scroll and center

Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>

.gitignore

@@ -1,4 +1,3 @@
-.sops.yaml
 .claude/
 old/
 docs/superpowers/

.sops.yaml

@@ -0,0 +1,17 @@
+keys:
+  - &primary age12yvtj49pfh3fqzqflscm0ek4yzrjhr6cqhn7x89gdxnlykq0xudq5c7334
+  - &work age1c8pawdsxptfslgrz2c56s39mrtnjzc5mm3hfzgr2wdwu2v6vfsdsupjsq6
+creation_rules:
+  - path_regex: hosts/laptop/secrets/secrets.yaml$
+    key_groups:
+      - age:
+        - *primary
+  - path_regex: hosts/server/secrets/secrets.yaml$
+    key_groups:
+      - age:
+        - *primary
+  - path_regex: hosts/work/secrets/secrets.yaml$
+    key_groups:
+      - age:
+        - *work
+        - *primary

README.md

@@ -33,6 +33,7 @@ _secrets_, and _custom theming_ all in one place.
 - 💻 Hyprland & TUIs: Preconfigured Hyprland ecosystem with a lot of cool TUIs
 - 🎨 Consistent Theming: Base16 & Stylix-powered themes
 - ⌨️ Vim-like Everywhere: Unified keybindings (Hyprland, nvim, vimium, etc.)
+- 🔒 Hardened by Default: LUKS encryption, sops-nix secrets, impermanence and more
 
 ## Table of Content
 

flake.lock

@@ -1,23 +1,5 @@
 {
   "nodes": {
-    "awesome-wallpapers": {
-      "inputs": {
-        "nixpkgs": "nixpkgs"
-      },
-      "locked": {
-        "lastModified": 1781031430,
-        "narHash": "sha256-AcJTjMpnffSJ6bpTDEaGcJ/31rOOYDgGr/2L2yH7H0Y=",
-        "owner": "anotherhadi",
-        "repo": "awesome-wallpapers",
-        "rev": "0147e19341039fd3b01d36c3cbaa9571105fb777",
-        "type": "github"
-      },
-      "original": {
-        "owner": "anotherhadi",
-        "repo": "awesome-wallpapers",
-        "type": "github"
-      }
-    },
     "base16": {
       "inputs": {
         "fromYaml": "fromYaml"
@@ -89,7 +71,7 @@
     "blog": {
       "inputs": {
         "bun2nix": "bun2nix",
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs"
       },
       "locked": {
         "lastModified": 1780522780,
@@ -155,50 +137,10 @@
         "type": "github"
       }
     },
-    "bun2nix_3": {
-      "inputs": {
-        "flake-parts": "flake-parts_3",
-        "import-tree": "import-tree_3",
-        "nixpkgs": [
-          "iknowyou",
-          "nixpkgs"
-        ],
-        "systems": "systems_3",
-        "treefmt-nix": "treefmt-nix_3"
-      },
-      "locked": {
-        "lastModified": 1770895533,
-        "narHash": "sha256-v3QaK9ugy9bN9RXDnjw0i2OifKmz2NnKM82agtqm/UY=",
-        "owner": "nix-community",
-        "repo": "bun2nix",
-        "rev": "c843f477b15f51151f8c6bcc886954699440a6e1",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "bun2nix",
-        "type": "github"
-      }
-    },
-    "crane": {
-      "locked": {
-        "lastModified": 1780532242,
-        "narHash": "sha256-D+BsdpxmtUwtqGoY0IXPhHgTlmqgcZKCEo1oMyn7ep0=",
-        "owner": "ipetkov",
-        "repo": "crane",
-        "rev": "59a82a1222dd3b2080b5cc52a1a2e8d5f1b77f37",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ipetkov",
-        "repo": "crane",
-        "type": "github"
-      }
-    },
     "default-creds": {
       "inputs": {
         "bun2nix": "bun2nix_2",
-        "nixpkgs": "nixpkgs_3"
+        "nixpkgs": "nixpkgs_2"
       },
       "locked": {
         "lastModified": 1780323652,
@@ -214,6 +156,26 @@
         "type": "github"
       }
     },
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1781152676,
+        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
@@ -299,24 +261,6 @@
       }
     },
     "flake-parts_3": {
-      "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib_3"
-      },
-      "locked": {
-        "lastModified": 1769996383,
-        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-parts_4": {
       "inputs": {
         "nixpkgs-lib": [
           "nur",
@@ -337,28 +281,7 @@
         "type": "github"
       }
     },
-    "flake-parts_5": {
+    "flake-parts_4": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "nvf",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1778716662,
-        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-parts_6": {
       "inputs": {
         "nixpkgs-lib": [
           "stylix",
@@ -440,11 +363,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781783441,
+        "lastModified": 1787301512,
-        "narHash": "sha256-v7rAVyX0DGAYqei3FxWPDJLqrzJrEsue2DVBEDApxQo=",
+        "narHash": "sha256-VYbNaWAcwK9G+mq3jmqyCu6t4zUNUOTT8PXB3pj7XgA=",
         "owner": "oxcl",
         "repo": "nix-flake-helium-browser",
-        "rev": "aabc12cf6518480d83b2b5d06d2eecf86a25273f",
+        "rev": "4fe9ac832466143224203f896a3a38aa8c73b611",
         "type": "github"
       },
       "original": {
@@ -460,11 +383,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785119570,
+        "lastModified": 1787146702,
-        "narHash": "sha256-Rgs2xKnGLFWQscxUaXX07oyZeuMDOHEbqDOsgliLFGM=",
+        "narHash": "sha256-YbRcLdU/yK4gWsQg7V8WTKZHfXL33g8+wSFUX3wyevs=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "d4fd24667c8cbef124bb70a20380cab75ec8474d",
+        "rev": "173b7e8d40fdc8c296a9c99854314f17a3a1704c",
         "type": "github"
       },
       "original": {
@@ -474,23 +397,43 @@
         "type": "github"
       }
     },
-    "iknowyou": {
+    "home-manager_2": {
       "inputs": {
-        "bun2nix": "bun2nix_3",
+        "nixpkgs": [
-        "nixpkgs": "nixpkgs_4",
+          "impermanence",
-        "nur-osint": "nur-osint"
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1779949739,
+        "lastModified": 1768598210,
-        "narHash": "sha256-axo7EprQSm8yYL4P6Ye9EZGEz/bdh8HHkmBlRIQzzvM=",
+        "narHash": "sha256-kkgA32s/f4jaa4UG+2f8C225Qvclxnqs76mf8zvTVPg=",
-        "owner": "anotherhadi",
+        "owner": "nix-community",
-        "repo": "iknowyou",
+        "repo": "home-manager",
-        "rev": "bb778b43747b7e703e2c311a898198c4a89ac12a",
+        "rev": "c47b2cc64a629f8e075de52e4742de688f930dc6",
         "type": "github"
       },
       "original": {
-        "owner": "anotherhadi",
+        "owner": "nix-community",
-        "repo": "iknowyou",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "impermanence": {
+      "inputs": {
+        "home-manager": "home-manager_2",
+        "nixpkgs": "nixpkgs_3"
+      },
+      "locked": {
+        "lastModified": 1769548169,
+        "narHash": "sha256-03+JxvzmfwRu+5JafM0DLbxgHttOQZkUtDWBmeUkN8Y=",
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "rev": "7b1d382faf603b6d264f58627330f9faa5cba149",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "impermanence",
         "type": "github"
       }
     },
@@ -524,21 +467,6 @@
         "type": "github"
       }
     },
-    "import-tree_3": {
-      "locked": {
-        "lastModified": 1763762820,
-        "narHash": "sha256-ZvYKbFib3AEwiNMLsejb/CWs/OL/srFQ8AogkebEPF0=",
-        "owner": "vic",
-        "repo": "import-tree",
-        "rev": "3c23749d8013ec6daa1d7255057590e9ca726646",
-        "type": "github"
-      },
-      "original": {
-        "owner": "vic",
-        "repo": "import-tree",
-        "type": "github"
-      }
-    },
     "mnw": {
       "locked": {
         "lastModified": 1780772958,
@@ -561,11 +489,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782030356,
+        "lastModified": 1786852476,
-        "narHash": "sha256-h4WpMr455AfRub0FXBaon6Vcpe0waUyJ4GivIW6oyd4=",
+        "narHash": "sha256-IM5CYtf86W4w8eUPpKcY/LpdHElmVBtJhaKnoTKxZEA=",
         "owner": "nix-community",
         "repo": "nix-index-database",
-        "rev": "3017088b49efd404f78e3b104f553b97e4af786b",
+        "rev": "c7962dc97b45129df8d751bedaf37beb5a17706e",
         "type": "github"
       },
       "original": {
@@ -576,35 +504,35 @@
     },
     "nixarr": {
       "inputs": {
-        "nixpkgs": "nixpkgs_5",
+        "nixpkgs": "nixpkgs_4",
-        "treefmt-nix": "treefmt-nix_4",
+        "treefmt-nix": "treefmt-nix_3",
         "vpnconfinement": "vpnconfinement",
         "website-builder": "website-builder"
       },
       "locked": {
-        "lastModified": 1781774207,
+        "lastModified": 1784997863,
-        "narHash": "sha256-pUHOn5uRbY1yOdeBgfm/UpkVkN9YrLUxl7jZnN1emyo=",
+        "narHash": "sha256-oTMag4I9MW3bstuOKqzc0F1OqxO49lLa9jkSkRe3EqA=",
-        "owner": "rasmus-kirk",
+        "owner": "nix-media-server",
         "repo": "nixarr",
-        "rev": "67952a6e79a298396e909d35f7ee35b23f754c43",
+        "rev": "282ce99b31d52d72cca281e3d26d3dd267946800",
         "type": "github"
       },
       "original": {
-        "owner": "rasmus-kirk",
+        "owner": "nix-media-server",
         "repo": "nixarr",
         "type": "github"
       }
     },
     "nixos-hardware": {
       "inputs": {
-        "nixpkgs": "nixpkgs_6"
+        "nixpkgs": "nixpkgs_5"
       },
       "locked": {
-        "lastModified": 1782166108,
+        "lastModified": 1787144466,
-        "narHash": "sha256-/EtnQBcKbsaCAGQ5VRcplrHRkR4ryqyLMpBfkVuG9Xw=",
+        "narHash": "sha256-HHfv2/HkNSKbbSyU9iD/g8lbP6r4tl33sSw1W4rXCk0=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "875776f0252fcb8618bb948640a0d1f7a5b362be",
+        "rev": "0471accf8d0a8210b31d947497d179ecc99e0021",
         "type": "github"
       },
       "original": {
@@ -615,15 +543,15 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1774106199,
+        "lastModified": 1776548001,
-        "narHash": "sha256-US5Tda2sKmjrg2lNHQL3jRQ6p96cgfWh3J1QBliQ8Ws=",
+        "narHash": "sha256-ZSK0NL4a1BwVbbTBoSnWgbJy9HeZFXLYQizjb2DPF24=",
-        "owner": "nixos",
+        "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6c9a78c09ff4d6c21d0319114873508a6ec01655",
+        "rev": "b12141ef619e0a9c1c84dc8c684040326f27cdcc",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
+        "owner": "NixOS",
         "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
@@ -659,28 +587,13 @@
         "type": "github"
       }
     },
-    "nixpkgs-lib_3": {
-      "locked": {
-        "lastModified": 1769909678,
-        "narHash": "sha256-cBEymOf4/o3FD5AZnzC3J9hLbiZ+QDT/KDuyHXVJOpM=",
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "rev": "72716169fe93074c333e8d0173151350670b824c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "type": "github"
-      }
-    },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1786384358,
+        "lastModified": 1787135253,
-        "narHash": "sha256-RzPPiWeUtuvymnpuEWsdtzli5w4kjZs49FqEs3/1u+I=",
+        "narHash": "sha256-RD2kNWCG+Bjo6h+JVjWVNntZs2GtRoeY2xHjts/FNkA=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "2fcb964de67fcf60b43471c55d5d99e61a9ccb5a",
+        "rev": "ffb3c9b700e759be2ef13237c9d8f953b32a1e46",
         "type": "github"
       },
       "original": {
@@ -691,22 +604,6 @@
       }
     },
     "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1776548001,
-        "narHash": "sha256-ZSK0NL4a1BwVbbTBoSnWgbJy9HeZFXLYQizjb2DPF24=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "b12141ef619e0a9c1c84dc8c684040326f27cdcc",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_3": {
       "locked": {
         "lastModified": 1772773019,
         "narHash": "sha256-E1bxHxNKfDoQUuvriG71+f+s/NT0qWkImXsYZNFFfCs=",
@@ -722,23 +619,23 @@
         "type": "github"
       }
     },
-    "nixpkgs_4": {
+    "nixpkgs_3": {
       "locked": {
-        "lastModified": 1775710090,
+        "lastModified": 1768564909,
-        "narHash": "sha256-ar3rofg+awPB8QXDaFJhJ2jJhu+KqN/PRCXeyuXR76E=",
+        "narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=",
-        "owner": "NixOS",
+        "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "4c1018dae018162ec878d42fec712642d214fdfa",
+        "rev": "e4bae1bd10c9c57b2cf517953ab70060a828ee6f",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
+        "owner": "nixos",
         "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
-    "nixpkgs_5": {
+    "nixpkgs_4": {
       "locked": {
         "lastModified": 1775595990,
         "narHash": "sha256-OEf7YqhF9IjJFYZJyuhAypgU+VsRB5lD4DuiMws5Ltc=",
@@ -754,7 +651,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_6": {
+    "nixpkgs_5": {
       "locked": {
         "lastModified": 1767892417,
         "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
@@ -767,73 +664,48 @@
         "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
       }
     },
+    "nixpkgs_6": {
+      "locked": {
+        "lastModified": 1787204541,
+        "narHash": "sha256-OURZPknrTjQrlNyxPdqzyqmU/81Wes1CUP/Ft1Rv/YI=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "5880666fd9eb563038431edb35c2d0aa595884e6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-26.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixpkgs_7": {
       "locked": {
-        "lastModified": 1786430034,
+        "lastModified": 1784796856,
-        "narHash": "sha256-Vux08kA5PICwS2sViCMfwVLAHNoH8TkKAeBo25LjpMI=",
+        "narHash": "sha256-vwxWgF+Gj276WznzGb1LxGsK/39HaQwgQXiU3EkC844=",
-        "owner": "nixos",
+        "rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
-        "repo": "nixpkgs",
+        "type": "tarball",
-        "rev": "70cc4559b10a6062b05ff1af17e0add065ccaed9",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1040357.e2587caef70c/nixexprs.tar.xz"
-        "type": "github"
       },
       "original": {
-        "owner": "nixos",
+        "type": "tarball",
-        "ref": "nixos-26.05",
+        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_8": {
-      "locked": {
-        "lastModified": 1781216227,
-        "narHash": "sha256-9mUW6gNwoN2SWc/l0fW4svPNOulXLl8ijqKyeSOGgJE=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "a0374025a863d007d98e3297f6aa46cc3141c2f0",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-26.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "notashelf-tuigreet": {
-      "inputs": {
-        "crane": "crane",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "rust-overlay": "rust-overlay"
-      },
-      "locked": {
-        "lastModified": 1781718334,
-        "narHash": "sha256-Ova9OQemsGRmg2b22W9HQSRhtjwS1C9mLUtkYqEjyRs=",
-        "owner": "NotAShelf",
-        "repo": "tuigreet",
-        "rev": "a75f469d51a11b35f9766153d35d15c535b268a6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NotAShelf",
-        "repo": "tuigreet",
-        "type": "github"
       }
     },
     "nur": {
       "inputs": {
-        "flake-parts": "flake-parts_4",
+        "flake-parts": "flake-parts_3",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1786612668,
+        "lastModified": 1787315761,
-        "narHash": "sha256-drUMW/BXNEKe5wzw2yM7ea/g7CnObPcwRNVp9ap0yQk=",
+        "narHash": "sha256-1ze3fFnH7GhN6P3e76Ved2OGNLU/r1Pgo59TbPi9Pg8=",
         "owner": "nix-community",
         "repo": "nur",
-        "rev": "a5ef785fafbf01c361372d7dc8e0f1591aeeacd3",
+        "rev": "9fd3c9b18edddb6c611fcbee9974d3b6de5443a7",
         "type": "github"
       },
       "original": {
@@ -842,27 +714,6 @@
         "type": "github"
       }
     },
-    "nur-osint": {
-      "inputs": {
-        "nixpkgs": [
-          "iknowyou",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1775935554,
-        "narHash": "sha256-7StMiQf3HSBruAxZ2/ZYJhhNEp1KbglGVijQBrurqiM=",
-        "owner": "anotherhadi",
-        "repo": "nur-osint",
-        "rev": "460e377522a43d3d968be20bec2cf40a72013904",
-        "type": "github"
-      },
-      "original": {
-        "owner": "anotherhadi",
-        "repo": "nur-osint",
-        "type": "github"
-      }
-    },
     "nur_2": {
       "inputs": {
         "flake-parts": [
@@ -891,17 +742,15 @@
     "nvf": {
       "inputs": {
         "flake-compat": "flake-compat_2",
-        "flake-parts": "flake-parts_5",
         "mnw": "mnw",
-        "nixpkgs": "nixpkgs_8",
+        "nixpkgs": "nixpkgs_7"
-        "systems": "systems_4"
       },
       "locked": {
-        "lastModified": 1781997110,
+        "lastModified": 1787305329,
-        "narHash": "sha256-6D6xtYN5t1kZGNd69eMZsRBkgX5Df1roErn/kFR1C+A=",
+        "narHash": "sha256-nYA+0kCn0h0dsaApPWuSJwIlBrPchqJphnfGLzDCOFs=",
         "owner": "notashelf",
         "repo": "nvf",
-        "rev": "320f60b97075a58d38b90fc5e39f478421dbd38a",
+        "rev": "93cb00e768908ba77f64a846f487e43e79130796",
         "type": "github"
       },
       "original": {
@@ -931,19 +780,18 @@
     },
     "root": {
       "inputs": {
-        "awesome-wallpapers": "awesome-wallpapers",
         "blog": "blog",
         "default-creds": "default-creds",
+        "disko": "disko",
         "git-hooks": "git-hooks",
         "helium-browser": "helium-browser",
         "home-manager": "home-manager",
-        "iknowyou": "iknowyou",
+        "impermanence": "impermanence",
         "nix-index-database": "nix-index-database",
         "nixarr": "nixarr",
         "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs_7",
+        "nixpkgs": "nixpkgs_6",
         "nixpkgs-unstable": "nixpkgs-unstable",
-        "notashelf-tuigreet": "notashelf-tuigreet",
         "nur": "nur",
         "nvf": "nvf",
         "nvf-config": "nvf-config",
@@ -951,27 +799,6 @@
         "stylix": "stylix"
       }
     },
-    "rust-overlay": {
-      "inputs": {
-        "nixpkgs": [
-          "notashelf-tuigreet",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1780975129,
-        "narHash": "sha256-428T1pLXnbVeUgZx2wWEkbvl3ZORjras34ANZ3ACp5A=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "fe64e6b409dc513274d2941f8da13bbd0fdcf44e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
     "sops-nix": {
       "inputs": {
         "nixpkgs": [
@@ -979,11 +806,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781943681,
+        "lastModified": 1786629091,
-        "narHash": "sha256-NFHmA7H47adqiyp+0iEOyZOQhmigDqA/NBAlf4imB6U=",
+        "narHash": "sha256-gkig4nPi1CWc4Z50GBsjE4ygSE7hMpl/TwID2an2Cck=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "420f8d2e9882911f65cfac15cc706f639ba96cca",
+        "rev": "a8627b21b9107c5711c96b84f32a9a4b3d45295f",
         "type": "github"
       },
       "original": {
@@ -999,13 +826,13 @@
         "base16-helix": "base16-helix",
         "base16-vim": "base16-vim",
         "firefox-gnome-theme": "firefox-gnome-theme",
-        "flake-parts": "flake-parts_6",
+        "flake-parts": "flake-parts_4",
         "gnome-shell": "gnome-shell",
         "nixpkgs": [
           "nixpkgs"
         ],
         "nur": "nur_2",
-        "systems": "systems_5",
+        "systems": "systems_3",
         "tinted-kitty": "tinted-kitty",
         "tinted-schemes": "tinted-schemes",
         "tinted-tmux": "tinted-tmux",
@@ -1071,36 +898,6 @@
         "type": "github"
       }
     },
-    "systems_4": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_5": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "tinted-kitty": {
       "flake": false,
       "locked": {
@@ -1210,28 +1007,6 @@
       }
     },
     "treefmt-nix_3": {
-      "inputs": {
-        "nixpkgs": [
-          "iknowyou",
-          "bun2nix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1770228511,
-        "narHash": "sha256-wQ6NJSuFqAEmIg2VMnLdCnUc0b7vslUohqqGGD+Fyxk=",
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "rev": "337a4fe074be1042a35086f15481d763b8ddc0e7",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "type": "github"
-      }
-    },
-    "treefmt-nix_4": {
       "inputs": {
         "nixpkgs": [
           "nixarr",

flake.nix

@@ -35,8 +35,9 @@
       url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    notashelf-tuigreet = {
+    impermanence.url = "github:nix-community/impermanence";
-      url = "github:NotAShelf/tuigreet";
+    disko = {
+      url = "github:nix-community/disko";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     helium-browser = {
@@ -49,11 +50,9 @@
     };
 
