Merge branch 'master' into feat/multi-host-rtx-wsl

- hm-activate failed Existing file /home/mask/.config/hypr would be clobbered, set backupFileExtension=backup to auto-rename

configuration.nix

@@ -11,6 +11,8 @@
   imports = [
     # Include the results of the hardware scan.
     ./hardware-configuration.nix
+    ./modules/mounts.nix
+    ./modules/samba.nix
   ];
 
   boot.loader.systemd-boot.enable = true;
@@ -26,62 +28,14 @@
     "net.ipv4.conf.all.proxy_arp" = 1;
     "net.ipv4.conf.ens2.proxy_arp" = 1;
   };
+
+  fonts.packages = with pkgs; [
+    fira-code
+    fira-code-symbols
+    nerd-fonts.hack
+  ];
+
   nixpkgs.config.allowUnfree = true;
-  fileSystems = {
-    "/mnt/games" = {
-      device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
-      fsType = "btrfs";
-      options = [
-        "users"
-        "compress=zstd"
-        "subvol=@games"
-        "nofail"
-      ];
-    };
-    "/mnt/photo" = {
-      device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
-      fsType = "btrfs";
-      options = [
-        "users"
-        "compress=zstd"
-        "subvol=@Pictures"
-        "nofail"
-      ];
-    };
-
-    "/mnt/media" = {
-      device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
-      fsType = "btrfs";
-      options = [
-        "users"
-        "compress=zstd"
-        "subvol=@media"
-        "nofail"
-      ];
-    };
-
-    "/mnt/winbackup" = {
-      device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
-      fsType = "btrfs";
-      options = [
-        "users"
-        "compress=zstd"
-        "subvol=@winbackup"
-        "nofail"
-      ];
-    };
-
-    "/mnt/winhdd" = {
-      device = "/dev/sdb1";
-      fsType = "ntfs";
-      options = [
-        "users"
-        "windows_names"
-        "noatime"
-        "nofail"
-      ];
-    };
-  };
 
   virtualisation.libvirtd = {
     "enable" = true;
@@ -114,6 +68,10 @@
 
   # Enable the X11 windowing system.
   services.xserver.enable = true;
+  hardware.graphics = {
+    enable = true;
+    enable32bit = true;
+  };
   services.xserver.xkb.layout = "us";
   services.xserver.xkb.options = "caps:escape";
 
@@ -223,11 +181,12 @@
 
   environment.systemPackages = with pkgs; [
     qbittorrent
+    pinentry-qt
     ddclient
     telegram-desktop
     btop
     # ungoogled-chromium
-    # opencode
+    opencode
     doas
     lan-mouse
     stylua
@@ -258,13 +217,13 @@
     wofi
     wayvnc
     pcmanfm
+    nnn
     htop
     rsync
     tmux
     git
     kitty
     python3
-    samba
     deno
     qbittorrent-nox
     sonarr
@@ -319,12 +278,18 @@
 
     '';
     virtualHosts."jellyfin.centraldogma.site:".extraConfig = ''
+      reverse_proxy /* 127.0.0.1:8096
+    '';
+    virtualHosts."jellyfin2.centraldogma.site:".extraConfig = ''
       redir /jellyfin /jellyfin/
       reverse_proxy /jellyfin/* 127.0.0.1:8096
     '';
     virtualHosts."git.centraldogma.site:".extraConfig = ''
       reverse_proxy /* 127.0.0.1:3000
     '';
+    virtualHosts."spy.centraldogma.site:".extraConfig = ''
+      reverse_proxy /* 192.168.1.78:4444
+    '';
     # virtualHosts."blog.centraldogma.dedyn.io:".extraConfig = ''
     #   root * /srv/root/
     #   file_server
@@ -334,77 +299,10 @@
   services.flaresolverr = {
     enable = true;
   };
-  services.samba = {
-    enable = true;
-    openFirewall = true;
-    settings = {
-      global = {
-        "security" = "user";
-        "workgroup" = "WORKGROUP";
-        "server string" = "smbnix";
-        "netbios name" = "smbnix";
-        #"use sendfile" = "yes";
-        #"max protocol" = "smb2";
-        # note: localhost is the ipv6 localhost ::1
-        "hosts allow" = "192.168.1.1/24 127.0.0.1 localhost";
-        "guest account" = "nobody";
-        "map to guest" = "bad user";
-      };
-
-      "games" = {
-        "path" = "/mnt/games";
-        "browseable" = "yes";
-        "read only" = "no";
-        "guest ok" = "no";
-        "create mask" = "0644";
-        "directory mask" = "0755";
-      };
-
-      "media" = {
-        "path" = "/mnt/media";
-        "browseable" = "yes";
-        "read only" = "no";
-        "guest ok" = "no";
-        "create mask" = "0644";
-        "directory mask" = "0755";
-      };
-
-      "photos" = {
-        "path" = "/mnt/photo";
-        "browseable" = "yes";
-        "read only" = "no";
-        "guest ok" = "no";
-        "create mask" = "0644";
-        "directory mask" = "0755";
-      };
-
-      "winhdd" = {
-        "path" = "/mnt/winhdd";
-        "browseable" = "yes";
-        "read only" = "no";
-        "guest ok" = "no";
-        "create mask" = "0644";
-        "directory mask" = "0755";
-      };
-
-      "winback" = {
-        "path" = "/mnt/winbackup";
-        "browseable" = "yes";
-        "read only" = "no";
-        "guest ok" = "no";
-        "create mask" = "0644";
-        "directory mask" = "0755";
-      };
-    };
-  };
-  services.samba-wsdd = {
-    enable = true;
-    openFirewall = true;
-  };
 
   services.mongodb = {
     enable = true;
-    package = pkgs.mongodb-7_0;
+    package = pkgs.mongodb-ce;
     initialRootPasswordFile = config.sops.secrets."mongodb/initial_password".path;
   };
 
