";
+    };
+    ".config/hypr".source = ../dotfiles/hypr;
+    # # Building this configuration will create a copy of 'dotfiles/screenrc' in
+    # # the Nix store. Activating the configuration will then make '~/.screenrc' a
+    # # symlink to the Nix store copy.
+    # ".screenrc".source = dotfiles/screenrc;
+
+    # # You can also set the file content immediately.
+    # ".gradle/gradle.properties".text = ''
+    #   org.gradle.console=verbose
+    #   org.gradle.daemon.idletimeout=3600000
+    # '';
+  };
+  programs.alacritty = {
+    enable = true;
+  };
+  programs.tmux = {
+    enable = true;
+    shell = "${pkgs.zsh}/bin/zsh";
+  };
+
+  programs.kitty = {
+    enable = true;
+    settings = {
+      font_family = "Hack Nerd Font Mono";
+      font_size = "";
+      bold_font = "auto";
+      italic_font = "auto";
+      bold_italic_font = "auto";
+    };
+  };
+
+  home.shellAliases = {
+    dogma-rebuild = "sudo nixos-rebuild switch --flake ${config.home.homeDirectory}#$(hostname)";
+    dogma-rebuild-nixos = "sudo nixos-rebuild switch --flake ${config.home.homeDirectory}#dogma-nixos";
+    dogma-rebuild-rtx = "sudo nixos-rebuild switch --flake ${config.home.homeDirectory}#dogma-nixos-rtx";
+    dogma-rebuild-wsl = "sudo nixos-rebuild switch --flake ${config.home.homeDirectory}#dogma-wsl";
+    cdproj = "cd ${config.home.homeDirectory}/projects/nixos-dogma";
+  };
+
+  # Home Manager can also manage your environment variables through
+  # 'home.sessionVariables'. These will be explicitly sourced when using a
+  # shell provided by Home Manager. If you don't want to manage your shell
+  # through Home Manager then you have to manually source 'hm-session-vars.sh'
+  # located at either
+  #
+  #  ~/.nix-profile/etc/profile.d/hm-session-vars.sh
+  #
+  # or
+  #
+  #  ~/.local/state/nix/profiles/profile/etc/profile.d/hm-session-vars.sh
+  #
+  # or
+  #
+  #  /etc/profiles/per-user/mask/etc/profile.d/hm-session-vars.sh
+  #
+
+  home.sessionVariables = {
+    SOPS_EDITOR = "nvim";
+    EDITOR = "nvim";
+    VISUAL = "nvim";
+  };
+
+  # Let Home Manager install and manage itself.
+
+  programs.zsh = {
+    enable = true;
+    autosuggestion.enable = true;
+    syntaxHighlighting.enable = true;
+  };
+
+  sops = {
+    age.keyFile = "/home/mask/.config/sops/age/keys.txt";
+    defaultSopsFile = ../secrets/secrets.yaml;
+    secrets = {
+      "github/token" = {};
+      "github/username" = {};
+      "gitlab/token" = {};
+      "gitea/token" = {};
+      "gitea/password" = {};
+      "gitea/username" = {};
+    };
+    templates = {
+      ".git-credentials" = {
+        path = "${config.home.homeDirectory}/.git-credentials";
+        mode = "0600";
+        content = ''
+          https://${config.sops.placeholder."gitea/username"}:${config.sops.placeholder."gitea/token"}@git.centraldogma.site
+          https://${config.sops.placeholder."github/username"}:${config.sops.placeholder."github/token"}@github.com
+        '';
+      };
+    };
+  };
+
+  programs.git = {
+    enable = true;
+    settings = {
+      user = {
+        name = "Jordan Ashurst";
+        email = "ashurstdev@proton.me";
+      };
+      alias = {
+        #Add and commit
+        ac = ''!f() {git add -A && git commit "$@";}; f'';
+        cm = "commit";
+      };
+      credential.helper = "store --file=${config.sops.templates.".git-credentials".path}";
+      # credential-helper = {
+      #
+      # };
+    };
+  };
+
+  programs.neovim = {
+    enable = true;
+    defaultEditor = true;
+    viAlias = true;
+    vimAlias = true;
+
+    extraPackages = with pkgs; [
+      git
+      curl
+      ripgrep
+      fd
+      gcc
+      gnumake
+      unzip
+      wget
+      statix
+      lazygit
+      luarocks
+      nil
+      fzf
+      basedpyright
+      ruff
+      vtsls
+    ];
+  };
+
+  programs.home-manager.enable = true;
+}

home/dogma-nixos-rtx.nix

@@ -0,0 +1,3 @@
+{...}: {
+  imports = [./common.nix];
+}

home/dogma-nixos.nix

@@ -0,0 +1,3 @@
+{...}: {
+  imports = [./common.nix];
+}

home/dogma-wsl.nix

@@ -0,0 +1,6 @@
+{ config, lib, pkgs, ... }: {
+  imports = [./common.nix];
+
+  # Headless WSL overrides: disable GUI apps
+  programs.kitty.enable = lib.mkForce false;
+}