     # Server
-    nixarr.url = "github:rasmus-kirk/nixarr";
+    nixarr.url = "github:nix-media-server/nixarr";
     default-creds.url = "github:anotherhadi/default-creds";
     blog.url = "github:anotherhadi/blog";
-    awesome-wallpapers.url = "github:anotherhadi/awesome-wallpapers";
-    iknowyou.url = "github:anotherhadi/iknowyou";
   };
 
   outputs = inputs @ {

home/programs/group/cybersecurity.nix

@@ -1,4 +1,9 @@
-{pkgs, ...}: {
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: {
   home.packages = import ./cybersecurity-packages.nix {
     inherit pkgs;
   };
@@ -37,4 +42,10 @@
       hash = "sha256-T0XkMHJZQiy63/j25nGTkaiDFjc+blmgEVGTAFgVylU=";
     };
   };
+
+  home.persistence."/persist" = lib.mkIf (config.var.impermanenceEnabled or false) {
+    directories = [
+      "Cyber"
+    ];
+  };
 }

home/programs/group/dev.nix

@@ -1,9 +1,12 @@
 {
   pkgs,
   pkgs-unstable,
+  config,
+  lib,
   ...
 }: {
-  home.packages = with pkgs-unstable;
+  home = {
+    packages = with pkgs-unstable;
       [
         go
         claude-code
@@ -17,4 +20,15 @@
         nix-prefetch-github
         rsync
       ]);
+
+    persistence."/persist" = lib.mkIf (config.var.impermanenceEnabled or false) {
+      directories = [
+        ".claude"
+      ];
+      files = [".claude.json"];
+    };
+
+    sessionPath = ["$HOME/.local/share/go/bin"];
+    sessionVariables.GOPATH = "$HOME/.local/share/go";
+  };
 }

home/programs/gui/helium/bookmarks/default.nix

@@ -1,7 +1,7 @@
 {
   config,
   lib,
-  pkgs-unstable,
+  pkgs,
   ...
 }: let
   bookmarkList =
@@ -451,7 +451,7 @@ in {
     };
     Service = {
       Type = "simple";
-      ExecStart = "${pkgs-unstable.darkhttpd}/bin/darkhttpd %h/.local/share/helium-startpage --port 8888 --addr 127.0.0.1 --no-listing";
+      ExecStart = "${pkgs.darkhttpd}/bin/darkhttpd %h/.local/share/helium-startpage --port 8888 --addr 127.0.0.1 --no-listing";
       Restart = "on-failure";
     };
     Install.WantedBy = ["default.target"];

home/programs/gui/helium/default.nix

@@ -136,4 +136,10 @@ in {
     categories = ["Network" "WebBrowser"];
     mimeType = ["text/html" "text/xml" "application/xhtml+xml"];
   };
+
+  home.persistence."/persist" = lib.mkIf (config.var.impermanenceEnabled or false) {
+    directories = [
+      ".config/net.imput.helium"
+    ];
+  };
 }

home/programs/gui/pkgs.nix

@@ -1,17 +1,28 @@
-{pkgs, ...}: {
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: {
   home.packages = with pkgs; [
     vlc # Video player
     obsidian # Note taking app
-    textpieces # Manipulate texts
-    resources # Resource monitor
-    gnome-clocks # Clocks app
-    gnome-text-editor # Basic graphic text editor
-    ticktick # Todo app
     pinta # Image editor
-    switcheroo # Convert images between different formats
     onlyoffice-desktopeditors # Office suite
     blanket # Listen to different sounds
     signal-desktop # Messaging app
-    thunar # File explorer
+    ticktick # Todo app
+
+    # Backup
+    thunar
+    gnome-text-editor
   ];
+
+  home.persistence."/persist" = lib.mkIf (config.var.impermanenceEnabled or false) {
+    directories = [
+      ".config/ticktick"
+      ".config/Signal"
+      ".config/obsidian"
+    ];
+  };
 }

home/programs/gui/proton/default.nix

@@ -1,24 +1,16 @@
 {
   pkgs,
   config,
+  lib,
   ...
 }: {
   home.packages = with pkgs; [
     proton-vpn
     proton-pass
-    proton-authenticator
   ];
 
   # Fix Proton Authenticator desktop entry
   xdg.desktopEntries = {
-    "Proton Authenticator" = {
-      name = "Proton Authenticator";
-      exec = "env WEBKIT_DISABLE_COMPOSITING_MODE=1 ${pkgs.proton-authenticator}/bin/proton-authenticator";
-      icon = "proton-authenticator";
-      type = "Application";
-      categories = ["Utility"];
-      terminal = false;
-    };
     "Proton Calendar" = {
       name = "Proton Calendar";
       exec = ''${config.programs.helium.package}/bin/helium "https://calendar.proton.me"'';
@@ -36,4 +28,11 @@
       terminal = false;
     };
   };
+
+  home.persistence."/persist" = lib.mkIf (config.var.impermanenceEnabled or false) {
+    directories = [
+      ".config/protonvpn"
+      ".config/Proton Pass"
+    ];
+  };
 }

home/programs/tui/elio/default.nix

@@ -66,6 +66,21 @@ in {
     categories = ["System" "FileManager" "FileTools" "ConsoleOnly"];
   };
 
+  xdg.configFile."elio/config.toml".text = ''
+    [places]
+    entries = [
+      "home",
+      "documents",
+      "downloads",
+      "pictures",
+      { title = "Notes", path = "~/Notes" },
+      { title = "Cyber", path = "~/Cyber" },
+      { title = "Projects", path = "~/Projects" },
+      { title = "NixOS Config", path = "~/.config/nixos" },
+      "trash",
+    ]
+  '';
+
   xdg.configFile."elio/theme.toml".text = ''
     [palette]
     bg = "#${c.base00}"

home/programs/tui/git/default.nix

@@ -24,11 +24,10 @@ in {
       user.name = username;
       user.email = email;
       init.defaultBranch = "main";
-      pull.rebase = "false";
+      pull.rebase = "true";
       push.autoSetupRemote = true;
       color.ui = "1";
       alias = {
-        essa = "push --force";
         co = "checkout";
         fuck = "commit --amend -m";
         c = "commit -m";

home/programs/tui/ilovetui/default.nix

@@ -2,6 +2,9 @@
   c = config.lib.stylix.colors;
 in {
   home.file.".config/ilovetui/config.yaml".text = ''
+    nerd_fonts: true
+    border: rounded
+    layout_border: full
     colors:
       base00: "#${c.base00}" # Background
       base01: "#${c.base01}" # Lighter Background / Status Bars

home/programs/tui/navi/default.nix

@@ -0,0 +1,5 @@
+{
+  programs.navi = {
+    enable = true;
+  };
+}

home/programs/tui/nvf/keymaps.nix

@@ -207,6 +207,28 @@
         desc = "Dedent and keep selection";
       }
 
+      # Scroll and center
+      {
+        key = "<C-d>";
+        mode = [
+          "n"
+          "v"
+        ];
+        silent = true;
+        action = "<C-d>zz";
+        desc = "Scroll down and center";
+      }
+      {
+        key = "<C-u>";
+        mode = [
+          "n"
+          "v"
+        ];
+        silent = true;
+        action = "<C-u>zz";
+        desc = "Scroll up and center";
+      }
+
       # Move
       {
         key = "<C-h>";

home/programs/tui/nvf/languages.nix

@@ -84,7 +84,7 @@
       go.enable = true;
       markdown = {
         enable = true;
-        format.type = ["prettierd"];
+        format.type = ["prettier"];
         extensions = {
           markview-nvim = {
             enable = true;

home/programs/tui/pkgs.nix

@@ -1,9 +1,13 @@
-{pkgs, ...}: {
+{
+  pkgs,
+  pkgs-unstable,
+  config,
+  lib,
+  ...
+}: {
   home.packages = with pkgs; [
     # I love TUIs
     caligula # User-friendly, lightweight TUI for disk imaging (ISO, USB BOOT)
-    dysk # A terminal-based disk usage analyzer
-    wikiman # Offline search engine for manual pages (arch wiki, tldr)
     tealdeer # Fast tldr client
     sttr # A minimalist CyberChef-like, cross-platform CLI app for performing various operations on strings
     slides # A terminal-based presentation tool that allows you to create and deliver presentations directly from the command line
@@ -11,17 +15,15 @@
     tabiew # A terminal-based CSV viewer and manipulator
     jless # A pager for JSON
     pkgs.nur.repos.anotherhadi.usbguard-tui # TUI for managing USBGuard rules
-    pkgs.nur.repos.anotherhadi.sheets # Terminal based spreadsheet tool
     pkgs.nur.repos.anotherhadi.settuings # Terminal based settings (wifi, bluetooth, audio, ...)
-    rainfrog # TODO: To test
+    pkgs.nur.repos.anotherhadi.fztea # Flipper Zero from the terminal
-    posting # TODO: To test
+    pkgs.nur.repos.anotherhadi.monitui # Edit hyprland's monitor configuration
-    newsboat # TODO: To test
+    dua # Tool to conveniently learn about the disk usage of directories
-    dooit # TODO: To test
+    mcat # Cat command for documents / images / videos and more
+    lazyjournal
 
-    # I love CLIs
     httpie # Command-line HTTP client, a user-friendly cURL replacement
     gh # GitHub
-    gh-dash # A terminal dashboard for GitHub
     figlet # Transform text into ASCII art
     pastel # Command-line tool to generate, analyze, convert and manipulate colors
     imagemagick # Image manipulation tool
@@ -35,5 +37,10 @@
     pipes
     cmatrix
     fastfetch
+    smassh # typing test, 10fastfinger like
   ];
+
+  home.persistence."/persist" = lib.mkIf (config.var.impermanenceEnabled or false) {
+    directories = [".config/gh" ".config/gh-dash"];
+  };
 }

home/programs/tui/shell/zsh.nix

@@ -11,11 +11,13 @@
   ];
 
   home = {
-    sessionPath = ["$HOME/go/bin"];
     sessionVariables = {
       COLORTERM = "truecolor";
       MANPAGER = "bat -l man -p";
     };
+    persistence."/persist" = lib.mkIf (config.var.impermanenceEnabled or false) {
+      files = [".zsh_history"];
+    };
   };
 
   programs.zsh = {
@@ -72,7 +74,7 @@
       spt = "spotatui";
       open = "${pkgs.xdg-utils}/bin/xdg-open";
 
-      notes = "nvim ~/notes/index.md --cmd 'cd ~/notes' -c ':lua Snacks.picker.smart()'";
+      notes = "nvim ~/Notes/index.md --cmd 'cd ~/notes' -c ':lua Snacks.picker.smart()'";
 
       # git
       g = "lazygit";

home/programs/tui/spotatui/default.nix

@@ -2,6 +2,7 @@
 {
   config,
   pkgs,
+  lib,
   ...
 }: let
   c = config.lib.stylix.colors;
@@ -11,6 +12,10 @@ in {
     spotatui
   ];
 
+  home.persistence."/persist" = lib.mkIf (config.var.impermanenceEnabled or false) {
+    directories = [".config/spotatui" ".config/spotify"];
+  };
+
   home.file.".config/spotatui/config.yml".text = ''
     keybindings:
       back: q

home/programs/tui/wikiman/default.nix

@@ -0,0 +1,49 @@
+{
+  pkgs,
+  lib,
+  ...
+}: let
+  # wikiman ships without the ArchWiki/tldr-pages databases (too heavy to
+  # bundle). These are fetched declaratively from wikiman's own release
+  # snapshots and baked into a wrapped `wikiman` so `-S` shows them as
+  # installed offline, no manual `make source-*` step required.
+  # To refresh: bump the release tag/date below and update the hashes
+  # (`nix hash file --sri <downloaded file>`).
+  #
+  # Download size (compressed): ~17M ArchWiki + ~3.4M tldr-pages.
+  # Store size (unpacked): ~239M ArchWiki + ~147M tldr-pages (~385M total).
+  archWikiSrc = pkgs.fetchurl {
+    url = "https://github.com/filiparag/wikiman/releases/download/2.14.1/arch-wiki_20260810.source.tar.xz";
+    hash = "sha256-82aiDvwZ07m9CfBVYIDLSUpWds4QxUbCbCPmQ26j1XI=";
+  };
+  tldrPagesSrc = pkgs.fetchurl {
+    url = "https://github.com/filiparag/wikiman/releases/download/2.14.1/tldr-pages_20260810.source.tar.xz";
+    hash = "sha256-2vdszVMImSN1UF+OepKdj1v+lsG2jM68gcpnUJyqddw=";
+  };
+
+  # Real files (not symlinks): wikiman's source-detection does `find -type f`
+  # on this dir, which doesn't match symlinks, so `pkgs.symlinkJoin` alone
+  # won't work here.
+  data = pkgs.runCommand "wikiman-data" {nativeBuildInputs = [pkgs.xz];} ''
+    mkdir -p $out
+    cp -r ${pkgs.wikiman}/share $out/share
+    chmod -R u+w $out/share
+    tar xf ${archWikiSrc} -C $out --strip-components=1
+    tar xf ${tldrPagesSrc} -C $out --strip-components=1
+  '';
+
+  wikiman-full = pkgs.symlinkJoin {
+    name = "wikiman-full";
+    paths = [pkgs.wikiman];
+    nativeBuildInputs = [pkgs.makeWrapper];
+    postBuild = ''
+      rm $out/bin/wikiman
+      makeWrapper ${pkgs.wikiman}/bin/.wikiman-wrapped $out/bin/wikiman \
+        --prefix PATH : "${lib.makeBinPath [pkgs.fzf pkgs.ripgrep pkgs.gawk pkgs.w3m pkgs.coreutils pkgs.parallel]}" \
+        --set conf_sys_usr "${data}"
+    '';
+    meta.mainProgram = "wikiman";
+  };
+in {
+  home.packages = [wikiman-full]; # Offline search engine for manual pages, ArchWiki and tldr
+}

home/system/clipboard/default.nix

@@ -3,6 +3,8 @@
 # script (tofi). Uses the home-manager module so the watcher services are
 # managed the same way as swaync/hypridle.
 {pkgs, ...}: {
+  home.packages = [pkgs.wl-clipboard];
+
   services.cliphist = {
     enable = true;
     allowImages = true;

home/system/hyprland/bindings.nix

@@ -2,20 +2,21 @@
   pkgs,
   lib,
   config,
+  scripts,
   ...
 }: let
   colors = config.lib.stylix.colors;
-  scripts = import ../waybar/scripts.nix {inherit pkgs config;};
+  border-size = config.theme.border-size;
 
   mkMenu = menu: let
     configFile = pkgs.writeText "config.yaml" (
       lib.generators.toYAML {} {
-        anchor = "bottom-right";
+        anchor = "top";
-        border = "#${colors.base0D}80";
+        border = "#${colors.base0D}EE";
-        background = "#${colors.base01}EE";
+        border_width = border-size;
+        background = "#${colors.base01}FF";
         color = "#${colors.base05}";
-        margin_right = 15;
+        margin_top = 0;
-        margin_bottom = 15;
         rows_per_column = 5;
 
         inherit menu;
@@ -23,8 +24,21 @@
     );
   in
     pkgs.writeShellScriptBin "menu" ''
+      # Toggle: if wlr-which-key is already open, closing it is all this run should do.
+      if ${pkgs.procps}/bin/pkill -x wlr-which-key; then
+        exit 0
+      fi
       exec ${lib.getExe pkgs.wlr-which-key} ${configFile}
     '';
+
+  tofi-drun-toggle = pkgs.writeShellScriptBin "tofi-drun-toggle" ''
+    # tofi-drun is a distinct process name from the plain "tofi" binary
+    # used by the emoji/icon/clipboard pickers, so this can't close those.
+    if ${pkgs.procps}/bin/pkill -x tofi-drun; then
+      exit 0
+    fi
+    exec ${pkgs.tofi}/bin/tofi-drun
+  '';
 in {
   wayland.windowManager.hyprland.settings = {
     "$mod" = "SUPER";
@@ -121,7 +135,7 @@ in {
         # Quick launch
         "$mod,RETURN, exec, ${pkgs.ghostty}/bin/ghostty +new-window" # Ghostty (terminal, via daemon D-Bus)
         "$mod,E, exec, ${pkgs.ghostty}/bin/ghostty +new-window -e elio" # Elio
-        "$mod, SPACE, exec, ${pkgs.tofi}/bin/tofi-drun" # Launcher
+        "$mod, SPACE, exec, ${lib.getExe tofi-drun-toggle}" # Launcher (toggle)
         "$mod, N, exec, ${pkgs.swaynotificationcenter}/bin/swaync-client -t" # Notification center
 
         # Windows

home/system/hyprland/default.nix

@@ -133,6 +133,9 @@ in {
         "match:class helium, suppress_event fullscreen"
         "match:class helium, sync_fullscreen false"
 
