what

hosts/headful/flamingo/libreoffice.nix

@@ -1,5 +1,5 @@
 {
   services.flatpak.packages = [
-    "io.gitlab.librewolf-community"
+    "org.libreoffice.LibreOffice"
   ];
 }

hosts/headful/flamingo/mpv.nix

@@ -0,0 +1,5 @@
+{
+  services.flatpak.packages = [
+    "io.mpv.Mpv"
+  ];
+}

hosts/headful/flamingo/spotify.nix

@@ -0,0 +1,5 @@
+{
+  services.flatpak.packages = [
+    "com.spotify.Client"
+  ];
+}

hosts/headful/glacier/gimp.nix

@@ -0,0 +1,5 @@
+{
+  services.flatpak.packages = [
+    "org.gimp.GIMP"
+  ];
+}

hosts/headful/glacier/inkscape.nix

@@ -0,0 +1,5 @@
+{
+  services.flatpak.packages = [
+    "org.inkscape.Inkscape"
+  ];
+}

hosts/headful/glacier/libreoffice.nix

@@ -0,0 +1,5 @@
+{
+  services.flatpak.packages = [
+    "org.libreoffice.LibreOffice"
+  ];
+}

hosts/headful/glacier/mpv.nix

@@ -0,0 +1,5 @@
+{
+  services.flatpak.packages = [
+    "io.mpv.Mpv"
+  ];
+}

hosts/headful/glacier/steam.nix

@@ -1,5 +1,6 @@
 {
   services.flatpak.packages = [
     "com.valvesoftware.Steam"
+    "com.github.Matoking.protontricks"
   ];
 }

hosts/headful/insomniac/cosmic.nix

@@ -0,0 +1,17 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  services.greetd.settings.initial_session = {
+    user = config.users.mainUser;
+    command = ''
+      ${lib.getExe' pkgs.coreutils "env"} XCURSOR_THEME="''${XCURSOR_THEME:-Pop}" systemd-cat --identifier start-cosmic ${lib.getExe' pkgs.cosmic-session "start-cosmic"}
+    '';
+  };
+
+  environment.cosmic.excludePackages = [
+    pkgs.cosmic-store
+  ];
+}

hosts/headful/insomniac/flatpak.nix

@@ -0,0 +1,6 @@
+{
+  services.flatpak.update.auto = {
+    enable = true;
+    onCalendar = "weekly";
+  };
+}

hosts/headful/insomniac/spotify.nix

@@ -0,0 +1,5 @@
+{
+  services.flatpak.packages = [
+    "com.spotify.Client"
+  ];
+}

hosts/headful/work/spotify.nix

@@ -0,0 +1,5 @@
+{
+  services.flatpak.packages = [
+    "com.spotify.Client"
+  ];
+}

hosts/headless/abacus/domains.nix

@@ -0,0 +1,14 @@
+{lib, ...}: let
+  inherit (lib) types;
+in {
+  options.networking.domains = lib.mkOption {
+    description = "Domains.";
+    type = types.attrsOf types.str;
+    default = {};
+  };
+
+  config.networking.domains = {
+    wrz = "wrz.one";
+    helvetica = "helveticanonstandard.net";
+  };
+}

hosts/headless/abacus/forgejo.nix

@@ -3,8 +3,7 @@
   lib,
   ...
 }: let
-  inherit (config.networking) domain;
-  virtualHostName = "tea.${domain}";
+  virtualHostName = "tea.wrz.one";
 in {
   age.secrets = lib.mkSecrets {
     forgejo-mailer = {
@@ -43,8 +42,8 @@ in {
       mailer = {
         ENABLED = true;
         SMTP_ADDR = "smtp.fastmail.com";
-        FROM = "tea@${domain}";
-        USER = "lukas@${domain}";
+        FROM = "tea@wrz.one";
+        USER = "lukas@wrz.one";
       };
     };
     secrets.mailer.PASSWD = config.age.secrets.forgejo-mailer.path;
@@ -53,6 +52,7 @@ in {
   systemd.services.forgejo.preStart = let
     forgejo = lib.getExe config.services.forgejo.package;
     passwordFile = config.age.secrets.forgejo-admin.path;
+    # TODO
     user = "lukas";
     email = "lukas@wrz.one";
   in ''
@@ -78,10 +78,8 @@ in {
     '';
 
     locations."/".proxyPass = let
-      inherit (config.services.forgejo.settings.server) HTTP_ADDR HTTP_PORT;
-    in "http://${lib.formatHostPort {
-      host = HTTP_ADDR;
-      port = HTTP_PORT;
-    }}";
+      host = config.services.forgejo.settings.server.HTTP_ADDR;
+      port = builtins.toString config.services.forgejo.settings.server.HTTP_PORT;
+    in "http://${host}:${port}";
   };
 }