hosts/common/default.nix

@@ -0,0 +1,195 @@
+# Shared base for all hosts (dogma-nixos, dogma-nixos-rtx, dogma-wsl)
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  ...
+}: {
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
+
+  nixpkgs.config.allowUnfree = true;
+
+  time.timeZone = "America/Phoenix";
+  i18n.defaultLocale = "en_US.UTF-8";
+  console = {
+    font = "Lat2-Terminus16";
+    useXkbConfig = true;
+  };
+
+  sops.age.keyFile = "/var/lib/sops-nix/keys.txt";
+  sops.defaultSopsFile = ../../secrets/secrets.yaml;
+
+  sops.secrets = {
+    "factorio/service_username" = {};
+    "factorio/service_token" = {};
+    "factorio/gamepassword" = {};
+    "backblaze/apikey" = {};
+    "google/gmail" = {};
+    "caddy/acme_email" = {};
+    "dedyn/dnstoken" = {};
+    "dedyn/dnsuser" = {};
+    "github/token" = {};
+    "gitlab/token" = {};
+    "sonarr/apikey" = {};
+    "cifs/user" = {};
+    "cifs/password" = {};
+    "radarr/apikey" = {};
+    "mongodb/initial_password" = {};
+    "namecheap/ddyn_password" = {
+      restartUnits = ["ddclient.service"];
+    };
+  };
+
+  programs.steam.enable = true;
+
+  sops.templates."factorio.json".content = builtins.toJSON {
+    service_username = config.sops.placeholder."factorio/service_username";
+    service_token = config.sops.placeholder."factorio/service_token";
+    gamepassword = config.sops.placeholder."factorio/gamepassword";
+  };
+  sops.templates."duplicity.env".content = builtins.toJSON {};
+
+  sops.templates."cifs-credentials".content = ''
+    username=${config.sops.placeholder."cifs/user"};
+    password=${config.sops.placeholder."cifs/password"};
+  '';
+
+  sops.templates."caddy.env" = {
+    owner = "root";
+    mode = "0600";
+    restartUnits = ["caddy.service"];
+    content = ''
+      ACME_EMAIL='${config.sops.placeholder."caddy/acme_email"}'
+    '';
+  };
+
+  programs.zsh.enable = true;
+  users.defaultUserShell = pkgs.zsh;
+  services.getty.autologinUser = "mask";
+  users.users.mask = {
+    isNormalUser = true;
+    shell = pkgs.zsh;
+    extraGroups = [
+      "wheel"
+      "libvirtd"
+      "media"
+      "uinput"
+    ];
+  };
+
+  networking.networkmanager.enable = true;
+
+  # Keep firewall disabled as in original configuration.nix:424
+  networking.firewall.enable = false;
+
+  programs.nix-ld = {
+    enable = true;
+    libraries = with pkgs; [
+      zlib
+      zstd
+      stdenv.cc.cc
+      curl
+      SDL2
+      wayland
+      openssl
+      libssh
+      bzip2
+      libxml2
+      acl
+      libsodium
+      util-linux
+      xz
+      systemd
+    ];
+  };
+
+  environment.systemPackages = with pkgs; [
+    inotify-tools
+    uv
+    opencode
+    steam
+    nnn
+    hyprlauncher
+    qbittorrent
+    pinentry-qt
+    ddclient
+    telegram-desktop
+    btop
+    doas
+    lan-mouse
+    stylua
+    gh
+    glab
+    gnupg
+    duplicity
+    wget
+    factorio-headless
+    dig
+    parted
+    tor-browser
+    jujutsu
+    caddy
+    clang
+    ansible
+    exiftool
+    gcc
+    home-manager
+    flaresolverr
+    docker-compose
+    virtio-win
+    spice
+    spice-gtk
+    OVMF
+    pigz
+    mpv
+    wofi
+    wayvnc
+    pcmanfm
+    htop
+    rsync
+    tmux
+    git
+    kitty
+    python3
+    deno
+    qbittorrent-nox
+    sonarr
+    radarr
+    jackett
+    jellyfin
+    curl
+    p7zip
+    dnsmasq
+    brave
+    keepassxc
+    sops
+    age
+    unzip
+  ];
+
+  services.openssh.enable = true;
+
+  services.keyd = {
+    enable = true;
+    keyboards = {
+      default = {
+        ids = ["*"];
+        settings = {
+          main = {
+            # Tap for Escape, hold for Control
+            capslock = "overload(control, escape)";
+
+            # OR Tap for Escape, hold for Super/Meta:
+            # capslock = "overload(meta, escape)";
+          };
+        };
+      };
+    };
+  };
+
+  system.stateVersion = "25.11";
+}