+        "match:class ^(steam_app_.*)$, suppress_event fullscreen"
+        "match:class ^(steam_app_.*)$, sync_fullscreen false"
+
         "match:class proton-authenticator, float on"
         "match:class proton-authenticator, center on"
         "match:class proton-authenticator, size 500 400"

home/system/hyprlock/default.nix

@@ -1,11 +1,75 @@
-{config, ...}: let
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
   c = config.lib.stylix.colors;
+  font = config.stylix.fonts.monospace.name;
+
+  fontSize = 16;
+  em = fontSize * 4.0 / 3.0;
+  charW = em * 0.6;
+  lineH = em * 1.32;
+
+  round = x: builtins.floor (x + 0.5);
+  px = x: toString (round x);
+
+  paint = color: t: ''<span foreground="#${color}">${t}</span>'';
+  fromFile = name: text: ''cmd[update:0] cat ${pkgs.writeText name text}'';
+
+  inner = 42;
+  width = inner + 2;
+  valueCol = 13;
+
+  spaces = n: lib.concatStrings (lib.genList (_: " ") n);
+
+  border = paint c.base0D;
+  hbar = lib.concatStrings (lib.genList (_: "─") inner);
+
+  row = content: border "│" + content + border "│";
+
+  blank = row (spaces inner);
+
+  entry = name: value: let
+    prompt = "  ${name}:";
+    gap = spaces (valueCol - builtins.stringLength prompt);
+    tail = spaces (inner - valueCol - builtins.stringLength value);
+  in
+    row (border prompt + gap + paint c.base05 value + tail);
+
+  lines = [
+    (border "┌${hbar}┐")
+    blank
+    (entry "Session" "Hyprland")
+    (entry "Username" config.home.username)
+    (entry "Password" "")
+    blank
+    (border "└${hbar}┘")
+  ];
+
+  rowY = i: -((i + 0.5) - (builtins.length lines) / 2.0) * lineH;
+  colX = i: (i - width / 2.0) * charW;
+
+  frameHalfH = (builtins.length lines) * lineH / 2.0;
+  outsideY = frameHalfH + 1.5 * lineH;
+
+  inputH = fontSize / 0.8;
+  inputW = 27 * charW;
+  dotPad = (inputH - lineH) / 2.0;
+  inputX = colX (valueCol + 1) - dotPad;
+  passwordRow = 4;
+  hidden = "<span> </span>";
 in {
   stylix.targets.hyprlock.enable = false;
 
   programs.hyprlock = {
     enable = true;
     settings = {
+      general = {
+        grace = 2;
+      };
+
       background = [
         {
           monitor = "";
@@ -16,65 +80,87 @@ in {
       label = [
         {
           monitor = "";
-          text = ''cmd[update:0] echo "[$USER@$(hostname) ~]"'';
+          text = ''cmd[update:1000] date +"%H:%M   %A %d %B"'';
-          color = "rgb(${c.base0D})";
-          font_size = 13;
-          font_family = "Maple Mono NF";
-          position = "48, -48";
-          halign = "left";
-          valign = "top";
-        }
-        {
-          monitor = "";
-          text = ''cmd[update:1000] echo "$(date +'%H:%M:%S')"'';
           color = "rgb(${c.base05})";
-          font_size = 13;
+          font_size = fontSize;
-          font_family = "Maple Mono NF";
+          font_family = font;
-          position = "48, -70";
+          position = "0, -64";
-          halign = "left";
+          halign = "center";
           valign = "top";
         }
         {
           monitor = "";
-          text = ''cmd[update:60000] echo "$(date +'%A %d %B %Y')"'';
+          text = "Welcome";
+          color = "rgb(${c.base05})";
+          font_size = fontSize;
+          font_family = font;
+          position = "0, ${px outsideY}";
+          halign = "center";
+          valign = "center";
+        }
+        {
+          monitor = "";
+          text = fromFile "hyprlock-frame" (lib.concatStringsSep "\n" lines);
+          color = "rgb(${c.base05})";
+          font_size = fontSize;
+          font_family = font;
+          text_align = "left";
+          position = "0, 0";
+          halign = "center";
+          valign = "center";
+        }
+        {
+          monitor = "";
+          text = "<span> </span>$FAIL<span> </span>";
+          color = "rgb(${c.base08})";
+          font_size = fontSize;
+          font_family = font;
+          position = "0, ${px (-outsideY)}";
+          halign = "center";
+          valign = "center";
+        }
+        {
+          monitor = "";
+          text =
+            fromFile "hyprlock-hints"
+            "${paint c.base0D "Enter"} ${paint c.base04 "unlock"}    ${paint c.base0D "Esc"} ${paint c.base04 "clear"}";
           color = "rgb(${c.base04})";
-          font_size = 13;
+          font_size = fontSize;
-          font_family = "Maple Mono NF";
+          font_family = font;
-          position = "48, -92";
+          position = "0, 40";
-          halign = "left";
+          halign = "center";
-          valign = "top";
+          valign = "bottom";
-        }
-        {
-          monitor = "";
-          text = "passwd:";
-          color = "rgb(${c.base0D})";
-          font_size = 13;
-          font_family = "Maple Mono NF";
-          position = "48, -141";
-          halign = "left";
-          valign = "top";
         }
       ];
 
       "input-field" = [
         {
           monitor = "";
-          size = "200, 20";
+          size = "${px inputW}, ${px inputH}";
+          position = "${px (inputX + inputW / 2.0)}, ${px (rowY passwordRow)}";
+          halign = "center";
+          valign = "center";
+
           outline_thickness = 0;
           outer_color = "rgba(00000000)";
           inner_color = "rgba(00000000)";
-          font_color = "rgb(${c.base05})";
-          fade_on_empty = false;
-          placeholder_text = "";
-          hide_input = true;
           rounding = 0;
-          check_color = "rgb(${c.base0B})";
+          fade_on_empty = false;
+
+          font_family = font;
+          font_color = "rgb(${c.base05})";
+
+          dots_text_format = "*";
+          dots_size = 0.8;
+          dots_spacing = 0.0;
+          dots_center = false;
+
+          swap_font_color = true;
+          placeholder_text = hidden;
+          fail_text = hidden;
+          check_color = "rgb(${c.base0C})";
           fail_color = "rgb(${c.base08})";
-          fail_text = ''<span font_desc="Maple Mono NF 13">auth failed</span>'';
           capslock_color = "rgb(${c.base0A})";
-          position = "116, -138";
-          halign = "left";
-          valign = "top";
         }
       ];
     };

home/system/mime/default.nix

@@ -1,4 +1,5 @@
 {
+  config,
   lib,
   pkgs,
   ...
@@ -147,6 +148,10 @@ in {
       music = null;
       publicShare = null;
       templates = null;
+      extraConfig = {
+        NOTES = "${config.home.homeDirectory}/Notes";
+        CYBER = "${config.home.homeDirectory}/Cyber";
+      };
     };
   };
 }

home/system/swaync/default.nix

@@ -1,9 +1,9 @@
 {
   config,
   pkgs,
+  scripts,
   ...
 }: let
-  scripts = import ../waybar/scripts.nix {inherit pkgs config;};
   c = config.lib.stylix.colors;
   font = config.stylix.fonts.sansSerif.name;
   monofont = config.stylix.fonts.monospace.name;

home/system/tofi/desktop-actions.nix

@@ -1,10 +1,8 @@
 {
   pkgs,
-  config,
+  scripts,
   ...
-}: let
+}: {
-  scripts = import ../waybar/scripts.nix {inherit pkgs config;};
-in {
   xdg.desktopEntries = {
     focus-toggle = {
       name = "Focus Mode";

home/system/waybar/default.nix

@@ -10,6 +10,8 @@ in {
     ./style.nix
   ];
 
+  _module.args.scripts = scripts;
+  _module.args.osdPath = scripts.osdPath;
   _module.args.networkScript = scripts.networkScript;
   _module.args.bluetoothScript = scripts.bluetoothScript;
   _module.args.volMuteScript = scripts.vol-mute;

home/system/waybar/scripts.nix

@@ -6,8 +6,8 @@
     name = "waybar-osd";
     runtimeInputs = with pkgs; [procps coreutils];
     text = ''
-      printf '%s' "$1" > /tmp/waybar-osd
+      printf '%s' "$1" > "$XDG_RUNTIME_DIR/waybar-osd"
-      pkill -x -RTMIN+8 waybar 2>/dev/null || true
+      pkill -f -RTMIN+8 '^waybar$' 2>/dev/null || true
     '';
   };
 
@@ -15,7 +15,7 @@
     name = "waybar-osd-status";
     runtimeInputs = with pkgs; [coreutils];
     text = ''
-      file=/tmp/waybar-osd
+      file="$XDG_RUNTIME_DIR/waybar-osd"
       [ -f "$file" ] || exit 1
       mtime=$(stat -c %Y "$file" 2>/dev/null) || exit 1
       age=$(( $(date +%s) - mtime ))
@@ -86,8 +86,9 @@
     jq -r 'to_entries[] | select(.key != "METADATA") | "\(.value.char)  \(.key)"' \
       ${nerdFontGlyphnames} > "$out"
   '';
+  osdPath = "$XDG_RUNTIME_DIR/waybar-osd";
 in {
-  inherit waybar-osd waybar-osd-status battery-monitor;
+  inherit waybar-osd waybar-osd-status battery-monitor osdPath;
 
   bluetoothScript = pkgs.writeShellScript "waybar-bluetooth" ''
     jq=${pkgs.jq}/bin/jq
@@ -234,19 +235,19 @@ in {
   '';
 
   wifi-toggle = pkgs.writeShellScriptBin "wifi-toggle" ''
-    if nmcli radio wifi | grep -q enabled; then
+    if ${pkgs.networkmanager}/bin/nmcli radio wifi | grep -q enabled; then
-      nmcli radio wifi off
+      ${pkgs.networkmanager}/bin/nmcli radio wifi off
     else
-      nmcli radio wifi on
+      ${pkgs.networkmanager}/bin/nmcli radio wifi on
     fi
     ${updateOsd}
   '';
 
   bluetooth-toggle = pkgs.writeShellScriptBin "bluetooth-toggle" ''
-    if bluetoothctl show | grep -q "Powered: yes"; then
+    if ${pkgs.bluez}/bin/bluetoothctl show | grep -q "Powered: yes"; then
-      bluetoothctl power off
+      ${pkgs.bluez}/bin/bluetoothctl power off
     else
-      bluetoothctl power on
+      ${pkgs.bluez}/bin/bluetoothctl power on
     fi
     ${updateOsd}
   '';
@@ -260,7 +261,7 @@ in {
   '';
 
   nightshift-toggle = pkgs.writeShellScriptBin "nightshift-toggle" ''
-    if pidof "hyprsunset" > /dev/null; then
+    if ${pkgs.procps}/bin/pidof "hyprsunset" > /dev/null; then
       pkill hyprsunset
       OSD_TEXT="󰖔  Night Shift Off"
     else
@@ -271,23 +272,23 @@ in {
   '';
 
   focus-toggle = pkgs.writeShellScriptBin "focus-toggle" ''
-    if test -f /tmp/hypr-focus-mode; then
+    if test -f "$XDG_RUNTIME_DIR/hypr-focus-mode"; then
-      rm /tmp/hypr-focus-mode
+      rm "$XDG_RUNTIME_DIR/hypr-focus-mode"
       OSD_TEXT="󰈈  Focus Off"
       ${updateOsd}
-      hyprctl reload
+      ${pkgs.hyprland}/bin/hyprctl reload
-      hyprctl dispatch exec waybar
+      ${pkgs.hyprland}/bin/hyprctl dispatch exec waybar
     else
-      touch /tmp/hypr-focus-mode
+      touch "$XDG_RUNTIME_DIR/hypr-focus-mode"
       OSD_TEXT="󰈈  Focus On"
       ${updateOsd}
-      pkill waybar || true
+      ${pkgs.procps}/bin/pkill waybar || true
-      hyprctl keyword animations:enabled false
+      ${pkgs.hyprland}/bin/hyprctl keyword animations:enabled false
-      hyprctl keyword general:gaps_in 0
+      ${pkgs.hyprland}/bin/hyprctl keyword general:gaps_in 0
-      hyprctl keyword general:gaps_out 0
+      ${pkgs.hyprland}/bin/hyprctl keyword general:gaps_out 0
-      hyprctl keyword decoration:active_opacity 1
+      ${pkgs.hyprland}/bin/hyprctl keyword decoration:active_opacity 1
-      hyprctl keyword decoration:inactive_opacity 1
+      ${pkgs.hyprland}/bin/hyprctl keyword decoration:inactive_opacity 1
-      hyprctl keyword decoration:rounding 0
+      ${pkgs.hyprland}/bin/hyprctl keyword decoration:rounding 0
     fi
   '';
 

home/system/waybar/settings.nix

@@ -1,6 +1,7 @@
 {
   config,
   pkgs,
+  osdPath,
   networkScript,
   bluetoothScript,
   caffeineToggleScript,
@@ -76,7 +77,7 @@ in {
       };
 
       "custom/osd" = {
-        exec = "cat /tmp/waybar-osd";
+        exec = "cat ${osdPath}";
         exec-if = "${osdStatusScript}/bin/waybar-osd-status";
         signal = 8;
         interval = 1;

hosts/laptop/configuration.nix

@@ -9,53 +9,30 @@
     ../../nixos/nix.nix
     ../../nixos/systemd-boot.nix
     ../../nixos/tuigreet.nix
+    ../../nixos/autologin.nix # Skip first TUIGreet login, use LUKS password to unlock the keyring
     ../../nixos/users.nix
     ../../nixos/utils.nix
     ../../nixos/hyprland.nix
-    ../../nixos/usbguard.nix
+    ../../nixos/steam.nix
+    ../../nixos/kernel-hardening.nix
     ../../home/programs/gui/helium/system.nix # I hate browser's configuration..
 
-    ../../nixos/omen.nix # CHANGEME: For my laptop only, remove this (OMEN 16)
+    # CHANGEME: You should probably remove those things:
-
+    ./wireguard.nix
-    ./wireguard.nix # CHANGEME: For my laptop only
+    ./persistence.nix # impermanence: what to keep once "/" is wiped on boot
+    ./usbguard.nix
+    ./disko.nix
+    ./secrets
 
     # You should let those lines as is
     ./hardware-configuration.nix
     ./variables.nix
   ];
 
-  # USBGuard:
-  # Allow all USB devices until a proper policy is configured.
-  # Run `sudo usbguard generate-policy` with your devices plugged in,
-  # then set rules = "<output>" and switch implicitPolicyTarget to "block".
-  # services.usbguard.implicitPolicyTarget = lib.mkForce "allow";
-
-  services.usbguard.rules = ''
-    allow id 1d6b:0002 serial "0000:05:00.3" name "xHCI Host Controller" hash "4a4NgfdUaJO43rkCzmWRSeHHR/uUh5+SNsXnhosm9qs=" parent-hash "ldMchY4Tt4GPUYo30eNGvai+Fs/EdnVY3vMyxJUq4Nk=" with-interface 09:00:00 with-connect-type ""
-    allow id 1d6b:0003 serial "0000:05:00.3" name "xHCI Host Controller" hash "d+DNGWARDtv9nEK2ZvnNOCtFernuMu5/e/oZ7kCppqQ=" parent-hash "ldMchY4Tt4GPUYo30eNGvai+Fs/EdnVY3vMyxJUq4Nk=" with-interface 09:00:00 with-connect-type ""
-    allow id 1d6b:0002 serial "0000:05:00.4" name "xHCI Host Controller" hash "icotY3rI59mWiKsGxc59BGZZeBjfbuH0b4NUByj3cbQ=" parent-hash "tHvBfznK5rpQn+oa0PEEjHa29EAEvGyCcZixsfwA6W0=" with-interface 09:00:00 with-connect-type ""
-    allow id 1d6b:0003 serial "0000:05:00.4" name "xHCI Host Controller" hash "UbEoCZW8HT2ldc3qDeiK+IiQlGeaBC7F63681OwmKhI=" parent-hash "tHvBfznK5rpQn+oa0PEEjHa29EAEvGyCcZixsfwA6W0=" with-interface 09:00:00 with-connect-type ""
-    allow id 1d6b:0002 serial "0000:07:00.3" name "xHCI Host Controller" hash "pz29Oo0RhQ+5+7LgOZR4v3OlcsVv3m9kCgGsGUnoUjI=" parent-hash "DRyV2/31MYHdzkIEfbPQeb/1w4/PjOW6GqWrXkftf2I=" with-interface 09:00:00 with-connect-type ""
-    allow id 1d6b:0003 serial "0000:07:00.3" name "xHCI Host Controller" hash "O6iOpcl9StImWT62SrbeXacqbG6N/mTIipTRc0ipCGM=" parent-hash "DRyV2/31MYHdzkIEfbPQeb/1w4/PjOW6GqWrXkftf2I=" with-interface 09:00:00 with-connect-type ""
-    allow id 1d6b:0002 serial "0000:07:00.4" name "xHCI Host Controller" hash "Hp8B0Enf+ACRT2tyy0EqXj7eNsFDAnTRZadzuh/Iqd4=" parent-hash "l2vhvC+VGVKlkBUUK/usFu8jHJ/5bWOnJG6WzRexpt4=" with-interface 09:00:00 with-connect-type ""
-    allow id 1d6b:0003 serial "0000:07:00.4" name "xHCI Host Controller" hash "rJ3LKdvkCK3SUrCU3lV8qVbmPjA+r9Fe5106x2HlgK4=" parent-hash "l2vhvC+VGVKlkBUUK/usFu8jHJ/5bWOnJG6WzRexpt4=" with-interface 09:00:00 with-connect-type ""
-    allow id 0bda:c85c serial "00e04c000001" name "Bluetooth Radio" hash "Q/wlToV8WQgEYHBW/UIhnSwCCusCGqAR2D5gspSCImQ=" parent-hash "4a4NgfdUaJO43rkCzmWRSeHHR/uUh5+SNsXnhosm9qs=" with-interface { e0:01:01 e0:01:01 e0:01:01 e0:01:01 e0:01:01 e0:01:01 e0:01:01 e0:01:01 } with-connect-type "hardwired"
-    allow id 30c9:009f serial "01.00.00" name "HP True Vision FHD Camera" hash "eYW5fqReJd29tfHXkEktKC63dGfDpmlRMo5uMGUWwME=" parent-hash "icotY3rI59mWiKsGxc59BGZZeBjfbuH0b4NUByj3cbQ=" with-interface { 0e:01:01 0e:02:01 0e:02:01 0e:02:01 0e:02:01 0e:02:01 0e:02:01 0e:02:01 0e:02:01 0e:02:01 0e:02:01 0e:02:01 0e:02:01 fe:01:01 } with-connect-type "hardwired"
-    allow id 03f0:036b serial "" name "HP USB-C Dock G5" hash "iPFGrgGz0sWgKQjWD/F8eNOhkeR728dTG8JJtkUSvuM=" parent-hash "Hp8B0Enf+ACRT2tyy0EqXj7eNsFDAnTRZadzuh/Iqd4=" via-port "7-1" with-interface { 09:00:01 09:00:02 } with-connect-type "hotplug"
-    allow id 03f0:066b serial "" name "HP USB-C Dock G5" hash "JHDjLFApQNqijjmuKdJSWH5+1oLL7S6LQ9QHTAk5fTk=" parent-hash "rJ3LKdvkCK3SUrCU3lV8qVbmPjA+r9Fe5106x2HlgK4=" via-port "8-1" with-interface 09:00:00 with-connect-type "hotplug"
-    allow id 03f0:056b serial "201604140001" name "USB Audio" hash "OxQ8HQenW3/4HSGEBOSYFS15rXDTOaNDnjMbICweHgw=" parent-hash "iPFGrgGz0sWgKQjWD/F8eNOhkeR728dTG8JJtkUSvuM=" with-interface { 01:01:00 01:02:00 01:02:00 01:02:00 01:02:00 03:00:00 } with-connect-type "unknown"
-    allow id 03f0:086b serial "" name "USB2734" hash "MSXcPAlZqkpTyZQylOhSIB8eMfST2AzVHV9EbrBGTWc=" parent-hash "iPFGrgGz0sWgKQjWD/F8eNOhkeR728dTG8JJtkUSvuM=" via-port "7-1.3" with-interface { 09:00:01 09:00:02 } with-connect-type "unknown"
-    allow id 03f0:046b serial "11AD1D0A89EA2D08310E0B00" name "HP USB-C Dock G5" hash "DEGeuj1u4lwqrzp0UksFX7mSEY9JnGLxg7yxGbglAKE=" parent-hash "iPFGrgGz0sWgKQjWD/F8eNOhkeR728dTG8JJtkUSvuM=" with-interface { 11:00:00 ff:03:00 03:00:00 } with-connect-type "unknown"
-    allow id 03f0:076b serial "" name "USB5734" hash "BshoqybYo0IKgoDORYPRtbhhlmQrYAxPQb2EAm1JsWA=" parent-hash "JHDjLFApQNqijjmuKdJSWH5+1oLL7S6LQ9QHTAk5fTk=" via-port "8-1.3" with-interface 09:00:00 with-connect-type "unknown"
-    allow id 0bda:8153 serial "000001000000" name "USB 10/100/1000 LAN" hash "utEnXKJ57kRUbPcGUaNWhEyoOEbLOYAFxvlsyC0PZkk=" parent-hash "JHDjLFApQNqijjmuKdJSWH5+1oLL7S6LQ9QHTAk5fTk=" with-interface { ff:ff:00 02:06:00 0a:00:00 0a:00:00 } with-connect-type "unknown"
-    allow id 046d:0ab7 serial "2046BAB04T68" name "Blue Microphones" hash "cC6AQ2e1Q/BeFeostpbf1mH2WpoUmt6bhau4NlA3niU=" parent-hash "MSXcPAlZqkpTyZQylOhSIB8eMfST2AzVHV9EbrBGTWc=" with-interface { 01:01:00 01:02:00 01:02:00 01:02:00 01:02:00 01:02:00 01:02:00 03:00:00 } with-connect-type "unknown"
-    allow id 13fd:5900 serial "50026B76861EE752    " name "External" hash "l/QvVV5hzZj1z6OUwB/kWl+WnH/7awrdMBoiNVx660M=" parent-hash "MSXcPAlZqkpTyZQylOhSIB8eMfST2AzVHV9EbrBGTWc=" with-interface { 08:06:50 08:06:62 } with-connect-type "unknown"
-    allow id 1532:02a1 name "Razer Ornata V3"
-    allow id 03f0:066b name "HP USB-C Dock G5"
-  '';
-
   home-manager.users."${config.var.username}" = import ./home.nix;
 