@@ -464,7 +362,7 @@
     server = "dynamicdns.park-your-domain.com";
     ssl = true;
     username = "centraldogma.site";
-    domains = ["@" "www"];
+    domains = ["@" "www", "*"];
     usev4 = "webv4, webv4=ipify-ipv4";
     passwordFile = config.sops.secrets."namecheap/ddyn_password".path;
     interval = "5mins";

dotfiles/hypr/hyprland.lua

@@ -0,0 +1,363 @@
+-- This is an example Hyprland Lua config file.
+-- Refer to the wiki for more information.
+-- https://wiki.hypr.land/configuring/
+
+-- Please note not all available settings / options are set here.
+-- For a full list, see the wiki
+
+-- You can (and should!!) split this configuration into multiple files
+-- Create your files separately and then require them like this:
+-- require("myColors")
+
+------------------
+---- MONITORS ----
+------------------
+
+-- See https://wiki.hypr.land/configuring/core/monitors/
+hl.monitor({
+	output = "",
+	mode = "highrr",
+	position = "auto",
+	scale = "auto",
+})
+
+---------------------
+---- MY PROGRAMS ----
+---------------------
+
+-- Set programs that you use
+local terminal = "alacritty"
+local fileManager = "dolphin"
+local menu = "hyprlauncher"
+
+-------------------
+---- AUTOSTART ----
+-------------------
+
+-- See https://wiki.hypr.land/configuring/core/autostart/
+
+-- Autostart necessary processes (like notifications daemons, status bars, etc.)
+-- Or execute your favorite apps at launch like this:
+--
+hl.on("hyprland.start", function()
+	hl.exec_cmd("lan-mouse daemon")
+end)
+
+-------------------------------
+---- ENVIRONMENT VARIABLES ----
+-------------------------------
+
+-- See https://wiki.hypr.land/configuring/core/environment-variables/
+
+hl.env("XCURSOR_SIZE", "24")
+hl.env("HYPRCURSOR_SIZE", "24")
+
+-----------------------
+----- PERMISSIONS -----
+-----------------------
+
+-- See https://wiki.hypr.land/configuring/core/advanced-configuration/permissions/
+-- Please note permission changes here require a Hyprland restart and are not applied on-the-fly
+-- for security reasons
+
+-- hl.config({
+--   ecosystem = {
+--     enforce_permissions = true,
+--   },
+-- })
+
+-- hl.permission("/usr/(bin|local/bin)/grim", "screencopy", "allow")
+-- hl.permission("/usr/(lib|libexec|lib64)/xdg-desktop-portal-hyprland", "screencopy", "allow")
+-- hl.permission("/usr/(bin|local/bin)/hyprpm", "plugin", "allow")
+
+-----------------------
+---- LOOK AND FEEL ----
+-----------------------
+
+-- Refer to https://wiki.hypr.land/configuring/core/config-options/
+hl.config({
+	general = {
+		gaps_in = 4,
+		gaps_out = 20,
+
+		border_size = 2,
+
+		col = {
+			active_border = { colors = { "rgba(33ccffee)", "rgba(00ff99ee)" }, angle = 45 },
+			inactive_border = "rgba(595959aa)",
+		},
+
+		-- Set to true to enable resizing windows by clicking and dragging on borders and gaps
+		resize_on_border = false,
+
+		-- Please see https://wiki.hypr.land/configuring/extra/tearing/ before you turn this on
+		allow_tearing = false,
+
+		layout = "dwindle",
+	},
+
+	decoration = {
+		rounding = 10,
+		rounding_power = 2,
+
+		-- Change transparency of focused and unfocused windows
+		active_opacity = 1.0,
+		inactive_opacity = 1.0,
+
+		shadow = {
+			enabled = true,
+			range = 4,
+			render_power = 3,
+			color = 0xee1a1a1a,
+		},
+
+		blur = {
+			enabled = true,
+			size = 3,
+			passes = 1,
+			vibrancy = 0.1696,
+		},
+	},
+
+	animations = {
+		enabled = true,
+	},
+})
+
+-- Default curves and animations, see https://wiki.hypr.land/configuring/core/animations/
+hl.curve("easeOutQuint", { type = "bezier", points = { { 0.23, 1 }, { 0.32, 1 } } })
+hl.curve("easeInOutCubic", { type = "bezier", points = { { 0.65, 0.05 }, { 0.36, 1 } } })
+hl.curve("linear", { type = "bezier", points = { { 0, 0 }, { 1, 1 } } })
+hl.curve("almostLinear", { type = "bezier", points = { { 0.5, 0.5 }, { 0.75, 1 } } })
+hl.curve("quick", { type = "bezier", points = { { 0.15, 0 }, { 0.1, 1 } } })
+
+-- Default springs
+hl.curve("easy", { type = "spring", mass = 1, stiffness = 238.1191, dampening = 24.21279333 })
+
+hl.animation({ leaf = "global", enabled = true, speed = 10, bezier = "default" })
+hl.animation({ leaf = "border", enabled = true, speed = 5.39, bezier = "easeOutQuint" })
+hl.animation({ leaf = "windows", enabled = true, speed = 4.79, spring = "easy" })
+hl.animation({ leaf = "windowsIn", enabled = true, speed = 4.1, spring = "easy", style = "popin 87%" })
+hl.animation({ leaf = "windowsOut", enabled = true, speed = 1.49, bezier = "linear", style = "popin 87%" })
+hl.animation({ leaf = "fadeIn", enabled = true, speed = 1.73, bezier = "almostLinear" })
+hl.animation({ leaf = "fadeOut", enabled = true, speed = 1.46, bezier = "almostLinear" })
+hl.animation({ leaf = "fade", enabled = true, speed = 3.03, bezier = "quick" })
+hl.animation({ leaf = "layers", enabled = true, speed = 3.81, bezier = "easeOutQuint" })
+hl.animation({ leaf = "layersIn", enabled = true, speed = 4, bezier = "easeOutQuint", style = "fade" })
+hl.animation({ leaf = "layersOut", enabled = true, speed = 1.5, bezier = "linear", style = "fade" })
+hl.animation({ leaf = "fadeLayersIn", enabled = true, speed = 1.79, bezier = "almostLinear" })
+hl.animation({ leaf = "fadeLayersOut", enabled = true, speed = 1.39, bezier = "almostLinear" })
+hl.animation({ leaf = "workspaces", enabled = true, speed = 1.94, bezier = "almostLinear", style = "fade" })
+hl.animation({ leaf = "workspacesIn", enabled = true, speed = 1.21, bezier = "almostLinear", style = "fade" })
+hl.animation({ leaf = "workspacesOut", enabled = true, speed = 1.94, bezier = "almostLinear", style = "fade" })
+hl.animation({ leaf = "zoomFactor", enabled = true, speed = 7, bezier = "quick" })
+
+-- Ref https://wiki.hypr.land/configuring/core/rules/workspace-rules/
+-- "Smart gaps" / "No gaps when only"
+-- uncomment all if you wish to use that.
+-- hl.workspace_rule({ workspace = "w[tv1]", gaps_out = 0, gaps_in = 0 })
+-- hl.workspace_rule({ workspace = "f[1]",   gaps_out = 0, gaps_in = 0 })
+-- hl.window_rule({
+--     name  = "no-gaps-wtv1",