hosts/common/desktop.nix

@@ -0,0 +1,62 @@
+# Desktop stack for baremetal hosts (dogma-nixos, dogma-nixos-rtx)
+# Headless WSL does NOT import this.
+{pkgs, ...}: {
+  fonts.packages = with pkgs; [
+    fira-code
+    fira-code-symbols
+    nerd-fonts.hack
+  ];
+
+  services.xserver.enable = true;
+  services.xserver.xkb.layout = "us";
+  services.xserver.displayManager.lightdm.autoLogin.timeout = 1;
+
+  hardware.graphics = {
+    enable = true;
+    extraPackages = [pkgs.mesa];
+  };
+
+  hardware.opengl = {
+    enable = true;
+  };
+
+  environment.sessionVariables = {
+    NIXOS_OZONE_WL = "1";
+  };
+
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    pulse.enable = true;
+    wireplumber.enable = true;
+  };
+
+  services.sunshine = {
+    enable = true;
+    autoStart = true;
+    capSysAdmin = true;
+    openFirewall = true;
+  };
+
+  programs.hyprland = {
+    enable = true;
+    xwayland.enable = true;
+  };
+  xdg.portal = {
+    enable = true;
+    extraPortals = with pkgs; [
+      xdg-desktop-portal
+      xdg-desktop-portal-gtk
+      xdg-desktop-portal-hyprland
+    ];
+  };
+
+  services.getty.autologinUser = "mask";
+
+  virtualisation.libvirtd = {
+    enable = true;
+    allowedBridges = ["br0"];
+  };
+  virtualisation.docker.enable = true;
+  programs.virt-manager.enable = true;
+}

hosts/common/server.nix

@@ -0,0 +1,222 @@
+# Server stack shared by dogma-nixos and dogma-nixos-rtx (not WSL)
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  options,
+  ...
+}: {
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
+    "net.bridge.bridge-nf-call-iptables" = 1;
+    "net.ipv4.conf.all.forwarding" = 1;
+    "net.ipv6.conf.all.forwarding" = 1;
+    "net.ipv4.conf.all.proxy_arp" = 1;
+    "net.ipv4.conf.ens2.proxy_arp" = 1;
+  };
+
+  networking.firewall.trustedInterfaces = ["br0"];
+
+  # Bridge networking - host-specific NIC may be overridden per-host
+  networking.interfaces.enp6s0.useDHCP = false;
+  networking.interfaces.br0.useDHCP = true;
+  networking.bridges.br0.interfaces = ["enp6s0"];
+
+  services.caddy = {
+    enable = true;
+    environmentFile = config.sops.templates."caddy.env".path;
+    
+    virtualHosts."centraldogma.site:".extraConfig = ''
+
+      root /srv/root/
+
+      file_server
+      encode zstd gzip
+
+      redir /radarr /radarr/
+      reverse_proxy /radarr/* 127.0.0.1:7878
+
+    '';
+    virtualHosts."http://dogma.lan:".extraConfig = ''
+      root * /srv/root/
+      file_server browse
+      encode zstd gzip
+    '';
+    virtualHosts."jellyfin.centraldogma.site:".extraConfig = ''
+      reverse_proxy /* 127.0.0.1:8096
+    '';
+
+    virtualHosts."sonarr.centraldogma.site:".extraConfig = ''
+      redir /sonarr /sonarr/
+      reverse_proxy /sonarr/* 127.0.0.1:8989
+    '';
+
+    virtualHosts."radarr.centraldogma.site:".extraConfig = ''
+      redir /radarr /radarr/
+      reverse_proxy /radarr/* 127.0.0.1:7878
+    '';
+    virtualHosts."git.centraldogma.site:".extraConfig = ''
+      reverse_proxy /* 127.0.0.1:3000
+    '';
+  };
+
+  services.flaresolverr.enable = true;
+
+  sops.templates.configarr-ev = {
+    content = ''
+      LOG_LEVEL=debug
+      LOG_STACKTRACE=true
+      CONFIGARR_ENABLE_MERGE=true
+      RADARR_API_KEY=${config.sops.placeholder."radarr/apikey"}
+      SONARR_API_KEY=${config.sops.placeholder."sonarr/apikey"}
+    '';
+    inherit (config.services.configarr) group;
+    owner = config.services.configarr.user;
+  };
+
+  services.configarr = {
+    package =
+      options.services.configarr.package.default.overrideAttrs
+      (old: {
+        pnpmDeps = old.pnpmDeps.overrideAttrs (_: {
+          outputHash = "sha256-auz4JyfHJAOF+baLfV391HgBTua4AJFfX4CtTPh+0Sw=";
+        });
+      });
+    enable = true;
+    config =
+      #yaml
+      ''
+        x-download-clients:
+          # Define an anchor for shared instance
+          qb_base: &qb_base
+            name: "qBit"
+            type: qbittorrent
+            enable: true
+            priority: 1
+            remove_completed_downloads: true
+            remove_failed_downloads: true
+            # YAML does a shallow merge, thus we must declare another anchor for the nested dictionary if we plan to override values in it
+            fields: &qb_fields
+              host: qbittorrent
+              port: 8080
+              use_ssl: false
+              username: admin
+              password: changeme
+
+          radarr:
+            radarr_instance:
+              api_key: !env RADARR_API_KEY
+              base_url: http://localhost:${toString config.services.radarr.settings.server.port}
+
+          sonarr:
+            sonarr_instance:
+              api_key: !env SONARR_API_KEY
+              base_url: http://localhost:${toString config.services.sonarr.settings.server.port}
+              download_clients:
+            data:
+              - <<: *qb_base
+                fields:
+                  <<: *qb_fields
+                  tv_category: series
+                tags: ["sonarr"]
+              # Reuse same base, override name and fields
+              - <<: *qb_base
+                name: "qBit 4K"
+                fields:
+                  <<: *qb_fields
+                  tv_category: series-4k
+                tags: ["4K"]
+            update_password: false
+            delete_unmanaged:
+              enabled: true
+              ignore: ["Manual Test Client"]
+            config:
+              enable_completed_download_handling: true
+              auto_redownload_failed: false
+
+
+      '';
+    environmentFile = config.sops.templates."configarr-ev".path;
+  };
+
+  services.mongodb = {
+    enable = true;
+    package = pkgs.mongodb-ce;
+    initialRootPasswordFile = config.sops.secrets."mongodb/initial_password".path;
+  };
+  services.jackett.enable = true;
+  services.prowlarr.enable = true;
+
+  services.factorio = {
+    enable = true;
+    public = true;
+    requireUserVerification = true;
+    username = "TheMaskedMan95";
+    admins = ["TheMaskedMan95"];
+    extraSettingsFile = config.sops.templates."factorio.json".path;
+    game-name = "Realm of the Masked Men";
+    description = "No Dogs allowed";
+    saveName = "SPACExxxx";
+    openFirewall = true;
+  };
+
+  services.radarr.enable = true;
+
+  services.ddclient = {
+    enable = true;
+    protocol = "namecheap";
+    server = "dynamicdns.park-your-domain.com";
+    ssl = true;
+    username = "centraldogma.site";
+    domains = [
+      "@"
+      "www"
+      "*"
+    ];
+    usev4 = "webv4, webv4=ipify-ipv4";
+    passwordFile = config.sops.secrets."namecheap/ddyn_password".path;
+    interval = "5mins";
+  };
+
+  services.sonarr.enable = true;
+
+  services.transmission = {
+    enable = true;
+    openRPCPort = true;
+    settings = {
+      rpc-bind-address = "0.0.0.0";
+      rpc-whitelist = "127.0.0.1,192.168.0.91";
+      download-dir = "/mnt/media/Downloads";
+    };
+  };
+
+  # services.adguardhome = {
+  #   enable = true;
+  #   host = "0.0.0.0";
+  #   port = 3003;
+  #   settings = {
+  #     allowDHCP = true;
+  #     dns = {
+  #       upstream_dns = [
+  #         "9.9.9.9#dns.quad9.net"
+  #         "149.112.112.112#dns.quad9.net"
+  #       ];
+  #     };
+  #     filtering = {
+  #       protection_enabled = true;
+  #       filtering_enabled = true;
+  #       parental_enabled = true;
+  #       safe_search.enabled = false;
+  #     };
+  #     filters =
+  #       map (url: {
+  #         enabled = true;
+  #         url = url;
+  #       }) [
+  #         "https://adguardteam.github.io/HostlistsRegistry/assets/filter_9.txt"
+  #         "https://adguardteam.github.io/HostlistsRegistry/assets/filter_11.txt"
+  #       ];
+  #   };
+  # };
+}