+  users.users.${config.var.username}.hashedPassword = "$y$j9T$A7gH534UczuBxulj9IfEu1$ImRy3lpYpemRWNVIkA7efKPWXneFiqhZnEF1aMkWcD8"; # CHANGEME: This is my password
+
   # Don't touch this
   system.stateVersion = "26.05";
 }

hosts/laptop/disko.nix

@@ -0,0 +1,56 @@
+{
+  disko.devices = {
+    nodev = {
+      "/" = {
+        fsType = "tmpfs";
+        mountOptions = [
+          "defaults"
+          "size=12G"
+          "mode=755"
+        ];
+      };
+    };
+
+    disk = {
+      boot = {
+        type = "disk";
+        device = "/dev/disk/by-uuid/5251-9B85";
+        content = {
+          type = "filesystem";
+          format = "vfat";
+          mountpoint = "/boot";
+          mountOptions = ["fmask=0077" "dmask=0077"];
+        };
+      };
+
+      nixos = {
+        type = "disk";
+        device = "/dev/disk/by-uuid/e3110976-78ee-4868-94c4-a3c052aee359";
+        content = {
+          type = "luks";
+          name = "crypted";
+          settings = {
+            allowDiscards = true;
+            bypassWorkqueues = true;
+          };
+          content = {
+            type = "btrfs";
+            extraArgs = ["-f"];
+            subvolumes = {
+              "/nix" = {
+                mountpoint = "/nix";
+                mountOptions = ["compress=zstd" "noatime"];
+              };
+              "/persist" = {
+                mountpoint = "/persist";
+                mountOptions = ["compress=zstd" "noatime"];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+
+  fileSystems."/persist".neededForBoot = true;
+}

hosts/laptop/flake.nix

@@ -18,6 +18,9 @@ nixpkgs.lib.nixosSystem {
     inputs.sops-nix.nixosModules.sops
     inputs.nix-index-database.nixosModules.default
     inputs.helium-browser.nixosModules.default
+    inputs.impermanence.nixosModules.impermanence
+    inputs.disko.nixosModules.disko
+    ./disko.nix
     ./configuration.nix
   ];
 }

hosts/laptop/hardware-configuration.nix

@@ -1,6 +1,4 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# Hardware detection - filesystems are managed by disko.nix
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
 {
   config,
   lib,
@@ -11,42 +9,13 @@
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  boot.initrd.availableKernelModules = [
+  boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "usb_storage" "usbhid" "uas" "sd_mod"];
-    "nvme"
-    "xhci_pci"
-    "uas"
-    "usbhid"
-    "sd_mod"
-  ];
   boot.initrd.kernelModules = [];
   boot.kernelModules = ["kvm-amd"];
   boot.extraModulePackages = [];
 
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/6320d3c6-0231-45ec-817a-c6f0e39aab73";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/5251-9B85";
-    fsType = "vfat";
-    options = [
-      "fmask=0077"
-      "dmask=0077"
-    ];
-  };
-
   swapDevices = [];
 
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp7s0f4u1u4.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlo1.useDHCP = lib.mkDefault true;
-
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/laptop/home.nix

@@ -1,6 +1,7 @@
 {
   config,
   inputs,
+  lib,
   ...
 }: {
   imports = [
@@ -23,6 +24,8 @@
     ../../home/programs/tui/nix-utils
     ../../home/programs/tui/spotatui
     ../../home/programs/tui/elio
+    ../../home/programs/tui/wikiman
+    ../../home/programs/tui/navi
     ../../home/programs/tui/pkgs.nix
 
     ## GROUPS
@@ -42,14 +45,31 @@
     ../../home/system/hypridle
 
     ./variables.nix # Mostly user-specific configuration
-    ./secrets # CHANGEME: You should probably remove this line, this is where I store my secrets
   ];
 
   home = {
     inherit (config.var) username;
     homeDirectory = "/home/" + config.var.username;
-    file.".face" = {
+
-      source = ./profile_picture.png;
+    persistence."/persist" = lib.mkIf (config.var.impermanenceEnabled or false) {
+      directories = [
+        ".config/nixos" # this repo itself (nixy manages it here)
+        ".local/share"
+        ".local/state"
+        ".cache"
+        ".steam"
+        "Notes"
+        "Projects"
+        "Documents"
+        "Downloads"
+        "Pictures"
+        "Videos"
+      ];
+
+      files = [
+        ".ssh/known_hosts"
+        ".config/sops/age/keys.txt"
+      ];
     };
 
     sessionVariables = {

hosts/laptop/persistence.nix

@@ -0,0 +1,29 @@
+# Impermanence: declares what should survive a wipe of "/".
+{
+  environment.persistence."/persist" = {
+    hideMounts = true;
+
+    directories = [
+      "/etc/NetworkManager/system-connections" # Wifi connections, VPN
+      "/var/lib/bluetooth" # Bluetooth connections
+      "/var/lib/nixos" # keeps uid/gid stable across boots
+      "/var/lib/systemd/coredump"
+      "/var/lib/upower" # battery calibration state
+      "/var/lib/systemd/backlight" # remembers screen brightness
+      "/var/lib/systemd/timers" # last-run timestamps (e.g. nix gc weekly)
+      "/var/log"
+      "/var/cache/tuigreet"
+      "/var/cache/vulnix"
+      "/var/db/sudo/lectured" # remembers that the sudo lecture was already shown
+    ];
+
+    files = [
+      "/etc/machine-id"
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/etc/ssh/ssh_host_ed25519_key.pub"
+      "/etc/ssh/ssh_host_rsa_key"
+      "/etc/ssh/ssh_host_rsa_key.pub"
+      "/var/lib/systemd/random-seed" # avoid a weak entropy pool on first boot
+    ];
+  };
+}

hosts/laptop/secrets/default.nix

@@ -1,62 +1,52 @@
 # Those are my secrets, encrypted with sops
 # You shouldn't import this file, unless you edit it
 {
-  inputs,
   pkgs,
   config,
   ...
 }: let
-  home = config.home.homeDirectory;
+  username = config.var.username;
+  home = "/home/${username}";
 in {
-  imports = [inputs.sops-nix.homeManagerModules.sops];
-
   sops = {
     age.keyFile = "${home}/.config/sops/age/keys.txt";
     defaultSopsFile = ./secrets.yaml;
     secrets = {
       ssh-config = {
+        owner = username;
+        mode = "0600";
         path = "${home}/.ssh/config";
       };
-      github-key = {
+      ssh-github-key = {
+        owner = username;
+        mode = "0600";
         path = "${home}/.ssh/github";
       };
-      jack-key = {
+      anotherhadi-pgp-key = {
+        owner = username;
+        mode = "0600";
+        path = "${home}/.ssh/anotherhadi-priv.asc";
+      };
+      ssh-jack-key = {
+        owner = username;
+        mode = "0600";
         path = "${home}/.ssh/jack";
       };
       signing-key = {
+        owner = username;
+        mode = "0600";
         path = "${home}/.ssh/key";
       };
       signing-pub-key = {
+        owner = username;
+        mode = "0600";
         path = "${home}/.ssh/key.pub";
       };
     };
   };
 
-  home.file.".config/nixos/.sops.yaml".text = ''
+  environment.systemPackages = with pkgs; [
-    keys:
-      - &primary age12yvtj49pfh3fqzqflscm0ek4yzrjhr6cqhn7x89gdxnlykq0xudq5c7334
-      - &work age1c8pawdsxptfslgrz2c56s39mrtnjzc5mm3hfzgr2wdwu2v6vfsdsupjsq6
-    creation_rules:
-      - path_regex: hosts/laptop/secrets/secrets.yaml$
-        key_groups:
-          - age:
-            - *primary
-      - path_regex: hosts/server/secrets/secrets.yaml$
-        key_groups:
-          - age:
-            - *primary
-      - path_regex: hosts/work/secrets/secrets.yaml$
-        key_groups:
-          - age:
-            - *work
-  '';
-
-  home.packages = with pkgs; [
     sops
     age
   ];
-
-  wayland.windowManager.hyprland.settings.exec-once = [
-    "systemctl --user start sops-nix"
-  ];
 }

hosts/laptop/usbguard.nix

@@ -0,0 +1,30 @@
+# USBGuard:
+# The following line allow all USB devices until a proper policy is configured.
+# Run `sudo usbguard generate-policy` with your devices plugged in,
+# then set rules = "<output>" and switch implicitPolicyTarget to "block".
+# services.usbguard.implicitPolicyTarget = lib.mkForce "allow";
+{
+  services.usbguard = {
+    enable = true;
+    implicitPolicyTarget = "block";
+    IPCAllowedUsers = [
+      "root"
+    ];
+    rules = ''
+      allow id 13fd:5900 name "External"
+      allow id 1d6b:0003 name "xHCI Host Controller"
+      allow id 1d6b:0002 name "xHCI Host Controller"
+      allow id 0bda:c85c name "Bluetooth Radio"
+      allow id 30c9:009f name "HP True Vision FHD Camera"
+      allow id 03f0:036b name "HP USB-C Dock G5"
+      allow id 03f0:066b name "HP USB-C Dock G5"
+      allow id 03f0:056b name "USB Audio"
+      allow id 0bda:8153 name "USB 10/100/1000 LAN"
+      allow id 046d:0ab7 name "Blue Microphones"
+      allow id 03f0:076b name "USB5734"
+      allow id 1532:02a1 name "Razer Ornata V3"
+      allow id 03f0:046b name "HP USB-C Dock G5"
+      allow id 03f0:086b name "USB2734"
+    '';
+  };
+}

hosts/laptop/variables.nix

@@ -26,6 +26,7 @@
 
     autoUpgrade = false;
     autoGarbageCollector = true;
+    impermanenceEnabled = true;
   };
 
   # DON'T TOUCH THIS

hosts/laptop/wireguard.nix

@@ -5,8 +5,6 @@
 }: let
   vpnConnection = "wg-vpn";
 
-  # Same OSD mechanism as home/system/waybar/scripts.nix's waybar-osd: drop the
-  # text in /tmp/waybar-osd and nudge waybar's custom/osd module to show it.
   toggleVpn = pkgs.writeShellScript "toggle-wg-vpn" ''
     set -euo pipefail
     nmcli="${pkgs.networkmanager}/bin/nmcli"
@@ -20,7 +18,7 @@
     fi
 
     printf '%s' "$OSD_TEXT" > /tmp/waybar-osd
-    ${pkgs.procps}/bin/pkill -x -RTMIN+8 waybar 2>/dev/null || true
+    ${pkgs.procps}/bin/pkill -f -RTMIN+8 '^waybar$' 2>/dev/null || true
   '';
 in {
   environment.systemPackages = [
@@ -36,10 +34,7 @@ in {
   ];
 
   sops = {
-    age.keyFile = "/home/hadi/.config/sops/age/keys.txt";
-    defaultSopsFile = ./secrets/secrets.yaml;
     secrets.wireguard-private-key = {};
-
     templates."wg-vpn.nmconnection" = {
       path = "/etc/NetworkManager/system-connections/wg-vpn.nmconnection";
       mode = "0600";

hosts/server/configuration.nix

@@ -16,17 +16,13 @@
     ../../server-modules/adguardhome.nix
     ../../server-modules/arr.nix
     ../../server-modules/blog.nix
-    ../../server-modules/awesome-wallpapers.nix
+    ../../server-modules/bentopdf.nix
-    ../../server-modules/iknowyou.nix
-    ../../server-modules/stirling-pdf.nix
     ../../server-modules/cyberchef.nix
     ../../server-modules/mazanoke.nix
-    ../../server-modules/kernel-hardening.nix
+    ../../nixos/kernel-hardening.nix
     ../../server-modules/fail2ban.nix
     ../../server-modules/default-creds.nix
-    ../../server-modules/umami.nix
     ../../server-modules/gitea.nix
-    ../../server-modules/mealie.nix
 
     # You should let those lines as is
     ./hardware-configuration.nix
@@ -38,5 +34,5 @@
   home-manager.users."${config.var.username}" = import ./home.nix;
 
   # Don't touch this
-  system.stateVersion = "24.05";
+  system.stateVersion = "26.05";
 }

hosts/server/flake.nix

@@ -6,13 +6,19 @@
 }:
 nixpkgs.lib.nixosSystem {
   modules = [
-    {_module.args = {inherit inputs pkgs-unstable;};}
+    {
+      nixpkgs.overlays = [
+        inputs.nur.overlays.default
+      ];
+      _module.args = {inherit inputs pkgs-unstable;};
+    }
     inputs.home-manager.nixosModules.home-manager
     inputs.stylix.nixosModules.stylix
     inputs.sops-nix.nixosModules.sops
     inputs.nixarr.nixosModules.default
     inputs.nix-index-database.nixosModules.default
     inputs.default-creds.nixosModules.default
+    inputs.impermanence.nixosModules.impermanence
     ./configuration.nix
   ];
 }

hosts/server/home.nix

@@ -4,18 +4,23 @@
   ...
 }: {
   imports = [
-    # Mostly user-specific configuration
+    ## TUI
-    ./variables.nix
-
-    # Programs
     inputs.nvf-config.homeManagerModules.default
+    ../../home/programs/tui/ilovetui
     ../../home/programs/tui/shell
     ../../home/programs/tui/git
     ../../home/programs/tui/git/lazygit.nix
+    ../../home/programs/tui/git/signing.nix # CHANGEME: Change the key or remove this file
     ../../home/programs/tui/nixy
     ../../home/programs/tui/nix-utils
+    ../../home/programs/tui/elio
+    ../../home/programs/tui/wikiman
+    ../../home/programs/tui/pkgs.nix
 
     ../../home/programs/group/dev.nix
+
+    # Mostly user-specific configuration
+    ./variables.nix
   ];
 
   home = {
@@ -23,7 +28,7 @@
     homeDirectory = "/home/" + config.var.username;
 
     # Don't touch this
-    stateVersion = "24.05";
+    stateVersion = "26.05";
   };
 
   programs.home-manager.enable = true;

hosts/server/secrets/default.nix

@@ -8,7 +8,7 @@
         path = "/home/hadi/.ssh/config";
         mode = "0600";
       };
-      github-key = {
+      ssh-github-key = {
         owner = "hadi";
         path = "/home/hadi/.ssh/github";
         mode = "0600";

hosts/work/configuration.nix

@@ -7,13 +7,20 @@
     ../../nixos/nix.nix
     ../../nixos/systemd-boot.nix
     ../../nixos/tuigreet.nix
-    ../../nixos/usbguard.nix
+    ../../nixos/autologin.nix # Skip first TUIGreet login, use LUKS password to unlock the keyring
     ../../nixos/users.nix
     ../../nixos/utils.nix
     ../../nixos/hyprland.nix
-    ../../nixos/docker.nix
+    ../../nixos/kernel-hardening.nix
+    ../../nixos/vulnix.nix
     ../../home/programs/gui/helium/system.nix # I hate browser's configuration..
 