+--     match = { float = false, workspace = "w[tv1]" },
+--     border_size = 0,
+--     rounding    = 0,
+-- })
+-- hl.window_rule({
+--     name  = "no-gaps-f1",
+--     match = { float = false, workspace = "f[1]" },
+--     border_size = 0,
+--     rounding    = 0,
+-- })
+
+-- See https://wiki.hypr.land/configuring/layouts/dwindle-layout/ for more
+hl.config({
+	dwindle = {
+		preserve_split = true, -- You probably want this
+	},
+})
+
+-- See https://wiki.hypr.land/configuring/layouts/master-layout/ for more
+hl.config({
+	master = {
+		new_status = "master",
+	},
+})
+
+-- See https://wiki.hypr.land/configuring/layouts/scrolling-layout/ for more
+hl.config({
+	scrolling = {
+		fullscreen_on_one_column = true,
+	},
+})
+
+----------------
+----  MISC  ----
+----------------
+
+hl.config({
+	misc = {
+		force_default_wallpaper = -1, -- Set to 0 or 1 to disable the anime mascot wallpapers
+		disable_hyprland_logo = false, -- If true disables the random hyprland logo / anime girl background. :(
+	},
+})
+
+---------------
+---- INPUT ----
+---------------
+
+hl.config({
+	input = {
+		kb_layout = "us",
+		kb_variant = "",
+		kb_model = "",
+		kb_options = "caps:swapescape",
+		kb_rules = "",
+
+		follow_mouse = 1,
+
+		sensitivity = 0, -- -1.0 - 1.0, 0 means no modification.
+
+		touchpad = {
+			natural_scroll = false,
+		},
+	},
+})
+
+hl.gesture({
+	fingers = 3,
+	direction = "horizontal",
+	action = "workspace",
+})
+
+-- Example per-device config
+-- See https://wiki.hypr.land/configuring/core/devices/ for more
+hl.device({
+	name = "epic-mouse-v1",
+	sensitivity = -0.5,
+})
+
+---------------------
+---- KEYBINDINGS ----
+---------------------
+
+local mainMod = "SUPER" -- Sets "Windows" key as main modifier
+
+-- Example binds, see https://wiki.hypr.land/configuring/core/binds/ for more
+hl.bind(mainMod .. " + Q", hl.dsp.exec_cmd(terminal))
+local closeWindowBind = hl.bind(mainMod .. " + C", hl.dsp.window.close())
+-- closeWindowBind:set_enabled(false)
+hl.bind(
+	mainMod .. " + M",
+	hl.dsp.exec_cmd("command -v hyprshutdown >/dev/null 2>&1 && hyprshutdown || hyprctl dispatch 'hl.dsp.exit()'")
+)
+hl.bind(mainMod .. " + E", hl.dsp.exec_cmd(fileManager))
+hl.bind(mainMod .. " + V", hl.dsp.window.float({ action = "toggle" }))
+hl.bind(mainMod .. " + P", hl.dsp.window.pseudo())
+hl.bind(mainMod .. " + R", hl.dsp.exec_cmd(menu))
+hl.bind(mainMod .. " + J", hl.dsp.layout("togglesplit")) -- dwindle only
+
+-- Move focus with mainMod + arrow keys
+hl.bind(mainMod .. " + left", hl.dsp.focus({ direction = "left" }))
+hl.bind(mainMod .. " + right", hl.dsp.focus({ direction = "right" }))
+hl.bind(mainMod .. " + up", hl.dsp.focus({ direction = "up" }))
+hl.bind(mainMod .. " + down", hl.dsp.focus({ direction = "down" }))
+
+-- Switch workspaces with mainMod + [0-9]
+-- Move active window to a workspace with mainMod + SHIFT + [0-9]
+for i = 1, 10 do
+	local key = i % 10 -- 10 maps to key 0
+	hl.bind(mainMod .. " + " .. key, hl.dsp.focus({ workspace = i }))
+	hl.bind(mainMod .. " + SHIFT + " .. key, hl.dsp.window.move({ workspace = i }))
+end
+
+-- Example special workspace (scratchpad)
+hl.bind(mainMod .. " + S", hl.dsp.workspace.toggle_special("magic"))
+hl.bind(mainMod .. " + SHIFT + S", hl.dsp.window.move({ workspace = "special:magic" }))
+
+-- Scroll through existing workspaces with mainMod + scroll
+hl.bind(mainMod .. " + mouse_down", hl.dsp.focus({ workspace = "e+1" }))
+hl.bind(mainMod .. " + mouse_up", hl.dsp.focus({ workspace = "e-1" }))
+
+-- Move/resize windows with mainMod + LMB/RMB and dragging
+hl.bind(mainMod .. " + mouse:272", hl.dsp.window.drag(), { mouse = true })
+hl.bind(mainMod .. " + mouse:273", hl.dsp.window.resize(), { mouse = true })
+
+-- Laptop multimedia keys for volume and LCD brightness
+hl.bind(
+	"XF86AudioRaiseVolume",
+	hl.dsp.exec_cmd("wpctl set-volume -l 1 @DEFAULT_AUDIO_SINK@ 5%+"),
+	{ locked = true, repeating = true }
+)
+hl.bind(
+	"XF86AudioLowerVolume",
+	hl.dsp.exec_cmd("wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-"),
+	{ locked = true, repeating = true }
+)
+hl.bind(
+	"XF86AudioMute",
+	hl.dsp.exec_cmd("wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle"),
+	{ locked = true, repeating = true }
+)
+hl.bind(
+	"XF86AudioMicMute",
+	hl.dsp.exec_cmd("wpctl set-mute @DEFAULT_AUDIO_SOURCE@ toggle"),
+	{ locked = true, repeating = true }
+)
+hl.bind("XF86MonBrightnessUp", hl.dsp.exec_cmd("brightnessctl -e4 -n2 set 5%+"), { locked = true, repeating = true })
+hl.bind("XF86MonBrightnessDown", hl.dsp.exec_cmd("brightnessctl -e4 -n2 set 5%-"), { locked = true, repeating = true })
+
+-- Requires playerctl
+hl.bind("XF86AudioNext", hl.dsp.exec_cmd("playerctl next"), { locked = true })
+hl.bind("XF86AudioPause", hl.dsp.exec_cmd("playerctl play-pause"), { locked = true })
+hl.bind("XF86AudioPlay", hl.dsp.exec_cmd("playerctl play-pause"), { locked = true })
+hl.bind("XF86AudioPrev", hl.dsp.exec_cmd("playerctl previous"), { locked = true })
+
+--------------------------------
+---- WINDOWS AND WORKSPACES ----
+--------------------------------
+
+-- See https://wiki.hypr.land/configuring/core/rules/
+
+-- Example window rules that are useful
+
+local suppressMaximizeRule = hl.window_rule({
+	-- Ignore maximize requests from all apps. You'll probably like this.
+	name = "suppress-maximize-events",
+	match = { class = ".*" },
+
+	suppress_event = "maximize",
+})
+-- suppressMaximizeRule:set_enabled(false)
+
+hl.window_rule({
+	-- Fix some dragging issues with XWayland
+	name = "fix-xwayland-drags",
+	match = {
+		class = "^$",
+		title = "^$",
+		xwayland = true,
+		float = true,
+		fullscreen = false,
+		pin = false,
+	},
+
+	no_focus = true,
+})
+
+-- Layer rules also return a handle.
+-- local overlayLayerRule = hl.layer_rule({
+--     name  = "no-anim-overlay",
+--     match = { namespace = "^my-overlay$" },
+--     no_anim = true,
+-- })
+-- overlayLayerRule:set_enabled(false)
+
+-- Hyprland-run windowrule
+hl.window_rule({
+	name = "move-hyprland-run",
+	match = { class = "hyprland-run" },
+
+	move = "20 monitor_h-120",
+	float = true,
+})