hosts/dogma-nixos-rtx/default.nix

@@ -0,0 +1,15 @@
+{ config, lib, pkgs, ... }: {
+  imports = [
+    ./hardware-configuration.nix
+    ../common/default.nix
+    ../common/desktop.nix
+    ../common/server.nix
+  ];
+
+  networking.hostName = "dogma-nixos-rtx";
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.systemd-boot.configurationLimit = 30;
+  boot.kernelModules = ["kvm-intel"];
+}

hosts/dogma-nixos-rtx/hardware-configuration.nix

@@ -0,0 +1,55 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/8b4ceb41-bd18-4cc9-87a6-455a123d67e5";
+      fsType = "btrfs";
+      options = [ "subvol=@rootfs" ];
+    };
+
+  fileSystems."/.swapvol" =
+    { device = "/dev/disk/by-uuid/8b4ceb41-bd18-4cc9-87a6-455a123d67e5";
+      fsType = "btrfs";
+      options = [ "subvol=@swap" ];
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/9197-677B";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  fileSystems."/home" =
+    { device = "/dev/disk/by-uuid/8b4ceb41-bd18-4cc9-87a6-455a123d67e5";
+      fsType = "btrfs";
+      options = [ "subvol=@home" ];
+    };
+
+  fileSystems."/nix" =
+    { device = "/dev/disk/by-uuid/8b4ceb41-bd18-4cc9-87a6-455a123d67e5";
+      fsType = "btrfs";
+      options = [ "subvol=@nix" ];
+    };
+
+  fileSystems."/partition-root" =
+    { device = "/dev/disk/by-uuid/8b4ceb41-bd18-4cc9-87a6-455a123d67e5";
+      fsType = "btrfs";
+    };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/dogma-nixos/default.nix