+    # CHANGEME: You should probably remove those things:
+    ./persistence.nix # impermanence: what to keep once "/" is wiped on boot
+    ./usbguard.nix
+    ./disko.nix
+    ./secrets
+
     # You should let those lines as is
     ./hardware-configuration.nix
     ./variables.nix
@@ -21,20 +28,7 @@
 
   home-manager.users."${config.var.username}" = import ./home.nix;
 
-  # USBGuard:
+  users.users.${config.var.username}.hashedPassword = "$y$j9T$quUlRuvuYJ18asD8SUrh11$0mHCP7ZRIOYjNHY0oT.aFfVho1V0M65eClLzVo0RARD"; # CHANGEME: This is my password
-  # Allow all USB devices until a proper policy is configured.
-  # Run `sudo usbguard generate-policy` with your devices plugged in,
-  # then set rules = "<output>" and switch implicitPolicyTarget to "block".
-  # services.usbguard.implicitPolicyTarget = lib.mkForce "allow";
-  services.usbguard.rules = ''
-    allow id 1d6b:0002 serial "0000:00:14.0" name "xHCI Host Controller" hash "jEP/6WzviqdJ5VSeTUY8PatCNBKeaREvo2OqdplND/o=" parent-hash "rV9bfLq7c2eA4tYjVjwO4bxhm+y6GgZpl9J60L0fBkY=" with-interface 09:00:00 with-connect-type ""
-    allow id 1d6b:0003 serial "0000:00:14.0" name "xHCI Host Controller" hash "prM+Jby/bFHCn2lNjQdAMbgc6tse3xVx+hZwjOPHSdQ=" parent-hash "rV9bfLq7c2eA4tYjVjwO4bxhm+y6GgZpl9J60L0fBkY=" with-interface 09:00:00 with-connect-type ""
-    allow id 17ef:6190 serial "" name "Lenovo Calliope USB Keyboard G2" hash "CfZ9R/aoXGm7BN/ojVEzKQwVoxCUtRWMuACrE7BL/5Y=" parent-hash "jEP/6WzviqdJ5VSeTUY8PatCNBKeaREvo2OqdplND/o=" via-port "1-10" with-interface { 03:01:01 03:00:00 } with-connect-type "hotplug"
-    allow id 0781:5581 name " SanDisk 3.2Gen1"
-    allow id 17ef:608d name "Lenovo USB Optical Mouse"
-  '';
-
-  networking.firewall.allowedTCPPorts = [9001];
 
   # Don't touch this
   system.stateVersion = "26.05";

hosts/work/disko.nix

@@ -0,0 +1,64 @@
+{
+  disko.devices = {
+    nodev = {
+      "/" = {
+        fsType = "tmpfs";
+        mountOptions = [
+          "defaults"
+          "size=12G"
+          "mode=755"
+        ];
+      };
+    };
+
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/disk/by-id/nvme-SK_hynix_PVC10_HFS512GEM9X173N_5MF4N00141310464Q";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = ["fmask=0077" "dmask=0077"];
+              };
+            };
+
+            luks = {
+              size = "100%";
+              content = {
+                type = "luks";
+                name = "crypted";
+                settings = {
+                  allowDiscards = true;
+                  bypassWorkqueues = true;
+                };
+                content = {
+                  type = "btrfs";
+                  extraArgs = ["-f"];
+                  subvolumes = {
+                    "/nix" = {
+                      mountpoint = "/nix";
+                      mountOptions = ["compress=zstd" "noatime"];
+                    };
+                    "/persist" = {
+                      mountpoint = "/persist";
+                      mountOptions = ["compress=zstd" "noatime"];
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+
+  fileSystems."/persist".neededForBoot = true;
+}

hosts/work/flake.nix

@@ -14,8 +14,12 @@ nixpkgs.lib.nixosSystem {
     }
     inputs.home-manager.nixosModules.home-manager
     inputs.stylix.nixosModules.stylix
+    inputs.sops-nix.nixosModules.sops
     inputs.nix-index-database.nixosModules.default
     inputs.helium-browser.nixosModules.default
+    inputs.impermanence.nixosModules.impermanence
+    inputs.disko.nixosModules.disko
+    ./disko.nix
     ./configuration.nix
   ];
 }

hosts/work/hardware-configuration.nix

@@ -1,6 +1,4 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# Hardware detection - filesystems are managed by disko.nix
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
 {
   config,
   lib,
@@ -11,32 +9,11 @@
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  boot.initrd.availableKernelModules = [
+  boot.initrd.availableKernelModules = ["xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod"];
-    "xhci_pci"
-    "ahci"
-    "nvme"
-    "usb_storage"
-    "usbhid"
-    "sd_mod"
-  ];
   boot.initrd.kernelModules = [];
   boot.kernelModules = ["kvm-intel"];
   boot.extraModulePackages = [];
 
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/5dbf85d3-d236-4af8-b489-d6066bfe1eb7";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/043E-1755";
-    fsType = "vfat";
-    options = [
-      "fmask=0077"
-      "dmask=0077"
-    ];
-  };
-
   swapDevices = [];
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";

hosts/work/home.nix

@@ -1,6 +1,7 @@
 {
   config,
   inputs,
+  lib,
   ...
 }: {
   imports = [
@@ -14,12 +15,16 @@
     ## TUI
     inputs.nvf-config.homeManagerModules.default
     ../../home/programs/tui/ghostty
+    ../../home/programs/tui/ilovetui
     ../../home/programs/tui/shell
     ../../home/programs/tui/git
     ../../home/programs/tui/git/lazygit.nix
     ../../home/programs/tui/nixy
     ../../home/programs/tui/nix-utils
     ../../home/programs/tui/spotatui
+    ../../home/programs/tui/elio
+    ../../home/programs/tui/wikiman
+    ../../home/programs/tui/navi
     ../../home/programs/tui/pkgs.nix
 
     ## GROUPS
@@ -33,19 +38,38 @@
     ../../home/system/swaync
     ../../home/system/tofi
     ../../home/system/mime
-    ../../home/system/termfilechooser
     ../../home/system/udiskie
+    ../../home/system/termfilechooser
     ../../home/system/clipboard
     ../../home/system/hypridle
 
     ./variables.nix # Mostly user-specific configuration
-    ./secrets # CHANGEME: You should probably remove this line, this is where I store my secrets
   ];
 
   home = {
     inherit (config.var) username;
     homeDirectory = "/home/" + config.var.username;
 
+    persistence."/persist" = lib.mkIf (config.var.impermanenceEnabled or false) {
+      directories = [
+        ".config/nixos" # this repo itself (nixy manages it here)
+        ".local/share"
+        ".local/state"
+        ".cache"
+        "Notes"
+        "Projects"
+        "Documents"
+        "Downloads"
+        "Pictures"
+        "Videos"
+      ];
+
+      files = [
+        ".ssh/known_hosts"
+        ".config/sops/age/keys.txt"
+      ];
+    };
+
     # Don't touch this
     stateVersion = "26.05";
   };

hosts/work/persistence.nix

@@ -0,0 +1,29 @@
+# Impermanence: declares what should survive a wipe of "/".
+{
+  environment.persistence."/persist" = {
+    hideMounts = true;
+
+    directories = [
+      "/etc/NetworkManager/system-connections" # Wifi connections, VPN
+      "/var/lib/bluetooth" # Bluetooth connections
+      "/var/lib/nixos" # keeps uid/gid stable across boots
+      "/var/lib/systemd/coredump"
+      "/var/lib/upower" # battery calibration state
+      "/var/lib/systemd/backlight" # remembers screen brightness
+      "/var/lib/systemd/timers" # last-run timestamps (e.g. nix gc weekly)
+      "/var/log"
+      "/var/cache/tuigreet"
+      "/var/cache/vulnix"
+      "/var/db/sudo/lectured" # remembers that the sudo lecture was already shown
+    ];
+
+    files = [
+      "/etc/machine-id"
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/etc/ssh/ssh_host_ed25519_key.pub"
+      "/etc/ssh/ssh_host_rsa_key"
+      "/etc/ssh/ssh_host_rsa_key.pub"
+      "/var/lib/systemd/random-seed" # avoid a weak entropy pool on first boot
+    ];
+  };
+}

hosts/work/secrets/default.nix

@@ -1,59 +1,42 @@
 # Those are my secrets, encrypted with sops
 # You shouldn't import this file, unless you edit it
 {
-  inputs,
   pkgs,
   config,
   ...
 }: let
-  home = config.home.homeDirectory;
+  username = config.var.username;
+  home = "/home/${username}";
 in {
-  imports = [inputs.sops-nix.homeManagerModules.sops];
-
   sops = {
     age.keyFile = "${home}/.config/sops/age/keys.txt";
     defaultSopsFile = ./secrets.yaml;
     secrets = {
       ssh-config = {
+        owner = username;
+        mode = "0600";
         path = "${home}/.ssh/config";
       };
       netrc = {
+        owner = username;
+        mode = "0600";
         path = "${home}/.netrc";
       };
-      github-key = {
+      ssh-github-key = {
+        owner = username;
+        mode = "0600";
         path = "${home}/.ssh/github";
       };
-      gitlab-key = {
+      ssh-gitlab-key = {
+        owner = username;
+        mode = "0600";
         path = "${home}/.ssh/gitlab";
       };
     };
   };
 
-  home.file.".config/nixos/.sops.yaml".text = ''
+  environment.systemPackages = with pkgs; [
-    keys:
-      - &primary age12yvtj49pfh3fqzqflscm0ek4yzrjhr6cqhn7x89gdxnlykq0xudq5c7334
-      - &work age1c8pawdsxptfslgrz2c56s39mrtnjzc5mm3hfzgr2wdwu2v6vfsdsupjsq6
-    creation_rules:
-      - path_regex: hosts/laptop/secrets/secrets.yaml$
-        key_groups:
-          - age:
-            - *primary
-      - path_regex: hosts/server/secrets/secrets.yaml$
-        key_groups:
-          - age:
-            - *primary
-      - path_regex: hosts/work/secrets/secrets.yaml$
-        key_groups:
-          - age:
-            - *work
-  '';
-
-  home.packages = with pkgs; [
     sops
     age
   ];
-
-  wayland.windowManager.hyprland.settings.exec-once = [
-    "systemctl --user start sops-nix"
-  ];
 }