dotfiles/nvim/lua/plugins/conform.lua

@@ -6,9 +6,5 @@ return {
         "alejandra",
       },
     },
-    format_on_save = {
-      timeout_ms = 1000,
-      lsp_format = "fallback",
-    },
   },
 }

flake.lock

@@ -45,6 +45,22 @@
         "type": "github"
       }
     },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "inputs": {
         "systems": "systems"
@@ -86,11 +102,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1789386765,
+        "lastModified": 1790110821,
-        "narHash": "sha256-4hyLFBhzQC7+qPMELWc7J/sbdA6ckXZxXU9CYRsGhsc=",
+        "narHash": "sha256-4vgPxAtYGryB/9SZVFMrcRKmNcOqcN3+MwRJPTVpb1o=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "87c391f49a34660de6010f35bb50fb1bf811be9f",
+        "rev": "a5768f1a46942657352e58037b7891bdcbc0741f",
         "type": "github"
       },
       "original": {
@@ -118,6 +134,28 @@
         "type": "github"
       }
     },
+    "nixos-wsl": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1789164534,
+        "narHash": "sha256-DoYGPM6QpnYBLWj9gGw6ZwAzIX+HrAVov1BoT+8Jixo=",
+        "owner": "nix-community",
+        "repo": "NixOS-WSL",
+        "rev": "72c92b11bb8289e6651c7fef29cc0a885fd6a255",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "main",
+        "repo": "NixOS-WSL",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1752480373,
@@ -136,11 +174,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1789286504,
+        "lastModified": 1790046670,
-        "narHash": "sha256-eiEK7cKZORNEvX0GeF3RtNEF/JXhgf2RqSp3230q13E=",
+        "narHash": "sha256-MYiI+CzL0tuWgRPjGsKCDHqYs2T3OzMlMQWOYWG0qso=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ef34387ddd751e1ab8857adf4676492d32eb24ec",
+        "rev": "6774f7bc253789b113a4f39285dc0fa100abeacc",
         "type": "github"
       },
       "original": {
@@ -155,6 +193,7 @@
         "alejandra": "alejandra",
         "home-manager": "home-manager",
         "lazyvim": "lazyvim",
+        "nixos-wsl": "nixos-wsl",
         "nixpkgs": "nixpkgs_2",
         "sops-nix": "sops-nix"
       }
@@ -183,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788914643,
+        "lastModified": 1789890976,
-        "narHash": "sha256-4GuMPW90JSxXWDPUB9M+1m7fYbe3H0apOd86/zBQ2Kw=",
+        "narHash": "sha256-GKwH3zpy7tartuJMG0Rv/xUsdetG1QLmTVv8UKgJLmA=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "13616fff713a9f94055c66f15687ebdc17a335df",
+        "rev": "7214124c20c1542c90deb54af50e2f53ae02711f",
         "type": "github"
       },
       "original": {

flake.nix

@@ -14,6 +14,11 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    nixos-wsl = {
+      url = "github:nix-community/NixOS-WSL/main";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     alejandra.url = "github:kamadorueda/alejandra/4.0.0";
     alejandra.inputs.nixpkgs.follows = "nixpkgs";
 
@@ -27,38 +32,51 @@
     lazyvim,
     alejandra,
     ...
-  }: {
+  }: let
-    nixosConfigurations.dogma-nixos = nixpkgs.lib.nixosSystem {
+    mkHost = {
-      system = "x86_64-linux";
+      hostname,
-
+      system ? "x86_64-linux",
-      specialArgs = {
+      extraModules ? [],
-        inherit inputs;
+      homeFile ? ./home/${hostname}.nix,
-      };
+    }:
-
+      nixpkgs.lib.nixosSystem {
-      modules = [
+        inherit system;
-        ./configuration.nix
+        specialArgs = {inherit inputs;};
+        modules =
+          [
+            ./hosts/${hostname}/default.nix
             inputs.home-manager.nixosModules.default
             {
-          environment.systemPackages = [alejandra.defaultPackage.${"x86_64-linux"}];
+              environment.systemPackages = [alejandra.defaultPackage.${system}];
             }
-
             {
               home-manager.useGlobalPkgs = true;
               home-manager.useUserPackages = true;
-
+              home-manager.backupFileExtension = "backup";
-          home-manager.extraSpecialArgs = {
+              home-manager.extraSpecialArgs = {inherit inputs;};
-            inherit inputs;
-          };
-
               home-manager.sharedModules = [
                 inputs.sops-nix.homeManagerModules.sops
               ];
-
+              home-manager.users.mask = homeFile;
-          home-manager.users.mask = ./home.nix;
             }
-
             inputs.sops-nix.nixosModules.sops
-      ];
+          ]
+          ++ extraModules;
+      };
+  in {
+    nixosConfigurations = {
+      dogma-nixos = mkHost {
+        hostname = "dogma-nixos";
+        extraModules = [./modules/nvidia-gtx1060.nix];
+      };
+      dogma-nixos-rtx = mkHost {
+        hostname = "dogma-nixos-rtx";
+        extraModules = [./modules/nvidia-rtx3070.nix];
+      };
+      dogma-wsl = mkHost {
+        hostname = "dogma-wsl";
+        extraModules = [inputs.nixos-wsl.nixosModules.default];
+      };
     };
   };
 }

home.nix

@@ -18,10 +18,10 @@
   # want to update the value, then make sure to first check the Home Manager
   # release notes.
   home.stateVersion = "25.11"; # Please read the comment before changing.
-
   # The home.packages option allows you to install Nix packages into your
   # environment.
   home.packages = with pkgs; [
+    fish
     # # It is sometimes useful to fine-tune packages, for example, by applying
     # # overrides. You can do that directly here, just don't forget the
     # # parentheses. Maybe you want to install Nerd Fonts with a limited number of
@@ -40,6 +40,8 @@
   # plain files is through 'home.file'.
   home.file = {
     ".config/nvim".source = ./dotfiles/nvim;
+    ".config/hypr".source = ./dotfiles/hypr;
+    ".config/lan-mouse".source = ./dotfiles/lan-mouse;
     # # Building this configuration will create a copy of 'dotfiles/screenrc' in
     # # the Nix store. Activating the configuration will then make '~/.screenrc' a
     # # symlink to the Nix store copy.
@@ -56,10 +58,20 @@
     shell = "${pkgs.zsh}/bin/zsh";
   };
 
