rest server

.sops.yaml

@@ -1,14 +1,33 @@
 keys:
   - &john-p14s age1f6drjusg866yscj8029tk4yfpgecklrvezldm02ankm6h8nnwu5s2u6ahy
   - &john-pc age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt
+  - &test-nix age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0
+  - &soteria age1h0prahyukq4l564yqwgcpg3g6gdrjflk0suklussjjrjstxd9uesws8633
 creation_rules:
+  - path_regex: soteria/secrets\.yaml$
+    key_groups:
+    - age:
+      - *john-pc
+      - *soteria
+      - *test-nix
+  - path_regex: john-p14s/secrets\.yaml$
+    key_groups:
+    - age:
+      - *john-p14s
+      - *john-pc
+  - path_regex: john-pc/secrets\.yaml$
+    key_groups:
+    - age:
+      - *john-pc
   - path_regex: \.yaml$
     key_groups:
     - age:
       - *john-p14s
       - *john-pc
+      - *test-nix
   - path_regex: \.json$
     key_groups:
     - age:
       - *john-p14s
       - *john-pc
+      - *test-nix

README.md

@@ -1,7 +1,77 @@
 # A Dendritic Nix Flake
 
+Regenerate flake and switch to it.
+
 ```shell
-nix run ".#write-flake"
+nix run .#write-flake
 nix flake check
 home-manager switch --flake .#desktop
 ```
+
+```shell
+nix flake show --all-systems
+```
+
+## Layout
+
+- Everything under `./modules` gets auto-imported by `import-tree`
+
+| Directory     | Description |
+| ------------- | ----------- |
+| `hosts`       | Provides either `homeConfigurations` or `nixosConfigurations` |
+| `nix-tools`   | Nix-specific tools, like factory functions for use in the flakes |
+| `nixos`       | `flake.modules.nixos` |
+| `programs`    | flakes that provide `flake.modules` attributes for specific programs |
+| `services`    | flakes that provide configuration for running services |
+| `users`       | flakes that provide configuration for individual users with the `flake.factory.user` factory |
+
+## Mechanics
+
+### Flake
+
+The top-level flake is created using [flake-file](https://flake-file.oeiuwq.com/)
+
+```shell
+nix flake init -t github:vic/flake-file#default
+...
+nix run ".#write-flake"
+```
+
+This uses `inputs.flake-parts.lib.mkFlake` to create the flake.
+
+The modules are automatically imported from the `./modules` using [import-tree](https://import-tree.oeiuwq.com/).
+
+### [Home Manager](https://flake.parts/options/home-manager.html)
+
+Uses the home-manager module of flake-parts, which is imported in `modules/home-manager/flake-parts.nix`
+
+Looks for options:
+
+- `flake.homeConfigurations`
+- `flake.homeModules`
+
+Show exported home configurations:
+
+```shell
+nix eval --apply builtins.attrNames .#homeConfigurations
+```
+
+### Testing
+
+These commands would are useful for debugging
+
+```shell
+SYSTEM=lxc
+
+# Just evaluate (fast, catches config errors)
+nix eval .#nixosConfigurations.${SYSTEM}.config.system.build.toplevel
+
+# Full build (slower, produces a bootable system)
+nix build .#nixosConfigurations.${SYSTEM}.config.system.build.toplevel
+```
+
+### Remote Deploy
+
+```shell
+nixos-rebuild switch --flake .#lxc --target-host root@fded:fb16:653e:25da:be24:11ff:fea0:753f
+```

flake.lock

@@ -1,12 +1,28 @@
 {
   "nodes": {
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1751685974,
+        "narHash": "sha256-NKw96t+BgHIYzHUjkTK95FqYRVKB8DHpVhefWSz/kTw=",
+        "ref": "refs/heads/main",
+        "rev": "549f2762aebeff29a2e5ece7a7dc0f955281a1d1",
+        "revCount": 92,
+        "type": "git",
+        "url": "https://git.lix.systems/lix-project/flake-compat.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.lix.systems/lix-project/flake-compat.git"
+      }
+    },
     "flake-file": {
       "locked": {
-        "lastModified": 1771017549,
-        "narHash": "sha256-n68HeYEQJ67hMH2LPI0cERD2pkpNe5dyeOGg11uZ7rc=",
+        "lastModified": 1775848911,
+        "narHash": "sha256-dqva/tlWxsXj32wYPdt06UrrR4l2QdK9JWyvPooWRi4=",
         "owner": "vic",
         "repo": "flake-file",
-        "rev": "9d89918faacdbd2ce26d0aa7298da0fecad8b437",
+        "rev": "b36cbd5fc01e9794a001ccb0c58b314efaabae08",
         "type": "github"
       },
       "original": {
@@ -21,6 +37,27 @@
           "nixpkgs-lib"
         ]
       },
+      "locked": {
+        "lastModified": 1775087534,
+        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "nvf",
+          "nixpkgs"
+        ]
+      },
       "locked": {
         "lastModified": 1769996383,
         "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
@@ -58,11 +95,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1771102945,
-        "narHash": "sha256-e5NfW8NhC3qChR8bHVni/asrig/ZFzd1wzpq+cEE/tg=",
+        "lastModified": 1776046499,
+        "narHash": "sha256-Wzc4nn07/0RL21ypPHRzNDQZcjhIC8LaYo7QJQjM5T4=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "ff5e5d882c51f9a032479595cbab40fd04f56399",
+        "rev": "287f84846c1eb3b72c986f5f6bebcff0bd67440d",
         "type": "github"
       },
       "original": {
@@ -73,11 +110,11 @@
     },
     "import-tree": {
       "locked": {
-        "lastModified": 1771045967,
-        "narHash": "sha256-oYO4poyw0Sb/db2PigqugMlDwsvwLg6CSpFrMUWxA3Q=",
+        "lastModified": 1773693634,
+        "narHash": "sha256-BtZ2dtkBdSUnFPPFc+n0kcMbgaTxzFNPv2iaO326Ffg=",
         "owner": "vic",
         "repo": "import-tree",
-        "rev": "c968d3b54d12cf5d9c13f16f7c545a06c9d1fde6",
+        "rev": "c41e7d58045f9057880b0d85e1152d6a4430dbf1",
         "type": "github"
       },
       "original": {
@@ -86,6 +123,43 @@
         "type": "github"
       }
     },
+    "mnw": {
+      "locked": {
+        "lastModified": 1770419553,
+        "narHash": "sha256-b1XqsH7AtVf2dXmq2iyRr2NC1yG7skY7Z6N2MpWHlK4=",
+        "owner": "Gerg-L",
+        "repo": "mnw",
+        "rev": "2aaffa8030d0b262176146adbb6b0e6374ce2957",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Gerg-L",
+        "repo": "mnw",
+        "type": "github"
+      }
+    },
+    "ndg": {
+      "inputs": {
+        "nixpkgs": [
+          "nvf",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1768214250,
+        "narHash": "sha256-hnBZDQWUxJV3KbtvyGW5BKLO/fAwydrxm5WHCWMQTbw=",
+        "owner": "feel-co",
+        "repo": "ndg",
+        "rev": "a6bd3c1ce2668d096e4fdaaa03ad7f03ba1fbca8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "feel-co",
+        "ref": "refs/tags/v2.6.0",
+        "repo": "ndg",
+        "type": "github"
+      }
+    },
     "nixgl": {
       "inputs": {
         "flake-utils": "flake-utils",
@@ -107,13 +181,29 @@
         "type": "github"
       }
     },
+    "nixos-hardware": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1775490113,
+        "narHash": "sha256-2ZBhDNZZwYkRmefK5XLOusCJHnoeKkoN95hoSGgMxWM=",
+        "owner": "NixOS",
+        "repo": "nixos-hardware",
+        "rev": "c775c2772ba56e906cbeb4e0b2db19079ef11ff7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixos-hardware",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1770841267,
-        "narHash": "sha256-9xejG0KoqsoKEGp2kVbXRlEYtFFcDTHjidiuX8hGO44=",
+        "lastModified": 1775423009,
+        "narHash": "sha256-vPKLpjhIVWdDrfiUM8atW6YkIggCEKdSAlJPzzhkQlw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ec7c70d12ce2fc37cb92aff673dcdca89d187bae",
+        "rev": "68d8aa3d661f0e6bd5862291b5bb263b2a6595c9",
         "type": "github"
       },
       "original": {
@@ -125,17 +215,58 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1771177547,
-        "narHash": "sha256-erxy9meNKMaKpKQpl8KfhZsVY4EtR4eaHT94jY98Ty0=",
-        "rev": "ac055f38c798b0d87695240c7b761b82fc7e5bc2",
+        "lastModified": 1775888245,
+        "narHash": "sha256-qTVvODr6edFBLD2lncXPF8yTQeCafZUuKVtpV3Xb3yM=",
+        "rev": "13043924aaa7375ce482ebe2494338e058282925",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre946843.ac055f38c798/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre978638.13043924aaa7/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
         "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"
       }
     },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1775579569,
+        "narHash": "sha256-/m3yyS/EnXqoPGBJYVy4jTOsirdgsEZ3JdN2gGkBr14=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "dfd9566f82a6e1d55c30f861879186440614696e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nvf": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "flake-parts": "flake-parts_2",
+        "mnw": "mnw",
+        "ndg": "ndg",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1775892726,
+        "narHash": "sha256-1TK1pe33cEHNvGW41TP5xAzrbG1Gp7LfyFL6c3+xf+I=",
+        "owner": "notashelf",
+        "repo": "nvf",
+        "rev": "5ab359ee7dfd3fa09a5c6f863efaf810bb9a9436",
+        "type": "github"
+      },
+      "original": {
+        "owner": "notashelf",
+        "repo": "nvf",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "flake-file": "flake-file",
@@ -143,12 +274,15 @@
         "home-manager": "home-manager",
         "import-tree": "import-tree",
         "nixgl": "nixgl",
+        "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_2",
         "nixpkgs-lib": [
           "nixpkgs"
         ],
+        "nvf": "nvf",
         "sops-nix": "sops-nix",
-        "systems": "systems_2"
+        "wrapper-modules": "wrapper-modules",
+        "wrappers": "wrappers"
       }
     },
     "sops-nix": {
@@ -158,11 +292,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770683991,
-        "narHash": "sha256-xVfPvXDf9QN3Eh9dV+Lw6IkWG42KSuQ1u2260HKvpnc=",
+        "lastModified": 1775971308,
+        "narHash": "sha256-VKp9bhVSm0bT6JWctFy06ocqxGGnWHi1NfoE90IgIcY=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "8b89f44c2cc4581e402111d928869fe7ba9f7033",
+        "rev": "31ac5fe5d015f76b54058c69fcaebb66a55871a4",
         "type": "github"
       },
       "original": {
@@ -200,6 +334,44 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "wrapper-modules": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_3"
+      },
+      "locked": {
+        "lastModified": 1775940860,
+        "narHash": "sha256-8Jxnn2uoFhm2H579ycVxFWDtrywJ6Mc8RmqWbZwk5So=",
+        "owner": "BirdeeHub",
+        "repo": "nix-wrapper-modules",
+        "rev": "fb62851ffc5f6a4d53ebc00b93743e29b41e6224",
+        "type": "github"
+      },
+      "original": {
+        "owner": "BirdeeHub",
+        "repo": "nix-wrapper-modules",
+        "type": "github"
+      }
+    },
+    "wrappers": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1775600302,
+        "narHash": "sha256-2fgKImv78CXIcfo1RsY7EI4uMZ84x/MggA5rrusYc7c=",
+        "owner": "lassulus",
+        "repo": "wrappers",
+        "rev": "9d8397d8ef1ac35763085f3338589f558128f7db",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lassulus",
+        "repo": "wrappers",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -1,29 +1,38 @@
 # DO-NOT-EDIT. This file was auto-generated using github:vic/flake-file.
 # Use `nix run .#write-flake` to regenerate it.
 {
-  description = "A dendritic setup.";
-
   outputs = inputs: inputs.flake-parts.lib.mkFlake { inherit inputs; } (inputs.import-tree ./modules);
 
   inputs = {
     flake-file.url = "github:vic/flake-file";
     flake-parts = {
-      inputs.nixpkgs-lib.follows = "nixpkgs-lib";
       url = "github:hercules-ci/flake-parts";
+      inputs.nixpkgs-lib.follows = "nixpkgs-lib";
     };
     home-manager.url = "github:nix-community/home-manager";
     import-tree.url = "github:vic/import-tree";
     nixgl = {
-      inputs.nixpkgs.follows = "nixpkgs";
       url = "github:nix-community/nixGL";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    nixos-hardware = {
+      url = "github:NixOS/nixos-hardware";
+      flake = false;
     };
     nixpkgs.url = "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz";
     nixpkgs-lib.follows = "nixpkgs";
-    sops-nix = {
+    nvf = {
+      url = "github:notashelf/nvf";
       inputs.nixpkgs.follows = "nixpkgs";
+    };
+    sops-nix = {
       url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    wrapper-modules.url = "github:BirdeeHub/nix-wrapper-modules";
+    wrappers = {
+      url = "github:lassulus/wrappers";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
-    systems.url = "github:nix-systems/default";
   };
-
 }

keys/secrets.yaml

@@ -1,3 +1,8 @@
+janus:
+    fingerprint: ENC[AES256_GCM,data:A0eNE3nX8hVq8m4bNFvkTGR15Xh9QV44JpOJFyhZojPOTirRGEq/MCSNIqpKfoFUB4TXdRZIN95pAoNlO7Z2dQ==,iv:3TQ9ZcjRmnQzkNA5Cv/cpEIT8gTJ1w3cTjTVtxtuzq4=,tag:hIwcjdZ6R8UzUgh/VoDz3A==,type:str]
+    admin_jwk: ENC[AES256_GCM,data:HhsnsCsR87ItjEKP3MsHpxb/WZHvxRrMIhbBgW7qq/0=,iv:b5MKd5TFkxFjd1zY0Lfi2QDv4sLmyKn7riW8s/EfDeA=,tag:GkGfyAM2RtKzuo567bAjiA==,type:str]
+test-nix:
+    ssh_host_key: ENC[AES256_GCM,data:04CRKNCycc8Dre44ERtytmX6NHdZOIds95ckYzmi/i74qEYyN/L5XsuKKmjH2WCn3brvK4pZLLIZWzxC5VJ85q+O8Tfd3qdFROTG5qYRvmK5huxphPaIWSUI2ZEdLqecpRtmq7Zeq+Xa2+JKC0ehg2sqavotkPM5vIeVsaStD5rMVSgnuGaTS3WuPPfEjJPfsCyGPup4ysgxKxfc3JXOR+T8t6w4ccG0Si6tGz6io0Sl9tgPzrYqwqTaMtWLUA50luJg+D8ZxpMjpqFNbIry2tKwettzwXtGz7xGYnjvuk+1sCdYl8PXOMRT2KwAy5usCJsWFRTXJzZ5kxzwAYLwmhlsfPuxwTrR5fRETJPglRP/1muq8piIZn6yHtq9dCSrNcDCZnjnjG+cby28yPLYKhDgVNF5DObob8e6Fp/nP00sdi4Bt1aHRR5pjK/9mpsWE6ikO83SUi4xSoL1LKZM2kC5DL8XBJP7nWQTwijp84m3htMKvrKfFo68G9xP4v/DhVcHLsoNGLytH5omAuGL,iv:0cAtrXlPBis8nYw1XT4kSPRuwVkq0XSh6jjY9mpewIA=,tag:WFsiOe/l8cVicOqX2C94xA==,type:str]
 restic_password:
     john_ubuntu: ENC[AES256_GCM,data:Q4lUaFFDgoK9k4kQj7hSVKaFDGW0T+6V+OpFU5R528R3EKM7YJMgcFX+sK3mWl9XA4/6E1GeINpIqOpx+FP5Cf/8qt9sXBXCmXXSYdA4IH3RS6a1NkcIVjsTMvpn4q/fslCeYN4LB+r4pBGmdca105miqVun8J69cZGwjZ+wuxrMAP+mdnHdSUPycjNWJJzmEa3waQsygAi4A5cAN5sigOPBxe2pCTh/FEKoTgWmzHGJvcjrzuL6wNOpQrkMWwTsHCtbe9dyMP/fQpoBgYDT4W9Rd4XHhbrooje+g3x48EL1rkRIVVNRavpRUih/mjcdJGzzJ6jZmLLcc1f7SZIKZht7f+ZcdZl3rKQB+WanZgK/KAgKBRCrbIk2eeBZwkcRSw5kmGFU7x0azdIipJYj+3KHHQS5S2VW4j2tQG74xK3qaNJcSMjpKmdI1dHcPf0x2ILaDDV9Ts0H4GTOB2zO9iGy7x2tdPd4tugxxk5rr5rphTZL3lgUf0Ri/qMkJh9I8CsjUdvRycHeIEUZPmEVaIqJC2jrd2pBslis5VWD/6PHQBCob07d1fcpIYox4YXM3GcLg3OxiD8nZ7DTzGRMhciZtTKKWbBT8qzPud4ZQvDkT5l+XOpeM13wXFIMa13CwOzYeyWjycED0VQ/i3XRw9+9lg3cosfxaPdaFtv4MjV7Od62G/UJw3OxaQOHM2y24N+Q0pSBoTdDAFwDCH/kcqZji6ZrVTu4Rad8opcILJJcqC+pjegDvBtUdDz+G3/dFiS6m8RYIRb7qB5yEX/lCgzlECmRS2XP8uraNJ5NN8rtk0gdBtaI9/78YyAjLLGkjIcIR4uJA5buCZBR9jIdqf4f52fowbx18VPrwFXN2mYX6mPsKbDmaz0ILHq/I9n8bS/KM7gIQmTw/RAUwnmL4IRu8zHn6nmIqj6d8AkjYx7s6pG8OF8LgfhqZT7tdPKCd+n/HnYn1fZGSw26zHzPd4nKnVV1e3NYvX6CVwVycerGs9elOKtOI8GsrWYyXzJbfC+nWxbHKI/t6sxyzTBrHPR4r6l/CchQF+SfBs5aELKExe7h325qBB2y6EFdkbxTj1tPGqxttp9xJB1LUyNtwsEAkpD44JNqPxZCYHQbeVE3Oo3TYtRUSVWREc1WNIsfSG/anScYUhDEah9YyIdiG+O71QqegunusLoxmpF2rQtx7shtAvJV3skDBB0tFDoQyIV+yPo7kPV0D7Ig+Ba+mk5ASJrT9DXZ53Q2CCTLAuslU4MP7g22RX8rU3s2hFJq8m7wvMwpqa9Tr6O38i1wX4PhG1VRMM8EIlMQnLWWKmni6NbOYiRxFYJMioxH5SyE4ODQYXy5YIuLoRsX8VR6UqJ1GZb7sJf3M1aPOFOHzTN9hnziTRRe1KCMoBrAghrqhvL1VRr9X5PYMxnjBh6o0d5YTN0WOGD2iEVbCzqxFXcxQZBBp4KyNAAhFhGNw8WUp/rVoyCYn7+OEYFspY4FmGMTYhvxbq5LEptXeQgOP2ggBkqsw8sYP9oj1cb4kzBNv8M7nR9kM1EqvZpFV47phoTbBeMY4DZOJodkASFVM5/7ijWy/M9rtWMFMCXKURKkAQJRFADs0KqMJ5osnFFnubX7vKgK736XXF4+wIQuuHqEsYDZ90ftInxq8sYRnb2FZ0EV4yc8qqnz++fjwrAA5EV+zhL6l6hum1zL8JkUJ1ICKZ905If6nIeoul8MY3B1Cz4W+osN2Wtl8OeJ2t3iZx3wk/unVa8uDZH1owu47He68e2V8vpYxOaW4/hLyy/XuL5DukETrhRjC+7GbEaKaCwoA2UwAdqU,iv:N8ek+tp16WiZgjTDxXb0CRXH+MbLsl/oZ/OwcOoVRO0=,tag:uIzCSX0R/EObF/RdWxj64w==,type:str]
 api:
@@ -7,22 +12,31 @@ sops:
         - recipient: age1f6drjusg866yscj8029tk4yfpgecklrvezldm02ankm6h8nnwu5s2u6ahy
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoWkxDSnlNT2Vua1ZXWC8r
-            SU9UMnhaVXVEVlZGL3dtYTBJSzNGbHVaSTJNCm9ZTFM3RndpRktUcWhwZk1Fc2dk
-            ZGtoWXdoOWVyK1F0YStSS3dsMkg2R28KLS0tIFkrdVFZNlVxRjhPaWdMZXl2elV3
-            TVpyTzFsNFNmd3FNU0tlMnlTOHNTQWsKfKdN4epZokF74bCNr9+jxulZJFBQM83P
-            quMhl+H85My8jAsEeC9CW7y2jdNPJkfk9gHun4ozoW8U7o6y5RLfJg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0UEpja2kxdThZVWZhOGVP
+            S0NtSi84MjhnN0RORkh2NjZ4YlYvWS9kZDBNClFzYnVxWnhmQkpCRkRFVUx1RDdX
+            ZHFqYXRqYXM0cWJzcU5EeEtSR1BUVzAKLS0tIDdEY2pnVTJqWlNZVkZldXVYVmFH
+            dVNBRUVodU5sRnpVcG1GZ1RiZzhjTXMKefqBvvD/qZwcSHmFjUnleukVRLueG36Y
+            Q81KlwQweF2F8kHl7Bqsi+3hH1dZZbVm3vjuGpWFOoti7fowUV55Kw==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSakZRUnkraWtId2h3eUhB
-            REpkUHhYMm1MSmtFU2pvd1BpQ0xRTTlCWkZJCkxrTm1sdDBqclJ3RHR6VkllOFpo
-            ZXRtS2lsazRDS2lyRnZmT3FTTjJ6WUUKLS0tIExxNlFoeDhHQ3l5a1VvUHNRWUdw
-            Mms2UEhFSU82UWR5Z1VvU25qenJUQm8KtQeZDIfJIczm1l8ql/WmVEf8KI9dg0vw
-            9rNSjtBkEttVd21zUSOziG4513abllE8NFTkAc1z3HacuXpHTBnd5A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqZFZxbDhVUWFEUGhPMlZI
+            SFdBYkpxSnAxTUZXbjVwQnlZQ3l1SWtuZGg0CmVBdnVHbTNUcmwvK01iMnZKZTJh
+            ajFla3kzYUl4ZWY3czA0WUdNM2lpVFUKLS0tIHo5Uk1pV296MXdnUTZGQ25haWZG
+            QWZDWGRaRDBhY1ZkZk5oTHY0ZVV2RXMKanv+WWRhf5nl+aw/T6QZFVQQmhV1DZfB
+            jkSzOAKOgPx7toYFmpq9E8fAH+zrMzDbxI2z2uyrOFI6v+QE0Ul/iQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-08-03T17:03:22Z"
-    mac: ENC[AES256_GCM,data:c3rcMHTRxbnpQoW5eLn0X1aCL1v2ft05UTcHaCuGiCaF3b/loVjEQr30pepBgR07PSleTIi375Y0Rj8ik8Ot3j+Zl5BR32bEtqf6gcWwz6oSmeORDrJS15698d7/avJl82/EC0ZN77j+fcdkWZrCJHb47HGfRxKl9L5HbyWasA4=,iv:g3d3C571uYpTTFixYZg+ztg8jTdof1g6Hb5gtRvpRkk=,tag:8kAxrUwUVeWvpYjWMDE+AA==,type:str]
+        - recipient: age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZcGtMNi9RSG5aTVV5cWdT
+            NittUXN0Qnpld1YvOU50OUh3Z3ZiSzhHOHdNCnc4TmdYbS9QQnBLbldHSytIdkJl
+            R0psQWxkZTgyZTRzckkrTGpyNCsvR2sKLS0tIEdLb05aT2I2S3BKcFRrVmtvTGw5
+            Z1orRCtkTDVXSktuck5pTmV4K05qZHMKZlHHu07q+GnyDDgdwW2Ic3P23PmoSPwn
+            WuNLZdlZQleROaRb+zpD+9P1HGGJ3mWAlNlnmjGrRk453k1PbBQ5Og==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-15T15:06:29Z"
+    mac: ENC[AES256_GCM,data:cF/TJ8VkzrHRUrO5iGdRdlFtqV/5EQ15JwQKIywJvsh0NERK67T21czSP7923MiL0u5QTVPn/rO8R5E/8gBu3r8+fLq+CFl9PDQHEX2JhnYOD5WZR412WMZq3MVR94IMTOrQANMVpS4uhMyvnrqOe4AenxLDyzrYhkwf1KQh4w0=,iv:Qwy8z4uXGMlf+kTMNiE42M9l8LtSJ+O7diknRrsSeYI=,tag:qlCY9r8HnEDmq/jw59C/sg==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.12.1