hosts/work/secrets/secrets.yaml

@@ -1,19 +1,28 @@
-ssh-config: ENC[AES256_GCM,data:npBcAOSwHpApUASlZmRo4stwMrOjdrdmhfYwumjbTpcq8aQ2ybV8le7cjNdVqIyxgwxUFV4/tGfmsq4nlrWIO/85spwfC5DyPGaZ848NI3UZJj8k2GKuw5qk/xGsTveNhq+vNZQcHeL4aeXF2TRmFLDHYGTku9anFL7FWkQ75MmGW78XfPUEyZJ52ylXq3gkYeVSrl6cXuwJw/QBlu+XTgFk4MM+E5BTXBFFNJOYkIt4GwWX7wdI+QqPEof8J0ENYdxUAMKMueL4pLNclWP0fu7QC7gwwRJWjauCNElJiDhpVFa6WukJV/Ut+I30FH9cJtj0rSodeu0hq2fWaiQ0wVbQudxi0JcnxJQs+B9nb6kpF+TN0MiD,iv:c7DMZSmlgMMnNlR0/kNRKPYjCzvNQJ46mZzojHppSg8=,tag:ausjsFk0H9nOiiMebHXSUg==,type:str]
+ssh-config: ENC[AES256_GCM,data:yTlt8SYPiON8aabbpQ9fE02hvp/u4oDmLaLuADzdOGdAL12MNe1QnNCND3lQ/nT+uxwm8k7OxExBfc70osLPjiq/CjNk1NOaO1nmBOXZqugnf33dF19P8SCMT2KtZTI1tYU2Kd5GmwpnozU6Qh0uJH+0ebR2tQnLChl16ap9fc6rg3AbD+XknSJ3+TndgZPBy4mN/MzT/GFL2kBDbYCmLoMXWDKxCM6ta1NvLRD8W7EBMeh/CNfkU+cw1kPjgPudDBP047VFudnqiueEAAigk3imqPyDFE1Jz4ouvVuLQz/f1BWnyZon3+sgHESAMRtAP3Lt7zo3s4PTJ04ohB4gk6K2fGBsFdyaWJp4uR8FMOhXrwG813KI,iv:W6bcO9ElLJ7YvN6PenqWNQnNSLi2WxZsjBc/adKdjeg=,tag:zKdx+RFXiOKpsY8EOGs46g==,type:str]
-netrc: ENC[AES256_GCM,data:EOpuZhDVXe7Q4P/98C3gtEvkdawI26d4oX/wRNytyp/mAdkHytXiLpFdsuO/3DADOG8h1CCo1UTs9ex+bqoD/LdChdp7INfNDSQ+aDxTiG0rLBgjvy8TIj8=,iv:tc/RbN1Upbjv+3rU5zUR3P//a1Hj1xODInLMShg4i1Y=,tag:7E9G2g4g+eMeJrwI20R/1g==,type:str]
+netrc: ENC[AES256_GCM,data:dlfPJqzz7EZ5JHBmQr7imMDlQv9KFfzDKY6YywtPWR7re7z9jBFgMoaPRk62ocCVltofak6Zrsr3on1jPrrpMwk4DQYFSnQ5tvUTi/1LJWpf9GgjokC5nqc=,iv:se1ysRyzZmB6MjU4heFrDLHe2bv8Ml2iLC4MuIcQW9Y=,tag:oyu8wfR+9hvOuKmsk2sDXw==,type:str]
-github-key: ENC[AES256_GCM,data:LRgJxUcKvLiqVJ3acz88oGp5qmvbo7QiyTbcft3YwZr+84CLbty9GCMrryJ8DFnP8GCGh+cCQxyvk/n/hA71qz7WZ6vIWbTN2byP0LHwDtQpugYOQi9z1Q04hQU3DYnsqKS8hu6bnUV/SzrDpAOXugyMGZL5dITitidgEsVG5PxB+bzTZGhg7EOcZISz955AEtD+bGedvxaryEcMYPTZwRHYPl2+wvKKIbeZMiup6i0BCCYktUUIb3qSBawbknZ9nfbQFODkZbNuEEhyU2MITz2ajQEx8AjE4eUutjBBQpJsesIhiAyq5H1AmJDzesC4iccFUpTVHFWf20clPX9QTH5njqbJ+aw1hIzU2ljK3vou1eZfoZ5HCdV3+tuQTJGYcfFY29/PaN4sENPhgbYm0p9Ui4UlMbte3FfmhSqdMzIc8jIB8dPMtoUM/NTjxof/dVu/TPMBTqnJplzNgvH1r2UcPToiAVfWj96tXsr2ESZfE9q9oQh9EGMcyGpXxq06Gni4tOnXDaF3oHyWAiJ6jP/wrYag5/67m4DwpFEymg+/ROKcy2ou3MYA+748ocKYFRoOVfY+SwcM4bxl6smstsRZW8SoDo6O9ikZII51LIN7X/6sQ0L+dgsBTT75zm8DOAFx2tnVgSPN8HYsd2tyHA3L6pYxAAGmY6lSGJfgmYP8hForSuZgCSxWhlwPHLLrU14A2wOFw+X5b4Zgy2ZdsTv3pHDn35a8lNwANKiWhXSc/irie0enmNjKyKTQDcVxq65mho2D+q7XANjDYtqQ8VX93HD2mLNljuA5GjJxtlTrw6V80AI9OiKjMlbEIG5BHIwOcDj5z53kZ2hPHIlSMCXVBXgBwZgPzw2GXDnIgsLFtGirVj/H+N8IWUioUgyimLjygPJwk8lcIrRCA279O7PnFAQKW3gchs4BN76vF41dR5AVJrDeWmSRonMHZEmGaHONEy+8pxFYf+u7hI6dC6YwrhNYHFgKymtKoYCGS1VTi3MXVPxzL4KxnS+StgfDqzf/FypqGD+c9Qkz3THw01J5SyQO4r7Y7cJFhpRvF09uDvT55BtUVuxexOUxANsmbzJCSKG0GLEWa6e+8owLHRbUh5fQQHN4WVMOCb2XLJkHM6YkZv+Sl3sjwUOtZS1+hRAz4I5BsxxNYK3OySwlzb5yBF2axC6z0DTpXNhyMUSEm2yI4gGroW+x0q8AK4dYelhcBC2QYYp8a2QkQu7vphg05QusuebZpjhRsFVphkjNmpEmAxAGRK/AaRr6YZtfVe/IsZgXso9xr75TBl/wee3jl5kLfBxs0q4lUCmfAcdfkT9EUWp6IOX6E+l7rgObuPLU5q64QtPzu5WDG2zM8cQWMbGt34EnKqSqwUPP3cmEVNuPSWh4bubLFKh+wcREMaMQ5j9GA9AXHDQnFsp3M9L3+0CBJIdBGnZetkjpg3l8INkqXzI35rNmJ6DkfmAE1a/SLLu9qkYK8HWi+1hsqKpNqv6bAp9iKSCb/tFc88wgNVh2n9UVZXBuWXCmtwc2BUfaN9/rw6L/+iqrTu9vrq0LTDSy8A1RuKr3aY+EyCN9gd+BVjEjpszFD8Jnrgj4qz5jihEgo8/AdGAS5/8QiMhdr18LQ5JaNC2EAsSswHx4MpOtFyyt84qJV0Ip4zegDJ0wMukjBJuRsZ6yR6ThgB0357pdmJsSXvj4XgevTwewWMmyX18kleac/i7oifv1xvp1gQrgigdp7s3tY91zH2o1LG/DqTbife7lgt9P6kR/LsHevJaVOytLv8DTO1ggTZjHDMT+A9DiUVot/gmhPcf5JwMnhV6PII5XtR4dy+lIs876JQFDm2YUgWNTPO+EJS/G63TgHxyJxBhumPCODzbYY58x+RFzykPvBuf+d6MpP2A2Pc2KPgW/SWc4XqTUVj6FIgwS58NJm06uLdh3vrEEUqO+fL6KOzmLYAa5TabqOv9oFGXYpOJ8sJtfGXIj6i+/aG4LrNZGeTzBzvz+W2jOcAH27qciC4YopLcP4NR6aXA3jYLVOLCnh54IfPVgMFFg0ZoqeaHEZN9jJIMsXNGbGsfT+f9FxN8JxAOM/iqqAVeCguXxNiKGJuCl+uQU2QdqyJVSgyq1xtXibRqGfJCDc+oGnXy5/jxjb0uDzhdYH94kfR4cj01MTDqt3kfFNjJtjl0KBR0oXj/E//PJwRgKJ3i0o5jYjRyLSqUfUJvEyiPrOmzAZrXQT8aYeOyB5MO4t0pdcMGBwcrWPkmxRiu3dERJHJttpFD03Iv5qFRZdNAsrfzu0dW59nO9x//Czxs3mcJfRyj2moAjMiyYC6vg5hPZso3lyDyJgvEySZ70GhJAfkb6peossSco7cdEw6lVisXDk9BuPArDn/kua94eUiajB1v3dwwvWNc535HQIQIbTd5478JESiFmB7mt5EXFXWVZWDhPRxkK8Px3KErl+4WBZec+glBSnrY1VqXDdBRG63etA/Ev2P4ih0MTEiv7/Bcbw9uzVsIIwhyopY3JtkJP/YqZpS9HSDzSTnkCcetO9YC6K1aqRjdxzDwfOqadu98gzXxZZOsGMFaBgptFqBwfrP5Z8+CWWebMIL2HzZCEhMZhHRFcfi5dI7t6R2AS6cqRFXQlaB75lYhOvFLmeuMtspjTUL2SQa1J17bZn9JYVNvBfL4twfZdp4zjo5DgFF5LiHC6uQa4LW3aWN8ujQ2CGRP67iRsIgedfrNZG6vdkwDMpzhyFFZXXrs507RTimTJGngX1kBWNb+j+b/RmjLsdONPPgCgE1o9fxJCfHM53zDHSlVcO8rsLideXY6HIUKgZC0khgpif5YBG+iHeqfT3ZBLwhLjK0GH6oP3TKw0xmHWq4Nb6C6OqdEIGQ7Rxt+rWOOPKhUMyzdhwz1YpeZA0zobRdR7isvmWGTMwxS56r+NuI6dOQL6xs+MlVFOPtyYNJAF2qWDHt0XOa/7Kv4XDRF7zDA19ZhqG8xDU9NtDwUDFrPBV5kO0TDSHuh7WShkzyXJYfc62WEIxIfbdMVX1m+mG20/f6Tk2r9wRxtAdxU4WqhK+YaZf8ZE6LfsNwJVyWI+o0VeK2v/2GkdUVeuDvq9aju+BipuUUHs9K09a4EyZOMNJtYUPj53W76rVP3rwAXr2jj+sWeDFCibsNTkv2KuyOzOM1cJCbONXNfqPAo5yx3cAwXp/ikz9kPMwmVqgIHGAd6QsTmaBXe4ex5C+GA1OBCMvk6ZAoSwRsAmoOZdharD+6dEEFL4HeqQx3XT+ddTRcGiQxgxuwPDAxcuCBkvqZSuVt1jb2c4WpL9id1S0TEsfzRtDj6VGM318jV3pj3pZvLXwVMJc7J4o6f0MNhjtgOZdcc302sh6HrusTn/zrRPpQVUPHkmmvmB4eP6IVT6aeKQS8Vt10PNtXbJKLYqFGnlTrrlHxBrGDMfz/j5ycai16VKeaKS1SnR1TQAReOaOksMc17xDVo9hnocOMs89tzCkDQ3e14lKngxWzmcxZAS6NGA5u/Y6x48b8OCiVbsbOxoeI5ouKd37TVPJEHo1VRPOhruVU50xv+eZtCbSkpTWPMq3r4AXZJjTKXn3aYTMQNMisR0yhto4dkdoNQw93ngm+MSduv+Sxt3VG108G6UDVEjE21ylMDueP5rDQ4G2sBPgIT/uSyFWan3tcP2eTFjps4BB0yzx4evjdUqu+Uqkvts7DOPY4MT8/g8YO41PvAW5sFItcwr6gLALyVSK8I3dzePeNELXK6daHLhkcI4EN4Yh3OO+kkT00X29A/V7wqIoV7T06FneC6Hg8rWyPHTFbAO0zqXK58Tp4E0kp0LkZHS+nLbmvuZOKSyQOMNWTvMYcagfRc+VgbAPjnZ9yRCXvWHY6N2z2CTKEioYoqt3Sgs8dgRHVZK/qGoO5lAWfdb6cTUFOZU0FnXYTS2ccQdOf8bJHOmldhavi0Oswe6wWpg3/Rp5Rvm0Y0g3r5CEF6lybkjM4K6eXc3DsFWcV43VPw/1w0sV3ErtuJHVyYxZzyS+iO0FC0Vpvru2emHoylbn0Tw3Cy31onjbnRlJfd9hzEZYiCUDj9l2P5b8Lrmw127NL25pzA+tdnRi55QS+ceUZ6omPqf7YsIO5AygG5+ZDCwFfjBX3tW5dpEFXzsdx1GWLopxT8RkPxjRjm8Z5EJpQtIYmptc3C6nBvPPCx0qVXJKo0LNbm9pZ1QPF0Vi/qS+V8PsL6dwPFH4t5jcKXJUdPNuiVLcqogKVicPSP+NviDn38UjWXixPHhkYk5Rv/2setqUXkKM+vePnOv7fNE3Px8QqJembwYkaj+T5do8st2KbJy08B2/l3gYvKoMZ5A3B3ypz3gghnEYPXb9uK1QyQIUsfV8tPFyFFWLVDQbSBSbqsWDfV1FThAJSi/FhcI4Al2JuqPvESQmjKW3qP6kk2GXQQco+R0lPszTEum1M9YQxq6YnRRy/wAPnHZgSgwNliNzx9d/FQbgo1kNg5LgdFjZh41ooPAubRyxfkHxzsVrnhjEV22wA/7dsAdllnnWRARQjBfn3tzENiG8YV/pWZF78aL8XZwapiPrWI=,iv:2Mvmz1CFO1112RxjIl6sxyNIDqa/cg00um6RcQaHNY8=,tag:+zygdwQdCBeBXVLvAj/jJQ==,type:str]
+ssh-github-key: ENC[AES256_GCM,data:Ed0l/lHDJo/jrxHU14VbsTrD9NfjhE+zsck3zde4wyIUZ2plZIYvTrnl3JMAWt/nXozFBijOoCKrYON+Os0ipfbLQBd5rZcQ/xeKjZN9J8CR6/xF6z4erKzelPfTIccN2+kojynjYfJK7ORzN+ZuUavcgNoAKwyXlifSizi/qf1V2qO28Qj5f/Yqes8DDhXtuT2IYMZ4NiV74kcUIxh3xrUseENtVWXRrleTAQyKDYy83hk8Wf1cvRM83mnNXx6ZL64K7U/1WwrYl+icyt7awu2jrAt7T6bgEcIcEsg3KwY144q5FeGvR8VK5pGlAN8NAczAjPO4SRS6uEf4Bh2pyLvRSYmgejU4kfvrhLpz7RXN9SJgvccDKMP3D/2qPPDTt9Ks0pdsusff5g1mpUWSvSubKxPh6dRlOjIt9i9MaSElDtg3RfmVJWvOy6sdJFm4V0YGSqIScICnyBWz47Z6KJO412nDV5m9DJU9OP9HQonvjdysfVBojqq+hOAn945j5PgWRcH6B/X5SqzYnyTCNbDJPnHDueuh+iPqjLWDNV2M767wAPeQuLKEuRyIj5Fzb7WNvV8Xqsw/1ePHJ+P68ylE5odJ6WXCUs+vCyUqXqtIzFOhTJlQ9782HNFbivg0CZFgGwikEEOirX5sZsjgyVp6rOtlW3UJro/yovy2YQE4/KW3h4Qwo0LGRaP0XrtgRai/fm3WFBq+MFouQbCuFHaLfUu+ejdz7X5dRMylj+7XxDu1C7Y06ab2Lw6AtYfhULCKCnkU+MK9Eu1iL/88I907P12EDdBSV1w3baHBRaoCSnTAhajV6kLr+kIcognZawiksi4UKieJx91g6vogyJgaZK0rie+aOI9KZbWqyihNKn2ZNiE8Rji+ewfrW/7sQDBA/hQHGZn8t1lnwkkwUcIk3UOQbWkUIvAkhrAVrMSo1IG+6g7QnDf9OhejkZiyHnVPmqEnDyBfIoHQNrydXfM6uEmEl7vokVgYhecgUV3RUw5aZyCaFDGPXHUuy7X6OFf8OBdb5ROfo30fGZw7lG1VmvNBmgUcc5LH29aPCDzbyaB2ArOqg2ftXx0ro+bV9PVX5n17BgM0Ze5GXR9yCPP2X/6mWR2VyQvXQ+85/HURqAXUMnpH+93nY/OKSRTzYMWMkhoMShfMF96OF/+mY3v+jhoRm6Da80fDGJhJ2BBd3eoZ1WMnS/AEXTLrbASI60h3offYaPQB7x0jZMdEbqLfUvdg0QBGRKK4lns6x/rNgzlFzf8xLMchqcX8C0795pbeAVPCIWrVMDIKj1UVTU/fI1M4QUHw2sNnBlpzBWs8TtDj9cng21nX0a6a6iRwFEJvlHjT4/gXFwHLCvtPWKa8s4qdL3BI1iSRvIGmVmy1yy7NGggrzkFjL65hTdaDC8Fcu4MWVob2lgQepd2SExiCD33ufb2NqUQw2UlVPWlAc0B73zDV4OuPct2eZyvxMdXDqCbv65iXYh974EqtpID2FgKLShmX2sjlEWsoqpAr6/9dqQaGBZZ0tq5gZJkjBkylEOxAr060GL86gBrVckUNC3URhDU9meXa58NEiBhCmbFDcUzyLNqpb1sbDaZMenLKqQASDkJjM8G/FrOhLENCTLH9Oe7SLVw1/Da/vYzKgGLtAPkAwAbFfS2EuNmkslVhshuFDqav/D6i7rZB8So0qfdAX1sbF88YC7rCscm4xGdhdvgldkbZGCRN3mQvwOvp0JdCHZHlQGuE4vWApykErtCg1kktY3+js0E1btPLz4XOdxId6CDWFqm01kTxrxEJj7b2+VKwcxCu5XZRaWyUuNZnqXqdzW2luGdGI9EUvqPnI7+6Rr5gK8KM20qaunjH9esTQvJB7B2Xmz6+yNSx4ocpxSmAGj0xCXWaDSXUx0YRy5U6oAb7ldL5RTO0L+13za+7Ufwas/8Bc/oS9174mmlFPJNfaPAaQDh8BemTsgI+MujTFm0HYzc0di3F+hffPJ4guvIkLDPQUC2cDNwgn+JxnCs+QlVl98EMjM+/1HCCsnhyxi1ZZMBAaKuhIH6SV1qiiH8ahmSY+v1XMKSB7OGSr9foLWFpsu77BIeTid4utHGOBeVMHfh7gNF9aq8HaJlQ1EX5pdTa4D/zI0DNUoPM5C/dmhRUqodR99IkmxD+a2J6DgC9I3H430CHlF/697Ch/YqrutmLLi5H4D9VY3Ya7+o2VECJVJZzCfv2jwXoLGvCGJPGLk9bcOUNy8XdHpneRpCo6ZKSKYumfXH0vNXPfbdQS1tptCc4Ligv4Cg6EVfu8/TLFIYzTc5BpokfLLf7O8TChDag2I6VcrmgY/Ua4lGsvSAxY3ZvRRvB+HkSJob4MXfw4MnR8XhJ066wOtqhrF2+9YwxMpxr7xMu+pOPciEEY5dWHvWL+ycgrONxqnO6pGxOmAmHifFqXKKLq3w9TL6Xe0anG1VbXnsQtKr4r4bhO/7Qzfdcw/5Gxl4zv4+tb/cVAamTcJzAm9y3vNCh20WkS7D3HJuXenqChBhpWkbqs5n322OYf7s5Tbt3P07584H20Mn216WtJKJgDqaOiNpDUnrC/VJcHp1HarP1eSGmVJr2vXmv0wgcdhbBocsSNwY2gFl24IrmUDINUCbhJkI1qoWu5t7J2NRLG86Z6oa3qvyYEZ1ZvCYuCKGMYoj571pksWEI5O8TmnDBYkQazYJhF4FcBo3MGKpp8b6VvI3Dv7XaSnp7tOAw0kAj9wwmAjK4/lPwQQjXavuwWzmaYpcCtsdBJkMdRttdRULffbmTvGlUslOMERtmidh3h0mqkvmOt4fvkb0a0i7rODAbAfKiAVBQJGZ4WFgU8/d63MHch/cCizNXCQU8zMfoQ5y5Aoa4Tfkm8f5qXgvnoJClBwguPKlqTir4Tsfc6mnbB6aBtSoOWgE5LZpPRnKwd6UiSQdotYxl7vUJIsqPPKNOlKfKPERwF34B4Ps861QRupezbb92M0N1EoLaxYUHP/know4WCOF9FlL+wKCQjfVjsMykwAc+qRTPE5pqK3LM6PANlpCOvlhRvC6kksAhvy815nspRsfrHHx4mmKGXZ47qwgdMUu599U/6k28gNUSmwzp8JFXfKc7R2b25BhlgpoHfG1t5u4RL/17j8ASD982byCHxwZgxxkKmhCe0QmfzA7eAw9eWJlvwe3pC+Q4ur2rgS0vuM9jcS+ZVDibAJFpPelQlC6jhly3bMb3BLoTnL9K6HxdS2e7Z6hoYZVfHiHO00eA/ajBQZVwglrmd/dODdxZBQ2GVLxEEivr1T9WYesu5PZFUDcMvnt6tAn1KyhNuh0Q45qyYE0N/3NwaqKIeg/tiirNgTGpzqHSJQoWnKOkh7uy04LC4ggTJR52dUfVtll1wsTNZcBaVFfXkYZEv2H7vW3XZYwEfifoUiB8F5lk4DHJvHXhocumItfx2zpPSsggVUC0K4vTRovFrOoCXYws+Xv+XAwZc04nNNVVEkrBOLC16To5T/OF1unZ1Fu7OmJwL6Jm/Iq35JzDp82eP6nk6elHQIyy5kjsmLL15SuTWdIX+kWTEJAzr4F+xKqK9+N/XcbM7zwyZxU5hL97dSS7wPVkrubQImGsUxrnUgUF4+kNiioCCmmvvVW1St0NR21TuliGjVwPdK1Zcsu1eEG4gzegblN2ERMwEQdaAGVlkR/dUPjj/6gs4BUbvbjCewXQR5Q8Dsjw3KlfIMi/3X5Sz4Kd4wgJPorCUVSk7SOZV4A7fj0gHJN6s1A1wuclpeAweHc00bFr3R6NKKShwwHcX700SfvEukVLhv1kPeB4di+EWttvsanWYxl2SauGyl5nVztNsHgHRVMb/1ZNhkmzEHqscSF/aB4FB9VPyRMS6oxMPRVrdIMGB+SmJylasf6kG8rufNRkVLnGkIeHQpJBgP4/ntzlm0PlJzrTCOTcEoxlcqPji1bIfg3TewXSFh6QkuS0xLhQ+xLKulE/oqmWDSccNqqet/qyWWPuOPPtWtNe6zuB7D9l0Wcl8ew9Ac9GI3iE6HkntLrQ1TFfuRggjTpsh6oqNFUEVvZvdMP0XcUMPMUn2dgqoYpcZm/68FR2/1HIBzOx+4zeJxJdt+6J3AyrZIHsPjZs2Jfx2PzUVoeVVioSu+QLSBd93pT2rRBCQlx6zBauGxAevrp707kkVCCp/yDBRCbUxk3Xa/B5u0d1oK0inuMyDjxjFT4vZnMbxbjojLIY2c6MXpIP6hZhoLuC4lO8lMS5QVc1Tknubog9L7Wcpz9PXsM8uiuLSm96k/URVuN+3cboF3q3MQA3GMYJNyr+6/EhymL2VnbJD7PBWdyLTgR02KWBIWVS13FVT7Wa0HV6mS3I7RuJn+HMU5JRdiSopQV+J1xx8BzFac08Jd6qJ+Bh5ZMkRdYP+iOfCl1vG/6IAYWqdSyoKSBlWHNfaxgw+joY0O95KwWk705NCNTwU22sq/gtohRgM7fcJrf0uacwx4F9+x1XxWlp6N3oxHUIfajiyAyJonUGdG/k42q3DcK+dMYy7R/IDnwmELA0/LgcMmyGk313p38wm7Qg+yZ7EBIPmP/QYgJlnoY=,iv:ElF3tykw7GKyhdb1YJBivwxT74DEWkdU1EOuOa/ntUM=,tag:+RYqptKt4L3UynBaoBmwNA==,type:str]