+  programs.kitty = {
+    enable = true;
+    settings = {
+      font_family = "Hack Nerd Font Mono";
+      font_size = "";
+      bold_font = "auto";
+      italic_font = "auto";
+      bold_italic_font = "auto";
+    };
+  };
+
   home.shellAliases = {
-    dogma-rebuild = "sudo nixos-rebuild switch --flake ${config.home.homeDirectory}#dogma-nixos";
+    dogma-rebuild = "sudo nixos-rebuild switch --flake ${config.home.homeDirectory}/nixos/#dogma-nixos";
     cdproj = "cd ${config.home.homeDirectory}/projects/nixos-dogma";
-    working = "echo aaa";
   };
 
   # Home Manager can also manage your environment variables through

home/common.nix

@@ -0,0 +1,181 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  # Home Manager needs a bit of information about you and the paths it should
+  # manage.
+  imports = [
+  ];
+  home.username = "mask";
+  home.homeDirectory = "/home/mask";
+
+  # This value determines the Home Manager release that your configuration is
+  # compatible with. This helps avoid breakage when a new Home Manager release
+  # introduces backwards incompatible changes.
+  #
+  # You should not change this value, even if you update Home Manager. If you do
+  # want to update the value, then make sure to first check the Home Manager
+  # release notes.
+  home.stateVersion = "25.11"; # Please read the comment before changing.
+  # The home.packages option allows you to install Nix packages into your
+  # environment.
+  home.packages = with pkgs; [
+    fish
+    alacritty
+    # # It is sometimes useful to fine-tune packages, for example, by applying
+    # # overrides. You can do that directly here, just don't forget the
+    # # parentheses. Maybe you want to install Nerd Fonts with a limited number of
+    # # fonts?
+    # (pkgs.nerdfonts.override { fonts = [ "FantasqueSansMono" ]; })
+
+    # # You can also create simple shell scripts directly inside your
+    # # configuration. For example, this adds a command 'my-hello' to your
+    # # environment:
+    # (pkgs.writeShellScriptBin "my-hello" ''
+    #   echo "Hello, ${config.home.username}!"
+    # '')
+  ];
+
+  # Home Manager is pretty good at managing dotfiles. The primary way to manage
+  # plain files is through 'home.file'.
+  home.file = {
+    ".config/nvim".source = ../dotfiles/nvim;
+    ".config/hypr".source = ../dotfiles/hypr;
+    # # Building this configuration will create a copy of 'dotfiles/screenrc' in
+    # # the Nix store. Activating the configuration will then make '~/.screenrc' a
+    # # symlink to the Nix store copy.
+    # ".screenrc".source = dotfiles/screenrc;
+
+    # # You can also set the file content immediately.
+    # ".gradle/gradle.properties".text = ''
+    #   org.gradle.console=verbose
+    #   org.gradle.daemon.idletimeout=3600000
+    # '';
+  };
+  programs.alacritty = {
+    enable = true;
+  };
+  programs.tmux = {
+    enable = true;
+    shell = "${pkgs.zsh}/bin/zsh";
+  };
+
+  programs.kitty = {
+    enable = true;
+    settings = {
+      font_family = "Hack Nerd Font Mono";
+      font_size = "";
+      bold_font = "auto";
+      italic_font = "auto";
+      bold_italic_font = "auto";
+    };
+  };
+
+  home.shellAliases = {
+    dogma-rebuild = "sudo nixos-rebuild switch --flake ${config.home.homeDirectory}#$(hostname)";
+    dogma-rebuild-nixos = "sudo nixos-rebuild switch --flake ${config.home.homeDirectory}#dogma-nixos";
+    dogma-rebuild-rtx = "sudo nixos-rebuild switch --flake ${config.home.homeDirectory}#dogma-nixos-rtx";
+    dogma-rebuild-wsl = "sudo nixos-rebuild switch --flake ${config.home.homeDirectory}#dogma-wsl";
+    cdproj = "cd ${config.home.homeDirectory}/projects/nixos-dogma";
+    working = "echo aaa";
+  };
+
+  # Home Manager can also manage your environment variables through
+  # 'home.sessionVariables'. These will be explicitly sourced when using a
+  # shell provided by Home Manager. If you don't want to manage your shell
+  # through Home Manager then you have to manually source 'hm-session-vars.sh'
+  # located at either
+  #
+  #  ~/.nix-profile/etc/profile.d/hm-session-vars.sh
+  #
+  # or
+  #
+  #  ~/.local/state/nix/profiles/profile/etc/profile.d/hm-session-vars.sh
+  #
+  # or
+  #
+  #  /etc/profiles/per-user/mask/etc/profile.d/hm-session-vars.sh
+  #
+
+  home.sessionVariables = {
+    SOPS_EDITOR = "nvim";
+    EDITOR = "nvim";
+    VISUAL = "nvim";
+  };
+
+  # Let Home Manager install and manage itself.
+
+  programs.zsh = {
+    enable = true;
+    autosuggestion.enable = true;
+    syntaxHighlighting.enable = true;
+  };
+
+  sops = {
+    age.keyFile = "/home/mask/.config/sops/age/keys.txt";
+    defaultSopsFile = ../secrets/secrets.yaml;
+    secrets = {
+      "github/token" = {};
+      "github/username" = {};
+      "gitlab/token" = {};
+      "gitea/token" = {};
+      "gitea/password" = {};
+      "gitea/username" = {};
+    };
+    templates = {
+      ".git-credentials" = {
+        path = "${config.home.homeDirectory}/.git-credentials";
+        mode = "0600";
+        content = ''
+          https://${config.sops.placeholder."gitea/username"}:${config.sops.placeholder."gitea/token"}@git.centraldogma.site
+          https://${config.sops.placeholder."github/username"}:${config.sops.placeholder."github/token"}@github.com
+        '';
+      };
+    };
+  };
+
+  programs.git = {
+    enable = true;
+    settings = {
+      user = {
+        name = "Jordan Ashurst";
+        email = "ashurstdev@proton.me";
+      };
+      alias = {
+        #Add and commit
+        ac = ''!f() {git add -A && git commit "$@";}; f'';
+        cm = "commit";
+      };
+      credential.helper = "store --file=${config.sops.templates.".git-credentials".path}";
+      # credential-helper = {
+      #
+      # };
+    };
+  };
+
+  programs.neovim = {
+    enable = true;
+    defaultEditor = true;
+    viAlias = true;
+    vimAlias = true;
+
+    extraPackages = with pkgs; [
+      git
+      curl
+      ripgrep
+      fd
+      gcc
+      gnumake
+      unzip
+      wget
+      nil
+      statix
+      lazygit
+      luarocks
+      nil
+    ];
+  };
+
+  programs.home-manager.enable = true;
+}