@@ -0,0 +1,28 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  imports = [
+    ./hardware-configuration.nix
+    ./mounts.nix
+    ./samba.nix
+    ./network.nix
+    ../common/default.nix
+    ../common/desktop.nix
+    ../common/server.nix
+  ];
+
+  networking.hostName = "dogma-nixos";
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.systemd-boot.configurationLimit = 30;
+  boot.kernelModules = ["kvm-intel"];
+  # hardware.nvidia = {
+  #   modesetting.enable = true;
+  #   nvidiaSettings = true;
+  #   package = config.boot.kernelPackages.nvidiaPackages.legacy_580;
+  # };
+}

hosts/dogma-nixos/hardware-configuration.nix

@@ -0,0 +1,55 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/8b4ceb41-bd18-4cc9-87a6-455a123d67e5";
+      fsType = "btrfs";
+      options = [ "subvol=@rootfs" ];
+    };
+
+  fileSystems."/.swapvol" =
+    { device = "/dev/disk/by-uuid/8b4ceb41-bd18-4cc9-87a6-455a123d67e5";
+      fsType = "btrfs";
+      options = [ "subvol=@swap" ];
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/9197-677B";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  fileSystems."/home" =
+    { device = "/dev/disk/by-uuid/8b4ceb41-bd18-4cc9-87a6-455a123d67e5";
+      fsType = "btrfs";
+      options = [ "subvol=@home" ];
+    };
+
+  fileSystems."/nix" =
+    { device = "/dev/disk/by-uuid/8b4ceb41-bd18-4cc9-87a6-455a123d67e5";
+      fsType = "btrfs";
+      options = [ "subvol=@nix" ];
+    };
+
+  fileSystems."/partition-root" =
+    { device = "/dev/disk/by-uuid/8b4ceb41-bd18-4cc9-87a6-455a123d67e5";
+      fsType = "btrfs";
+    };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/dogma-nixos/mounts.nix

@@ -0,0 +1,67 @@
+{config, ...}: {
+  fileSystems = {
+    "/mnt/games" = {
+      device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
+      fsType = "btrfs";
+      options = [
+        "users"
+        "compress=zstd"
+        "subvol=@games"
+        "nofail"
+      ];
+    };
+
+    "/mnt/photo" = {
+      device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
+      fsType = "btrfs";
+      options = [
+        "users"
+        "compress=zstd"
+        "subvol=@Pictures"
+        "nofail"
+      ];
+    };
+
+    "/mnt/media" = {
+      device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
+      fsType = "btrfs";
+      options = [
+        "users"
+        "compress=zstd"
+        "subvol=@media"
+        "nofail"
+      ];
+    };
+
+    "/mnt/winbackup" = {
+      device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
+      fsType = "btrfs";
+      options = [
+        "users"
+        "compress=zstd"
+        "subvol=@winbackup"
+        "nofail"
+      ];
+    };
+
+    # "/mnt/dogma-rtx-public" = {
+    #   device = "//192.168.0.93/Users/Public";
+    #   fsType = "cifs";
+    #   options = let
+    #     # Prevent system hangs if the network drops or the NAS is offline
+    #     automount_opts = "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
+    #   in ["${automount_opts},credentials=${config.sops.templates."cifs-credentials".path},uid=1000,gid=100" "nofail"];
+    # };
+
+    "/mnt/winhdd" = {
+      device = "/dev/sdb1";
+      fsType = "ntfs";
+      options = [
+        "users"
+        "windows_names"
+        "noatime"
+        "nofail"
+      ];
+    };
+  };
+}

hosts/dogma-nixos/network.nix

@@ -0,0 +1 @@
+{}

hosts/dogma-nixos/samba.nix

@@ -0,0 +1,76 @@
+{
+  pkgs,
+  config,
+  ...
+}: {
+  services.samba = {
+    enable = true;
+    openFirewall = true;
+    settings = {
+      global = {
+        "security" = "user";
+        "workgroup" = "WORKGROUP";
+        "server string" = "smbnix";
+        "netbios name" = "smbnix";
+        #"use sendfile" = "yes";
+        #"max protocol" = "smb2";
+        # note: localhost is the ipv6 localhost ::1
+        "hosts allow" = "192.168.0.1/24 127.0.0.1 localhost";
+        "guest account" = "nobody";
+        "map to guest" = "bad user";
+      };
+
+      "games" = {
+        "path" = "/mnt/games";
+        "browseable" = "yes";
+        "read only" = "no";
+        "guest ok" = "no";
+        "create mask" = "0644";
+        "directory mask" = "0755";
+      };
+
+      "media" = {
+        "path" = "/mnt/media";
+        "browseable" = "yes";
+        "read only" = "no";
+        "guest ok" = "no";
+        "create mask" = "0644";
+        "directory mask" = "0755";
+      };
+
+      "photos" = {
+        "path" = "/mnt/photo";
+        "browseable" = "yes";
+        "read only" = "no";
+        "guest ok" = "no";
+        "create mask" = "0644";
+        "directory mask" = "0755";
+      };
+
+      "winhdd" = {
+        "path" = "/mnt/winhdd";
+        "browseable" = "yes";
+        "read only" = "no";
+        "guest ok" = "no";
+        "create mask" = "0644";
+        "directory mask" = "0755";
+      };
+
+      "winback" = {
+        "path" = "/mnt/winbackup";
+        "browseable" = "yes";
+        "read only" = "no";
+        "guest ok" = "no";
+        "create mask" = "0644";
+        "directory mask" = "0755";
+      };
+    };
+  };
+
+  services.samba-wsdd = {
+    enable = true;
+    openFirewall = true;
+  };
+
+  environment.systemPackages = [pkgs.samba];
+}