-gitlab-key: ENC[AES256_GCM,data:3vFa2NQIR0PVOJj8CTrGDRzFeo+G5P4e4LGYBAhjwnfm1q8D3pLHDcLP/Y5Rth5MpRtfYpomCV+8V7ia/zSqUh2N2toUEJyfkLEZOaIzcjli/EIKrnZriaqvQTPdfPzAskraYjpySbJimhkCM7xA9YjTdPIsz227M9GZbpXPHO2BkuqQf3zLGT0FnCR6gd+yE0NPgPw8ncmLnHfDET3lXbeVquxGqzndXaGAZU88sTwgBj4G6lM5aGJpzyGu+Wpx2ZeJQnUxxtBS9IaZXGUAR3ENdEPh4NsprxuEHsWFKj4uMYU0yGncPcsshdTL0OEfS0S9+E0EUIUwMdPmnEZDJBHAFo3tA/sMvY0sz7N17o5wg5PUEHwQIX2Xsxn6XBkfiM1DemV36KmaKQvJTc+Xv96XT1q6QY8ln5gPIqxb+5MJ1/DUR05vf6rzonso6XAPS18TTk6pnpI+0zfTcSE9K13xMiKSdHcciiaKzb6eYV3D+Grnw2YQVNBU58Of2ET6ljmHrcqmT+PPutbgXZ/+PtJmRN7vnjt3puDcrgcRxMvd93d4Xa4NH+Ex1oP8Dp0ihjO16uk2O2tMd0p4E8kOIPq6GqQKY1wlMX80NpFXnZmiN80UWUkbjulu+TU/MTp3dqs2K4Jct2edZhGgTPONraBcl1U1tr+iHtEPqOFRyriFIPHmkjVsJMUTvjGXCcgW2/w81RK6HWf1Ojqu7ruK5zMKgOBi3UpAEyUGNM4P4OKt9zfQbDcsOWMBJ/Q3+kzSK15XIocinTkfGVIZg5gRb6tiIox1YMnxwEn9j046Q9kWy8mCy0iAZVaTsComZYW9eV5lovl42QvWPTLM1GCU0W40jCc1Wtw9IVjgSDEO+TYRy1H8XMjlwADWw/U5N2o8BxYKkBCTiJ8lkxrLAbMCdLxjprbt0OgXqFO+BD1QTp+JP5zjg+Yrm+lyEXrG/8MCV81U+mYZLcTR1VRXhNGmbJ7JpJQfxvFNdYz0Q5cbqYE2/+metDgolKzv6RQaOFcyEgXSTJ85Pj6U2xrWvLrgnixtsLvQ1OULVd3aTEJk6v0USljKqvHyUrq56eIQqg4CtpHw2+AIicXF5L2YfnkIEvCp8Aj3z9YzGK31kVx0xcUO44eEY5g+tw2puMBY8h4vNbWQuZG2FZj6H8+iqfGEPXwNM87FHkk5fLxH8b9LjsIY69kY/oWBVeqwT7IDXgkyhnj4cHqVL+VJ1Xpx7nlMQAv31Jr92ZdxXVlacDe4VkVK2cDSQJmciM3rQKtechKJqiAWvyvftCQLmdHknjEusE1VLvTG72BAftQwxZgDFvLPPBJU8V/92CqNcJz8YFyrSB/zbI/+jkwa+xF0xGWpT2iTPYS5kdHJNclCnM9FvtYRV7LYCM3m4IWYK0GxMc9PlgYVlUzTnZtu6XLkt3qprYBkXcv0N2zj4vr1eGNuE89FnGr9RBj/MC7bMX3tEh1vzzeIYL8x/CVK2k6nJr0PXNvb8tzaYPI4ZKuTTDMOTLdcSBczY0846fSIbfTzPUENoQh2GHQGxlrMkhYcaDFwi5WBB+VUCZwjdYZ6Qie20DHZYg3GakxRBv62t3vaCLHtBLsGnY3U0TvDOMUmpbciO+yXHyhpw/maIRlHfh9g0ifXhSS14SJ5rqT8S+NDFiu7I++XlwKyyodFxPI36diPHGjZv5AoeG9Zf8Z3FhXuQcCMKQ7ZYOqlpOpXix3syee9v+Zys5ChOtb5JAO/sDIqVdJOIrsrBUv0sbQ+lpxxzwsKKUJQa5RotDp6zbMDaeoQaUiurgaRWDeKrvDc7HoYdu5HJVEwUCzBrugQi+agqsgv9eXfz8k91dDJ85DQAcIw4gJ3UMXmDu0lEhyfmL4zhQ4iH14TR5EnsBZ7aHkLbdGo8HVR3clyUV1pz4BmiQy3Ry7mpalPzggHSdDpRegqZ/v57U0n4koipaRpWx9+SzHrc5Htyv6BksY7P10jkPBND1V7v/SfKhybkqdxW6R8Y57n53SzD/D/qI71+usijxJ1dZFxzKAiOvGrm0bkWLKovNXAH7M9SQN5iE/CxjsRvCZg5vRSzzWWV2ugE03os6UKB4EVpe/1GhzITFx5nKTOMwIChCWZ+fMJSqjDW09kVigIzNYAkBLL/n0bVJmJFEed+kxO35+TNodE+L0w/1u3knoZ9Y/9J5ru5lZnFpa8Nl+J5pWoB02rVtFfDEsA00HuHxkY0cHLfS71IPiExsvvTlUUK8bhYXq4OIO3DaIUtI1kXZEc3+6/RXR/03QUEWFaOuZ7ZjuyyjlaZawcyBp32LRjBIC3Sj3HLyUyiCtSOCuLDuMQbD5P7iGJDGJupQfQOjQ73zaHsTjR3fi+vjRBii5zjEYYYEcGB3w+OxTnvc1gIsAGbJQ7XCp31is0RVnVpVPQmlRsZTswrVwUXx3ggpS6xIM4nWAi2e5lskxBono7ED0OWzBok76OTv0DwYKihdJUaGtcuUMdJ8WxJR1PE6Oe1wjrGoE7zXS9uQe2TFTMnpSxqsPyIJy30R1O5vSK/daZDCXCKs8924wKgmC5Z7gxU3/YTLv8wuJiZaYA85f16r0cuEj0z/a+wndf8x0vR+FybcCH6OvcYfVB5f0oGitY+M0F+dVkFNBGON/c7jv5v6bb/NhAPco3FmH0nify4a4oKqHdwBnV66Kq27DM1xfO7MRJRLRxoA/AcLuz308uPLxsQY6YoieAIFTI3clupk+OvorNDyIy8i9uSyYA7Y68HWzqwlbbNgd40EorIQBdVeBKBc6HFQiU0VzCj9IPIVy/E2KRrOFcfNYF5ABn+/sZ7rs6FR4V1fN02rHX2pT99h+wItyVO7urMoX4HigK415Fi3Cf2aFFZlUP6Cj4Xjm/bzWi3e6kqwwUY3tcILAiFXUthZz3RBw9KTwOL8cfPp+3cagNyO3mI9azyfuuk458vKSbgxpqIRFubTUDG59d5MiF1LF5Xuzjrmx1ZyJgMjLFl9tK3sZrcgzCvsCNZmYCjBb8dhfafeQ5bmw4aVlVJFEszPDYGJKs3ejXOZRiRwFrXPW4UyFNajiHYJKBpO5L9l6Pin90SJ+1fHXB3w8HOkJr3B/jYNXRiWS786YUn+zL4YDyecFtOFWgfWR6gA59nd4qI9dk01DS78P4dcEqPyhAFn+NL6YQ0wX6uoAhzHWaSXYtKqwE7huX10RxblUKxYjjNIsMdiSuz1qtivfGeRSY6hQx/pRSXTUbXsEUPGugoLXJacKUytq5PA9zfzideQw4M4uMAfs9+gxPRZbwvdFHDYbXWOBb+N0Ejv/dmK+7d/tFVP8wvQ4MMs1/7av4sCBYHx6XMbJq1VWKr+oi4jWDX7ayT7Me4kX6d+e9cw7gvxpp26687R1M0cEVWGnyql5w7nqNsBSm6EJASgu3PWtfMs61Z6uk+HvqrJsQLrvkfYhhdv0Q6Yn+OA0OjDEJtkdZrB9/x0mZhQdSbvto16yHPTmythygYh20DHPdfhA1Hj8PuOxqzOzRRjUvcUzt1zFMwP7xoh9OScF1gweVvioFzpQ+Wnwn3pej+z8meR1Pyb9AzSO3tyz4EWYaQG9U0tu0pTBsGIVLqhDgTh8coMVlEQLpWupADllM661pvSfDfZlbJt4rxlTAlruoFY+TF2sPZxragaQvWoTBqQEJWNuK1pakozf9R48MhmI3RV+y3XVJHV/s/jZrcId6C1CF3qQOiOn8hhGRVsvYiRVAqpth04dMfiZCpjGSBblTwI5zD8RjYPwwnRG+gDqko8zsR67A85P3JLnVT8V+0N2+7QxkfHcMWmCRauO70s5tc4RMNoCQk2gM1KYU6Ssul5mSsJ/F+2k1ACypyH/sY7NZV1jMtkoahlIt7nOjS4LN8nrzyBUj/wvpHvIT8Tx4wc8/3I57CL5ggNvikTu7xl0ta0kGuAP/hJThRxvBvyGkcHU5FDJhp3G7U4Vr4i5EB/MjPOtEd0a0cC4vnz1Xke6YTJl2j7NXMjt0TI/y25phsFN4OlLtbH1CrSNnw2vJlo+YmybCuUwuv+ortw+Zp8jjZXWkuuPT+pBRUvoTV9O40jUt3mKyFMjqCXo50xzNkxlGpFUl+EfAgqlveih4H6NJsGmHh6z/hVR5pPmMXyfZU+J2hwuDrbBjHTp/882pNdmaJA1fcX9VRti7bPKoNyY7f3fiucCmtiwg6jrRjABfZHdwj/xHxKwoL4YsA0VGZKbhk58+G61CM5iMqiWaEN4rC0WZnmPMAHc3272u8ue1hBoAbMnZnl2H9HdWQuLsFmqjWDW197bfEgsYKALY3fGGi/Rrt5WAoG73EjAmgK17WTKZhlJZCasZ/Hul9ax/2S/UhilJp41oXa/QsMtQGwau5jzXsGolfWhLBhTYMkCme2JD1sLoalKIkdPbmmtJx4VKlJq4Rc4WOKDXGhyfkUMhEutz8BHCjonJ8MTEyvopiqWPYepd1cqW+X2uXhLYLudLvvEGdMq0,iv:pbe2MtYmFmY/kS+gM9xyI6cXViVmzPB3H7XL1ZH47h0=,tag:NmSKMlAIEOWE8Jw/iy3+Xw==,type:str]
+ssh-gitlab-key: ENC[AES256_GCM,data:TvbxkmVE5mhbCyp//CPNFjQPUQfyMfDjqoGDjVY+4pWJ4pUyuEeF2Fi3x8pSnytprtv2sKa+TI7SCQ7zFi3UMXLrz7NI97jDX1tSMfN/FICz2bT1YAsblR1wRhINvqcVguVL6qz37ICNklf7IU7tcvLD8GMQY2fbnBWCmn5ORbol0Za7J7i5Ycf/rdyPPBw2acJ+0sDhx0Qv0GBlYIPlZXiv9KUJlUP0o3lG3aYTWY1WmDjnSEPNBtUidceDgnhH42shZO/5oXEUVy+CVjGM79Z1nqsBodwsJyAaMGXU+nSAXdtKXk5mAq+AMSQn+jFf1BE2Q/LC/5HHs4Inmioimu+Xc2DkqK1LixtHcD63lrJH0CGM/dzwYHC5EUIQ/bz7H8IPam9Ckk0GUR34Hdy3MPRe5f8eyVT15uxx+qK5xI/00yqw8ExFQ2c1wnQJb21Q32BraQYUqgk9Qr0VWkQMERWxrUebc5J3Blu70sv1KwSpiJKGoqu9PdjwAqQe6kJMl0umOEtfCJ0rshUIWN7UVBTbZaafD13CfZI5ugqA8Wrpb0JOqtgTQTGuhDQbF/Eq/DQ4I0Df1I7BdITLmS40/G30mR/OmfksKGUBi5bMW2PKJeBTv983F9FEBr7d8+x0+v23oGnrHMghjSMYUT3kTz2FtES8fUDSsD3FHs8GffT/9qAb0mEUqUQYkg4RhDiZByXDIwpeipw9asfhFgCoSmERBygRr7anAI3XO3TOONqu2dcDg4+uoa5cBykKX7tIJXRGjdCeeEtLRL4t8YWMYxbyycS2apOM7kspjosXAWNMIxLlJ1TbQd7DMiIV1RnmqLIRXLExcLpQCGR36vJFB2Izlde5zea44+X3GZy0jH4JqjgMwdvnpbM2qaJgSf4ejAfg4t9XcCIh26iZ6wNziGH9BVloBKe0XAZ46W1YSNAfmPIVVgspA9LNZToqPYZGAajpvPc2a3JgHjoFVDW6F/tGrr+3reBRaoaksVmDy/RO5hkJjLVdvs9g53QJz5+okQNB1uSw++6m7WrYz69G1b2A9DgZhL7EpwiLPmRYKg/Lj/mEZMoLWeW6tIPmOQpakf4d1y143g+oPCSkuMWZmCV5aIX53HmRtsGu/v+SMhnj1fhPny9iRNF8JgIX12ldUAkEwfPQBWhu/1Z++hWzClRNbxp6slaM76wRsl5aHgrq+63hDkWB81ujglyHV0Gz0DAQ5AehPKD1W9ejVLa/O7EPqNpNhI13Y0hjvWoKdnagZYVptvrznLLyGsPnQREoJhnJg62qPn0p+XN21t1eWBqY+LFsGw8t2kM5YLfU8bT/vVZdGspH63A/v4bUmq9pJlyIpJUnwEVX1Ui45v/HOrM3kDSEdY8pmysLBPIvdoK1RMbCvGcz2FmbPJouho4+dztKbcOVHVhCtSJp9HGLhzcv4gjUt5Bv/2q1HvImVZtDwhpaao11j6AAW0ZFdg0ZaftD9ux5tmchDrM5bbMnVKzvvQZDpM9Bi0nJoBZLGq90tioydkxpBNDcIWkzy9j3muUBhbpqxP3mRdtxNSq53u6yNMg25cR6eC393HIaPORK8QVs7xzwPtq5LuI0o9KS+AtO2OHTAvogU0joDY0TYyoRjgD21m6a4u8bSYkRlMCs/qIUgmNpIH4BEFDBVZ61sM+YJq6LvlX8XbPzT2aABoirpTxM/oQ/74r0I7gUo+Vj1dBmOulCN3yvbXrLbFbRCw24V0XRgFamlk6lt8iL9EsrXh7E5adrPCWOZ3L8v1NE4mW/MsKU4OILXF8CWSL1pPhJ0dnUhQbrAGfd10lExFu54kUEFQnRDPu0gn4syESrmtH+3oUpBd10QmlnarKh7vaeNOMJEtry94KxGDpGkJBnkaC7S8+SIegQAb58J0Gy8/JbX0VbuUozPd1uCdPPfNrCeL4XnYUUkYen8Uj1J4mFvs1gkq8weuQtx6WI5X5i68rWnEPqiihjGPbNxAnZUCml8qD+gJFW0zzRr79Mml+0dqO57rpdzpANyN9llqQeoscMKJrshZBfMEM57/1f73CB9VrlNMVZ2KS5aX8OPw3BrsLEDTNBp03jeqjbPQugeH07K575fiADNFEyLr5k1cwfd6OiKH0t779Vl/SEq/e3GxTDLFNT29deOm6m+8vLnvd1lNCeWdYUAtJGRdFd6tYm16wVxaTyfz6Uv9KzJt0bC5Jp0zAESh0n/hmh67TZNRMCGXS4nIsn+MD8udyfGQXqgIC25uKpyKvuk5eho0OCf2UujYefsUqYShjPOEtJDP9pI8zmyksXXRuQOTjougLykiq9kJeA97FQ02nR06AheERxeA4IQDNYsSndcNGV8aPqzjxWc05kL5D+7QSfs+uYTHb/6ZuwNlY18ofwH3yZkXgtSY14vLU2QajYC+mAaBcQsWCu+RVR1jL0JRt26ael1H7w08lT34V8ThcZmCFsHHHvhbgiMK1Ixk65wmviqzHqtZkVq8S4JAoau6SnlmIv4ukZ0iNjlnDlgXSvwp/oRJsTE9R2rC2wWaWZ5yhjEwr83aEMP367hGDfQVltu+VUqHW9ejfEBs5S2emXtXl8MJZpDFnJI0dG+XqXVsS6a4OUYfWVlD5KrZHBQ240dNyOBOYmAkAur/gMLvbw7LND5gVFaJObL2+vBEy9bKhhKzAITpVXdsdxlz29V7VR6B1AnC9HUViBgrX4E1b6Nka5LHgMkvxtSmiLnmiu/XVpuRLwrYpqh8gFxDTr+RsJv5TzGHz3ZidTtmqTW0XcOc7lVYyFDEbpDu8PjUrRf7UPKkmBmdv89pE+xzSr+pUgftUlaie1LnLxIiBAHjFbZ0K8sZi2o/zzz8mFb9tHXQY0QyO9d47iEJWb1O4uzYpDrU6nIMbIccZfCa4LEQf3AJGgWxw+vszS7Y4V+ABvn8MYbq0aHkr16C0xttXbcQRXKmXqhlFJ5TyPlPxIswBAppJDiRtiUtQv68eME/LeOaxcAeAEHE96PZrYbIYP27HCqgg3xmna+DcjDs/208BTboQ8XtW+Rl6IldXfMuPmB9B1bI7Zy2JVNpriwUBAAi7gWPX6oynIPqGWmIjwgypI2ByhK6TFzMkA9ID5OHR1j49FtKLa/cmMaY6pR0CG9OYwn7MKWKL9iuhcnQOBInOH7FWk086huQFqphSv/pYoU0eP04+GZuEprK9E5wGgOENtdQqexUkT288OZUWgkPwxtPXw/2Hl2PfEMzBPEN/KxyvruWUC17KC9VvfVOaxcA8vxRe4/QNKlkZ26nnz9vhPABHVxjVlw/F4XVgrx0+s6NbKPMjHaFyQaZ7DmwjjOQLhYWTY5/pfNNLShoJ6XyRhvGEkI9FFXVrFJq9j8w38f7yzb3TuT/bP8MYX8jwr22jMLKLeCgPFwhvEpBwyh3PvQoCQZeejnSiXs3rRxtyTC108LM5R/tNdZA6ykWlQYbAxxE0NZs/U+fu+TuJzM+mt84EzffNX9bx+vISkNL35ra5sioMK9ENIISSBAFm3VU3EcmfLfriETdU6bmsYWePwcbxhr/Ad8qjIkg5+h0dML0l9MUkb2AKGMRD6THBeWD5FvSBCupIpC4Qg5M1P9ZihwfpqOzQNSQN81yIMM3JxZa80QKj6ei9bH4an+K7KhQQT/t/kEH5LW+MjrnxqZeHBwcvrZHqiLELg8+b0vsdwolUTshTGhyVD+JqveG3uvHor+fsJ08ZmVsR99Wnj4piFJ1r7V5DxZi49V2SOTLKayZZm59j5z9QE43R68gQ3/EwsGo2qTOZw1KZWajbGaJ1vFaROA/Lywsy64n5nuyY6RMq9wkT2yozAb6185qdLS8j3jebX+282/kV7AtDxOEv2eoY2AFBeOpJVIEgu5XHg9H3obE0LW5hMzETCeEhTGLWBoiWDmVM4K0WnFhfcNeWmRfT1ggN+i8Tj5kd8BiisCgfMesMUQfWbSWPfJQY2xEY7iPqUzhlv1XiCkfqshpdYiOHrXJbjDj3zt5HId1JuwBusiDydnLCW7UJHo3zWMVUAXZZOe3FS19kWrYvQtC7hPixcKIIOv6BrGMGPAC9pkfLbNZY2oEcuiHHuk2QDDitD68TQLZvK3pKmn7D6f8jM52t/PAoeIzvoba7ciCxsHytpctmdb5zbf+eAvO21LNbeMlsQ8G7I2btPLmbNAb/qWgJpqrdgy8Fb9Cl9h/b9U7kf92ExhD38a0zG/9pVdX/g1GMXm6xvLku9HsGj414WrQOaEpg6FmKo7Ck7YbWa/QUF/FqMCNXPpUpmF7IYBiMEOl4++bm7s0lc1dRXJq8k4Nc191Io+gmc4kzcQLmMMlBuBNk5lfHAIG9tH5kNKS7U0UO10LKKepXMTv6Pu/KCGmhDtDCf33fzjyBSomuoqQ0q3xzCXjKziz5ky5j0sueAemJrfD2oDvKKHC3HD+z1+peYRarXwlUQ4BzWjNOjYs1A//iqFG/ksnr+PnUHTCebYECoacDAvtQx,iv:h87uW6VOwRubj19DKxEoddRN5/2v+vmKlBxfZnGjY70=,tag:SV17QrAMwJb0QWOXRbPdnw==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVby9Wa1NUUkpyeDMwU3dM
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBma2xHeGpudjVRMTQ2WFlZ
-            R0EyeFVtT0tJU0pKaWtXQzRkTDBPY3JjcTFrClNIQnl2WVorS0FZZjhicTQ5V2kx
+            aGJvNnJvM0hkQjM0MThZSjQvc1ErYXZRSDJjCkphZDZycUljcUhUQStNT1RFN29z
-            MUZTZWZtaUk2a1ZhUTBCUnhkWHFIMFUKLS0tIElLcjJLZWNLOUJYN0NNVGFNUEFN
+            djRrTzhTckt2K1I1TGsvRWFaeVdSK1kKLS0tIFBGdFFpV1lTNlFzMSt1TktDNk91
-            RkMrdTYwNkY1Tlc3M3dxTFdkRXJJZUEKUlYU45jXpS9hJO9Z/uAQ6XMj9QWgMMRI
+            NUphdlJ5ODZjNDZyTUl3OStpdmYrUWcKYKZ8pvGG1QkCBZTqVtFb5GIYWYfsr/Mc
-            LbJxvt48+yC+Y0XKOtDE0lHAuGNzUG8R/7FB1tTD8NCamBe46KGCIg==
+            +OGeP1hRwQzJ9+DLUgrsfK/8vr+0Y5q2Nej9gbfxyrnlszussbOADw==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1c8pawdsxptfslgrz2c56s39mrtnjzc5mm3hfzgr2wdwu2v6vfsdsupjsq6
-    lastmodified: "2026-07-01T12:18:22Z"
+        - enc: |
-    mac: ENC[AES256_GCM,data:rX8MoqaMAbfuMdcQMw8eDGXos3VgbA3VfNJJcGGk2xQPuTC7FW5S0BVuh68ajzVv0oaYtT8pBRktv9Lo2VDY6Mm4neVuF/9IgV0cTKwvx5ACjN40Zt7OU+QtlQK44kDXsJQFyV+BYHVNiW8jej1h9d7vSAgG0hD3GOpvtK6ZY6E=,iv:3B3COjvazDVRkUsuIiLlOCFqlE9ooFR8dC5PTXe/q28=,tag:QEqcRTks4zSX02qc9KDsrA==,type:str]
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0aWQ1NzVWc0lnMXBHZFZq
+            SEplcWMwc1R4NmkvdWdMQUJWY2R0dnRBeVVzCjBCNjVEc3hJazJzZXFFc0EzbXNV
+            enFtYnNVNzUwYVQ4RVUxWVhROFJhT2sKLS0tIGpWeHNwWm5NakFzY0JzYWxicHhk
+            MzVVaVdyOEtoUkF1aDY2UnBGbC9rbDgKoEUqT/OlVXYR5MVlpsnTY4NHa6yg3FzQ
+            WaBrZfGv2/dKeulFCKKFrT3ZG8TIbLTqdRoVIrUp1O+U3vObzY9fzA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age12yvtj49pfh3fqzqflscm0ek4yzrjhr6cqhn7x89gdxnlykq0xudq5c7334
+    lastmodified: "2026-08-17T12:19:14Z"
+    mac: ENC[AES256_GCM,data:2rK9RlYE7dX/c6zg3J1AeB1TI3v2XVhoUGsou0u35enhebzINUCYVC9HN9Te+6nWO/OVQ3i5vn+DwOZDbK2bfH88wqwIqI4o1Ztw2MW8/kzNJZhqv4QA4Xdo0ULD2TO3X95E1iEnuQIJ0c26gIuVdfsrQviBDbmBTMR/JVE6yHQ=,iv:kZ+2R0+Z64zAZb7ePDdJfPlo/BMFyLpAxK+7ZiDoKFI=,tag:xbf7xOYuG+Msoicx5qjyNw==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.13.1
+    version: 3.13.3