home/dogma-nixos-rtx.nix

@@ -0,0 +1,3 @@
+{...}: {
+  imports = [./common.nix];
+}

home/dogma-nixos.nix

@@ -0,0 +1,3 @@
+{...}: {
+  imports = [./common.nix];
+}

home/dogma-wsl.nix

@@ -0,0 +1,6 @@
+{ config, lib, pkgs, ... }: {
+  imports = [./common.nix];
+
+  # Headless WSL overrides: disable GUI apps
+  programs.kitty.enable = lib.mkForce false;
+}

hosts/common/default.nix

@@ -0,0 +1,165 @@
+# Shared base for all hosts (dogma-nixos, dogma-nixos-rtx, dogma-wsl)
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  ...
+}: {
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
+
+  nixpkgs.config.allowUnfree = true;
+
+  time.timeZone = "America/Phoenix";
+  i18n.defaultLocale = "en_US.UTF-8";
+  console = {
+    font = "Lat2-Terminus16";
+    useXkbConfig = true;
+  };
+
+  sops.age.keyFile = "/var/lib/sops-nix/keys.txt";
+  sops.defaultSopsFile = ../../secrets/secrets.yaml;
+
+  sops.secrets = {
+    "factorio/service_username" = {};
+    "factorio/service_token" = {};
+    "factorio/gamepassword" = {};
+    "backblaze/apikey" = {};
+    "google/gmail" = {};
+    "caddy/acme_email" = {};
+    "dedyn/dnstoken" = {};
+    "dedyn/dnsuser" = {};
+    "github/token" = {};
+    "gitlab/token" = {};
+    "mongodb/initial_password" = {};
+    "namecheap/ddyn_password" = {
+      restartUnits = ["ddclient.service"];
+    };
+  };
+
+  programs.steam.enable = true;
+
+  sops.templates."factorio.json".content = builtins.toJSON {
+    service_username = config.sops.placeholder."factorio/service_username";
+    service_token = config.sops.placeholder."factorio/service_token";
+    gamepassword = config.sops.placeholder."factorio/gamepassword";
+  };
+  sops.templates."duplicity.env".content = builtins.toJSON {};
+
+  sops.templates."caddy.env" = {
+    owner = "root";
+    mode = "0600";
+    restartUnits = ["caddy.service"];
+    content = ''
+      ACME_EMAIL='${config.sops.placeholder."caddy/acme_email"}'
+    '';
+  };
+
+  programs.zsh.enable = true;
+  users.defaultUserShell = pkgs.zsh;
+  services.getty.autologinUser = "mask";
+  users.users.mask = {
+    isNormalUser = true;
+    shell = pkgs.zsh;
+    extraGroups = [
+      "wheel"
+      "libvirtd"
+      "media"
+      "uinput"
+    ];
+  };
+
+  networking.networkmanager.enable = true;
+
+  # Keep firewall disabled as in original configuration.nix:424
+  networking.firewall.enable = false;
+
+  programs.nix-ld = {
+    enable = true;
+    libraries = with pkgs; [
+      zlib
+      zstd
+      stdenv.cc.cc
+      curl
+      openssl
+      libssh
+      bzip2
+      libxml2
+      acl
+      libsodium
+      util-linux
+      xz
+      systemd
+    ];
+  };
+
+  environment.systemPackages = with pkgs; [
+    inotify-tools
+    opencode
+    steam
+    nnn
+    hyprlauncher
+    qbittorrent
+    pinentry-qt
+    ddclient
+    telegram-desktop
+    btop
+    doas
+    lan-mouse
+    stylua
+    gh
+    glab
+    gnupg
+    duplicity
+    wget
+    factorio-headless
+    dig
+    parted
+    tor-browser
+    jujutsu
+    caddy
+    clang
+    ansible
+    exiftool
+    gcc
+    home-manager
+    flaresolverr
+    docker-compose
+    virtio-win
+    spice
+    spice-gtk
+    OVMF
+    pigz
+    mpv
+    wofi
+    wayvnc
+    pcmanfm
+    htop
+    rsync
+    tmux
+    git
+    kitty
+    python3
+    deno
+    qbittorrent-nox
+    sonarr
+    radarr
+    jackett
+    jellyfin
+    curl
+    p7zip
+    dnsmasq
+    brave
+    keepassxc
+    sops
+    age
+    unzip
+  ];
+
+  services.openssh.enable = true;
+
+  system.stateVersion = "25.11";
+}

hosts/common/desktop.nix

@@ -0,0 +1,35 @@
+# Desktop stack for baremetal hosts (dogma-nixos, dogma-nixos-rtx)
+# Headless WSL does NOT import this.
+{pkgs, ...}: {
+  fonts.packages = with pkgs; [
+    fira-code
+    fira-code-symbols
+    nerd-fonts.hack
+  ];
+
+  services.xserver.enable = true;
+  services.xserver.xkb.layout = "us";
+  services.xserver.xkb.options = "caps:escape";
+  services.xserver.displayManager.lightdm.autoLogin.timeout = 1;
+
+  services.pipewire = {
+    enable = true;
+    pulse.enable = true;
+  };
+
+  services.sunshine = {
+    enable = true;
+    autoStart = true;
+    capSysAdmin = true;
+    openFirewall = true;
+  };
+
+  programs.hyprland.enable = true;
+
+  virtualisation.libvirtd = {
+    enable = true;
+    allowedBridges = ["br0"];
+  };
+  virtualisation.docker.enable = true;
+  programs.virt-manager.enable = true;
+}