modules/default.nix

@@ -1,12 +1,9 @@
 { inputs, ... }:
 {
   imports = [
+    # https://github.com/vic/flake-file/tree/main/modules/dendritic
     inputs.flake-file.flakeModules.dendritic
   ];
-  flake-file.description = "A dendritic setup.";
-
-  # flake.flakeModule = {
-  #   imports = (inputs.import-tree ./home-manager);
-  # };
 
+  systems = [ "x86_64-linux" "aarch64-linux" ];
 }

modules/features/desktop.nix

@@ -0,0 +1,15 @@
+# This module is for programs with GUIs that run in a desktop environment
+{ self, inputs, ... }: {
+  flake.modules.homeManager.desktop = { config, pkgs, lib, ... }: {
+    imports = with inputs.self.modules.homeManager; [
+      brave
+      ghostty
+      onepassword
+      vscode
+    ];
+    home.packages = with pkgs; [
+      mangohud
+      sublime4
+    ];
+  };
+}

modules/features/forgejo.nix

@@ -0,0 +1,147 @@
+{ self, inputs, ... }: {
+  flake.modules.nixos.forgejo = {config, pkgs, lib, ... }:
+    let
+      cfg = config.forgejo;
+      needsPrivilegedPort = cfg.port < 1024;
+    in
+    {
+      options.forgejo = {
+        enable = lib.mkEnableOption "Enable Forgejo backed with PostgreSQL";
+        root_url = lib.mkOption {
+          type = lib.types.str;
+        };
+
+        port = lib.mkOption {
+          type = lib.types.port;
+          default = 3000;
+          description = "TCP port for the Forgejo web interface.";
+        };
+
+        openFirewall = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+          description = "Open the Forgejo web interface port in the firewall.";
+        };
+
+        https = lib.mkEnableOption "Open the Forgejo web interface port in the firewall.";
+      };
+
+      config = lib.mkIf cfg.enable {
+        networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [ cfg.port ];
+
+        systemd.services.forgejo.serviceConfig = lib.mkIf needsPrivilegedPort {
+          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+          CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+          PrivateUsers = lib.mkForce false;
+        };
+
+        sops.secrets = {
+          "forgejo/secret_key".owner = config.services.forgejo.user;
+          "forgejo/internal_token".owner = config.services.forgejo.user;
+          "forgejo/jwt_secret".owner = config.services.forgejo.user;
+          "forgejo/lfs_jwt_secret".owner = config.services.forgejo.user;
+        };
+
+        services = {
+          forgejo = {
+            enable = true;
+            lfs.enable = true;
+            database.type = "postgres";
+            settings = {
+              DEFAULT = {
+                RUN_MODE = "dev";
+              };
+              server = lib.mkMerge [
+                {
+                  HTTP_PORT = cfg.port;
+                  DISABLE_SSH = true;
+                  ROOT_URL = cfg.root_url;
+                }
+                (lib.mkIf cfg.https {
+                  PROTOCOL = "https";
+                  COOKIE_SECURE = true;
+                  KEY_FILE = config.mtls.keyFile;
+                  CERT_FILE = config.mtls.certFile;
+                })
+              ];
+              oauth2_client = {
+                ENABLE_AUTO_REGISTRATION = true;
+                USERNAME = "nickname";
+                UPDATE_AVATAR = true;
+                ACCOUNT_LINKING = "login";
+                REGISTER_EMAIL_CONFIRM = false;
+              };
+              repository = {
+                ENABLE_PUSH_CREATE_USER = true;
+              };
+              ui.SHOW_USER_EMAIL = false;
+              markup = {
+                ENABLED = true;
+              };
+            };
+
+            secrets = {
+              security = {
+                SECRET_KEY = lib.mkForce config.sops.secrets."forgejo/secret_key".path;
+                INTERNAL_TOKEN = lib.mkForce config.sops.secrets."forgejo/internal_token".path;
+              };
+              oauth2.JWT_SECRET = lib.mkForce config.sops.secrets."forgejo/jwt_secret".path;
+              server.LFS_JWT_SECRET = lib.mkForce config.sops.secrets."forgejo/lfs_jwt_secret".path;
+            };
+            dump = {
+              enable = true;
+              type = "tar";
+              interval = "*-*-* 00/12:00:00";
+            };
+          };
+
+          postgresql = {
+            enable = true;
+            enableTCPIP = false;
+          };
+        };
+
+        # https://forgejo.org/docs/latest/admin/command-line/#dump
+        systemd.services.forgejo-dump.serviceConfig.ExecStart = lib.mkForce ''
+          ${lib.getExe config.services.forgejo.package} dump --verbose \
+          --type ${config.services.forgejo.dump.type} \
+          --database postgres \
+          --work-path ${config.services.forgejo.dump.backupDir}
+        '';
+
+        environment.systemPackages =
+          let
+            systemctl = lib.getExe' pkgs.systemd "systemctl";
+            clean-forgejo = (pkgs.writeShellScriptBin "clean-forgejo" ''
+              set -euo pipefail
+              sudo ${systemctl} stop forgejo.service
+              ${lib.getExe' pkgs.coreutils "echo"} "Stopped Forgejo"
+              sudo ${lib.getExe' pkgs.coreutils "rm"} -rf ${config.services.forgejo.stateDir}
+              ${lib.getExe' pkgs.coreutils "echo"} "Removed ${config.services.forgejo.stateDir}"
+            '');
+            clean-postgres = (pkgs.writeShellScriptBin "clean-postgres" ''
+              set -euo pipefail
+              sudo ${systemctl} stop postgresql.service
+              ${lib.getExe' pkgs.coreutils "echo"} "Stopped PostgreSQL"
+              sudo ${lib.getExe' pkgs.coreutils "rm"} -rf ${config.services.postgresql.dataDir}
+              ${lib.getExe' pkgs.coreutils "echo"} "Removed ${config.services.postgresql.dataDir}"
+            '');
+          in [
+            clean-forgejo
+            clean-postgres
+            (pkgs.writeShellScriptBin "clean-all" ''
+              set -euo pipefail
+              GREEN_CHECK="\e[32m✔\e[0m"
+              YELLOW_BANG="\e[33m!\e[0m"
+              ${lib.getExe' pkgs.coreutils "echo"} -n -e "$YELLOW_BANG Remove everything related to Forgejo and the PostgreSQL database behind it?"
+              read -p " (y/n) " -n 1 -r
+              if [[ $REPLY =~ ^[Yy]$ ]]; then
+                ${lib.getExe clean-forgejo}
+                ${lib.getExe clean-postgres}
+                ${lib.getExe' pkgs.coreutils "echo"} -e "$GREEN_CHECK Removed everything related to forgejo"
+              fi
+            '')
+          ];
+      };
+    };
+}

modules/features/gnome.nix

@@ -0,0 +1,107 @@
+{ inputs, ... }: {
+  flake.modules.nixos.gnome = {pkgs, ... }: {
+    services = {
+      desktopManager.gnome.enable = true;
+      displayManager.gdm = {
+        enable = true;
+        wayland = true;
+        banner = "Welcome to John's NixOS implementation";
+      };
+      udev.packages = [
+        pkgs.gnome-settings-daemon # For gnome systray icons
+      ];
+    };
+  };
+
+  flake.modules.homeManager.gnome = { config, pkgs, ... }:
+  let
+    # `gnome-extensions list` for a list
+    extensions = with pkgs.gnomeExtensions; [
+      appindicator # For gnome systray icons
+      dash-to-panel
+      gtile
+      space-bar
+      switcher
+      tactile
+      vitals
+    ];
+    enabledExtensions = map (ext: ext.extensionUuid) extensions;
+  in
+  {
+    gtk = {
+      enable = true;
+      theme = {
+        name = "Orchis-Dark";
+        package = pkgs.orchis-theme;
+      };
+      gtk4.theme = config.gtk.theme;
+    };
+
+    home.packages = [ pkgs.gnome-tweaks ] ++ extensions;
+
+    dconf.settings = {
+      "org/gnome/desktop/interface" = {
+        color-scheme = "prefer-dark";
+      };
+
+      "org/gnome/shell" = {
+        disable-user-extensions = false;
+        enabled-extensions = enabledExtensions;
+      };
+
+      "org/gnome/desktop/wm/preferences" = {
+        button-layout = ":minimize,close";
+      };
+
+      "org/gnome/desktop/wm/keybindings" = {
+        "switch-to-workspace-1" = ["<Super>1"];
+        "switch-to-workspace-2" = ["<Super>2"];
+        "switch-to-workspace-3" = ["<Super>3"];
+        "switch-to-workspace-4" = ["<Super>4"];
+        "move-to-workspace-1" = ["<Shift><Super>1"];
+        "move-to-workspace-2" = ["<Shift><Super>2"];
+        "move-to-workspace-3" = ["<Shift><Super>3"];
+        "move-to-workspace-4" = ["<Shift><Super>4"];
+      };
+
+      "org/gnome/settings-daemon/plugins/media-keys" = {
+        custom-keybindings = [
+          "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/edit-nix/"
+          "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/launch-browser/"
+          "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/ad-dev/"
+          "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/shutdown/"
+        ];
+      };
+
+      "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/edit-nix" = {
+        binding = "<Primary><Alt>n";
+        command = "code /etc/nixos";
+        name = "Edit Nix config";
+      };
+
+      "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/launch-browser" = {
+        binding = "<Primary><Alt>b";
+        command = "brave";
+        name = "Launch Brave browser";
+      };
+
+      "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/ad-dev" = {
+        binding = "<Primary><Alt>d";
+        command = ''code --file-uri "vscode-remote://ssh-remote+ad-nix/etc/nixos/ad-nix.code-workspace"'';
+        name = "Launch AppDaemon Development over Tailscale";
+      };
+
+      "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/ws1" = {
+        binding = "<Super>1";
+        command = "wmctrl -s 0";
+        name = "Switch to workspace 1";
+      };
+
+      "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/shutdown" = {
+        binding = "<Primary><Alt>p";
+        command = "gnome-session-quit --power-off --force";
+        name = "Shutdown immediately";
+      };
+    };
+  };
+}

modules/features/greetd.nix

@@ -0,0 +1,28 @@
+# https://github.com/glabrie/dotfiles/blob/main/modules/system/settings/greetd.nix
+{ inputs, ... }: {
+  flake.modules.nixos.greetd = { pkgs, lib, ... }: {
+    services.greetd = {
+      enable = true;
+      settings = {
+        default_session = {
+          command = "${lib.getExe pkgs.tuigreet} --time --remember --cmd niri-session";
+          user = "greeter";
+        };
+      };
+    };
+
+    systemd.services.greetd.serviceConfig = {
+      Type = "idle";
+      StandardInput = "tty";
+      StandardOutput = "tty";
+      StandardError = "journal"; # Without this errors will spam on screen
+      # Without these bootlogs will spam on screen
+      TTYReset = true;
+      TTYVHangup = true;
+      TTYVTDisallocate = true;
+    };
+
+    # Let's allow our keyring to work from the start
+    security.pam.services.greetd.enableGnomeKeyring = true;
+  };
+}