hosts/work/usbguard.nix

@@ -10,5 +10,12 @@
     IPCAllowedUsers = [
       "root"
     ];
+    rules = ''
+      allow id 1d6b:0002 name "xHCI Host Controller"
+      allow id 0951:1666 name "DataTraveler 3.0"
+      allow id 1d6b:0003 name "xHCI Host Controller"
+      allow id 0461:574a name "HP 125 USB Optical Mouse"
+      allow id 0461:554a name "HP 125 Wired Keyboard"
+    '';
   };
 }

hosts/work/variables.nix

@@ -21,11 +21,12 @@
 
     git = {
       username = "Hadi";
-      email = "hadi@example.com";
+      email = "hadi@example.fr";
     };
 
     autoUpgrade = false;
     autoGarbageCollector = true;
+    impermanenceEnabled = true;
   };
 
   # DON'T TOUCH THIS

nixos/autologin.nix

@@ -0,0 +1,27 @@
+# Autologin at boot: greetd starts your session directly on the first VT
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: {
+  services.greetd.settings.initial_session = {
+    command = "${pkgs.uwsm}/bin/uwsm start -e -D Hyprland hyprland.desktop";
+    user = config.var.username;
+  };
+
+  # Needed so the LUKS passphrase entered at boot is cached in the kernel
+  # keyring, where pam_fde_boot_pw can retrieve it (see below).
+  boot.initrd.systemd.enable = true;
+
+  security.pam.services.greetd.rules.session.fde_boot_pw = {
+    order = 12550; # kwallet=12500, gnome_keyring=12600: must run in between
+    control = "optional";
+    modulePath = "${pkgs.pam_fde_boot_pw}/lib/security/pam_fde_boot_pw.so";
+    args = ["inject_for=gkr"];
+  };
+
+  security.pam.services.login.enableGnomeKeyring = true;
+
+  systemd.services.greetd.serviceConfig.KeyringMode = lib.mkForce "shared";
+}

nixos/kernel-hardening.nix

@@ -1,4 +1,3 @@
-# Kernel hardening for the server
 {
   boot.kernel.sysctl = {
     # Restrict access to kernel logs and pointers
@@ -9,6 +8,18 @@
     "net.core.bpf_jit_harden" = 2;
     "kernel.unprivileged_bpf_disabled" = 1;
 
+    # Restrict ptrace to parent processes only
+    "kernel.yama.ptrace_scope" = 1;
+
+    # Disable kexec (loading a new kernel at runtime)
+    "kernel.kexec_load_disabled" = 1;
+
+    # Disable magic SysRq key
+    "kernel.sysrq" = 0;
+
+    # Restrict access to /proc for non-root users
+    "kernel.perf_event_paranoid" = 3;
+
     # Reverse path filtering (anti-spoofing)
     "net.ipv4.conf.all.rp_filter" = 1;
     "net.ipv4.conf.default.rp_filter" = 1;
@@ -29,7 +40,18 @@
     # Don't send ICMP redirects
     "net.ipv4.conf.all.send_redirects" = 0;
 
-    # Restrict ptrace to parent processes only
+    # Ignore bogus ICMP error responses
-    "kernel.yama.ptrace_scope" = 1;
+    "net.ipv4.icmp_ignore_bogus_error_responses" = 1;
+
+    # Protect against time-wait assassination
+    "net.ipv4.tcp_rfc1337" = 1;
   };
+
+  boot.kernelParams = [
+    "init_on_alloc=1" # zero freshly allocated kernel memory
+    "init_on_free=1" # zero freed kernel memory
+    "slab_nomerge" # don't merge slab caches of different sizes (harder heap grooming)
+    "page_alloc.shuffle=1" # randomize page allocator freelists
+    "randomize_kstack_offset=1" # randomize the kernel stack offset on syscall entry
+  ];
 }

nixos/omen.nix

@@ -1,68 +0,0 @@
-# Omen laptop configuration for NixOS
-# Import this only if you have an HP Omen laptop
-{
-  config,
-  pkgs,
-  ...
-}: let
-  hp-omen-linux-module = pkgs.callPackage (
-    {
-      kernel ? config.boot.kernelPackages.kernel,
-      stdenv,
-      fetchFromGitHub,
-    }:
-      stdenv.mkDerivation (finalAttrs: {
-        pname = "hp-omen-linux-module";
-        version = "rebase-6.15";
-        # Upstream only rebases per kernel branch and currently tops out at
-        # rebase-6.15, while linuxPackages_latest is already on 7.x. If the
-        # module ever fails to build against a newer kernel, either bump this
-        # to a fresh upstream branch or fall back to a stable kernel.
-        src = fetchFromGitHub {
-          owner = "ranisalt";
-          repo = "hp-omen-linux-module";
-          rev = "d4b9b5adb84581c3874ca3985dc749c40c3ece67"; # rebase-6.15
-          sha256 = "sha256-IOXHzcCB0n1InMjeIu3XYEJ4bhbHS3NIlS8/+4XIwkQ=";
-        };
-        setSourceRoot = ''
-          export sourceRoot=$(pwd)/${finalAttrs.src.name}/src
-        '';
-        nativeBuildInputs = kernel.moduleBuildDependencies;
-        makeFlags = [
-          "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-        ];
-        installPhase = ''
-          runHook preInstall
-          install hp-wmi.ko -Dm444 -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/platform/x86/hp/
-          runHook postInstall
-        '';
-      })
-  ) {kernel = config.boot.kernelPackages.kernel;};
-in {
-  boot.extraModulePackages = [hp-omen-linux-module];
-  boot.kernelModules = ["hp-wmi"];
-  boot.kernelParams = ["hp_wmi.force_slow_fan_control=1"];
-
-  users.groups.omen-rgb = {};
-  users.users.${config.var.username}.extraGroups = ["omen-rgb"];
-
-  systemd.tmpfiles.rules = [
-    "w /sys/devices/platform/hp-wmi/rgb_zones/zone00 0660 root omen-rgb -"
-    "w /sys/devices/platform/hp-wmi/rgb_zones/zone01 0660 root omen-rgb -"
-    "w /sys/devices/platform/hp-wmi/rgb_zones/zone02 0660 root omen-rgb -"
-    "w /sys/devices/platform/hp-wmi/rgb_zones/zone03 0660 root omen-rgb -"
-  ];
-
-  services.udev.extraRules = ''
-    SUBSYSTEM=="platform", KERNEL=="hp-wmi", ACTION=="add", \
-    RUN+="${pkgs.coreutils-full}/bin/sleep 2", \
-    RUN+="${pkgs.coreutils}/bin/chgrp omen-rgb /sys/devices/platform/hp-wmi/rgb_zones/zone00", \
-    RUN+="${pkgs.coreutils}/bin/chmod 0660 /sys/devices/platform/hp-wmi/rgb_zones/zone00", \
-    RUN+="${pkgs.coreutils}/bin/chgrp omen-rgb /sys/devices/platform/hp-wmi/rgb_zones/zone01", \
-    RUN+="${pkgs.coreutils}/bin/chmod 0660 /sys/devices/platform/hp-wmi/rgb_zones/zone01", \
-    RUN+="${pkgs.coreutils}/bin/chgrp omen-rgb /sys/devices/platform/hp-wmi/rgb_zones/zone02", \
-    RUN+="${pkgs.coreutils}/bin/chmod 0660 /sys/devices/platform/hp-wmi/rgb_zones/zone02", \
-    RUN+="${pkgs.coreutils}/bin/chgrp omen-rgb /sys/devices/platform/hp-wmi/rgb_zones/zone03", \
-    RUN+="${pkgs.coreutils}/bin/chmod 0660 /sys/devices/platform/hp-wmi/rgb_zones/zone03"
-  '';
-}

nixos/steam.nix

@@ -0,0 +1,30 @@
+# Source: https://github.com/Dylouwu/MyNixy/blob/main/nixos/steam.nix
+{
+  config,
+  pkgs,
+  ...
+}: {
+  programs.steam = {
+    enable = true;
+    gamescopeSession.enable = true;
+  };
+
+  environment.systemPackages = with pkgs; [
+    mangohud
+    protonup-ng
+  ];
+
+  environment.sessionVariables = {
+    STEAM_EXTRA_COMPAT_TOOLS_PATHS = "/home/${config.var.username}/.steam/root/compatibilitytools.d";
+  };
+
+  programs.gamemode.enable = true;
+}
+# Example of recommanded launch options for your games in Steam :
+# Regular gaming :
+# LD_PRELOAD="" gamescope -W 2560 -H 1440 -r 360 -f -- %command%
+# LD_PRELOAD="" gamescope -W 3440 -H 1440 -r 140 -f -- %command%
+# HDR gaming :
+# LD_PRELOAD="" ENABLE_HDR_WSI=1 gamescope -w 2560 -h 1440 -r 360 -f --hdr-enabled --hdr-debug-force-output --hdr-sdr-content-nits 600 -- env ENABLE_GAMESCOPE_WSI=1 DXVK_HDR=1 DISABLE_HDR_WSI=1 VKD3D_DISABLE_EXTENSIONS=VK_KHR_present_wait %command%
+# LD_PRELOAD="" removes a glitch causing games to slow down after roughly 24 minutes
+# For the rest of the command, you can change the values to match your screen resolution and refresh rate

nixos/tuigreet.nix

@@ -1,12 +1,11 @@
 {
   pkgs,
-  inputs,
   config,
   lib,
   ...
 }: let
   c = config.lib.stylix.colors;
-  tuigreet = inputs.notashelf-tuigreet.packages.${pkgs.stdenv.hostPlatform.system}.default;
+  tuigreet = pkgs.tuigreet;
 
   theme = lib.concatStringsSep ";" [
     "border=#${c.base0D}"

nixos/vulnix.nix

@@ -0,0 +1,27 @@
+# Vulnix scans the Nix store against the NVD CVE feed to find packages with
+# known vulnerabilities.
+{pkgs, ...}: {
+  environment.systemPackages = [pkgs.vulnix];
+
+  systemd.services.vulnix-scan = {
+    description = "Scan the system closure for known vulnerabilities (vulnix)";
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.vulnix}/bin/vulnix --system --cache-dir /var/cache/vulnix";
+      CacheDirectory = "vulnix";
+      # vulnix exits non-zero when it finds vulnerabilities; that's expected,
+      # don't let systemd treat the scan itself as a failure.
+      SuccessExitStatus = "1 2";
+    };
+  };
+
+  systemd.timers.vulnix-scan = {
+    description = "Daily vulnix scan";
+    wantedBy = ["timers.target"];
+    timerConfig = {
+      OnCalendar = "daily";
+      Persistent = true;
+      RandomizedDelaySec = "1h";
+    };
+  };
+}

server-modules/awesome-wallpapers.nix

@@ -1,41 +0,0 @@
-{
-  config,
-  inputs,
-  lib,
-  ...
-}: let
-  inherit (import ./mk-container.nix {inherit lib config;}) mkContainer;
-in {
-  imports = [
-    (mkContainer {
-      name = "wallpapers";
-      hostIp = "10.233.4.1";
-      containerIp = "10.233.4.2";
-      nixosConfig = {pkgs-unstable, ...}: {
-        services.nginx = {
-          enable = true;
-          virtualHosts."wallpapers" = {
-            root = "${inputs.awesome-wallpapers.packages.${pkgs-unstable.stdenv.hostPlatform.system}.default}/share/awesome-wallpapers";
-            listen = [
-              {
-                addr = "0.0.0.0";
-                port = 8080;
-              }
-            ];
-            locations."/" = {
-              tryFiles = "$uri $uri/ /index.html";
-            };
-            extraConfig = ''
-              port_in_redirect off;
-              absolute_redirect off;
-            '';
-          };
-        };
-        networking.firewall.allowedTCPPorts = [8080];
-        system.stateVersion = "24.05";
-      };
-    })
-  ];
-
-  services.cloudflared.tunnels."${config.var.tunnelId}".ingress."wallpapers.${config.var.domain}" = "http://10.233.4.2:8080";
-}

server-modules/bentopdf.nix

@@ -7,13 +7,22 @@
 in {
   imports = [
     (mkContainer {
-      name = "stirling-pdf";
+      name = "bentopdf";
       hostIp = "10.233.9.1";
       containerIp = "10.233.9.2";
       nixosConfig = {...}: {
-        services.stirling-pdf = {
+        services.bentopdf = {
           enable = true;
-          environment."SERVER_PORT" = "8080";
+          domain = "bentopdf";
+          nginx = {
+            enable = true;
+            virtualHost.listen = [
+              {
+                addr = "0.0.0.0";
+                port = 8080;
+              }
+            ];
+          };
         };
         networking.firewall.allowedTCPPorts = [8080];
         system.stateVersion = "24.05";

server-modules/glance/server.nix

@@ -74,9 +74,9 @@
                       icon = "sh:mazanoke";
                     }
                     {
-                      title = "Stirling PDF";
+                      title = "BentoPDF";
                       url = "https://pdf.${domain}";
-                      icon = "sh:stirling-pdf";
+                      icon = "sh:bentopdf";
                     }
                     {
                       title = "Default-creds";

server-modules/iknowyou.nix

@@ -1,64 +0,0 @@
-{
-  config,
-  inputs,
-  lib,
-  ...
-}: let
-  inherit (import ./mk-container.nix {inherit lib config;}) mkContainer;
-in {
-  imports = [
-    (mkContainer {
-      name = "iky-prod";
-      hostIp = "10.233.1.1";
-      containerIp = "10.233.1.2";
-      internet = true;
-      bindMounts."/etc/iky/config.yaml" = {
-        hostPath = "/var/lib/iknowyou-prod/config.yaml";
-        isReadOnly = false;
-      };
-      nixosConfig = {...}: {
-        imports = [inputs.iknowyou.nixosModules.default];
-        users.users.iknowyou.uid = 999;
-        users.groups.iknowyou.gid = 999;
-        services.iknowyou = {
-          enable = true;
-          port = 8080;
-          openFirewall = true;
-        };
-        system.stateVersion = "24.05";
-      };
-    })
-
-    (mkContainer {
-      name = "iky-demo";
-      hostIp = "10.233.2.1";
-      containerIp = "10.233.2.2";
-      nixosConfig = {...}: {
-        imports = [inputs.iknowyou.nixosModules.default];
-        services.iknowyou = {
-          enable = true;
-          port = 8080;
-          openFirewall = true;
-        };
-        systemd.services.iknowyou.environment.IKY_DEMO = "true";
-        system.stateVersion = "24.05";
-      };
-    })
-  ];
-
-  users.users.iknowyou = {
-    isSystemUser = true;
-    group = "iknowyou";
-    uid = 999;
-  };
-  users.groups.iknowyou.gid = 999;
-
-  systemd.tmpfiles.rules = [
-    "f /var/lib/iknowyou-prod/config.yaml 0600 iknowyou iknowyou -"
-  ];
-
-  services.cloudflared.tunnels."${config.var.tunnelId}".ingress = {
-    "iknowyou-prod.${config.var.domain}" = "http://10.233.1.2:8080";
-    "iknowyou.${config.var.domain}" = "http://10.233.2.2:8080";
-  };
-}

server-modules/mealie.nix

@@ -1,26 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  inherit (import ./mk-container.nix {inherit lib config;}) mkContainer;
-in {
-  imports = [
-    (mkContainer {
-      name = "mealie";
-      hostIp = "10.233.8.1";
-      containerIp = "10.233.8.2";
-      internet = true;
-      nixosConfig = {...}: {
-        services.mealie = {
-          enable = true;
-          port = 8080;
-        };
-        networking.firewall.allowedTCPPorts = [8080];
-        system.stateVersion = "24.05";
-      };
-    })
-  ];
-
-  services.cloudflared.tunnels."${config.var.tunnelId}".ingress."mealie.${config.var.domain}" = "http://10.233.8.2:8080";
-}

server-modules/mk-container.nix

@@ -39,8 +39,7 @@ in {
               nginxHardening
             ];
             networking.nameservers = lib.mkIf internet [
-              "1.1.1.1"
+              "${hostIp}"
-              "1.0.0.1"
             ];
           };
         };

server-modules/umami.nix

@@ -1,39 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  inherit (import ./mk-container.nix {inherit lib config;}) mkContainer;
-in {
-  sops.secrets.umami-secret.mode = "0400";
-
-  imports = [
-    (mkContainer {
-      name = "umami";
-      hostIp = "10.233.10.1";
-      containerIp = "10.233.10.2";
-      bindMounts."/run/secrets/umami-secret" = {
-        hostPath = config.sops.secrets.umami-secret.path;
-        isReadOnly = true;
-      };
-      nixosConfig = {...}: {
-        services.umami = {
-          enable = true;
-          settings = {
-            PORT = 8080;
-            HOSTNAME = "0.0.0.0";
-            APP_SECRET_FILE = "/run/secrets/umami-secret";
-            DISABLE_TELEMETRY = true;
-            DISABLE_BOT_CHECK = true;
-          };
-        };
-        # PrivateUsers breaks systemd-creds inside nspawn containers (nested user namespaces)
-        systemd.services.umami.serviceConfig.PrivateUsers = lib.mkForce false;
-        networking.firewall.allowedTCPPorts = [8080];
-        system.stateVersion = "24.05";
-      };
-    })
-  ];
-
-  services.cloudflared.tunnels."${config.var.tunnelId}".ingress."umami.${config.var.domain}" = "http://10.233.10.2:8080";
-}

shell.nix

@@ -3,7 +3,7 @@
   gitHooksLib,
 }: let
   hooks = gitHooksLib.run {
-    src = ../.;
+    src = ./.;
     hooks = {
       inject-exec = {
         enable = true;
@@ -29,6 +29,7 @@ in
     packages = with pkgs;
       [
         doctoc
+        python3
       ]
       ++ hooks.enabledPackages;
 

themes/nixy.nix

@@ -73,8 +73,8 @@
 
     polarity = "dark";
     image = pkgs.fetchurl {
-      url = "https://raw.githubusercontent.com/anotherhadi/awesome-wallpapers/main/app/static/wallpapers/another-one.png";
+      url = "https://raw.githubusercontent.com/anotherhadi/awesome-wallpapers/main/wallpapers/another-one.png";
-      sha256 = "sha256-zthfsd4QLShPPApV8RoPANaymMC5IiCrmp8QwyyhCcY=";
+      sha256 = "sha256-bKke8RNz6qNxHSfLbU5xVVkG3tbFZW1sFjLB1hltcoI=";
     };
   };
 }