hosts/dogma-wsl/default.nix

@@ -0,0 +1,27 @@
+{ config, lib, pkgs, ... }: {
+  imports = [
+    ../common/default.nix
+  ];
+
+  networking.hostName = "dogma-wsl";
+
+  # WSL-specific: no bootloader, no hardware-configuration.nix
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
+
+  # WSL uses nixos-wsl module injected via flake; ensure systemd is enabled
+  wsl.enable = true;
+  wsl.defaultUser = "mask";
+
+  # Headless - explicitly disable desktop/server features that may leak via common
+  # (common/default.nix is minimal, but ensure graphics/desktop stays off)
+  services.xserver.enable = lib.mkForce false;
+  programs.hyprland.enable = lib.mkForce false;
+  services.pipewire.enable = lib.mkForce false;
+  services.sunshine.enable = lib.mkForce false;
+  virtualisation.libvirtd.enable = lib.mkForce false;
+  virtualisation.docker.enable = lib.mkForce false;
+
+  # No bridged networking in WSL
+  networking.firewall.trustedInterfaces = lib.mkForce [];
+}

modules/nvidia-gtx1060.nix

@@ -0,0 +1,18 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  nixpkgs.config.allowUnfree = true;
+  hardware.graphics.enable = true;
+  hardware.nvidia = {
+    modesetting.enable = true;
+    powerManagement.enable = false;
+    powerManagement.finegrained = false;
+    open = false; # Pascal (GTX 1060) requires closed driver
+    nvidiaSettings = true;
+    package = config.boot.kernelPackages.nvidiaPackages.legacy_580;
+  };
+  services.xserver.videoDrivers = ["nvidia"];
+}

modules/nvidia-rtx3070.nix

@@ -0,0 +1,13 @@
+{ config, lib, pkgs, ... }: {
+  nixpkgs.config.allowUnfree = true;
+  hardware.graphics.enable = true;
+  hardware.nvidia = {
+    modesetting.enable = true;
+    powerManagement.enable = false;
+    powerManagement.finegrained = false;
+    open = false; # keep closed for consistency; set true for Turing+ open module if desired
+    nvidiaSettings = true;
+    package = config.boot.kernelPackages.nvidiaPackages.stable;
+  };
+  services.xserver.videoDrivers = ["nvidia"];
+}