modules/features/mtls.nix

@@ -0,0 +1,352 @@
+{ self, inputs, lib, ... }:
+let
+  # Options that will be in common between the nixos module and the home-manager module.
+  mkOpts = config: let cfg = config.mtls; in {
+    enable = lib.mkEnableOption "Enable mTLS";
+    subject = lib.mkOption {
+      description = "The Common Name, DNS Name, or IP address that will be set as the Subject Common Name for the certificate. If no Subject Alternative Names (SANs) are configured (via the --san flag) then the subject will be set as the only SAN.";
+      type = lib.types.str;
+    };
+    certDir = lib.mkOption {
+      description = "String path to the directory where the certs will be stored";
+      type = lib.types.str;
+    };
+    caFile = lib.mkOption {
+      description = "String path for the root CA file";
+      type = lib.types.str;
+      default = "${cfg.certDir}/root_ca.crt";
+    };
+    keyFile = lib.mkOption {
+      description = "String path for the private key";
+      type = lib.types.str;
+      default = "${cfg.certDir}/key.pem";
+    };
+    certFile = lib.mkOption {
+      description = "String path for the public cert";
+      type = lib.types.str;
+      default = "${cfg.certDir}/cert.pem";
+    };
+    bundleFile = lib.mkOption {
+      description = "String path for the mTLS key bundle";
+      type = lib.types.str;
+      default = "${cfg.certDir}/mtls.pem";
+    };
+    san = lib.mkOption {
+      description = "List of SAN to give the mTLS cert";
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+    };
+    provisioner = lib.mkOption {
+      type = lib.types.str;
+      default = "admin";
+    };
+    lifetime = lib.mkOption {
+      type = lib.types.str;
+      default = "24h";
+    };
+    renew = {
+      enable = lib.mkOption {
+        description = "Enable automatic mTLS certificate renewal using a systemd timer.";
+        type = lib.types.bool;
+        default = true;
+      };
+      onCalendar = lib.mkOption {
+        description = "systemd OnCalendar schedule for mTLS certificate renewal checks.";
+        type = lib.types.str;
+        default = "*:1/15";
+      };
+      randomizedDelaySec = lib.mkOption {
+        description = "Randomized delay added to renewal timer runs to avoid synchronized renewals.";
+        type = lib.types.str;
+        default = "5m";
+      };
+      user = lib.mkOption {
+        description = "User account to run the mTLS renewal service as.";
+        type = lib.types.str;
+        default = "root";
+      };
+      group = lib.mkOption {
+        description = "Group to run the mTLS renewal service as. Defaults to the configured renewal user.";
+        type = lib.types.nullOr lib.types.str;
+        default = "mtls";
+      };
+      reloadUnits = lib.mkOption {
+        description = "systemd units to try-reload-or-restart after a successful certificate renewal.";
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+      };
+      postCommands = lib.mkOption {
+        description = "Shell commands to run after a successful certificate renewal.";
+        type = lib.types.listOf lib.types.lines;
+        default = [ ];
+      };
+    };
+  };
+
+  mkMtlsGenerateScript = {
+    pkgs,
+    subject,
+    provisioner,
+    san,
+    certFile,
+    keyFile,
+    bundleFile,
+    lifetime,
+    user,
+    group,
+  }:
+  let
+    sanArgs = lib.concatMapStringsSep " " (s: "--san \"${s}\"") san;
+  in
+    pkgs.writeShellApplication {
+      name = "mtls-generate";
+      runtimeInputs = with pkgs; [ coreutils step-cli ];
+      text = ''
+        set -euo pipefail
+        step ca certificate ${subject} ${certFile} ${keyFile} \
+          --provisioner ${provisioner} \
+          --not-before=-5m --not-after=${lifetime} \
+          ${sanArgs} \
+          "$@"
+        (umask 077; cat ${certFile} ${keyFile} > ${bundleFile})
+        chown ${user}:${group} ${certFile} ${keyFile} ${bundleFile}
+        chmod 640 ${certFile} ${keyFile} ${bundleFile}
+        printf '\033[32m✔\033[0m \033[1mmTLS Bundle:\033[0m %s\n' ${lib.escapeShellArg bundleFile}
+      '';
+    };
+  
+  mkMtlsCheckScript = { pkgs, bundleFile }: pkgs.writeShellApplication {
+    name = "mtls-check";
+    runtimeInputs = with pkgs; [ openssl ];
+    text = ''
+      openssl x509 -noout -in ${bundleFile} \
+        -subject -issuer \
+        -ext subjectAltName,extendedKeyUsage \
+        -enddate
+    '';
+  };
+
+  mkMtlsRenewScript = {
+    pkgs,
+    cfg,
+    systemctlArgs ? [ ],
+  }:
+  let
+    systemctlCmd = "systemctl ${lib.escapeShellArgs systemctlArgs}";
+
+    hasReloadUnits = cfg.renew.reloadUnits != [ ];
+    renewReloadScript = lib.concatMapStringsSep "\n" (unit: ''
+      if ${systemctlCmd} --quiet is-active "${unit}"; then
+        ${systemctlCmd} try-reload-or-restart "${unit}"
+      fi
+    '') cfg.renew.reloadUnits;
+
+    hasPostCommands = cfg.renew.postCommands != [ ];
+    renewPostCommands = lib.concatStringsSep "\n" cfg.renew.postCommands;
+
+    fileOwner = "${cfg.renew.user}:${cfg.renew.group}";
+  in
+    pkgs.writeShellApplication {
+      name = "mtls-renew";
+      runtimeInputs = with pkgs; [ coreutils step-cli systemd ];
+      text = ''
+      set -euo pipefail
+
+      YELLOW_BANG="\e[33m!\e[0m"
+
+      force=0
+      while [[ $# -gt 0 ]]; do
+      case $1 in
+        --force)
+        force=1
+        shift
+        ;;
+        *)
+        echo -e "$YELLOW_BANG Warning: ignoring unrecognized argument '$1'"
+        exit 1
+        ;;
+      esac
+      done
+
+      if [[ $force -eq 0 ]] && ! step certificate needs-renewal "${cfg.certFile}"; then
+        echo "Skipping renew"
+        exit 0
+      fi
+
+      echo "Renewing mTLS certificate"
+      step ca renew --force "${cfg.certFile}" "${cfg.keyFile}"
+      (umask 077; cat "${cfg.certFile}" "${cfg.keyFile}" > "${cfg.bundleFile}")
+      chown ${fileOwner} ${cfg.certFile} ${cfg.keyFile} ${cfg.bundleFile}
+      chmod 640 ${cfg.certFile} ${cfg.keyFile} ${cfg.bundleFile}
+
+      ${lib.optionalString hasReloadUnits ''
+        echo "Reloading units: ${lib.concatStringsSep ", " cfg.renew.reloadUnits}"
+        ${renewReloadScript}
+      ''}
+
+      ${lib.optionalString hasPostCommands ''echo "Post commands:" ${renewPostCommands}''}
+      '';
+    };
+
+  mkNixosMtlsRenewService = { pkgs, cfg, ... }:
+    {
+      description = "Renew the mTLS certificate when Smallstep marks it ready";
+      wantedBy = [ ];
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        User = cfg.renew.user;
+        Group = cfg.renew.group;
+        ExecStart = lib.getExe (mkMtlsRenewScript { inherit pkgs cfg; });
+      };
+    };
+
+  mkNixosMtlsRenewTimer = {
+    onCalendar,
+    randomizedDelaySec,
+    unit ? "mtls-renew.service",
+  }: {
+    description = "Periodic Smallstep renewal for the mTLS certificate";
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      Persistent = true;
+      OnCalendar = onCalendar;
+      AccuracySec = "1us";
+      RandomizedDelaySec = randomizedDelaySec;
+      Unit = unit;
+    };
+  };
+
+  mkHomeManagerMtlsRenewService = { pkgs, cfg, ... }:
+  let
+    renewScript = mkMtlsRenewScript {
+      inherit pkgs cfg;
+      systemctlArgs = [ "--user" ];
+    };
+  in
+  {
+    Unit = {
+      Description = "Renew the mTLS certificate when Smallstep marks it ready";
+      After = [ "network-online.target" ];
+      Wants = [ "network-online.target" ];
+    };
+    Service = {
+      Type = "oneshot";
+      ExecStart = lib.getExe renewScript;
+    };
+  };
+
+  mkHomeManagerMtlsRenewTimer = {
+    onCalendar,
+    randomizedDelaySec,
+    unit ? "mtls-renew.service",
+  }: {
+    Unit = {
+      Description = "Periodic Smallstep renewal for the mTLS certificate";
+    };
+    Timer = {
+      Persistent = true;
+      OnCalendar = onCalendar;
+      AccuracySec = "1us";
+      RandomizedDelaySec = randomizedDelaySec;
+      Unit = unit;
+    };
+    Install = {
+      WantedBy = [ "timers.target" ];
+    };
+  };
+
+in
+{
+  flake.modules.nixos.mtls = { config, lib, pkgs, ... }:
+    let
+      cfg = config.mtls;
+      sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
+    in
+    {
+      options.mtls = (mkOpts config) // {
+        certDir = lib.mkOption {
+          description = "String path to where the mtls certs will be stored.";
+          type = lib.types.str;
+          default = "/etc/step-ca/certs";
+        };
+        certReaders = lib.mkOption {
+          description = "";
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
+        users.groups.certReaders = {
+          name = cfg.renew.group;
+          members = cfg.certReaders;
+        };
+
+        environment.systemPackages = with pkgs; lib.optionals cfg.enable [
+          # step-cli
+          (mkMtlsGenerateScript {
+            inherit pkgs;
+            inherit (cfg) subject provisioner san certFile keyFile bundleFile lifetime;
+            inherit (cfg.renew) user group;
+          })
+          (mkMtlsCheckScript { inherit pkgs; inherit (cfg) bundleFile; })
+          (mkMtlsRenewScript { inherit pkgs cfg; })
+        ];
+
+        systemd.tmpfiles.rules = [
+          "d ${cfg.certDir} 0750 ${cfg.renew.user} ${cfg.renew.group} -"
+        ];
+
+        systemd.services.mtls-renew = lib.mkIf cfg.renew.enable
+          (mkNixosMtlsRenewService { inherit pkgs cfg; });
+
+        systemd.timers.mtls-renew = lib.mkIf cfg.renew.enable (mkNixosMtlsRenewTimer {
+          inherit (cfg.renew) onCalendar randomizedDelaySec;
+        });
+      };
+    };
+
+  flake.modules.homeManager.mtls = { config, lib, pkgs, ... }:
+    let
+      cfg = config.mtls;
+      keyFile = cfg.keyFile;
+      certFile = cfg.certFile;
+      bundleFile = cfg.bundleFile;
+      sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
+    in
+    {
+      options.mtls = (mkOpts config) // {
+        certDir = lib.mkOption {
+          description = "String path to where the mtls certs will be stored.";
+          type = lib.types.str;
+          default = "${config.home.homeDirectory}/.step/certs";
+        };
+      };
+
+      config = {
+        home.packages = with pkgs; lib.optionals cfg.enable [
+          # step-cli
+          (mkMtlsGenerateScript {
+            inherit (cfg) subject provisioner san lifetime;
+            inherit (cfg.renew) user group;
+            inherit pkgs certFile keyFile bundleFile;
+          })
+          (mkMtlsCheckScript { inherit pkgs bundleFile; })
+          (mkMtlsRenewScript { inherit pkgs cfg; systemctlArgs = [ "--user" ]; })
+        ];
+
+        systemd.user.tmpfiles.rules = lib.mkIf cfg.enable [
+          "d ${cfg.certDir} 0700 - - -"
+        ];
+
+        systemd.user.services.mtls-renew = lib.mkIf cfg.renew.enable
+          (mkHomeManagerMtlsRenewService { inherit pkgs cfg; });
+
+        systemd.user.timers.mtls-renew = lib.mkIf cfg.renew.enable (mkHomeManagerMtlsRenewTimer {
+          inherit (cfg.renew) onCalendar randomizedDelaySec;
+        });
+      };
+    };
+}

modules/features/restic.nix

@@ -0,0 +1,108 @@
+{ self, inputs, ... }: {
+  flake.modules.nixos.restic-server = { config, pkgs, lib, ... }: {
+    services.restic.server = {
+      enable = true;
+      dataDir = "/mnt/restic";
+      listenAddress = "0.0.0.0:8080";
+      extraFlags = [ "--no-auth" ];
+    };
+  };
+
+  flake.modules.homeManager.restic = { config, pkgs, lib, ... }:
+    let
+      cfg = config.restic;
+    in
+    {
+      options.restic = {
+        repoName = lib.mkOption {
+          description = "Name of the restic repo to use";
+          type = lib.types.str;
+          default = "john-ubuntu";
+        };
+        repoUrl = lib.mkOption {
+          description = "URL to the REST endpoint";
+          type = lib.types.str;
+          default = "rest:https://soteria.john-stream.com/${cfg.repoName}";
+        };
+        passwordFile = lib.mkOption {
+          description = "String path to the restic password file";
+          type = lib.types.str;
+        };
+        paths = lib.mkOption {
+          description = "List of string paths to include in the backup";
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+        };
+        exclude = lib.mkOption {
+          description = "List of string paths to include in the backup. There are already some common ones included by default.";
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+        };
+        OnCalendar = lib.mkOption {
+          description = "";
+          type = lib.types.str;
+        };
+        RandomizedDelaySec = lib.mkOption {
+          description = "";
+          type = lib.types.str;
+          default = "1m";
+        };
+      };
+
+      config = {
+        home.sessionVariables = {
+          RESTIC_REPOSITORY = cfg.repoUrl;
+          RESTIC_PASSWORD_FILE = cfg.passwordFile;
+          RESTIC_CACERT = config.mtls.caFile;
+          RESTIC_TLS_CLIENT_CERT = config.mtls.bundleFile;
+        };
+        
+        # This is necessary because the restic service in home manager doesn't otherwise expose these options.
+        systemd.user.services."restic-backups-${cfg.repoName}".Service.Environment = [
+          "RESTIC_CACERT=${config.mtls.caFile}"
+          "RESTIC_TLS_CLIENT_CERT=${config.mtls.bundleFile}"
+        ];
+
+        services.restic = {
+          enable = true;
+          backups.${cfg.repoName} = {
+            repository = cfg.repoUrl;
+            passwordFile = cfg.passwordFile;
+            paths = cfg.paths;
+            timerConfig = {
+              OnCalendar = cfg.OnCalendar;
+              RandomizedDelaySec = cfg.RandomizedDelaySec;
+              Persistent = true;
+            };
+            runCheck = true;
+            pruneOpts = [
+              "--keep-last 10"
+              "--keep-hourly 8"
+              "--keep-daily 14"
+              "--keep-weekly 8"
+              "--keep-monthly 12"
+            ];
+            exclude = cfg.exclude ++ [
+              ".cache"
+              ".devenv"
+              ".rustup"
+              ".cargo"
+              ".venv"
+              ".pyenv"
+              ".vscode*"
+              "data/postgres"
+              "build"
+              "dist"
+              "__pycache__"
+              "*.log"
+              "*.egg-info"
+              "*.csv"
+              "*.m4a"
+              ".local/share/Steam"
+              ".local/share/Trash"
+            ];
+          };
+        };
+      };
+    };
+}

modules/features/shell-tools.nix

@@ -0,0 +1,41 @@
+# This module provides all the shell options
+{ inputs, lib, ... }:
+{
+  flake.modules.homeManager.shell-tools = { config, pkgs, ... }: {
+    options.shell.program = lib.mkOption {
+      type = lib.types.enum [ "bash" "zsh" ];
+      default = "zsh";
+      description = "Which interactive shell configuration to enable.";
+    };
+
+    imports = with inputs.self.modules.homeManager; [
+      bash
+      zsh
+
+      # Tools
+      eza
+      files
+    ];
+
+    config = {
+      home.shell.enableShellIntegration = true;
+      programs.zsh.enable  = lib.mkForce (config.shell.program == "zsh");
+      home.packages = with pkgs; [
+        nh
+        nvd
+        nix-output-monitor
+        wget
+        curl
+        busybox
+        gnugrep
+        dig
+        btop
+        uv
+        xclip
+        jq
+        ripgrep
+        (writeShellScriptBin "ds" ''${lib.getExe pkgs.gdu} -x -I /snap /'')
+      ];
+    };
+  };
+}

modules/home-manager/bash.nix

@@ -1,10 +0,0 @@
-{
-  flake.homeModules.bash = { pkgs, lib, ... }:
-  {
-    programs.bash = {
-      enable = true;
-      enableCompletion = true;
-      package = pkgs.bash;
-    };
-  };
-}

modules/home-manager/docker.nix

@@ -1,22 +0,0 @@
-{
-  flake.homeModules.docker = { config, lib, pkgs, ... }:
-  {
-    options.docker = {
-      enable = lib.mkEnableOption "Docker tools and utilities";
-    };
-
-    config = lib.mkIf config.docker.enable {
-      programs.lazydocker.enable = true;
-      programs.docker-cli.enable = true;
-
-      home.packages = with pkgs; [
-        docker
-        docker-compose
-        lazydocker
-        (pkgs.writeShellScriptBin "test-docker" ''
-          echo "Hello from docker.nix!"
-        '')
-      ];
-    };
-  };
-}

modules/home-manager/files.nix

@@ -1,13 +0,0 @@
-{
-  flake.homeModules.files = { pkgs, ... }:
-  {
-    programs.lf.enable = true;
-    programs.lf.cmdKeybindings = {
-      "D" = "delete";
-    };
-
-    home.packages = with pkgs; [
-      gdu
-    ];
-  };
-}

modules/home-manager/rebuild.nix

@@ -1,43 +0,0 @@
-{ inputs, ... }:
-{
-  flake.homeModules.rebuild =
-    { pkgs, lib, config, ... }:
-    {
-      options = {
-        homeManagerFlakeDir = lib.mkOption {
-          type = lib.types.str;
-          default = "~/.config/home-manager/jsl-home";
-          description = "Path to the home-manager flake directory.";
-        };
-      };
-
-      config = let
-        nixBin = lib.getExe pkgs.nix;
-        flakeDir = config.homeManagerFlakeDir;
-      in
-      {
-        home.activation.printFlakeDir = lib.hm.dag.entryAfter ["writeBoundary"] ''
-          run echo "Home Manager flake directory: ${flakeDir}"
-        '';
-
-        home.packages = with pkgs; [
-          home-manager
-          (writeShellScriptBin "flake-parts-test" ''
-            echo "Test ${flakeDir}"
-          '')
-          (writeShellScriptBin "flake-parts-check" ''
-            cd ${flakeDir}
-            ${nixBin} run ".#write-flake"
-            ${nixBin} flake check
-          '')
-          (writeShellScriptBin "nhms" ''
-            ${lib.getExe home-manager} switch --impure --flake ${flakeDir}
-          '')
-          (writeShellScriptBin "nhmu" ''
-            ${nixBin} flake update --flake ${flakeDir}
-            nhms
-          '')
-        ];
-      };
-    };
-}

modules/home-manager/shell.nix

@@ -1,41 +0,0 @@
-{ inputs, ... }:
-{
-  flake.homeModules.shell = {pkgs, lib, ...}:
-  {
-    imports = with inputs.self.homeModules; [
-      # Shells
-      # bash
-      zsh
-      
-      # Tools
-      shell-tools
-      files
-      docker
-    ];
-
-    programs.eza = {
-      enable = true;
-      package = pkgs.eza;
-      enableBashIntegration = true;
-      enableZshIntegration = true;
-    };
-
-    home.shell.enableShellIntegration = true;
-    home.shellAliases = {
-      ls = "${lib.getExe pkgs.eza} -lgos type --no-time --follow-symlinks";
-    };
-  };
-
-  flake.homeModules.shell-tools = {pkgs, ...}: {
-    home.packages = with pkgs; [
-      wget
-      curl
-      cacert
-      busybox
-      gnugrep
-      dig
-      btop
-      uv
-    ];
-  };
-}

modules/home-manager/sops.nix

@@ -1,82 +0,0 @@
-{ inputs, ... }:
-let
-  inputs' = inputs;  # save a reference before it's shadowed
-in
-{
-  flake-file.inputs = {
-    # Adding sops-nix to the flake-file inputs causes it to get added to the inputs in flake.nix when it gets generated.
-    # This also makes the sops-nix module available
-    sops-nix.url = "github:Mic92/sops-nix";
-    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
-  };
-  
-  # Define the homeModules that are used by flake-parts
-  # https://flake.parts/options/home-manager.html#opt-flake.homeModules
-  flake.homeModules.sops = { inputs, config, pkgs, lib, ... }:
-  let
-    sopsBin = lib.getExe pkgs.sops;
-    sopsConfigPath = ../../.sops.yaml;
-    sopsSecretsPath = ../../keys/secrets.yaml;
-    ageKeyFile = "${config.xdg.configHome}/sops/age/keys.txt";
-  in
-  {
-    home.packages = with pkgs; [
-      eza
-      age
-      sops # This is necessary to make the sops binary available
-      ssh-to-age
-      (writeShellScriptBin "gen-age-key" ''
-        ${lib.getExe pkgs.ssh-to-age} -i ${config.ssh.IdentityFile} -private-key > ${ageKeyFile}
-        echo -n "Created ${ageKeyFile}: "
-        echo $(show-age-key)
-      '')
-      (writeShellScriptBin "show-age-key" "exec ${lib.getExe' pkgs.age "age-keygen"} -y ${ageKeyFile}")
-      (writeShellScriptBin "edit-secrets" "exec ${sopsBin} --config ${sopsConfigPath} ${sopsSecretsPath}")
-      (writeShellScriptBin "ls-secrets" "exec ${lib.getExe pkgs.eza} -alT --follow-symlinks ~/.config/sops-nix/secrets")
-    ];
-
-    programs.zsh.shellAliases.sops = "exec ${sopsBin} --config ${sopsConfigPath}";
-
-    imports = [
-      # This import makes the sops config attribute available below
-      inputs'.sops-nix.homeManagerModules.sops
-    ];
-
-    home.sessionVariables = {
-      GMAIL_CREDS_PATH = "${config.xdg.configHome}/sops-nix/gmail_api_credentials.json";
-    };
-
-    # Option definitions for the sops home-manager module:
-    # https://github.com/Mic92/sops-nix/blob/master/modules/home-manager/sops.nix
-    sops = {
-      defaultSopsFile = "${sopsSecretsPath}";
-      defaultSopsFormat = "yaml";
-
-      # Not sure any of these are necessary
-      # age.sshKeyPaths = [ "${config.sshIdentityFile}" ];
-      # age.keyFile = "${ageKeyFile}";
-      # age.generateKey = true;
-
-      # secrets."api/gmail_client_secret" = {
-      #   path = "${config.xdg.configHome}/resticprofile/dendrite.txt";
-      # };
-      
-      templates."gmail_creds" = {
-        path = "${config.xdg.configHome}/sops-nix/gmail_api_credentials.json";
-        content = ''
-          {
-              "installed": {
-                  "client_id": "499012320469-vtml6emu6bmujpsj9lud2b44jqu7h26j.apps.googleusercontent.com",
-                  "project_id": "python-apis-423500",
-                  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
-                  "token_uri": "https://oauth2.googleapis.com/token",
-                  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
-                  "client_secret": "${config.sops.placeholder."api/gmail_client_secret"}",
-                  "redirect_uris": [ "http://localhost" ]
-              }
-          }
-        '';
-      };
-    };
-  };
-}