hosts/headless/abacus/headscale.nix

@@ -1,9 +1,23 @@
-{
-  services.headscale = {
-    enable = true;
-    address = "127.0.0.1";
-    port = 3122; # TODO
-    settings = {
-    };
-  };
-}
+# {config, ...}: let
+#   virtualHostName = "";
+# in {
+#   services.headscale = {
+#     enable = true;
+#     address = "127.0.0.1";
+#     port = 8070;
+#     server_url = "https://${virtualHostName}";
+#     settings = {
+#       logtail.enabled = false;
+#     };
+#   };
+#
+#   services.nginx.virtualHosts.${virtualHostName} = {
+#     forceSSL = true;
+#     enableACME = true;
+#     locations."/" = {
+#       proxyPass = "http://localhost:${toString config.services.headscale.port}";
+#       proxyWebsockets = true;
+#     };
+#   };
+# }
+{}

hosts/headless/abacus/microbin.nix

@@ -1,3 +1,4 @@
+# TODO: use another service for this
 {
   config,
   lib,
@@ -41,9 +42,9 @@ in {
     enableACME = true;
     forceSSL = true;
 
-    locations."/".proxyPass = "http://${lib.formatHostPort {
+    locations."/".proxyPass = let
       host = config.services.microbin.settings.MICROBIN_BIND;
-      port = config.services.microbin.settings.MICROBIN_PORT;
-    }}";
+      port = builtins.toString config.services.microbin.settings.MICROBIN_PORT;
+    in "http://${host}:${port}";
   };
 }

hosts/headless/abacus/miniflux.nix

@@ -1,3 +1,4 @@
+# TODO: is this bloat
 {
   config,
   lib,

hosts/headless/abacus/navidrome.nix

@@ -1,10 +1,5 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  inherit (config.networking) domain;
-  virtualHostName = "navi.${domain}";
+{config, ...}: let
+  virtualHostName = "navidrome.helveticanonstandard.net";
 in {
   services.navidrome = {
     enable = true;
@@ -19,9 +14,9 @@ in {
     enableACME = true;
     forceSSL = true;
 
-    locations."/".proxyPass = "http://${lib.formatHostPort {
+    locations."/".proxyPass = let
       host = config.services.navidrome.settings.Address;
-      port = config.services.navidrome.settings.Port;
-    }}";
+      port = builtins.toString config.services.navidrome.settings.Port;
+    in "http://${host}:${port}";
   };
 }

hosts/headless/abacus/nginx.nix

@@ -1,4 +1,4 @@
-{config, ...}: {
+{
   services.nginx = {
     enable = true;
 
@@ -12,11 +12,19 @@
       access_log /var/log/nginx/access.log;
     '';
 
-    virtualHosts."~.*" = {
-      default = true;
-      rejectSSL = true;
+    virtualHosts = let
+      matchAll = ''~.*'';
+      matchWww = ''~^www\.(?<domain>.+)$'';
+    in {
+      # Redirect anything that doesn't match any server name to networking.domain
+      ${matchAll} = {
+        default = true;
+        rejectSSL = true;
 
-      globalRedirect = config.networking.domain;
+        globalRedirect = "wrz.one";
+      };
+      # Redirect www to non-www
+      ${matchWww}.globalRedirect = "$domain";
     };
   };
 }

hosts/headless/abacus/static-sites.nix

@@ -3,14 +3,14 @@
   lib,
   ...
 }: let
-  inherit (config.networking) domain;
   parent = "/var/www";
   sites = [
-    domain
-    "log.${domain}"
+    "wrz.one"
+    "helveticanonstandard.net"
   ];
 in
-  lib.mkMerge (map (
+  lib.mkMerge (
+    map (
       virtualHostName: let
         root = "${parent}/${virtualHostName}";
       in {
@@ -28,4 +28,5 @@ in
         };
       }
     )
-    sites)
+    sites
+  )

hosts/headless/abacus/vaultwarden.nix

@@ -3,8 +3,7 @@
   lib,
   ...
 }: let
-  inherit (config.networking) domain;
-  virtualHostName = "vault.${domain}";
+  virtualHostName = "vault.wrz.one";
   backupDir = "/srv/backup/vaultwarden";
 in {
   age.secrets = lib.mkSecrets {vaultwarden = {};};
@@ -38,10 +37,10 @@ in {
     forceSSL = true;
 
     locations."/" = {
-      proxyPass = "http://${lib.formatHostPort {
+      proxyPass = let
         host = config.services.vaultwarden.config.ROCKET_ADDRESS;
-        port = config.services.vaultwarden.config.ROCKET_PORT;
-      }}";
+        port = builtins.toString config.services.vaultwarden.config.ROCKET_PORT;
+      in "http://${host}:${port}";
       proxyWebsockets = true;
     };
   };

hosts/headless/vessel/syncthing.nix

@@ -1,14 +1,15 @@
-{lib, ...}: let
+# TODO: unify syncthing.nix files
+let
   guiPort = 8384;
 in {
   services.syncthing = {
     enable = true;
     systemService = true;
     openDefaultPorts = true;
-    guiAddress = lib.formatHostPort {
+    guiAddress = let
       host = "0.0.0.0";
-      port = guiPort;
-    };
+      port = builtins.toString guiPort;
+    in "${host}:${port}";
   };
 
   networking.firewall.allowedTCPPorts = [guiPort];