secrets/secrets.yaml

@@ -7,10 +7,12 @@ factorio:
     service_token: ENC[AES256_GCM,data:qydcvSgSdu1G+tGF5/yS8UAxYFxhEMcL2jw1lXyR,iv:Zc4TtArTB0FAcaMcN7pU8o21jdAZdhphwIS9UsbaKpk=,tag:rfTVLNNlXKcvXvEc+c0Hrg==,type:str]
     gamepassword: ENC[AES256_GCM,data:jKfiINlNE5DITQ==,iv:+sAfRJRRgW1Gec59zV0rDue11+OD7CFhM+9Jia2oZI0=,tag:AUiQXhrFuitJyObbZI9umg==,type:str]
 github:
+    username: ENC[AES256_GCM,data:1ad/B9EnHim1vg3Vgw==,iv:c6VVRwYHNtUdERhYj4gk2Azks8iZ4SkXPLsnOyiI8g4=,tag:wLtOtbySOKYv7Aut3j6iNg==,type:str]
     token: ENC[AES256_GCM,data:ke1DF7fhotXL0Grbm1HvqeUhlJcOTFXfSH5PFBf249CUYYz49ZH5eA==,iv:j6Ahz6AsOhujf0K1TMIVdVxUneUtJmmAHimOg9Foy5g=,tag:6B/a/+CQ+qxWPRkGvjqcng==,type:str]
 duplicity:
     passphrase: ENC[AES256_GCM,data:2pja+bXmndi+bSae1B5f3rH0/ZRpIBBgIFKR9Vfgsvo2Vgd4FoI8WhVDYYRqIQ==,iv:AL2vVhM9EAdMyPhic5UV7iPZIG8X37Jtr22+v5AFP/o=,tag:HY9oaQTC2WWKUkqfUUOdlg==,type:str]
 gitlab:
+    username: ENC[AES256_GCM,data:SPDJfn7NJDJP5hQ=,iv:xLAjm+pM8sFT6tiianNDm/D8S8Of8dLxQl4y9I3vWWU=,tag:N0jXEbFFwurQLYUFfjEGxQ==,type:str]
     token: ENC[AES256_GCM,data:od35ZBgqCGZPYZDsTAndK+o5pahEWN7hTSm9FB6hvAr7IguuQvoIiBR+uc+MDe3a0QiSnhpOOaE8hwQo3u0=,iv:Wc1SbSF2G4JZIHYwakdCom1lOHUczxKYYzUjTmIsJKE=,tag:Auv6V2OdWU6rqReMzgEhbg==,type:str]
 github_token: ENC[AES256_GCM,data:G+0yjjphqXiSSi+7YrhIWaRLXJw9c0AHQnmWb3NVCpvBz0xWmXnYHw==,iv:1duT9LC0C+cZA3Xi07NxDsCQiUDv7eoL+bO60lr2tkQ=,tag:57j06/mtQH/pZAeo48al3A==,type:str]
 gitlab_token: ENC[AES256_GCM,data:Eej/KLFtxJ/zotoVlh8wuw14OLR4jInY1vK+ZOYPaa70ZZOJet5M4+in6DI8oulWZvR+a9TbPeRIFCAivSQ=,iv:YKsI/PO5ITT8XBIMo0EslraR/fzl+3I4n7JWoUuJcdg=,tag:kZ0uamAuW+Q6EUzCT1VWrQ==,type:str]
@@ -22,15 +24,25 @@ postgres:
     pgmasterpass: ENC[AES256_GCM,data:KYlzLRIV9jkbtbb8O8EiTXXYP+cPwYkV+WEse1T+grd5kPpl/xxAqAOIc44UcfQ8+FJMFpBe,iv:kWHbvoeLznuESsvKx5ADrPGGxVYVRMlRL3XUjr92+fU=,tag:dK2gii+lxVM7+Y++1eR5ZA==,type:str]
 pgmasterpass: ENC[AES256_GCM,data:s3KOZiag7h3iFYxBxXnhyYQ6ZG9jdav4uM9bQHgXdpYZW4yircOgoI1YiuciDoF1RhdOjbNh,iv:KzblpETo/wQtYUJUALAyvPRDlbuxXPiGOBhgJpVJd/8=,tag:Z5f7UhWNtn060UUm+/owqg==,type:str]
 gitea:
+    username: ENC[AES256_GCM,data:LEcU7zX0w16D,iv:4WDBdArQstkg4fRAgEFYIqKIZ1Kdyt21PrHP4pvvFqM=,tag:1t7a2bGHW6LKLeSiUmsjGA==,type:str]
+    token: ENC[AES256_GCM,data:y5Wzuti/kjK10auc3jlddoWKnudfRA1UosfKzeD8IWljauhfCUCMKw==,iv:ygFxVBm5gQjDX4oIjeWpzrLsJ/ts6Po1+n9bDf3nNHY=,tag:8BsOUvwvSNi/Zo2T2jbjAA==,type:str]
+    database: ENC[AES256_GCM,data:AiYQyrsmFVlWSYO+YFFgrCSTGTn3nl2tH+YcXlQKsLGJeNtTt1WV0/VvNuo=,iv:XZhZi183po9Mp8hAvSpti5qWec5+Rwu+UFPEUplZv0I=,tag:IFT/oP9Unwk+RE9sBLjJGg==,type:str]
     password: ENC[AES256_GCM,data:6GKcqsdLXaHVJODuuz2sZSZDn/0U1vT9NTfeuNlhwGO6MrQ9QYaOlpU3AI8=,iv:TL1EQnLXgXeenp0CqNAOajq4g66Spl1JLgPP3i4OpQc=,tag:9jPCAGR6zxKl0tzMeXWsGA==,type:str]
 caddy:
     acme_email: ENC[AES256_GCM,data:TpXEvreBkq2gqpq3OTokke/Zues=,iv:iO8jIMEzBpk5DOksQqnT87Nq8vFTG28qELvfIscOqWc=,tag:poK3Kl1bkePLetSF5DPb9A==,type:str]
 gitea_password: ENC[AES256_GCM,data:Qtp9wKXS5EwcK9vZOb8unc98Ptif6ox5xClNxKy7/rhdE0kU6sjRpMq675w=,iv:1QmjDt/89zuWAtkTqzApJ8/VW//i4h/+SlAfhguYN88=,tag:vzSA5PEjuad2QO8w1qcigA==,type:str]