hosts/common/server.nix

@@ -0,0 +1,135 @@
+# Server stack shared by dogma-nixos and dogma-nixos-rtx (not WSL)
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
+    "net.bridge.bridge-nf-call-iptables" = 1;
+    "net.ipv4.conf.all.forwarding" = 1;
+    "net.ipv6.conf.all.forwarding" = 1;
+    "net.ipv4.conf.all.proxy_arp" = 1;
+    "net.ipv4.conf.ens2.proxy_arp" = 1;
+  };
+
+  networking.firewall.trustedInterfaces = ["br0"];
+
+  # Bridge networking - host-specific NIC may be overridden per-host
+  networking.interfaces.enp6s0.useDHCP = false;
+  networking.interfaces.br0.useDHCP = true;
+  networking.bridges.br0.interfaces = ["enp6s0"];
+
+  services.caddy = {
+    enable = true;
+    environmentFile = config.sops.templates."caddy.env".path;
+    virtualHosts."centraldogma.site:".extraConfig = ''
+
+      root /srv/root/
+      file_server
+      encode zstd gzip
+
+      redir /jellyfin /jellyfin/
+      reverse_proxy /jellyfin/* 127.0.0.1:8096
+
+      redir /sonarr /sonarr/
+      reverse_proxy /sonarr/* 127.0.0.1:8989
+
+      redir /radarr /radarr/
+      reverse_proxy /radarr/* 127.0.0.1:7878
+
+    '';
+    virtualHosts."jellyfin.centraldogma.site:".extraConfig = ''
+      reverse_proxy /* 127.0.0.1:8096
+    '';
+    virtualHosts."jellyfin2.centraldogma.site:".extraConfig = ''
+      redir /jellyfin /jellyfin/
+      reverse_proxy /jellyfin/* 127.0.0.1:8096
+    '';
+    virtualHosts."git.centraldogma.site:".extraConfig = ''
+      reverse_proxy /* 127.0.0.1:3000
+    '';
+  };
+
+  services.flaresolverr.enable = true;
+
+  services.mongodb = {
+    enable = true;
+    package = pkgs.mongodb-ce;
+    initialRootPasswordFile = config.sops.secrets."mongodb/initial_password".path;
+  };
+  services.jackett.enable = true;
+
+  services.factorio = {
+    enable = true;
+    public = true;
+    requireUserVerification = true;
+    username = "TheMaskedMan95";
+    admins = ["TheMaskedMan95"];
+    extraSettingsFile = config.sops.templates."factorio.json".path;
+    game-name = "Realm of the Masked Men";
+    description = "No Dogs allowed";
+    saveName = "SPACExxxx";
+    openFirewall = true;
+  };
+
+  services.radarr.enable = true;
+
+  services.ddclient = {
+    enable = true;
+    protocol = "namecheap";
+    server = "dynamicdns.park-your-domain.com";
+    ssl = true;
+    username = "centraldogma.site";
+    domains = [
+      "@"
+      "www"
+      "*"
+    ];
+    usev4 = "webv4, webv4=ipify-ipv4";
+    passwordFile = config.sops.secrets."namecheap/ddyn_password".path;
+    interval = "5mins";
+  };
+
+  services.sonarr.enable = true;
+
+  services.transmission = {
+    enable = true;
+    openRPCPort = true;
+    settings = {
+      rpc-bind-address = "0.0.0.0";
+      rpc-whitelist = "127.0.0.1,192.168.1.86";
+      download-dir = "/mnt/media/Downloads";
+    };
+  };
+
+  # services.adguardhome = {
+  #   enable = true;
+  #   host = "0.0.0.0";
+  #   port = 3003;
+  #   settings = {
+  #     allowDHCP = true;
+  #     dns = {
+  #       upstream_dns = [
+  #         "9.9.9.9#dns.quad9.net"
+  #         "149.112.112.112#dns.quad9.net"
+  #       ];
+  #     };
+  #     filtering = {
+  #       protection_enabled = true;
+  #       filtering_enabled = true;
+  #       parental_enabled = true;
+  #       safe_search.enabled = false;
+  #     };
+  #     filters =
+  #       map (url: {
+  #         enabled = true;
+  #         url = url;
+  #       }) [
+  #         "https://adguardteam.github.io/HostlistsRegistry/assets/filter_9.txt"
+  #         "https://adguardteam.github.io/HostlistsRegistry/assets/filter_11.txt"
+  #       ];
+  #   };
+  # };
+}

hosts/dogma-nixos-rtx/default.nix

@@ -0,0 +1,15 @@
+{ config, lib, pkgs, ... }: {
+  imports = [
+    ./hardware-configuration.nix
+    ../common/default.nix
+    ../common/desktop.nix
+    ../common/server.nix
+  ];
+
+  networking.hostName = "dogma-nixos-rtx";
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.systemd-boot.configurationLimit = 30;
+  boot.kernelModules = ["kvm-intel"];
+}

hosts/dogma-nixos-rtx/hardware-configuration.nix

@@ -0,0 +1,55 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/8b4ceb41-bd18-4cc9-87a6-455a123d67e5";
+      fsType = "btrfs";
+      options = [ "subvol=@rootfs" ];
+    };
+
+  fileSystems."/.swapvol" =
+    { device = "/dev/disk/by-uuid/8b4ceb41-bd18-4cc9-87a6-455a123d67e5";
+      fsType = "btrfs";
+      options = [ "subvol=@swap" ];
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/9197-677B";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  fileSystems."/home" =
+    { device = "/dev/disk/by-uuid/8b4ceb41-bd18-4cc9-87a6-455a123d67e5";
+      fsType = "btrfs";
+      options = [ "subvol=@home" ];
+    };
+
+  fileSystems."/nix" =
+    { device = "/dev/disk/by-uuid/8b4ceb41-bd18-4cc9-87a6-455a123d67e5";
+      fsType = "btrfs";
+      options = [ "subvol=@nix" ];
+    };
+
+  fileSystems."/partition-root" =
+    { device = "/dev/disk/by-uuid/8b4ceb41-bd18-4cc9-87a6-455a123d67e5";
+      fsType = "btrfs";
+    };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/dogma-nixos/default.nix