modules/home-manager/ssh.nix

@@ -1,109 +0,0 @@
-{inputs, ... }:
-let
-  userName = "john";
-in
-{
-  flake.homeModules.ssh = { pkgs, config, lib, ... }:
-  {
-    options.ssh = {
-      IdentityFile = lib.mkOption {
-        # Intentionally not using a path type here because that will end up with the private key getting copied into the store
-        type = lib.types.str;
-        default = "${config.home.homeDirectory}/.ssh/id_ed25519";
-        description = "Path to the SSH identity file.";
-      };
-
-      matchSets = {
-        appdaemon = lib.mkEnableOption "Enable AppDaemon SSH targets";
-        certs = lib.mkEnableOption "Enable Janus and Soteria SSH targets";
-        homelab = lib.mkEnableOption "Enable various Homelab targets";
-      };
-    };
-
-    # All this stuff has to be wrapped in a config attribute because of the presence of the options here?
-    config = let
-      identityFile = config.ssh.IdentityFile;
-      publicKeyFile = "${identityFile}.pub";
-      certificateFile = "${identityFile}-cert.pub";
-      userKnownHostsFile = "${config.home.homeDirectory}/.ssh/known_hosts";
-    in {
-      home.packages = [
-        (pkgs.writeShellScriptBin "sign-ssh-cert" ''
-          echo "Signing ${publicKeyFile}"
-          echo "Copy the Step-CA JWK Provisioner password from 1password"
-          step ssh certificate --sign \
-          --principal root --principal ${userName} \
-          --provisioner admin \
-          ${userName} ${publicKeyFile}
-        '')
-      ];
-
-      programs.ssh = {
-        enable = true;
-        enableDefaultConfig = false;
-        extraConfig = ''
-          SetEnv TERM="xterm-256color"
-          IdentityAgent ~/.1password/agent.sock
-        '';
-
-        matchBlocks = lib.mkMerge [
-          {
-            "*" = {
-              user = "john";
-
-              compression = false;
-              serverAliveInterval = 0;
-              serverAliveCountMax = 3;
-
-              identitiesOnly = true;
-              inherit identityFile certificateFile;
-
-              hashKnownHosts = false;
-              userKnownHostsFile = "${userKnownHostsFile}";
-
-              addKeysToAgent = "yes";
-              forwardAgent = false;
-            };
-          }
-          (lib.mkIf config.ssh.matchSets.appdaemon {
-            "appdaemon" = {
-              hostname = "192.168.1.242";
-            };
-            "ad-nix" = {
-              hostname = "192.168.1.201";
-              user = "appdaemon";
-            };
-          })
-          (lib.mkIf config.ssh.matchSets.certs {
-            "janus" = {
-              hostname = "janus.john-stream.com";
-              user = "root";
-            };
-            "soteria" = {
-              hostname = "soteria.john-stream.com";
-              user = "john";
-            };
-          })
-          (lib.mkIf config.ssh.matchSets.homelab {
-            "docs" = {
-              hostname = "192.168.1.110";
-              user = "root";
-            };
-            "gitea" = {
-              hostname = "192.168.1.104";
-              user = "john";
-            };
-            "hermes" = {
-              hostname = "192.168.1.150";
-              user = "root";
-            };
-            "panoptes" = {
-              hostname = "192.168.1.107";
-              user = "panoptes";
-            };
-          })
-        ];
-      };
-    };
-  };
-}

modules/home-manager/user.nix

@@ -1,30 +0,0 @@
-{ inputs, self, ... }:
-let
-  userName = "john";
-in
-{
-  flake.homeModules."${userName}" = {
-    home.username = userName;
-    home.homeDirectory = "/home/${userName}";
-    home.stateVersion = "25.11";
-
-    programs.git.settings.user.name = "John Lancaster";
-    programs.git.settings.user.email = "32917998+jsl12@users.noreply.github.com";
-  };
-
-  flake.modules.nixos.user = 
-    { pkgs, ... }:
-    {
-      users.users."${userName}" = {
-        name = "${userName}";
-        shell = pkgs.zsh;
-      };
-      programs.zsh.enable = true;
-
-      home-manager.users."${userName}" = {
-        imports = [
-          inputs.self.homeModules."${userName}"
-        ];
-      };
-    };
-}

modules/home-manager/zsh.nix

@@ -1,37 +0,0 @@
-{
-  flake.homeModules.zsh = { pkgs, ... }:
-  {
-    programs.zsh = {
-      enable = true;
-      package = pkgs.zsh;
-      enableCompletion = true;
-      autosuggestion.enable = true;
-      # syntaxHighlighting.enable = true;
-      history = {
-        append = true;
-        ignoreAllDups = true;
-        ignorePatterns = [
-          "history"
-          "ls"
-          "eza"
-          "clear"
-        ];
-        save = 1000;
-        size = 1000;
-        share = true;
-      };
-      oh-my-zsh = {
-        enable = true;
-        # theme = "risto";
-        theme = "agnoster";
-        plugins = [
-          "sudo"
-          "dotenv"
-          "git"
-          "ssh"
-          "ssh-agent"
-        ];
-      };
-    };
-  };
-}

modules/hosts/janus/default.nix

@@ -0,0 +1,109 @@
+{ inputs, ... }:
+let
+  username = "john";
+  hostname = "janus";
+  ca-url = "https://janus.john-stream.com/";
+  fingerprint = builtins.readFile ./fingerprint;
+in
+{
+  flake.modules.nixos.janus-ca =
+    { config, lib, ... }:
+    let
+      cfg = config.janus-ca;
+      johnHome = lib.attrByPath [ "users" "users" username "home" ] "/home/${username}" config;
+      johnGroup = lib.attrByPath [ "users" "users" username "group" ] username config;
+      cfgInEtc = lib.hasPrefix "/etc/" cfg.certDir;
+      certDirEtcPath =
+        if cfgInEtc then
+          lib.removePrefix "/etc/" cfg.certDir
+        else
+          cfg.certDir;
+      certRootEtcPath = "${certDirEtcPath}/root_ca.crt";
+      mkStepRules = home: user: group: [
+        "d ${home}/.step 0700 ${user} ${group} -"
+        "d ${home}/.step/config 0700 ${user} ${group} -"
+        "d ${home}/.step/certs 0700 ${user} ${group} -"
+        "L+ ${home}/.step/config/defaults.json - - - - /etc/step-ca/defaults.json"
+        "L+ ${home}/.step/certs/root_ca.crt - - - - ${cfg.certDir}/root_ca.crt"
+      ];
+    in
+    {
+      options.janus-ca = {
+        certDir = lib.mkOption {
+          description = "String path to where the mtls certs will be stored.";
+          type = lib.types.str;
+          default = "/etc/step-ca/certs";
+        };
+      };
+
+      config = {
+        environment.etc = lib.mkIf cfgInEtc {
+          "step-ca/defaults.json".text = builtins.toJSON {
+            inherit ca-url fingerprint;
+            root = "/etc/${certRootEtcPath}";
+          };
+          "${certRootEtcPath}".source = ./root_ca.crt;
+        };
+        systemd.tmpfiles.rules =
+          mkStepRules johnHome username johnGroup
+          ++ mkStepRules "/root" "root" "root";
+      };
+    };
+
+  flake.modules.homeManager.janus-ca = { config, ... }: {
+    home.file.".step/config/defaults.json".text = builtins.toJSON {
+      inherit ca-url fingerprint;
+      root = "${config.home.homeDirectory}/.step/certs/root_ca.crt";
+    };
+    home.file.".step/certs/root_ca.crt".source = ./root_ca.crt;
+  };
+
+  flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
+    modules = with inputs.self.modules; [
+      nixos.lxc
+      nixos.mysops
+      nixos.step-ssh-host
+      nixos.janus-ca
+      inputs.home-manager.nixosModules.home-manager
+      nixos."${username}"
+      nixos.docker
+      nixos.login-text
+      nixos.mtls
+      {
+        networking.hostName = hostname;
+        step-ssh-host = {
+          hostname = hostname;
+        };
+        mtls = {
+          enable = true;
+          subject = hostname;
+          san = [
+            "${hostname}.john-stream.com"
+            "192.168.1.244"
+          ];
+        };
+
+        home-manager.users."${username}" = {
+          imports = with inputs.self.modules.homeManager; [
+            mysops
+            step-ssh-user
+          ];
+          shell.program = "zsh";
+          docker.enable = true;
+        };
+      }
+    ];
+  };
+
+  perSystem = { system, pkgs, lib, ... }: {
+    packages.janus-ca = inputs.wrappers.lib.wrapPackage {
+      inherit pkgs;
+      package = pkgs.step-cli;
+      binName = "janus-cert";
+      args = [
+        "ca" "certificate"
+        "--ca-url=${ca-url}"
+      ];
+    };
+  };
+}

modules/hosts/janus/fingerprint

@@ -0,0 +1 @@
+2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6

modules/hosts/janus/root_ca.crt

@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBlDCCATqgAwIBAgIRAKDvqOX8WVhJ/ev02Y1gXKQwCgYIKoZIzj0EAwIwKDEO
+MAwGA1UEChMFSmFudXMxFjAUBgNVBAMTDUphbnVzIFJvb3QgQ0EwHhcNMjUxMjE4
+MDYwMjI4WhcNMzUxMjE2MDYwMjI4WjAoMQ4wDAYDVQQKEwVKYW51czEWMBQGA1UE
+AxMNSmFudXMgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABMt6kNpx
+Q9vySc1N6F9jJObeQXZI+9f33E1cN4zbEuNpmtpRl0WaPa1AGNbSi5sIbiH7wDv2
+llXfCqYWkeoCE5mjRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/
+AgEBMB0GA1UdDgQWBBRo55byyyo2sePP+8zz+uM4mXNV+zAKBggqhkjOPQQDAgNI
+ADBFAiB6zxTbvWMZWgDQhKGh+MnGQQ7f8UGhzinOfRG7a/HdOAIhAIVWt6MLl6QU
+FOvl/qIFGd7YJeWU5aahPABVttxjSMn/
+-----END CERTIFICATE-----

modules/hosts/janus/ssh_user_ca.pub

@@ -0,0 +1 @@
+ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNpgz9xYE3K+JeQ7vtDA07iWlp0xTXB+G8MBzX6/RluXs8E6v+ahx90M093EYIOImaW6npWQ0JnFtmZaet5l9Ao=

modules/hosts/john-p14s/configuration.nix

@@ -0,0 +1,147 @@
+{ self, inputs, ... }:
+{
+  flake.modules.nixos.p14sConfiguration = { config, pkgs, lib, ... }:
+    let
+      hostname = "john-p14s";
+      homeDirectory = config.home-manager.users.john.home.homeDirectory;
+      flakeDir = "${homeDirectory}/Documents/dendritic";
+      my-neovim = inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.my-neovim;
+    in
+    {
+      imports = [
+        self.modules.nixos.p14sHardware
+      ];
+
+      nix.settings.experimental-features = [ "nix-command" "flakes" ];
+      nixpkgs.config = {
+        permittedInsecurePackages = [ "openssl-1.1.1w" ];
+        allowUnfree = true;
+      };
+
+      rebuild.flakeDir = flakeDir;
+
+      networking = {
+        hostName = hostname;
+        networkmanager.enable = true;
+      };
+
+      # Enable automatic login for the user.
+      # services.displayManager.autoLogin.enable = true;
+      # services.displayManager.autoLogin.user = "john";
+
+      programs.zsh.enable = true;
+      services.openssh.enable = true;
+      services.tailscale.enable = true;
+
+      # List packages installed in system profile. To search, run:
+      # $ nix search wget
+      environment.systemPackages = with pkgs; [
+        wget
+        cacert
+        busybox
+        dig
+        samba
+        my-neovim
+      ];
+
+      security.pam.services.swaylock = {};
+      security.pam.services.swaylock.fprintAuth = true;
+
+      programs._1password.enable = true;
+      programs._1password-gui = {
+        enable = true;
+        # Certain features, including CLI integration and system authentication support,
+        # require enabling PolKit integration on some desktop environments (e.g. Plasma).
+        polkitPolicyOwners = [ "john" ];
+        # TODO this should not be a hardcoded username
+      };
+
+      # This is needed for VSCode remote support. Read: https://nixos.wiki/wiki/Visual_Studio_Code
+      programs.nix-ld.enable = true;
+
+      # This value determines the NixOS release from which the default
+      # settings for stateful data, like file locations and database versions
+      # on your system were taken. It's perfectly fine and recommended to leave
+      # this value at the release version of the first install of this system.
+      # Before changing this value read the documentation for this option
+      # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+      system.stateVersion = "24.05"; # Did you read the comment?
+
+      # Set your time zone.
+      time.timeZone = "America/Chicago";
+
+      # Select internationalisation properties.
+      i18n = {
+        defaultLocale = "en_US.UTF-8";
+        extraLocaleSettings = {
+          LC_ADDRESS = "en_US.UTF-8";
+          LC_IDENTIFICATION = "en_US.UTF-8";
+          LC_MEASUREMENT = "en_US.UTF-8";
+          LC_MONETARY = "en_US.UTF-8";
+          LC_NAME = "en_US.UTF-8";
+          LC_NUMERIC = "en_US.UTF-8";
+          LC_PAPER = "en_US.UTF-8";
+          LC_TELEPHONE = "en_US.UTF-8";
+          LC_TIME = "en_US.UTF-8";
+        };
+      };
+
+      services.libinput.enable = true; # Enable touchpad support (enabled default in most desktopManager).
+      services.fprintd.enable = true; # Enables fingerprint sensor
+
+      # Enable sound with pipewire.
+      services.pulseaudio.enable = false;
+      security.rtkit.enable = true; # PulseAudio server uses this to acquire realtime priority.
+      services.pipewire = {
+        enable = true;
+        alsa.enable = true;
+        alsa.support32Bit = true;
+        pulse.enable = true;
+        # If you want to use JACK applications, uncomment this
+        #jack.enable = true;
+
+        # use the example session manager (no others are packaged yet so this is enabled by default,
+        # no need to redefine it in your config for now)
+        # media-session.enable = true;
+      };
+
+      home-manager.users.root = {
+        imports = with inputs.self.modules.homeManager; [
+          rebuild
+        ];
+        home.stateVersion = "25.11";
+      };
+      home-manager.users.john.imports = with inputs.self.modules.homeManager; [
+        gnome
+        desktop
+        mysops
+        rebuild
+        {
+          my-vscode.enable = true;
+          mysops.hostSecretFile = "${flakeDir}/modules/hosts/john-p14s/secrets.yaml";
+          homeManagerFlakeDir = "${flakeDir}";
+          shell.program = "zsh";
+          home.packages = with pkgs; [
+            bash
+            discord
+            my-neovim
+            proton-vpn
+            joplin-desktop
+          ];
+          ssh.certificates.enable = true;
+          ssh.matchSets = {
+            appdaemon = true;
+            homelab = true;
+            dev = true;
+            certs = true;
+          };
+        }
+      ];
+      sops.defaultSopsFile = ./secrets.yaml;
+      sops.age.sshKeyPaths = [ "${homeDirectory}/.ssh/id_ed25519" ];
+      mtls = {
+        enable = true;
+        subject = hostname;
+      };
+    };
+}

modules/hosts/john-p14s/default.nix

@@ -0,0 +1,27 @@
+{ self, inputs, ... }: {
+  flake-file.inputs = {
+    nixos-hardware = {
+      url = "github:NixOS/nixos-hardware";
+      flake = false;
+    };
+  };
+
+  flake.nixosConfigurations.john-p14s = inputs.nixpkgs.lib.nixosSystem {
+    modules = [
+      "${inputs.nixos-hardware}/lenovo/thinkpad/p14s"
+      "${inputs.nixos-hardware}/lenovo/thinkpad/p14s/amd/gen4"
+    ] ++ (with self.modules.nixos; [
+      p14sConfiguration
+      janus-ca
+      rebuild
+      sudo
+      john
+      gnome
+      steam
+      wireguard
+      mtls
+      # greetd
+      # niri
+    ]);
+  };
+}

modules/hosts/john-p14s/hardware.nix

@@ -0,0 +1,59 @@
+{ self, inputs, ... }: {
+  flake.modules.nixos.p14sHardware = { config, lib, pkgs, modulesPath, ... }: {
+    imports = [
+      (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+    boot = {
+      loader = {
+        systemd-boot.enable = true;
+        efi.canTouchEfiVariables = true;
+      };
+      initrd = {
+        availableKernelModules = [ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "usbhid" "sd_mod" ];
+        kernelModules = [ "amdgpu" ];
+      };
+      kernelModules = [ "kvm-amd" ];
+      extraModulePackages = [ ];
+    };
+
+    # boot.loader.systemd-boot.enable = true;
+    # boot.loader.efi.canTouchEfiVariables = true;
+    # boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "usbhid" "sd_mod" ];
+    # boot.initrd.kernelModules = [ "amdgpu" ];
+    # boot.kernelModules = [ "kvm-amd" ];
+    # boot.extraModulePackages = [ ];
+
+    fileSystems."/" = {
+      device = "/dev/disk/by-uuid/fbc7d8bc-080b-4554-a2b2-5f92d059ce07";
+      fsType = "ext4";
+    };
+
+    fileSystems."/boot" = {
+      device = "/dev/disk/by-uuid/9A04-ADD8";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+    swapDevices = [ ];
+
+    # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+    # (the default) this is the recommended approach. When using systemd-networkd it's
+    # still possible to use this option, but it's recommended to use it in conjunction
+    # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+    networking.useDHCP = lib.mkDefault true;
+    # networking.interfaces.enp102s0u2u4.useDHCP = lib.mkDefault true;
+    # networking.interfaces.enp1s0f0.useDHCP = lib.mkDefault true;
+    # networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true;
+
+    nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+    hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+
+    hardware.graphics = {
+      enable = true;
+      enable32Bit = true;
+      extraPackages = [ pkgs.rocmPackages.clr.icd ];
+    };
+    environment.variables.AMD_VULKAN_ICD = "RADV";
+  };
+}