+realname: ENC[AES256_GCM,data:5EtmFg2ZbM6fPwyK1X/+aF1Z4UGL,iv:a8v05Gt+eABECBxmh7quVYgDrMmDrj/3fhfGdHZPC+k=,tag:Ip9csJr85k5RQcadccn81w==,type:str]
 google:
     gmail: ENC[AES256_GCM,data:WwDdjZx5TuJcsVdasWaEw0c=,iv:3HftLdrT12DB/DyPy4g20FbYRAhNPyPrTkDlK6F5Keo=,tag:gCNJi09B7JCBHPNHy5uMVA==,type:str]
+proton:
+    email: ENC[AES256_GCM,data:H4Byh+a+PQ0TinXNcQpMMEgUTac=,iv:PWkxiPVLJn0uXI9m1Ijh266z1WAwUB7vjA7BQzueIG4=,tag:uB6t5Qi08QSkIo3lZhRA3g==,type:str]
 backblaze:
     apikey: ENC[AES256_GCM,data:WglELVuGMc4tt7Zap9W50iUk2XX/Ijz0E43P7cWMcYpEOGfI7rvqsb+Q,iv:xVv/8u0qLfxxxv7i6M65cz4gi8qO6ng2j30SY/1pnw8=,tag:FzipD8kV0D3eMrDwEsfLuA==,type:str]
 backblaze_apikey: ENC[AES256_GCM,data:q5rVZBV3GQdY6ySOBVMFOPQDJGJmtMNdNi2zyMu6jjzQx7/AaQCbZxqT,iv:Mb2qoy6j+libJoNUFSPCw2EuE8pJEaMsW2ozWCEf2Ew=,tag:CmBFEDTwKi7EDT67C8Y4/A==,type:str]
+radarr:
+    apikey: ENC[AES256_GCM,data:NINmhtjhAuQ266Z+VxY4qsjk/q2DJAecUST3XnwFDqo=,iv:+OlHR2QduPYNJQdoN3dAhNUEDr+Meaonp058tyangHM=,tag:OkAIyFuekFHqo41Fkmt2MQ==,type:str]
+sonarr:
+    apikey: ENC[AES256_GCM,data:TBxluw9aCRHAZIP+01wejCk/amqzGnafOqPuYSnwHDU=,iv:xX5J+BpxtIGUFob6vxU2/n+xK8K6hIFdGCNNip795IU=,tag:h+bfbnepRmpS252xhYyj0g==,type:str]
 steam:
     recovery: ENC[AES256_GCM,data:pmKEJTIL,iv:WvH1jj0Q7PIYzsrMgpqkvdnUFL+zdbDzG5+3N+8DuWY=,tag:B7y1mbISbNCzFaicYodsXA==,type:str]
 dedyn:
@@ -38,6 +50,11 @@ dedyn:
     dnsuser: ENC[AES256_GCM,data:P++O0d6Xu7fcylYZ,iv:MrXtbicDb+nJY4WdbyEKzyn/OeCYapa1WuclqA6+S3A=,tag:aKV2yHRw74HN9J1qHD1iVw==,type:str]
 namecheap:
     ddyn_password: ENC[AES256_GCM,data:kWYdgXnwdmAErHLpEU7CSbUYoIipv+F8rTCAxR2gAuk=,iv:4O5ngC/au+mTMXrzd+x8Jn+OB608QqE7Y4sRTDPvvCY=,tag:NxsK+LrZi6nYjRVvv+PRlQ==,type:str]
+mongodb:
+    initial_password: ENC[AES256_GCM,data:3Jih05JKK9BbKVl1qAFJFCtfX3qUpnwO01Xxi1ZlydbbyPtiT0ROVCZPUa0qN0M=,iv:TsGNGxpFIOpRaUGSYY7KO6/zvM20rTswpKIq/4QaPwg=,tag:tbA6Q6O7TI+S7uA1iRyOow==,type:str]
+cifs:
+    user: ENC[AES256_GCM,data:gLlxFg==,iv:g4OChKmju3sQZNNxRpw4zF+OmLszJBk4eUY4pE3s4Sk=,tag:HwFe6YI5SPziY+3Z95kLLw==,type:str]
+    password: ENC[AES256_GCM,data:jPOpy+wKKYVyuDjeFA==,iv:jjukqSLaJ7rynZt8Xe5SabqJ+a2CUuBlul1IGrN2z1E=,tag:0+i4GBTCWYpD3wq43xHBAQ==,type:str]
 sops:
     age:
         - enc: |
@@ -49,7 +66,7 @@ sops:
             OXJfnqQIRsiwQJFNLDjB4hNZ5r9iupVj66BAbadO3pwlHWOFt6+PaQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1xgfxwt7488dkpksgjawc53ewsc4p94jy6kdvnpd5r0jv5a5yr9tqzxy8x2
-    lastmodified: "2026-09-14T02:31:14Z"
+    lastmodified: "2026-09-29T07:40:28Z"
-    mac: ENC[AES256_GCM,data:P+9OCeLiwRCEfDcxVfK8ryFgfLy8oxR3KG02rhFmuQ2QqGKxuVQv5lHSB7QX8pzwM6+t7iAz666dk5+6Ztj48v+WruXwkV+gC1sM+NhfFmP5El0ItCozyvzu8/+pgcMFtsBoJ9DSgK8vQzAvPbKm1MjFSbLvqCuq753HsjYKiz0=,iv:oMKTX/1zXx3JgjLJEVYA7ROQYg3ueFvzj+bMdKPFq8Y=,tag:/y9zg6YtNjgqmYnydDE5gQ==,type:str]
+    mac: ENC[AES256_GCM,data:Le4QJ3G8+TkFthecp8MnngmUJUajjbsXt3WZxdbVUlt8hwAYJYDk889y8GQjvJn+dCZCf+sNMPQUwNF/CQd/GcAUN84PV8kAR+x3W+OJP2/6SrWl8Bz/asWViQvD6mj0xSeXTe3VgJM/MQwHGIV6XHBSjIOOTg6hSkwIC0fCHBU=,iv:anrJYiSw8CZ0d8M6zh1VR6u4mUl1y0wltE85WKv7uLg=,tag:KOP2ON70vmF3EBg4vICgDQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.3