@@ -0,0 +1,28 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  imports = [
+    ./hardware-configuration.nix
+    ./mounts.nix
+    ./samba.nix
+    ./network.nix
+    ../common/default.nix
+    ../common/desktop.nix
+    ../common/server.nix
+  ];
+
+  networking.hostName = "dogma-nixos";
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.systemd-boot.configurationLimit = 30;
+  boot.kernelModules = ["kvm-intel"];
+  # hardware.nvidia = {
+  #   modesetting.enable = true;
+  #   nvidiaSettings = true;
+  #   package = config.boot.kernelPackages.nvidiaPackages.legacy_580;
+  # };
+}

hosts/dogma-nixos/hardware-configuration.nix

@@ -0,0 +1,55 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/8b4ceb41-bd18-4cc9-87a6-455a123d67e5";
+      fsType = "btrfs";
+      options = [ "subvol=@rootfs" ];
+    };
+
+  fileSystems."/.swapvol" =
+    { device = "/dev/disk/by-uuid/8b4ceb41-bd18-4cc9-87a6-455a123d67e5";
+      fsType = "btrfs";
+      options = [ "subvol=@swap" ];
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/9197-677B";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  fileSystems."/home" =
+    { device = "/dev/disk/by-uuid/8b4ceb41-bd18-4cc9-87a6-455a123d67e5";
+      fsType = "btrfs";
+      options = [ "subvol=@home" ];
+    };
+
+  fileSystems."/nix" =
+    { device = "/dev/disk/by-uuid/8b4ceb41-bd18-4cc9-87a6-455a123d67e5";
+      fsType = "btrfs";
+      options = [ "subvol=@nix" ];
+    };
+
+  fileSystems."/partition-root" =
+    { device = "/dev/disk/by-uuid/8b4ceb41-bd18-4cc9-87a6-455a123d67e5";
+      fsType = "btrfs";
+    };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/dogma-nixos/mounts.nix

@@ -0,0 +1,57 @@
+{
+  fileSystems = {
+    "/mnt/games" = {
+      device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
+      fsType = "btrfs";
+      options = [
+        "users"
+        "compress=zstd"
+        "subvol=@games"
+        "nofail"
+      ];
+    };
+    "/mnt/photo" = {
+      device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
+      fsType = "btrfs";
+      options = [
+        "users"
+        "compress=zstd"
+        "subvol=@Pictures"
+        "nofail"
+      ];
+    };
+
+    "/mnt/media" = {
+      device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
+      fsType = "btrfs";
+      options = [
+        "users"
+        "compress=zstd"
+        "subvol=@media"
+        "nofail"
+      ];
+    };
+
+    "/mnt/winbackup" = {
+      device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
+      fsType = "btrfs";
+      options = [
+        "users"
+        "compress=zstd"
+        "subvol=@winbackup"
+        "nofail"
+      ];
+    };
+
+    "/mnt/winhdd" = {
+      device = "/dev/sdb1";
+      fsType = "ntfs";
+      options = [
+        "users"
+        "windows_names"
+        "noatime"
+        "nofail"
+      ];
+    };
+  };
+}

hosts/dogma-nixos/network.nix

@@ -0,0 +1 @@
+{}

hosts/dogma-nixos/samba.nix

@@ -0,0 +1,72 @@
+{pkgs, ...}: {
+  services.samba = {
+    enable = true;
+    openFirewall = true;
+    settings = {
+      global = {
+        "security" = "user";
+        "workgroup" = "WORKGROUP";
+        "server string" = "smbnix";
+        "netbios name" = "smbnix";
+        #"use sendfile" = "yes";
+        #"max protocol" = "smb2";
+        # note: localhost is the ipv6 localhost ::1
+        "hosts allow" = "192.168.1.1/24 127.0.0.1 localhost";
+        "guest account" = "nobody";
+        "map to guest" = "bad user";
+      };
+
+      "games" = {
+        "path" = "/mnt/games";
+        "browseable" = "yes";
+        "read only" = "no";
+        "guest ok" = "no";
+        "create mask" = "0644";
+        "directory mask" = "0755";
+      };
+
+      "media" = {
+        "path" = "/mnt/media";
+        "browseable" = "yes";
+        "read only" = "no";
+        "guest ok" = "no";
+        "create mask" = "0644";
+        "directory mask" = "0755";
+      };
+
+      "photos" = {
+        "path" = "/mnt/photo";
+        "browseable" = "yes";
+        "read only" = "no";
+        "guest ok" = "no";
+        "create mask" = "0644";
+        "directory mask" = "0755";
+      };
+
+      "winhdd" = {
+        "path" = "/mnt/winhdd";
+        "browseable" = "yes";
+        "read only" = "no";
+        "guest ok" = "no";
+        "create mask" = "0644";
+        "directory mask" = "0755";
+      };
+
+      "winback" = {
+        "path" = "/mnt/winbackup";
+        "browseable" = "yes";
+        "read only" = "no";
+        "guest ok" = "no";
+        "create mask" = "0644";
+        "directory mask" = "0755";
+      };
+    };
+  };
+
+  services.samba-wsdd = {
+    enable = true;
+    openFirewall = true;
+  };
+
+  environment.systemPackages = [pkgs.samba];
+}

hosts/dogma-wsl/default.nix

@@ -0,0 +1,27 @@
+{ config, lib, pkgs, ... }: {
+  imports = [
+    ../common/default.nix
+  ];
+
+  networking.hostName = "dogma-wsl";
+
+  # WSL-specific: no bootloader, no hardware-configuration.nix
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
+
+  # WSL uses nixos-wsl module injected via flake; ensure systemd is enabled
+  wsl.enable = true;
+  wsl.defaultUser = "mask";
+
+  # Headless - explicitly disable desktop/server features that may leak via common
+  # (common/default.nix is minimal, but ensure graphics/desktop stays off)
+  services.xserver.enable = lib.mkForce false;
+  programs.hyprland.enable = lib.mkForce false;
+  services.pipewire.enable = lib.mkForce false;
+  services.sunshine.enable = lib.mkForce false;
+  virtualisation.libvirtd.enable = lib.mkForce false;
+  virtualisation.docker.enable = lib.mkForce false;
+
+  # No bridged networking in WSL
+  networking.firewall.trustedInterfaces = lib.mkForce [];
+}

modules/nvidia-gtx1060.nix

@@ -0,0 +1,18 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  nixpkgs.config.allowUnfree = true;
+  hardware.graphics.enable = true;
+  hardware.nvidia = {
+    modesetting.enable = true;
+    powerManagement.enable = false;
+    powerManagement.finegrained = false;
+    open = false; # Pascal (GTX 1060) requires closed driver
+    nvidiaSettings = true;
+    package = config.boot.kernelPackages.nvidiaPackages.legacy_580;
+  };
+  services.xserver.videoDrivers = ["nvidia"];
+}

modules/nvidia-rtx3070.nix

@@ -0,0 +1,13 @@
+{ config, lib, pkgs, ... }: {
+  nixpkgs.config.allowUnfree = true;
+  hardware.graphics.enable = true;
+  hardware.nvidia = {
+    modesetting.enable = true;
+    powerManagement.enable = false;
+    powerManagement.finegrained = false;
+    open = false; # keep closed for consistency; set true for Turing+ open module if desired
+    nvidiaSettings = true;
+    package = config.boot.kernelPackages.nvidiaPackages.stable;
+  };
+  services.xserver.videoDrivers = ["nvidia"];
+}