modules/hosts/john-p14s/secrets.yaml

@@ -0,0 +1,26 @@
+restic_password: ENC[AES256_GCM,data:8KeL7kOMTHkK+ZpY3aq0/S4UYbkZh72FxJAolcVes79NPfdHiNi77fmAZuXb8Gxasu16vk4y6ksWFmrZquvcbg+cLt8Yze+qvuCiUW62IOppzRIBLk6w2f8uPhU41gsVuj6u4Jz/Su7miNBvJYmF8vulIwDKS7qg43dzIKXY4q1HaRHCD12PkU9EfGpIgivdNCOO0lCE6m/O3IB8Ed4R51scBnVrIj89K5OuTepvIrGElmXiWqBdsTzCIaJCZJ8fDnzJPorLhsTAzKCnQhNoIrW/aYArzj9+WmglmGuqeaoemBoNTrYC9bssUwuWAOqsf1HC7gWST/dP9FmKl7UHlgkslblRcRedFPAQjDhy/RgZCj8hs/XrVYOzwW8WJ0XeB9UPK03QPJc8EZdz9r2Q0+U3LQxMV6Jne5JZGsMpII4b+7b/WbRZTooX3G09MES/gzwD+hyBr++6EpP9QTYs+4XsNLNN+S6y5+YS/7XmRvR7xb93eZ4EfUUKiQYejVKQBl9b8QTJa3q26RPa/82O5zQlzd1w/EjA4G6Vv8H6wvK0fHNwpU3hl9V8EL7Ca7JKfJr11Vw0fNHx2nXjOLURt27wbDeWUaSrzI+z2h/0TSiKWas/Eu5+4L9n7E3H5u5Hg2uaCQkDpy6RJkW9UL6lCC1YEJw5yHTugrPNoMcRlAKRoSIeSZSPfGl0CKYAC39s422xX2f46GpJu0bO8GG/XN9Qk+SxqPHGuzx7nWghFQctZb1ssGKuvHKqaNYZvWeWqqkxyPWb6xjaBaSGxcp5MsET+RAu2F1XgX9Is11mIJETlHhRE3OpMSHh7toIiuNs8YzsgkedVFWhx+Xu27DWvOFvg/01Rh6s5RGJKMgL7WQMLTtY2KI/ko648WXVoCtVymG8d30qWnSt8319jkILX/wdB8Vqp5ceRqHwDE89jhEh0GOg07eLcREnh+gjXij1/bS66/+hHk4jhkzGtbdfEji9sro4Nm+kVRA+6fgJjCvt1sAvjuj10Scx4uH3AdDTW+y0KaniK8EHTZzaGDuaV+tk3hZEfpwpdan5mquoQvFdZWsWlDefX7gRq38szmi9LtULEai0WKOtqnnDIOnWk/3NYeNdzJ28YzrUDbkxtghkRgr7fNGEtyCGRuWRRMc5mVp2FPzAwRKk29ShILpWbvfUzwAWUOEpyAS4bstzlMybf9L8sp20+Ier8gOMGJ81eXXXmhtgMn6aWZ6EDGe1Shl0gDM0JUEAkA2+kf3oIZAvcWiFxj7vyd4Aacw3RetUSJcy8JwbV3I/isxKyy/xs8zE2PUY0z3Cwh9MpVP9G8N6Mef6v2DNDNg+2iJ/eslQdbZRQzdJwnBMhpOopzRwuUaC7jJKyGBkcNbbmNjceJWEue0XVjIcZHJ7BFe3jKluezNIJIf268V35+HIpXJA7BUJn8NPCIQXze5Frm46U2aRTQ53LU4HBGLXYPzx8QLsn0jLVy518w/TztawdT3/SmSWNwYTuZG18TmXs9v3oB6PrUr4M7kJbNRLpRb0ZelbMDwpR074FPwwud6fkjR2lLQBbufmPUBdpVJZ2xFjijle8h1h29zoFsydFNq5wSXUO/nm/S09KdKi5F2S1uKP+NL80OVEeC+QXcBdTry07meVIhsBOh+9ajy1ExaMaPs2xjB5QvTgJA9kfJOAoUygjMC33FwdRw10eGP//IsiRm9EukF1o++MfZnAtcjhoOoy79TjlO8p8YVNwEhZ14Ik/kIizyQtr0gR+pVEIc6+1W29UOWNRXb+ZavXRDq0wvxigMagfcL+zIr4gctufTfubiOmVa85qVJB,iv:VogP+OQvlsYCSqlmffO+o99C0hJm63ZqLXVd2B0oom0=,tag:+se1QHW6xLMj/dZrbY0MKQ==,type:str]
+wireguard_private_key: ENC[AES256_GCM,data:sCskwDhemU1y4M4A4R9KxwiL8q+FtxnUqg1omU7yS81H1bbSM804hNzmq+A=,iv:7wNMAG+7wYYXYgKEohIAYisMN5lbz+M5RhCEaHL4yWE=,tag:FENdJTEEGD9cEJVwIIUQDA==,type:str]
+sops:
+    age:
+        - recipient: age1f6drjusg866yscj8029tk4yfpgecklrvezldm02ankm6h8nnwu5s2u6ahy
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHS0F1R0NnV0gyNFlkUEhZ
+            UkxvN1ZLQTFsV0tnR0pLNFJycmduU1VXUlFVCjBkRGxQd1B1c3cweTRsZm9OUCt0
+            anU3RTFUUkxoaXlhdlR0RkxPclVUdVkKLS0tIG9kTEVNK2piRWI5ZWFSejFFUGtD
+            emtTUGk0cVZWR3F5R05WTTFJUFUwNTAKrRYQAJen6QVSgaOyqPxSIniHiMLUfXuv
+            /O1Ebz5xLWn99EhloqW7rHhUxXlhxP2CmwfYXizyKFa6nAu6R+BCgg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXNWRXZTFWREIzRVhRaWRB
+            anNDb3hsZzFOMFMrclhmeldaOWY4b3BJekFBCkJhbjRvRUwva3lFbzNTKzJqK2p2
+            WVlMaXpvczlhdGduZHIrb2xPaEg3OUUKLS0tIHFtM09mN0FEUWdjWEVEL3VXL00w
+            WHpOY280S2hpVU1mNnozODRoMnB4bGMKK5RrDK2kAZlWf2igqyzWgshxLPj+f74A
+            mCmMLDHo5drNieFYp+guqHaHnZkf9IzpAglj7x6wCITjk+l6go5KvA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-27T03:59:09Z"
+    mac: ENC[AES256_GCM,data:MsPAxssWUSvsJQP0Ogrl3r/GoVqeL1L95YTJQbAJZ4FVxhRXP7KfbUnKSclzU6G8CP5WxV18TXZfB4JITKG3Lz5rtVpD/WFMdhDmve0f6BPMAimle2ajWUaWYNePvEynClX3nydLk3h31DjHGa8YvJZqW2ieDb/JDMdBXiLTrWc=,iv:82ul5CV3XXllFCDJfF6beIcAIFj71ycJJF4iEQvovMA=,tag:108L7VkAoPUTLtV74qgrrA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.2

modules/hosts/john-pc/default.nix

@@ -0,0 +1,117 @@
+{ withSystem, self, inputs, ... }:
+let
+  username = "john";
+  hostname = "john-pc-ubuntu";
+
+  # testTarget = "fded:fb16:653e:25da:be24:11ff:fe89:1cc3"; # soteria
+  # testTarget = "fded:fb16:653e:25da:be24:11ff:fea0:753f"; # test-nix
+  testHost = "soteria"; # which host to test build
+  testTarget = "test-nix";
+
+in
+{
+  flake.modules.homeManager."${hostname}" = { config, pkgs, lib, ... }:
+  let
+    selfPkgs = inputs.self.packages.${pkgs.stdenv.hostPlatform.system};
+    resticPasswordFile = "${config.xdg.configHome}/restic/password.txt";
+    flakeDir = "${config.xdg.configHome}/home-manager/jsl-dendritic";
+    test-push = with pkgs; writeShellApplication {
+      name = "test-push";
+      runtimeInputs = [ nh ];
+      text = ''nh os switch ${flakeDir}#${testHost} --target-host root@${testTarget} -e none'';
+    };
+  in
+  {
+    imports = with inputs.self.modules.homeManager; [
+      rebuild
+      john
+      mysops
+      janus-ca
+      step-ssh-user
+      mtls
+      restic
+      docker
+      desktop
+    ];
+    # TODO: make this more restrictive, rather than allowing all unfree packages
+    nixpkgs.config.allowUnfree = true;
+    nixpkgs.config.permittedInsecurePackages = [ "openssl-1.1.1w" ];
+
+    targets.genericLinux.enable = true;
+
+    home.username = "${username}";
+    home.homeDirectory = "/home/${username}";
+    home.packages = with pkgs; [
+      nixos-rebuild
+      test-push
+      selfPkgs.neovim-min
+      # ${selfPkgs}.my-neovim
+      # selfPkgs.richPrinter
+      selfPkgs.janus-ca
+    ];
+
+    shell.program = "zsh";
+  
+    homeManagerFlakeDir = flakeDir;
+    docker.enable = true;
+
+    step-ssh-user = {
+      enable = true;
+      principals = ["root" "${username}" "appdaemon"];
+      provisioner = "admin";
+    };
+    ssh = {
+      certificates.enable = true;
+      knownHosts = [
+        "fded:fb16:653e:25da:be24:11ff:fea0:753f ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ9ZqiWPrCwHjxFCiu0lT4rlQs7KyMapxKJQQ5PJP1eh"
+      ];
+      matchSets = {
+        certs = true;
+        appdaemon = true;
+        homelab = true;
+        dev = true;
+      };
+    };
+
+    # This provides the keys at build time and will be included in the nix store
+    sops.defaultSopsFile = ../../../keys/secrets.yaml;
+
+    # This will provide the edit-secrets script targeting this file
+    mysops.hostSecretFile = "${config.xdg.configHome}/home-manager/jsl-dendritic/keys/secrets.yaml";
+
+    sops.secrets."restic_password" = {
+      path = resticPasswordFile;
+      mode = "0400";
+      sopsFile = ./secrets.yaml;
+    };
+    restic = {
+      passwordFile = resticPasswordFile;
+      OnCalendar = "*:0/15";
+      paths = [ "${config.xdg.userDirs.documents}" "/conf" ];
+      exclude = [
+        "/home/*/Pictures"
+        "/home/*/Videos"
+        "/home/*/go"
+        "/home/*/snap"
+        "/home/john/john-nas"
+      ];
+    };
+    mtls = {
+      enable = true;
+      subject = hostname;
+      san = [
+        "${hostname}"
+        "192.168.1.85"
+        "spiffe://john-stream.com/ubuntu"
+      ];
+      lifetime = "1h";
+      renew.onCalendar = "*:1/10";
+    };
+  };
+
+  flake.homeConfigurations."john@john-pc-ubuntu" = withSystem "x86_64-linux" (ctx@{ config, inputs', ...}:
+    inputs.home-manager.lib.homeManagerConfiguration {
+      pkgs = inputs'.nixpkgs.legacyPackages;
+      modules = [ inputs.self.modules.homeManager."${hostname}" ];
+  });
+}

modules/hosts/john-pc/secrets.yaml

@@ -0,0 +1,16 @@
+restic_password: ENC[AES256_GCM,data:BVP4do8UgSX48ovwDH3D2Px6p3lr859F43TTO6pr/fIo78kI0btLDtP+BKbIauawHdvOR7g3dIRrJIvUqDBUnKIH8NE9VxyUrK+U9UzwX17m7T96h/gf3FJ55BEKKVecbJdLrVriq9fVQwUT0Dg2cCZQLctfhwaPNa5Jhkb2oqSKbJ6OmM10eS9KqprE+bVXnCd5vZtRWMKAKiGn3kfKieC79kUcFZla7M739+BMiYa7KvPkhmPOBYwSsWIBQrBFr9X+IDxP0EuEMHrOItnAv/TzG773PM+T+h5rgv6xY+fd1i1cBl5XIijtOGmyJDvrOQLVLTjeoY9LHzYyy31N102mP0SLoz1F4bINMzn1ykvUZCbgSdbyfbBUSS2WJmpbKGrE+KYGxLybFr+4kVYrrONK7Bg7NTWDPcTwdpgDL+Fk8KCiP2jg7sAjpaWRAkwrXpbCwhHPmjmJ7P5tlsxmGy46dZVKmZ3BhPWZlZfQDJ+8NRGn3U56MjGBACLMn1ZvSYXxyWc0SzLRPe2F106XCx3c08jzBaFVP76fLMAY0TXJ6VpvHrEsQKMGLw0pfciisfjRpKmNIPczz5N9wqgJIOrYBTlc/ipugXfJ5HunoLegzc6P/Z2Xjr38Ug0pz86+KhRviLVLvtDtouzpeejOve7FGIiOrd5dNVUsZ2QG+YI5Pbm6tiO/NgTLAWLmlsti1TKN9pen6nvi7NhDPiFMRqQi9FRF2HFxhhvW8uE3Ax8G98xlKcqtmzNidqiZJndAP5EJcJKe0WQUCLnybWNi8nmneFx8iMPEMFpxx9PeYNte4Wdv51P7NYNZmju+4NNaSuWW1sqmi4VJqw0HvhPHJ/8R+AKG8h6BWk00Nsawbn4OHGnz5+jWczUq+hsxeNDutUQf3FWRQIXNE/XGsXXEXBguk1AOScVj2GtdMa5L/Abamq1kx3osXMf2P1HqPHyzQK2a6olZPSVeERr9vk7V5/a0ZYgaIUPq3X8gieo1Fv6gSKiilQ33oAJ3dt0nDvrtzTHtyEuPn4xfG2JKvsFAKQIFbjSObsO6Lb/bVZWjFYc1Wt7I3Jcu6atHxpaFqv+riI4gbdgZ4NcsoruDvm5pGoNfVPoEylstsWXRQ3FptohQ74qr+Z8rAUGwVOXg+HFtFQqETGxy8QPWk0hLupNotxt2uIKpBal/z/6IYvHtP/KwiTaY/tlQmQ9l5qGQJLm1LfhdPCJJNvGUFEDZnrCYl34STIATcFIYmy2AzBQPABH7CFk/4MLeu8aiDRC8LV9zwm5PqYJ8DR0gFk6OJIciJ9rnPomMhyI5svpDQN+q8JpXWkUDl2Hi6sAx/jevk4+RyQaD1z2rusZjO5FJ/zVI2sT//yBdcgg7sNb3UfrIU4RjFP4Ep9iu04Mn3gOpt9RBGt7ITyzqXIvV7Qfy/1C4Uk9Fgj9T+ANPIRtdImTuDB01yP14FBeV02KbdqJCnwpUvArJ85/JDtVZniDm9EwilWJuAMlehDqam7jZEGVJjbnM2PyTci3DOGHAtfxsYX6R6RMD43+ScVY26sLjqNWFJq0FTGqf+yqBlG3XrS0l4P985iy6wL53R+MHvwel2a4mqAW1BNMQT/pCGyBrwuAF1M4Zgz7WAyPU8xCT7dMrq0ZQtsLGgs3qeq5rRVOw61F9zlIgFq72whlQcm0YJ3gAXl+5w742/O2MMpZoixB84Ao34uwkAn3WzGNZvpD+UK0UlpnisiXSVKUxFWZZcssVWUFuFzOSxftvmJ4CWgZu7Waj1oyV6E1Emu/a+uaIhaThdtFdJFmtUQlOjRWQ3e6dGv4FOIIl3ndR,iv:cJZBim2+pQ7o+nhfsgfbWF6PlVizvcUnoc1liLKyxLw=,tag:QPlckxNJslHT5lJ0osHVgA==,type:str]
+sops:
+    age:
+        - recipient: age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZNDh5Ym16YThRTGtRL2RB
+            TWhlOTdubGNsK3c0b2JRQ05rcUsraU10eXdVCm16MTIwdUZMbDlwbkZwVFMyeHVL
+            UlV3cEZwSUJXaVJWb1RHN3M2QUM4Y00KLS0tIFFncStUdEdWVDQzdFFaNk44cERj
+            L1pNOWNucFUvSERMZE9VS3AwMHA3emcKpppJUeUE8iBVNstQTV/3nTK8Jbz8p617
+            rEk1nxzIcHDPNj7jn9ZuIfizIOoaK6S/S5qEJogliA+L3G5SZ2DX7w==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-25T03:59:38Z"
+    mac: ENC[AES256_GCM,data:6K7fXOkKbpvpvkuBR/INlAPFfvXAW2xwpdn0evB4OaF7NueZvtg9tDJVDtGAxmo78vAOLBEZX8x4h0ezuuWpkDW5LFP6N7O70h4ExlCEH01zcESgk3gjyXLu9gRTM2/7+bvlGLKq2TQYHOF4LYDhcs5/RzWgarFKYljh6m1KbSQ=,iv:Rlh1r588ymZF5BXf5S+gKLH77+kuaC19Ctvhctfu4EQ=,tag:b55Bx+dRwQPx10zdizUMeg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.1

modules/hosts/soteria/secrets.yaml

@@ -0,0 +1,44 @@
+janus:
+    admin_jwk: ENC[AES256_GCM,data:2XcN5X77wTQ+OUXa4C9xAErGvrwJKseHjCcgoj6jt+c=,iv:9x+M1wM0dYND1JYkJjM4N8pSOok2OF+P9vmm9NCumTI=,tag:dTCfh+KB1iRJBVoNsGqvuw==,type:str]
+forgejo:
+    #ENC[AES256_GCM,data:/wtm0uXbiWFoGNWtlTzVuNxBR7CPm2FMB98t3AxSj5V5rltLvzF9BjgWoJCiX3ltzmU=,iv:xaZXbUIGJHxPrLRQzEQI7hgRgc0y061jIhoE3zlcMaA=,tag:fQGheCIdBKm6wE+vtj7g6A==,type:comment]
+    secret_key: ENC[AES256_GCM,data:/jcyeDcsryLqu9Q3VnNaENb71/Tl5JUr0zDzxt8L5UCtnJ/YHA6MKItrQ9ZHFv1XROtnSfZl9D5kKomeM8EVqA==,iv:HxMKAMVQ08gkq6SWENj0/d8i9PhcgPCp5eqbztj9bSg=,tag:nO2dFWT/vfgGc/9JIDZrGw==,type:str]
+    #ENC[AES256_GCM,data:TADqVsZwXpH/zfrXNclavH8Sv++jX081UjK/Mkys5x52gU5fU0ikk478EmwzeergsHpmxxon,iv:v9HsIsud+eiko7F0u622MBrTVDsIxlpqru0Viifvqow=,tag:FLgNTW0EcGhHT6iI9I6Bsg==,type:comment]
+    internal_token: ENC[AES256_GCM,data:7eZM+misgHZz1p6HH9VzCAPIIFjp2vT0kyc9B1KllE+x2URyrgs5IR9SZ+T5vNdMdnlNzF25pUhKzjbak8tVN554rYWp06SczzqhLyaoHKs8iGBohMqfJkoZxxIVSB7g7GC+/SAsb719,iv:XbBXqXh/PqjEcAj0qsajR7Ij56KGT/9Spdp5T549p9I=,tag:o4ONucOkIE2VJ6VjOlPb6w==,type:str]
+    #ENC[AES256_GCM,data:ZqwgnKjaolJtjcy287fnDOkb/oSLnBpfWfsTeVPwbIE8YLRSoPP4gbCnHJBLq+TJNNI=,iv:zTvw4ZS6C1ifUwOijNLuTfUQ3JM+5gj1X2f/s8MwWXc=,tag:Y1yKlL+jIRHVBulGlSErog==,type:comment]
+    jwt_secret: ENC[AES256_GCM,data:e59MlATOorsTIQjtTUKfX5Yo3CVsbbfuKczp1gh1m2D1kkZK3ORFztYpjg==,iv:JH3PVUmXToiThEKDkDJ8MGVMAPlIEgPSWhru+9WgNjk=,tag:FfDpaCPejpw6kGDkxJwDWw==,type:str]
+    lfs_jwt_secret: ENC[AES256_GCM,data:xi9PEKFUGRyc3YOg3JM3KrrENi9xsbeBjiz4R16SK5WDafoGFLazN6KRJQ==,iv:1IhPyQDwA8tZ22pfZJiU8TRTCLCHC/HAnKdmSGDfvcM=,tag:rLdREVSKBm67rt8ayN16Vw==,type:str]
+restic_password: ENC[AES256_GCM,data:u7QOZXJkxVG4J75K5nphb2uJGdz6jbWuVSsKKu+41fshp7cVoRijtr/Cs02LjVse,iv:bt1W2FeBTG6ypBFYzMPXPIkYTSn0uHURY2ui6MRgYY8=,tag:DObAMws/zQcM+UKUe9EECA==,type:str]
+sops:
+    age:
+        - recipient: age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5QThHOFdVQ0F6ZDE3QXdL
+            QVF0WW5yRkNtNXIyRm1LeEhwY2dRRWo0WENZCmZoWmlXZDh4ZGlUR2JYOUxuaVAx
+            WjhXVHBMNWdrdkgvTENJR2RpWldkNTAKLS0tIEF1bS9JSnFTbytBa1U5RjVzWkd3
+            S0pKVVI2RFN5a1BMYXBEY3VOUUM5QTAKNarYZm9DKRQhosSJBn9yryFxDkmFTV/o
+            i8b/tZ1ZybjEXX+X1EsgylM5u8iKkbEyUzqKO0E0gpg4qXSsJaMMYQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1h0prahyukq4l564yqwgcpg3g6gdrjflk0suklussjjrjstxd9uesws8633
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhdEN2M1lkMFoyQzg3bCsz
+            cVB0NUlkV1JPRjQ1TW5RSVFHUjdNMERoRXlzCk9tc25iMG00TkZjWjk2S2cyVE1J
+            cUFITDh2SkZGN0lpeWJVcWM3V3JrTTQKLS0tIENOWVBzTFYrdHRsMERwV0RKS01j
+            QVI5TVl4L0dwOWpoQ1I2THZ6cWovWGMKIo1x1ZbdTyr/dNlPhvuomfk2MoPLsHyU
+            N3CP3Scu3aZ7vqVua7uwtv4xQqyQI/yOnFjwxrVYPJ+N5Y/b4wsC6A==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGSGQvL2ZYM2dtV1JWaDR1
+            RjJnN0YwWFM4d1IwTElqUnZQQkVDTmdydUJjCjdCUWxCVDNXUHVLd2ZHcDA5L0Mw
+            cEVxVE84L2xmQnRoYmsxVEdMSEZjdGcKLS0tIHViRVJyTWt4Q3JrMWtYaS9QdHlS
+            Yjd0MUcxcExvWVpCOUR3MkdZdGQyWUkKnru0Y2A98+0Mps7EtVK7ct3vPqIGveUt
+            E5fzpcKvdefzObrx7BPTwJ19t2fZg/dSi7HKwx3vmKZSzyQaqJOzsg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-04-04T23:18:43Z"
+    mac: ENC[AES256_GCM,data:qBgeli5lHb4pyA8nAADBuRBAaq8VbAIsFI37OZtgnbnoHW2crxo3YC+EknaIYnZpZ48kwVhQS5lGRjI6JsWWhTH3+LVAhTmS2Qj/pZTD/JDLK6XJGXS4U9nB7m9aGYyW8gFCy9/DfoJWGsS//+ZmUikKPfd5kMZgh1zGoYCIGug=,iv:h+2fA+bO2SMCNrEslP36x3BPRaIy25cU/DNX8CYSC6A=,tag:RvVyUZ4ONRaKaqGiT31eUQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.2

modules/hosts/soteria/soteria.nix

@@ -0,0 +1,123 @@
+{ self, inputs, lib, ... }:
+let
+  username = "john";
+  hostname = "soteria";
+in
+{
+  flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
+    modules = with inputs.self.modules; [
+      nixos.lxc
+      nixos."${username}"
+      nixos.mysops
+      nixos.step-ssh-host
+      nixos.login-text
+      nixos.docker
+      nixos.mtls
+      nixos.janus-ca
+      nixos.forgejo
+      # nixos.restic-server
+      # nixos.restic-envoy
+      ({ config, pkgs, ... }: {
+        networking.hostName = hostname;
+        time.timeZone = "America/Chicago";
+
+        # Removes password for sudo
+        security.sudo-rs.extraRules = lib.mkAfter [
+          {
+            users = [ username ];
+            commands = [
+              {
+                command = "ALL";
+                options = [ "NOPASSWD" ];
+              }
+            ];
+          }
+        ];
+
+        users.users."${username}".extraGroups = [ "mtls" ];
+        mtls = {
+          enable = true;
+          certDir = config.janus-ca.certDir;
+          subject = hostname;
+          san = [
+            "${hostname}.john-stream.com"
+            # "192.168.1.142"
+            "forgejo.john-stream.com"
+            "192.168.1.244"
+          ];
+          lifetime = "12h";
+          renew.onCalendar = "*:3/15";
+          renew.reloadUnits = [ "forgejo.service" "restic-rest-server.service" ];
+          certReaders = [ config.services.forgejo.user "restic" ];
+        };
+        forgejo = {
+          enable = true;
+          root_url = "https://forgejo.john-stream.com";
+          https = true;
+          port = 443;
+        };
+
+        networking.firewall.allowedTCPPorts = [ 8000 ];
+        services.restic.server = {
+          enable = true;
+          privateRepos = true;
+          listenAddress = "0.0.0.0:8000";
+          extraFlags = [
+            "--no-auth"
+            "--tls"
+            "--tls-cert=${config.mtls.certFile}"
+            "--tls-key=${config.mtls.keyFile}"
+          ];
+        };
+
+        loginText.extraServiceStatus = {
+          Docker = "docker";
+          "mTLS Renewal" = "mtls-renew.timer";
+          Forgejo = "forgejo.service";
+          "Forgejo Backup" = "forgejo-dump.timer";
+          "Restic REST Server" = "restic-rest-server.service";
+        };
+
+        step-ssh-host.hostname = hostname;
+
+        # This provides the secrets at install time
+        sops.defaultSopsFile = ./secrets.yaml;
+
+        programs.zsh.enable = true;
+        home-manager.users."${username}" = {
+          imports = with inputs.self.modules; [
+            homeManager."${hostname}"
+          ];
+        };
+
+        environment.systemPackages = [
+          inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.janus-ca
+          inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.my-neovim
+          inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.jsl-zsh
+        ];
+      })
+    ];
+  };
+
+  flake.modules.homeManager."${hostname}" = { config, pkgs, lib, ... }: {
+    imports = with inputs.self.modules; [
+      homeManager.rebuild
+      homeManager.mysops
+    ];
+
+    homeManagerFlakeDir = "${config.xdg.configHome}/home-manager";
+    shell.program = "zsh";
+    docker.enable = true;
+
+    # This will provide the edit-secrets script targeting this file
+    mysops.hostSecretFile = "${config.homeManagerFlakeDir}/modules/hosts/soteria/secrets.yaml";
+  };
+
+  flake.homeConfigurations."${hostname}" = inputs.home-manager.lib.homeManagerConfiguration {
+    pkgs = import inputs.nixpkgs { system = "x86_64-linux"; };
+    modules = with inputs.self.modules; [
+      homeManager."${username}"
+      homeManager."${hostname}"
+    ];
+  };
+}

modules/hosts/test-nix.nix

@@ -0,0 +1,30 @@
+{ inputs, ... }:
+let
+  username = "john";
+  hostname = "test-nix";
+in
+{
+  flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
+    modules = with inputs.self.modules; [
+      nixos.lxc
+      nixos.mysops
+      nixos.step-ssh-host
+      inputs.home-manager.nixosModules.home-manager
+      nixos."${username}"
+      nixos.docker
+      {
+        home-manager.users."${username}" = {
+          imports = with inputs.self.modules.homeManager; [
+            mysops
+          ];
+          shell.program = "zsh";
+          docker.enable = true;
+          ssh.matchSets = {
+            certs = true;
+            homelab = true;
+          };
+        };
+      }
+    ];
+  };
+}

modules/nix-tools/rebuild.nix

@@ -0,0 +1,132 @@
+{ self, inputs, ... }:
+{
+  flake.modules.nixos.rebuild =
+    { config, pkgs, lib, ... }:
+    let
+      flakeDir = config.rebuild.flakeDir;
+      echoCmd = lib.getExe' pkgs.coreutils "echo";
+      hostnameCmd = "$(${lib.getExe pkgs.hostname} -s)";
+
+      nfs = with pkgs; writeShellApplication {
+        name = "nfs";
+        runtimeInputs = [ coreutils hostname nh ];
+        text = ''
+          HOSTNAME=$(hostname -s)
+          echo "Switching to the $HOSTNAME nixos profile"
+          nh os switch "$@" "${flakeDir}#$HOSTNAME"
+        '';
+      };
+      nfsu = with pkgs; writeShellApplication {
+        name = "nfsu";
+        runtimeInputs = [ nfs pkgs.git ];
+        text = ''nfs --refresh "$@"'';
+      };
+    in
+    {
+      options.rebuild = {
+        flakeDir = lib.mkOption {
+          description = "Path to the flake directory.";
+          type = lib.types.str;
+          default = "/etc/nixos";
+        };
+      };
+
+      config = {
+        environment.systemPackages = with pkgs; [ nfs nfsu ];
+      };
+    };
+
+  flake.modules.homeManager.rebuild =
+    { config, pkgs, lib, ... }:
+    let
+      flakeDir = config.homeManagerFlakeDir;
+      hostnameCmd = "$(${lib.getExe pkgs.hostname} -s)";
+
+      flake-parts-check = with pkgs; writeShellApplication {
+        name = "flake-parts-check";
+        runtimeInputs = [ nix ];
+        text = ''
+          cd ${flakeDir}
+          nix run "${flakeDir}#write-flake"
+          nix flake check
+        '';
+      };
+
+      nhms = with pkgs; writeShellApplication {
+        name = "nhms";
+        runtimeInputs = [ coreutils hostname nh ];
+        text = ''
+          HOSTNAME=$(hostname -s)
+          echo "Switching to the $HOSTNAME home-manager profile"
+          nh home switch ${flakeDir} -c "$HOSTNAME" "$@"
+        '';
+      };
+
+      nhmu = with pkgs; writeShellApplication {
+        name = "nhmu";
+        runtimeInputs = [ nhms ];
+        text = ''nhms --update'';
+      };
+
+      test-build = with pkgs; writeShellApplication {
+        name = "test-build";
+        runtimeInputs = [ coreutils nix hostname ];
+        text = ''
+          if [ -z "$1" ]; then
+            HOSTNAME=$(hostname -s)
+          else
+            HOSTNAME="$1"
+          fi
+          echo "Testing the evaulation of the nixos config for $HOSTNAME"
+          nix eval "${flakeDir}#nixosConfigurations.$HOSTNAME.config.system.build.toplevel.drvPath"
+        '';
+      };
+
+      cleanup = with pkgs; writeShellApplication {
+        name = "cleanup";
+        runtimeInputs = [ coreutils home-manager nix ];
+        text = ''
+          set -e
+          DAYS=$1
+          if [ -z "$DAYS" ]; then
+            echo "usage: cleanup <days>"
+            exit 1
+          fi
+          home-manager expire-generations "-$DAYS days"
+          nix profile wipe-history --older-than "''${DAYS}d"
+          nix store gc
+          nix store optimise
+        '';
+      };
+
+    in
+    {
+      options = {
+        homeManagerFlakeDir = lib.mkOption {
+          description = "Path to the home-manager flake directory.";
+          type = lib.types.str;
+          default = "${config.xdg.configHome}/home-manager";
+        };
+      };
+
+      config = {
+        home.activation.printFlakeDir = lib.hm.dag.entryAfter ["writeBoundary"] ''
+          run echo "Home Manager flake directory: ${flakeDir}"
+        '';
+
+        home.packages = with pkgs; [
+          home-manager
+          (symlinkJoin {
+            name = "build-tools";
+            paths = [
+              flake-parts-check
+              nhms
+              nhmu
+              test-build
+              cleanup
+            ];
+          })
+        ];
+      };
+    };
+}

modules/nix-tools/user.nix

@@ -0,0 +1,40 @@
+# Lifted from:
+# https://github.com/Doc-Steve/dendritic-design-with-flake-parts/blob/69edacdb5a4a6ca71d649bb8eb62cf8c630c8627/modules/users/bob%20%5BNDn%5D/bob.nix#L8
+{ self, inputs, ... }:
+{
+  config.flake.factory.user = {
+    username,
+    isAdmin ? false,
+    noPassword ? false,
+    # homeImports ? [ ],
+    # homePackages ? [ ],
+  }: {
+    nixos."${username}" = { config, lib, pkgs, ... }: {
+      imports = [
+        inputs.home-manager.nixosModules.home-manager
+      ];
+
+      users.users."${username}" = {
+        isNormalUser = true;
+        home = "/home/${username}";
+        shell = lib.mkIf config.programs.zsh.enable pkgs.zsh;
+        extraGroups = [ "input" "networkmanager" ]
+        ++ lib.optional isAdmin "wheel"
+        ++ lib.optional config.virtualisation.docker.enable "docker"
+        ++ lib.optional (isAdmin && config.services.forgejo.enable) config.services.forgejo.group
+        ++ lib.optional (isAdmin && config.services.postgresql.enable) "postgres";
+      };
+
+      security.sudo-rs.enable = lib.mkIf isAdmin true;
+
+      home-manager.useGlobalPkgs = true;
+      # https://github.com/Doc-Steve/dendritic-design-with-flake-parts/wiki/Dendritic_Aspects#multi-context-aspect
+      home-manager.users."${username}" = {
+        imports = [ self.modules.homeManager."${username}" ];
+        home.username = "${username}";
+        home.homeDirectory = "/home/${username}";
+        # home.packages = homePackages;
+      };
+    };
+  };
+}

modules/nix-tools/wrappers.nix

@@ -0,0 +1,12 @@
+{ self, inputs, ... }: {
+  flake-file.inputs = {
+    wrapper-modules = {
+      url = "github:BirdeeHub/nix-wrapper-modules";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    wrappers = {
+      url = "github:lassulus/wrappers";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+}

modules/nixos/games.nix

@@ -0,0 +1,12 @@
+{ ... }:
+{
+  flake.modules.nixos.games = {
+    programs.steam = {
+      enable = true;
+      gamescopeSession.enable = true;
+      remotePlay.openFirewall = true;
+      dedicatedServer.openFirewall = true;
+      localNetworkGameTransfers.openFirewall = true;
+    };
+  };
+}

modules/nixos/login-text.nix

@@ -0,0 +1,58 @@
+{ inputs, ... }: {
+  flake.modules.nixos.login-text = { config, lib, ... }:
+    let
+      defaultServiceStatus = {
+        SSH = "sshd.socket";
+        "SSH Cert Renewal" = "step-ssh-host-renew.timer";
+      };
+    in {
+    options.loginText.extraServiceStatus = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      default = { };
+      description = "Additional rust-motd service status entries keyed by display name.";
+    };
+
+    config = {
+      programs.rust-motd = {
+        enable = true;
+        refreshInterval = "*:0/5";
+        order = [
+          "global"
+          "last_login"
+          "service_status"
+          # "uptime"
+          "memory"
+          "filesystems"
+        ];
+        settings = {
+          global = {
+            time_format = "%Y-%m-%d %H:%M:%S %Z";
+          };
+
+          last_login = {
+            john = 3;
+            root = 3;
+          };
+
+          service_status = lib.mkMerge [
+            defaultServiceStatus
+            config.loginText.extraServiceStatus
+          ];
+
+          # This calculation is wrong for LXCs
+          # uptime = {
+          #   prefix = "Uptime";
+          # };
+
+          memory = {
+            swap_pos = "beside";
+          };
+
+          filesystems = {
+            root = "/";
+          };
+        };
+      };
+    };
+  };
+}

modules/nixos/lxc.nix

@@ -0,0 +1,29 @@
+{ inputs, ... }:
+{
+  flake.modules.nixos.lxc = { pkgs, lib, ...}: {
+    imports = with inputs.self.modules.nixos; [
+      ({ modulesPath, ... }: { imports = [ "${modulesPath}/virtualisation/proxmox-lxc.nix" ]; })
+    ];
+    nixpkgs.hostPlatform = lib.mkForce "x86_64-linux";
+    system.stateVersion = "25.11";
+    nix.settings.experimental-features = [ "nix-command" "flakes" ];
+    environment.systemPackages = with pkgs; [ git zsh ];
+
+    # security.sudo-rs.enable = true;
+    programs.nix-ld.enable = true;
+    nix.optimise.automatic = true;
+    nix.gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 30d";
+    };
+    programs.bash.enable = true;
+  };
+
+  # Generic bootstrapping lxc, use a specific host file for more
+  flake.nixosConfigurations.lxc = inputs.nixpkgs.lib.nixosSystem {
+    modules = with inputs.self.modules.nixos; [
+      lxc
+    ];
+  };
+}

modules/profiles/desktop.nix

@@ -1,26 +0,0 @@
-{ inputs, ... }:
-{
-  flake.homeModules.desktop = 
-    { pkgs, ... } :
-    {
-      xdg.enable = true;
-
-      imports = with inputs.self.homeModules; [
-        rebuild
-        john
-        ssh
-        git
-        shell
-        ghostty
-        sops
-      ];
-    };
-
-
-  flake.homeConfigurations.desktop = inputs.home-manager.lib.homeManagerConfiguration {
-    pkgs = import inputs.nixpkgs { system = "x86_64-linux"; };
-    modules = with inputs.self.homeModules; [
-      desktop
-    ];
-  };
-}

modules/programs/bash.nix

@@ -0,0 +1,10 @@
+{
+  flake.modules.homeManager.bash = { pkgs, lib, config, ... }:
+  {
+    programs.bash = lib.mkIf (config.shell.program == "bash") {
+      enable = true;
+      enableCompletion = true;
+      package = pkgs.bash;
+    };
+  };
+}

modules/programs/brave.nix

@@ -0,0 +1,11 @@
+{ self, inputs, ... }: {
+  flake.modules.homeManager.brave = {
+    programs.brave = {
+      enable = true;
+      extensions = [
+        # https://chromewebstore.google.com/detail/1password-%E2%80%93-password-mana/aeblfdkhhhdcdjpifhhbdiojplfjncoa
+        "aeblfdkhhhdcdjpifhhbdiojplfjncoa"
+      ];
+    };
+  };
+}

modules/programs/eza.nix

@@ -0,0 +1,24 @@
+{ self, inputs, ... }:
+{
+  flake.modules.homeManager.eza = { config, pkgs, lib, ... }: {
+    programs.eza = {
+      enable = true;
+      enableBashIntegration = true;
+      enableZshIntegration = true;
+      git = true;
+      icons = "auto";
+      colors = "auto";
+      extraOptions = [
+        "--all"
+        "--long"
+        "--group-directories-first"
+        "--sort=type"
+        "--dereference"
+        "--octal-permissions"
+        "--smart-group"
+        "--no-time"
+        "--git"
+      ];
+    };
+  };
+}

modules/programs/files.nix

@@ -0,0 +1,25 @@
+{
+  flake.modules.homeManager.files = { pkgs, lib, ... }:
+  {
+    programs.lf = {
+      enable = true;
+      cmdKeybindings = {
+        "D" = "delete";
+      };
+      settings = {
+        preview = true;
+        hidden = true;
+        drawbox = true;
+        icons = true;
+        ignorecase = true;
+      };
+    };
+
+    home.packages = with pkgs; [
+      gdu
+      # (writeShellScriptBin "lfcd" ''
+      #   . <(${lib.getExe pkgs.lf} -print-last-dir | sed 's/^/cd /')
+      # '')
+    ];
+  };
+}

modules/programs/ghostty.nix

@@ -7,14 +7,25 @@
     };
   };
 
-  flake.homeModules.ghostty = { config, pkgs, lib, ... }:
+  flake.modules.homeManager.ghostty = { config, pkgs, lib, ... }:
+  let
+    ghosttyPackage = pkgs.symlinkJoin {
+      name = "ghostty-x11";
+      paths = [ (config.lib.nixGL.wrap pkgs.ghostty) ];
+      nativeBuildInputs = [ pkgs.makeWrapper ];
+      meta.mainProgram = "ghostty";
+      postBuild = ''
+        wrapProgram $out/bin/ghostty --set GDK_BACKEND x11
+      '';
+    };
+  in
   {
     home.sessionVariables = {
       TERMINAL = "ghostty";
     };
 
     targets.genericLinux.nixGL = {
-      packages = inputs.nixgl.packages.${pkgs.system};
+      packages = inputs.nixgl.packages.${pkgs.stdenv.hostPlatform.system};
       defaultWrapper = "mesa";
       installScripts = [ "mesa" ];
     };
@@ -22,7 +33,7 @@
     programs.ghostty = {
       enable = true;
       enableZshIntegration = true;
-      package = config.lib.nixGL.wrap pkgs.ghostty;
+      package = ghosttyPackage;
       settings = {
         command = "TERM=xterm-256color ${lib.getExe pkgs.zsh}";
         font-size = 12;
@@ -32,13 +43,16 @@
         shell-integration = "zsh";
         shell-integration-features = [ "no-title" "sudo" ];
         gtk-single-instance = true;
+        mouse-scroll-multiplier = 0.375;
 
-        window-position-x = 100;
-        window-position-y = 100;
+        window-position-x = 25;
+        window-position-y = 25;
+        # window-height = 40;
+        # window-width = 200;
 
-        window-padding-balance = true;
-        window-padding-x = 5;
-        window-padding-y = 5;
+        # window-padding-balance = true;
+        # window-padding-x = 5;
+        # window-padding-y = 5;
         initial-window = true;
         resize-overlay = "never";
 
@@ -52,17 +66,19 @@
           "ctrl+s>k=goto_split:down"
         ];
 
-        window-height = 40;
-        window-width = 200;
       };
     };
 
     # https://github.com/ghostty-org/ghostty/discussions/3763#discussioncomment-11699970
-    xdg.desktopEntries."com.mitchellh.ghostty" = {
+    xdg.desktopEntries."com.mitchellh.ghostty" =
+    let
+      ghosttyCmd = lib.getExe ghosttyPackage;
+    in
+    {
       name = "Ghostty";
       type = "Application";
       comment = "A terminal emulator";
-      exec = "nixGLMesa ghostty";
+      exec = ghosttyCmd;
       icon = "com.mitchellh.ghostty";
       terminal = false;
       startupNotify = true;
@@ -79,7 +95,7 @@
       actions = {
         new-window = {
           name = "New Window";
-          exec = "nixGLMesa ghostty";
+          exec = ghosttyCmd;
         };
       };
     };

modules/programs/git.nix

@@ -1,6 +1,8 @@
-{
-  flake.homeModules.git = { config, lib, ... }:
-  {
+{ self, inputs, ... }: {
+  flake.modules.homeManager.git = { config, pkgs, lib, ... }: {
+    home.packages = with pkgs; [
+      git-credential-oauth
+    ];
     programs.git = {
         enable = true;
         settings = {
@@ -14,5 +16,8 @@
       enableBashIntegration = true;
       enableZshIntegration = true;
     };
+    home.shellAliases = {
+      "lzg" = "lazygit";
+    };
   };
 }

modules/programs/gmail.nix

@@ -0,0 +1,26 @@
+{ self, inputs, ... }: {
+  flake.modules.homeManager.gmail = {config, ... }: {
+    home.sessionVariables = {
+      GMAIL_CREDS_PATH = "${config.xdg.configHome}/sops-nix/gmail_api_credentials.json";
+    };
+    sops = {
+      secrets."api/gmail_client_secret" = { };
+      templates."gmail_creds" = {
+        path = "${config.xdg.configHome}/sops-nix/gmail_api_credentials.json";
+        content = ''
+          {
+              "installed": {
+                  "client_id": "499012320469-vtml6emu6bmujpsj9lud2b44jqu7h26j.apps.googleusercontent.com",
+                  "project_id": "python-apis-423500",
+                  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
+                  "token_uri": "https://oauth2.googleapis.com/token",
+                  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
+                  "client_secret": "${config.sops.placeholder."api/gmail_client_secret"}",
+                  "redirect_uris": [ "http://localhost" ]
+              }
+          }
+        '';
+      };
+    };
+  };
+}

modules/programs/neovim.nix

@@ -0,0 +1,158 @@
+{ self, inputs, ... }: {
+  flake-file.inputs = {
+    nvf = {
+      url = "github:notashelf/nvf";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  perSystem = { system, pkgs, config, ... }: {
+    packages.my-neovim = ((inputs.nvf.lib.neovimConfiguration {
+      inherit pkgs;
+      modules = [
+        {
+          # https://nvf.notashelf.dev/search.html
+          config.vim = {
+            options = {
+              number = true;
+              relativenumber = true;
+              expandtab = true;
+              shiftwidth = 4;
+              tabstop = 4;
+              softtabstop = 4;
+
+              wrap = true;
+              linebreak = true;
+            };
+
+            syntaxHighlighting = true;
+
+            # Enable custom theming options
+            theme.enable = true;
+            theme.name = "catppuccin";
+            theme.style = "mocha";
+
+            git.enable = true;
+            # git.neogit.enable = true;
+
+            # https://github.com/akinsho/toggleterm.nvim
+            terminal.toggleterm.enable = true;
+            terminal.toggleterm.lazygit.enable = true;
+            terminal.toggleterm.lazygit.direction = "float";
+            terminal.toggleterm.lazygit.mappings.open = "<C-g>";
+
+
+            utility.nix-develop.enable = true;
+
+            utility.oil-nvim.enable = true;
+            utility.oil-nvim.gitStatus.enable = true;
+
+            filetree.neo-tree = {
+              enable = true;
+            };
+
+            # lazy = {
+            #   enable = true;
+            # };
+
+            # globals = {
+            #   SimpylFold_docstring_preview = 1;
+            #   SimpylFold_fold_blank = 0;
+            # };
+
+            # extraPlugins = with pkgs.vimPlugins; {
+            #   SimpylFold.package = SimpylFold;
+            # };
+
+            telescope = {
+              enable = true;
+              extensions  = [
+                {
+                  name = "fzf";
+                  packages = [pkgs.vimPlugins.telescope-fzf-native-nvim];
+                  setup = {fzf = {fuzzy = true;};};
+                }
+              ];
+            };
+
+            # Enable Treesitter
+            treesitter = {
+              enable = true;
+              grammars = with pkgs.vimPlugins.nvim-treesitter-parsers; [ python ];
+            };
+
+            lsp.enable = true;
+
+            languages = {
+              enableTreesitter = true;
+              enableFormat = true;
+
+              markdown = {
+                enable = true;
+                extensions = {
+                  # render-markdown-nvim.enable = true;
+                  markview-nvim.enable = true;
+                };
+              };
+
+              bash.enable = true;
+              css.enable = true;
+              yaml.enable = true;
+              toml.enable = true;
+
+              nix = {
+                enable = true;
+              };
+
+              python = {
+                enable = true;
+                dap.enable = true;
+                format.type = [ "ruff" ];
+              };
+            };
+
+            keymaps = [
+              {
+                desc = "Edit key mappings";
+                key = "<leader>ekm";
+                mode = [ "n" ];
+                silent = false;
+                action = "<cmd>:edit +/keymaps /home/john/.config/home-manager/jsl-dendritic/modules/programs/neovim.nix<CR>";
+              }
+              {
+                desc = "Home Manager Switch";
+                key = "<leader>nhms";
+                mode = [ "n" ];
+                silent = false;
+                action = "<cmd>:TermExec cmd='clear && nhms && exit' name='Nix Home Manager Switch' direction=float<CR>";
+              }
+              {
+                desc = "Key Maps [Telescope]";
+                key = "<leader>fkm";
+                mode = "n";
+                silent = false;
+                action = "<cmd>:Telescope keymaps<CR>";
+              }
+              {
+                desc = "Toggle Filesystem Tree [NeoTree]";
+                key = "<C-b>";
+                mode = [ "n" "v" "t" ];
+                silent = false;
+                action = "<cmd>:Neotree toggle filesystem left action=show<CR>";
+              }
+              {
+                key = "<C-`>";
+                mode = ["n" "v" "t"];
+                silent = false;
+                action = "<cmd>:ToggleTerm<CR>";
+              } 
+            ];
+          };
+        }
+      ];
+    }).neovim).overrideAttrs (old: {
+      pname = "my-neovim";
+      version = "custom";
+    });
+  };
+}

modules/programs/niri.nix

@@ -0,0 +1,28 @@
+{ self, inputs, ... }: {
+  flake.modules.nixos.niri = { pkgs, lib, ... }: {
+    programs.niri = {
+      enable = true;
+      package = self.packages.${pkgs.stdenv.hostPlatform.system}.myNiri;
+    };
+  };
+
+  perSystem = { pkgs, lib, self', ... }: {
+    packages.myNiri = inputs.wrapper-modules.wrappers.niri.wrap {
+      inherit pkgs;
+      env.RUST_BACKTRACE = "full";
+      settings = {
+        spawn-at-startup = [
+          "${lib.getExe self'.packages.myNoctalia}"
+        ];
+        xwayland-satellite.path = lib.getExe pkgs.xwayland-satellite;
+        input.keyboard.xkb.layout = "us,ua";
+        layout.gaps = 5;
+        binds = {
+          "Mod+Return".spawn-sh = lib.getExe pkgs.ghostty;
+          "Mod+Q".close-window = null;
+          "Mod+S".spawn-sh = "${lib.getExe self'.packages.myNoctalia} ipc call launcher toggle";
+        };
+      };
+    };
+  };
+}

modules/programs/noctalia.nix

@@ -0,0 +1,8 @@
+{ self, inputs, ... }: {
+  perSystem = { pkgs, ... }: {
+    packages.myNoctalia = inputs.wrapper-modules.wrappers.noctalia-shell.wrap {
+      inherit pkgs;
+      # settings = (builtins.fromJSON (builtins.readFile ./noctalia.json)).settings;
+    };
+  };
+}

modules/programs/onepassword.nix

@@ -0,0 +1,10 @@
+{ self, inputs, ... }: {
+  flake.modules.homeManager.onepassword = { config, ... }: {
+    home.file.".config/1Password/ssh/agent.toml".text = ''
+      # https://developer.1password.com/docs/ssh/agent/config
+      [[ssh-keys]]
+      vault = "Private"
+    '';
+    programs.ssh.matchBlocks."*".identityAgent = "${config.home.homeDirectory}/.1password/agent.sock";
+  };
+}

modules/programs/sops.nix

@@ -0,0 +1,97 @@
+{ inputs, ... }:
+let
+  inputs' = inputs;  # save a reference before it's shadowed
+in
+{
+  flake-file.inputs = {
+    # Adding sops-nix to the flake-file inputs causes it to get added to the inputs in flake.nix when it gets generated.
+    # This also makes the sops-nix module available
+    sops-nix.url = "github:Mic92/sops-nix";
+    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  flake.modules.nixos.mysops = {
+    imports = [ inputs.sops-nix.nixosModules.sops ];
+  };
+
+  # Define the homeModules that are used by flake-parts
+  # https://flake.parts/options/home-manager.html#opt-flake.modules.homeManager
+  flake.modules.homeManager.mysops = { inputs, config, pkgs, lib, ... }:
+  let
+    cfg = config.mysops;
+    sopsBin = lib.getExe pkgs.sops;
+    sopsConfigPath = ../../.sops.yaml;
+    sopsSecretsPath = ../../keys/secrets.yaml;
+
+    editScript = lib.optional (cfg.hostSecretFile != null) (pkgs.writeShellScriptBin  "edit-secrets" ''
+      ${sopsBin} --config ${sopsConfigPath} ${cfg.hostSecretFile}
+    '');
+  in
+  {
+    imports = [
+      # This import makes the sops config attribute available below
+      inputs'.sops-nix.homeManagerModules.sops
+    ];
+
+    options.mysops = {
+      ageKeyFile = lib.mkOption {
+        description = "Default location for the age key";
+        type = lib.types.str;
+        default = "${config.xdg.configHome}/sops/age/keys.txt";
+      };
+      hostSecretFile = lib.mkOption {
+        description = "Path to the secrets file for this host. Used to create the edit-secrets script";
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+      };
+    };
+
+    config =
+    let
+      echo = lib.getExe' pkgs.coreutils "echo";
+      dirname = lib.getExe' pkgs.coreutils "dirname";
+      mkdir = lib.getExe' pkgs.coreutils "mkdir";
+      show-age-key = (pkgs.writeShellScriptBin "show-age-key" ''
+        ${lib.getExe' pkgs.age "age-keygen"} -y ${cfg.ageKeyFile}
+      '');
+    in
+    {
+      home.packages = with pkgs; [
+        eza
+        age
+        sops # This is necessary to make the sops binary available
+        ssh-to-age
+        (writeShellScriptBin "gen-age-key" ''
+          set -eu
+
+          if [ ! -f "${config.ssh.identityFile}" ]; then
+            ${echo} "SSH identity file not found: ${config.ssh.identityFile}" >&2
+            exit 1
+          fi
+
+          if [ -e "${cfg.ageKeyFile}" ]; then
+            ${echo} "Refusing to overwrite existing age key file: ${cfg.ageKeyFile}" >&2
+            exit 1
+          fi
+
+          ${mkdir} -p "$(${dirname} "${cfg.ageKeyFile}")"
+          ${lib.getExe pkgs.ssh-to-age} -i ${config.ssh.identityFile} -private-key > ${cfg.ageKeyFile}
+          ${echo} -n "Created ${cfg.ageKeyFile}: "
+          ${echo} $(${lib.getExe show-age-key})
+        '')
+        show-age-key
+        (writeShellScriptBin "ls-secrets" "${lib.getExe pkgs.eza} -alT --follow-symlinks ~/.config/sops-nix/secrets")
+      ] ++ editScript;
+
+      home.shellAliases.sops = "${sopsBin} --config ${sopsConfigPath}";
+
+      # Option definitions for the sops home-manager module:
+      # https://github.com/Mic92/sops-nix/blob/master/modules/home-manager/sops.nix
+      sops = {
+        defaultSopsFile = sopsSecretsPath;
+        defaultSopsFormat = "yaml";
+        age.sshKeyPaths = [ "${config.ssh.identityFile}" ];
+      };
+    };
+  };
+}

modules/programs/steam.nix

@@ -0,0 +1,14 @@
+{ self, inputs, ... }: {
+  flake.modules.nixos.steam = {
+    programs.steam = {
+      enable = true;
+      gamescopeSession.enable = true;
+      # Open ports in the firewall for Steam Remote Play
+      remotePlay.openFirewall = true;
+      # Open ports in the firewall for Source Dedicated Server
+      dedicatedServer.openFirewall = true;
+      # Open ports in the firewall for Steam Local Network Game Transfers
+      localNetworkGameTransfers.openFirewall = true;
+    };
+  };
+}

modules/programs/step-client.nix

@@ -0,0 +1,37 @@
+{ self, inputs, ... }: {
+  #
+  # Home Manager Module
+  #
+  flake.modules.homeManager.step-ssh-user = { config, pkgs, lib, ... }:
+  let
+    cfg = config.step-ssh-user;
+    firstPrincipal = lib.head cfg.principals;
+    principalArgs = lib.concatMapStringsSep " "
+      (principal: "--principal \"${principal}\"") cfg.principals;
+  in
+  {
+    options.step-ssh-user = {
+      enable = lib.mkEnableOption "opionated step client config for SSH certs";
+      provisioner = lib.mkOption {
+        type = lib.types.str;
+        default = "admin";
+      };
+      principals = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+      };
+    };
+    config = lib.mkIf cfg.enable {
+      sops.secrets."janus/admin_jwk".mode = "0400";
+      home.packages = with pkgs; [
+        (writeShellScriptBin "sign-ssh-cert" ''
+          ${lib.getExe pkgs.step-cli} ssh certificate \
+          --sign \
+          ${principalArgs} \
+          --provisioner "${cfg.provisioner}" \
+          --provisioner-password-file "${config.sops.secrets."janus/admin_jwk".path}" \
+          "${firstPrincipal}" "${config.ssh.identityFile}.pub"
+        '')
+      ];
+    };
+  };
+}

modules/programs/sudo.nix

@@ -0,0 +1,10 @@
+{ self, inputs, ... }: {
+  flake.modules.nixos.sudo = {
+    security.sudo-rs = {
+      enable = true;
+      execWheelOnly = false;
+      wheelNeedsPassword = false;
+      extraConfig = "Defaults        timestamp_timeout=1440";
+    };
+  };
+}

modules/programs/vscode.nix

@@ -0,0 +1,26 @@
+{ self, inputs, ... }: {
+  flake.modules.homeManager.vscode = { config, pkgs, lib, ... }: {
+    options.my-vscode = {
+      enable = lib.mkEnableOption "Enable nix-managed VSCode";
+    };
+
+    config = lib.mkIf config.my-vscode.enable {
+      programs.vscode = {
+        enable = true;
+        package = pkgs.vscode;
+        profiles.default.extensions = with pkgs.vscode-extensions; [
+          mhutchie.git-graph
+          ms-vscode-remote.vscode-remote-extensionpack
+          ms-python.python
+          ms-python.vscode-pylance
+          ms-toolsai.jupyter
+          charliermarsh.ruff
+          github.vscode-pull-request-github
+          github.vscode-github-actions
+          github.copilot
+          catppuccin.catppuccin-vsc
+        ];
+      };
+    };
+  };
+}

modules/programs/wireguard.nix

@@ -0,0 +1,59 @@
+{ self, inputs, ... }: {
+  flake.modules.nixos.wireguard = { config, pkgs, lib, ... }:
+  let
+    wgInterface = "platform";
+    systemctl = lib.getExe' pkgs.systemd "systemctl";
+    journalctl = lib.getExe' pkgs.systemd "journalctl";
+
+    mkConnect = interface:
+      let
+        serviceName = "wg-quick-${interface}";
+        service = "${serviceName}.service";
+      in
+      pkgs.writeShellScriptBin "wg-connect-${interface}" ''
+        ${systemctl} start ${service}
+        start_time=$(${systemctl} show -p ActiveEnterTimestamp ${serviceName} | cut -d= -f2)
+        ${journalctl} -u ${service} --since "$start_time" --no-pager
+      '';
+    mkDisconnect = interface:
+      let
+        serviceName = "wg-quick-${interface}";
+        service = "${serviceName}.service";
+      in
+      pkgs.writeShellScriptBin "wg-disconnect-${interface}" ''
+        STOPTIME=$(${lib.getExe' pkgs.coreutils "date"} '+%Y-%m-%d %H:%M:%S')
+        ${systemctl} stop ${service}
+        start_time=$(${systemctl} show -p ActiveEnterTimestamp ${serviceName} | cut -d= -f2)
+        ${journalctl} -u ${service} --since "$STOPTIME" --no-pager
+      '';
+  in
+  {
+    imports = [ inputs.sops-nix.nixosModules.sops ];
+
+    environment.systemPackages = with pkgs; [
+      wireguard-tools
+      wg-netmanager
+      (mkConnect "platform")
+      (mkDisconnect "platform")
+    ];
+
+    sops.secrets.wireguard_private_key = { };
+    networking.wg-quick.interfaces = {
+      ${wgInterface} = {
+        autostart = false; # Managed by dispatcher
+        postUp = "echo 'Post up command'";
+        address = [ "192.168.3.5/32" ];
+        dns = [ "192.168.1.150" ];
+        privateKeyFile = config.sops.secrets.wireguard_private_key.path;
+        peers = [
+          {
+            publicKey = "BD1/q18OfpoMCDusNZk9cqB1vvR8bgodZ1L7198jVic=";
+            allowedIPs = [ "192.168.0.0/16" ];
+            endpoint = "wg.john-stream.com:51830";
+            persistentKeepalive = 25;
+          }
+        ];
+      };
+    };
+  };
+}

modules/programs/zsh.nix

@@ -0,0 +1,188 @@
+{ self, inputs, ... }:
+let
+  username = "john";
+in
+{
+  flake.modules = {
+    nixos.zsh = { pkgs, ... }: {
+      users.users."${username}".shell = pkgs.zsh;
+      programs.zsh.enable = true;
+      # Already being imported by the john.nix module
+      # home-manager.sharedModules = [
+      #   inputs.self.modules.homeManager.zsh
+      # ];
+    };
+
+    homeManager.zsh = { pkgs, config, ... }: {
+      programs.zsh = {
+        enable = true;
+        package = pkgs.zsh;
+        enableCompletion = true;
+        autosuggestion.enable = true;
+        # syntaxHighlighting.enable = true;
+        initContent = "HOST=$(hostname -s)";
+        dotDir = "${config.xdg.configHome}/zsh";
+        history = {
+          append = true;
+          ignoreAllDups = true;
+          ignorePatterns = [
+            "history"
+            "ls"
+            "eza"
+            "clear"
+          ];
+          save = 1000;
+          size = 1000;
+          share = true;
+        };
+        oh-my-zsh = {
+          enable = true;
+          # theme = "risto";
+          theme = "agnoster";
+          plugins = [
+            "sudo"
+            "dotenv"
+            "git"
+            "ssh"
+            "ssh-agent"
+          ];
+        };
+      };
+    };
+  };
+
+  perSystem = { system, pkgs, ... }: {
+    packages.jsl-zsh = inputs.wrapper-modules.wrappers.zsh.wrap {
+      inherit pkgs;
+      extraPackages = with pkgs; [
+        inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.neovim-min
+        btop
+        coreutils
+        curl
+        wget
+        yazi
+        zsh
+      ];
+    };
+
+    packages.neovim-min = ((inputs.nvf.lib.neovimConfiguration {
+      inherit pkgs;
+      modules = [
+        {
+          # https://nvf.notashelf.dev/search.html
+          config.vim = {
+            options = {
+              number = true;
+              relativenumber = true;
+              expandtab = true;
+              shiftwidth = 4;
+              tabstop = 4;
+              softtabstop = 4;
+
+              wrap = true;
+              linebreak = true;
+            };
+
+            syntaxHighlighting = true;
+
+            # Enable custom theming options
+            theme.enable = true;
+            theme.name = "catppuccin";
+            theme.style = "mocha";
+
+            git.enable = true;
+            # git.neogit.enable = true;
+            extraPlugins = with pkgs.vimPlugins; {
+              icons = {
+                package = nvim-web-devicons;
+              };
+              octo = {
+                package = octo-nvim;
+                setup = "require('octo').setup {}";
+                after = ["telescope" "icons"];
+              };
+            };
+
+            # https://github.com/akinsho/toggleterm.nvim
+            terminal.toggleterm.enable = true;
+            terminal.toggleterm.lazygit.enable = true;
+            terminal.toggleterm.lazygit.direction = "float";
+            terminal.toggleterm.lazygit.mappings.open = "<C-g>";
+
+            utility.nix-develop.enable = true;
+
+            filetree.neo-tree.enable = true;
+
+            telescope = {
+              enable = true;
+              extensions  = [
+                {
+                  name = "fzf";
+                  packages = [pkgs.vimPlugins.telescope-fzf-native-nvim];
+                  setup = {fzf = {fuzzy = true;};};
+                }
+              ];
+            };
+
+            languages = {
+              enableTreesitter = true;
+              enableFormat = true;
+
+              markdown = {
+                enable = true;
+                extensions = {
+                  markview-nvim.enable = true;
+                };
+              };
+
+              bash.enable = true;
+              yaml.enable = true;
+              toml.enable = true;
+              nix.enable = true;
+            };
+
+            keymaps = [
+              {
+                desc = "Edit key mappings";
+                key = "<leader>ekm";
+                mode = [ "n" ];
+                silent = false;
+                action = "<cmd>:edit +/keymaps /home/john/.config/home-manager/jsl-dendritic/modules/programs/neovim.nix<CR>";
+              }
+              {
+                desc = "Home Manager Switch";
+                key = "<leader>nhms";
+                mode = [ "n" ];
+                silent = false;
+                action = "<cmd>:TermExec cmd='clear && nhms && exit' name='Nix Home Manager Switch' direction=float<CR>";
+              }
+              {
+                desc = "Key Maps [Telescope]";
+                key = "<leader>fkm";
+                mode = "n";
+                silent = false;
+                action = "<cmd>:Telescope keymaps<CR>";
+              }
+              {
+                desc = "Toggle Filesystem Tree [NeoTree]";
+                key = "<C-b>";
+                mode = [ "n" "v" "t" ];
+                silent = false;
+                action = "<cmd>:Neotree toggle filesystem left action=show<CR>";
+              }
+              {
+                key = "<C-`>";
+                mode = ["n" "v" "t"];
+                silent = false;
+                action = "<cmd>:ToggleTerm<CR>";
+              } 
+            ];
+          };
+        }
+      ];
+    }).neovim).overrideAttrs (old: {
+      pname = "neovim-min";
+      version = "custom";
+    });
+  };
+}

modules/services/docker.nix

@@ -0,0 +1,25 @@
+{ self, inputs, ... }:
+{
+  flake.modules.nixos.docker = {
+    virtualisation.docker.enable = true;
+    home-manager.sharedModules = [ inputs.self.modules.homeManager.docker ];
+  };
+
+  flake.modules.homeManager.docker = { config, lib, pkgs, ... }:
+  {
+    options.docker.enable = lib.mkEnableOption "Docker tools and utilities";
+    config = lib.mkIf config.docker.enable {
+      programs.lazydocker.enable = true;
+      programs.docker-cli.enable = true;
+
+      home.packages = with pkgs; [
+        docker
+        docker-compose
+        lazydocker
+      ];
+      home.shellAliases = {
+        lzd = "lazydocker";
+      };
+    };
+  };
+}

modules/services/restic/envoy.nix

@@ -0,0 +1,323 @@
+{ lib, ... }:
+{
+  flake.modules.nixos.restic-envoy = { config, lib, pkgs, ... }:
+    let
+      cfg = config.restic.envoy;
+
+      envoyConfig = {
+        static_resources = {
+          listeners = [
+            {
+              name = "listener_0";
+              address.socket_address = {
+                address = cfg.listenAddress;
+                port_value = cfg.port;
+              };
+              filter_chains = [
+                {
+                  filter_chain_match.server_names = cfg.serverNames;
+                  transport_socket = {
+                    name = "envoy.transport_sockets.tls";
+                    typed_config = {
+                      "@type" = "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext";
+                      require_client_certificate = true;
+                      common_tls_context = {
+                        tls_params.tls_minimum_protocol_version = "TLSv1_3";
+                        validation_context = {
+                          trusted_ca.filename = cfg.trustedCAPath;
+                          match_typed_subject_alt_names = [
+                            {
+                              san_type = "URI";
+                              matcher.prefix = cfg.spiffePrefix;
+                            }
+                          ];
+                        };
+                        tls_certificates = [
+                          {
+                            certificate_chain.filename = cfg.certificatePath;
+                            private_key.filename = cfg.pkcs8PrivateKeyPath;
+                          }
+                        ];
+                      };
+                    };
+                  };
+                  filters = [
+                    {
+                      name = "envoy.filters.network.http_connection_manager";
+                      typed_config = {
+                        "@type" = "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager";
+                        stat_prefix = "ingress_http";
+                        use_remote_address = true;
+                        http2_protocol_options.max_concurrent_streams = 100;
+                        access_log = [
+                          {
+                            name = "envoy.access_loggers.file";
+                            typed_config = {
+                              "@type" = "type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog";
+                              path = cfg.accessLogPath;
+                            };
+                          }
+                        ];
+                        route_config = {
+                          name = "local_route";
+                          virtual_hosts = [
+                            {
+                              name = "local_service";
+                              domains = [ "*" ];
+                              routes = [
+                                {
+                                  match.prefix = "/";
+                                  route.cluster = cfg.clusterName;
+                                }
+                              ];
+                            }
+                          ];
+                        };
+                        http_filters = [
+                          {
+                            name = "envoy.filters.http.rbac";
+                            typed_config = {
+                              "@type" = "type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC";
+                              rules = {
+                                action = "ALLOW";
+                                policies = lib.mapAttrs (_: policy: {
+                                  permissions = [
+                                    {
+                                      and_rules.rules = [
+                                        {
+                                          header = {
+                                            name = ":path";
+                                            string_match.prefix = policy.pathPrefix;
+                                          };
+                                        }
+                                      ];
+                                    }
+                                  ];
+                                  principals = [
+                                    {
+                                      authenticated.principal_name.exact = policy.principal;
+                                    }
+                                  ];
+                                }) cfg.policies;
+                              };
+                            };
+                          }
+                          {
+                            name = "envoy.filters.http.router";
+                            typed_config = {
+                              "@type" = "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router";
+                            };
+                          }
+                        ];
+                      };
+                    }
+                  ];
+                }
+              ];
+            }
+          ];
+          clusters = [
+            {
+              name = cfg.clusterName;
+              connect_timeout = cfg.connectTimeout;
+              type = "STRICT_DNS";
+              lb_policy = "ROUND_ROBIN";
+              load_assignment = {
+                cluster_name = cfg.clusterName;
+                endpoints = [
+                  {
+                    lb_endpoints = [
+                      {
+                        endpoint.address.socket_address = {
+                          address = cfg.upstreamHost;
+                          port_value = cfg.upstreamPort;
+                        };
+                      }
+                    ];
+                  }
+                ];
+              };
+            }
+          ];
+        };
+      };
+
+      configFile = (pkgs.formats.json { }).generate "restic-envoy.json" envoyConfig;
+      ensurePkcs8Key = pkgs.writeShellScript "restic-envoy-prepare-key" ''
+        set -euo pipefail
+
+        install -d -m 0750 /run/restic-envoy
+        ${lib.getExe pkgs.openssl} pkcs8 \
+          -topk8 \
+          -nocrypt \
+          -in ${lib.escapeShellArg cfg.sourcePrivateKeyPath} \
+          -out ${lib.escapeShellArg cfg.pkcs8PrivateKeyPath}
+        chmod 0600 ${lib.escapeShellArg cfg.pkcs8PrivateKeyPath}
+      '';
+    in
+    {
+      options.restic.envoy = {
+        enable = lib.mkEnableOption "an Envoy mTLS front-end for restic";
+
+        listenAddress = lib.mkOption {
+          type = lib.types.str;
+          default = "0.0.0.0";
+          description = "Address for Envoy to bind to.";
+        };
+
+        port = lib.mkOption {
+          type = lib.types.port;
+          default = 10000;
+          description = "TCP port for the Envoy listener.";
+        };
+
+        openFirewall = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+          description = "Open the configured listener port in the firewall.";
+        };
+
+        serverNames = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ "*.john-stream.com" ];
+          description = "Accepted SNI server names for the downstream TLS filter chain.";
+        };
+
+        spiffePrefix = lib.mkOption {
+          type = lib.types.str;
+          default = "spiffe://john-stream.com";
+          description = "Allowed SPIFFE URI prefix for client certificate SAN validation.";
+        };
+
+        trustedCAPath = lib.mkOption {
+          type = lib.types.str;
+          default = "/etc/step/certs/root_ca.crt";
+          description = "Path to the CA certificate used to validate client certificates.";
+        };
+
+        certificatePath = lib.mkOption {
+          type = lib.types.str;
+          default = "/etc/step/certs/cert.pem";
+          description = "Path to the server certificate presented by Envoy.";
+        };
+
+        sourcePrivateKeyPath = lib.mkOption {
+          type = lib.types.str;
+          default = "/etc/step/certs/key.pem";
+          description = "Path to the source private key that will be converted to PKCS#8 for Envoy.";
+        };
+
+        pkcs8PrivateKeyPath = lib.mkOption {
+          type = lib.types.str;
+          default = "/run/restic-envoy/key_pkcs8.pem";
+          description = "Path to the PKCS#8 private key file consumed by Envoy.";
+        };
+
+        accessLogPath = lib.mkOption {
+          type = lib.types.str;
+          default = "/var/log/envoy/access.log";
+          description = "Path for the Envoy HTTP access log.";
+        };
+
+        clusterName = lib.mkOption {
+          type = lib.types.str;
+          default = "restic";
+          description = "Name of the upstream Envoy cluster.";
+        };
+
+        connectTimeout = lib.mkOption {
+          type = lib.types.str;
+          default = "0.25s";
+          description = "Cluster connect timeout in Envoy duration format.";
+        };
+
+        upstreamHost = lib.mkOption {
+          type = lib.types.str;
+          default = "rest-server";
+          description = "DNS name or IP address for the upstream restic server.";
+        };
+
+        upstreamPort = lib.mkOption {
+          type = lib.types.port;
+          default = 8000;
+          description = "TCP port for the upstream restic server.";
+        };
+
+        logLevel = lib.mkOption {
+          type = lib.types.enum [ "trace" "debug" "info" "warning" "error" "critical" "off" ];
+          default = "info";
+          description = "Envoy application log level.";
+        };
+
+        policies = lib.mkOption {
+          description = "RBAC policy definitions keyed by Envoy policy name.";
+          type = lib.types.attrsOf (lib.types.submodule ({ ... }: {
+            options = {
+              pathPrefix = lib.mkOption {
+                type = lib.types.str;
+                description = "Allowed HTTP path prefix for this principal.";
+              };
+
+              principal = lib.mkOption {
+                type = lib.types.str;
+                description = "Exact SPIFFE principal required for this path prefix.";
+              };
+            };
+          }));
+          default = {
+            ubuntu-policy = {
+              pathPrefix = "/john-ubuntu";
+              principal = "spiffe://john-stream.com/ubuntu";
+            };
+            p14-policy = {
+              pathPrefix = "/john-p14s";
+              principal = "spiffe://john-stream.com/john-p14s";
+            };
+            gitea-policy = {
+              pathPrefix = "/gitea";
+              principal = "spiffe://john-stream.com/gitea";
+            };
+          };
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
+        assertions = [
+          {
+            assertion = cfg.serverNames != [ ];
+            message = "restic.envoy.serverNames must not be empty.";
+          }
+          {
+            assertion = cfg.policies != { };
+            message = "restic.envoy.policies must define at least one RBAC policy.";
+          }
+        ];
+
+        networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [ cfg.port ];
+
+        systemd.tmpfiles.rules = [
+          "d /var/log/envoy 0750 root root -"
+          "d /run/restic-envoy 0750 root root -"
+        ];
+
+        systemd.services.restic-envoy = {
+          description = "Envoy reverse proxy for the restic server";
+          wantedBy = [ "multi-user.target" ];
+          after = [ "network-online.target" ];
+          wants = [ "network-online.target" ];
+          restartIfChanged = true;
+          serviceConfig = {
+            Type = "simple";
+            User = "root";
+            Group = "root";
+            ExecStartPre = ensurePkcs8Key;
+            ExecStart = "${lib.getExe pkgs.envoy} --config-path ${configFile} --log-level ${cfg.logLevel}";
+            Restart = "on-failure";
+            RestartSec = "5s";
+            RuntimeDirectory = "restic-envoy";
+            LogsDirectory = "envoy";
+          };
+        };
+      };
+    };
+}

modules/services/ssh.nix

@@ -0,0 +1,202 @@
+{ inputs, ... }:
+let
+  userName = "john";
+  sshHostCAPubKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNug18oLH0vZxnibXJzMJvTWFPZTnSlhCDDVi+rHhgnIum6ZXQ4SF+VHOOAM5BbzZmMKitNJ5lcrGP15Eur7DzQ=";
+in
+{
+  flake.modules.nixos.ssh = { config, pkgs, lib, ... }:
+  let
+    cfg = config.ssh;
+    configDir = "/etc/ssh";
+  in
+  {
+    options.ssh = {
+      hostKey = lib.mkOption {
+        description = "String path to the host private key file";
+        type = lib.types.str;
+        default = "ssh_host_ed25519_key";
+      };
+      certificates = {
+        enable = lib.mkEnableOption "Enable SSH host certificates";
+        userCA = lib.mkOption {
+          description = "Content for the SSH user CA file (public key)";
+          type = lib.types.path;
+          default = ../hosts/janus/ssh_user_ca.pub;
+        };
+        userCAFile = lib.mkOption {
+          description = "String path to the SSh user CA";
+          type = lib.types.str;
+          default = "ssh_user_ca.pub";
+        };
+      };
+    };
+
+    config = {
+      services.openssh = {
+        enable = true;
+        # require public key authentication for better security
+        settings = lib.mkMerge [
+          {
+            PasswordAuthentication = false;
+            KbdInteractiveAuthentication = false;
+            HostKey = "${configDir}/${cfg.hostKey}";
+          }
+          (lib.mkIf cfg.certificates.enable {
+            TrustedUserCAKeys = "${configDir}/${cfg.certificates.userCAFile}";
+            HostCertificate = "${configDir}/${cfg.hostKey}-cert.pub";
+          })
+        ];
+      };
+
+      environment.etc."ssh/${cfg.certificates.userCAFile}" = lib.mkIf cfg.certificates.enable {
+        source = cfg.certificates.userCA;
+      };
+
+      programs.ssh.knownHosts = lib.mkIf cfg.certificates.enable {
+        "192.168.1.*" = { 
+          certAuthority = true;
+          publicKey = sshHostCAPubKey;
+        };
+        "*.john-stream.com" = {
+          certAuthority = true;
+          publicKey = sshHostCAPubKey;
+        };
+      };
+    };
+  };
+
+  flake.modules.homeManager.ssh = { config, pkgs, lib, ... }:
+  let
+    cfg = config.ssh;
+    configDir = "${config.home.homeDirectory}/.ssh";
+    identityFile = cfg.identityFile;
+    publicKeyFile = "${identityFile}.pub";
+    certificateFile = "${identityFile}-cert.pub";
+  in
+  {
+    options.ssh = with lib; {
+      identityFile = mkOption {
+        # Intentionally not using a path type here because that will end up with the private key getting copied into the store
+        type = types.str;
+        default = "${config.home.homeDirectory}/.ssh/id_ed25519";
+        description = "Path to the SSH identity file.";
+      };
+
+      certificates = {
+        enable = mkEnableOption "Enable SSH client certificates";
+      };
+
+      knownHostsFile = mkOption {
+        type = types.str;
+        default = "${configDir}/known_hosts";
+      };
+
+      knownHosts = mkOption {
+        description = "";
+        type = types.listOf types.str;
+        default = [ ];
+      };
+
+      matchSets = {
+        appdaemon = mkEnableOption "Enable AppDaemon SSH targets";
+        certs = mkEnableOption "Enable Janus and Soteria SSH targets";
+        homelab = mkEnableOption "Enable various Homelab targets";
+        dev = mkEnableOption "Enable development targets";
+      };
+    };
+
+    # All this stuff has to be wrapped in a config attribute because of the presence of the options here?
+    config = let
+      provisionerPasswordPath = config.sops.secrets."janus/admin_jwk".path;
+    in {
+      home.file.".ssh/known_hosts" = {
+        text = lib.concatStringsSep "\n" (
+          cfg.knownHosts ++ lib.optionals cfg.certificates.enable [
+            "@cert-authority 192.168.1.* ${sshHostCAPubKey}"
+            "@cert-authority *.john-stream.com ${sshHostCAPubKey}"
+          ]
+        );
+      };
+
+      programs.ssh = {
+        enable = true;
+        enableDefaultConfig = false;
+        extraConfig = ''
+          SetEnv TERM="xterm-256color"
+        '';
+
+        matchBlocks = lib.mkMerge [
+          {
+            "john-pc-ubuntu" = {
+              hostname = "192.168.1.85";
+            };
+
+            "*" = lib.mkMerge [
+              {
+                user = "john";
+
+                compression = false;
+                serverAliveInterval = 0;
+                serverAliveCountMax = 3;
+
+                identitiesOnly = true;
+                inherit identityFile;
+
+                hashKnownHosts = false;
+                userKnownHostsFile = cfg.knownHostsFile;
+
+                addKeysToAgent = "yes";
+                forwardAgent = false;
+              }
+              (lib.mkIf cfg.certificates.enable { inherit certificateFile; })
+            ];
+          }
+          (lib.mkIf cfg.matchSets.appdaemon {
+            "appdaemon" = {
+              hostname = "192.168.1.242";
+              user = "appdaemon";
+            };
+            "ad-nix" = {
+              hostname = "192.168.1.201";
+              user = "appdaemon";
+            };
+          })
+          (lib.mkIf cfg.matchSets.certs {
+            "janus" = {
+              hostname = "janus.john-stream.com";
+              user = "root";
+            };
+            "soteria" = {
+              hostname = "soteria.john-stream.com";
+              user = "john";
+            };
+          })
+          (lib.mkIf cfg.matchSets.homelab {
+            "docs" = {
+              hostname = "192.168.1.110";
+              user = "root";
+            };
+            "gitea" = {
+              hostname = "192.168.1.104";
+              user = "john";
+            };
+            "hermes" = {
+              hostname = "192.168.1.150";
+              user = "root";
+            };
+            "panoptes" = {
+              hostname = "192.168.1.107";
+              user = "panoptes";
+            };
+          })
+          (lib.mkIf cfg.matchSets.dev {
+            "test-nix" = {
+              hostname = "fded:fb16:653e:25da:be24:11ff:fea0:753f";
+              user = "john";
+            };
+          })
+        ];
+      };
+    };
+  };
+}

modules/services/step-ca/ca.json

@@ -0,0 +1,129 @@
+{
+  "root": "/etc/step-ca/certs/root_ca.crt",
+  "federatedRoots": null,
+  "crt": "/etc/step-ca/certs/intermediate_ca.crt",
+  "key": "/etc/step-ca/secrets/intermediate_ca_key",
+  "address": ":443",
+  "insecureAddress": "",
+  "dnsNames": [
+    "janus.john-stream.com",
+    "192.168.1.113"
+  ],
+  "ssh": {
+    "hostKey": "/etc/step-ca/secrets/ssh_host_ca_key",
+    "userKey": "/etc/step-ca/secrets/ssh_user_ca_key"
+  },
+  "logger": {
+    "format": "text"
+  },
+  "db": {
+    "type": "badgerv2",
+    "dataSource": "/var/lib/step-ca/db",
+    "badgerFileLoadingMode": ""
+  },
+  "authority": {
+    "provisioners": [
+      {
+        "type": "ACME",
+        "name": "acme"
+      },
+      {
+        "type": "SSHPOP",
+        "name": "sshpop",
+        "claims": {
+          "enableSSHCA": true
+        }
+      },
+      {
+        "type": "JWK",
+        "name": "admin",
+        "key": {
+          "use": "sig",
+          "kty": "EC",
+          "kid": "xoxgOJFbveSLIL2gm1Yu5ZiRb9v8Jxe44F56i3v-Nf8",
+          "crv": "P-256",
+          "alg": "ES256",
+          "x": "zFO8hPx_eH0Iyz7UJI-w8ODMusEKCZ28M76sGWmWYxA",
+          "y": "XIWLLyKDzqxV9UH-2KeAkKPDrgLoPrxxW9-PzkXggME"
+        },
+        "encryptedKey": "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoiUVJnTnJVTF9KcmxJYkJMVTlGNVRPZyJ9.DMu7xBNCq5pr-_--YTxNr5Hrcqy6ZmSVHsWurfVXL7Hk0Q3vyYRxiw.h-CnFiYc-DhxThI3.plx3_Qa_0kU-2TwnqFNfAfGnCpfQ2e0iiCMLruNHbLMnHeXQ1BysHBqps45_02zZXIRdHoDgYGtXRSfcdUYYoS0pLoPzC6m301ZFNSAFdRVlSZ3Q6VmWdixPXXnEB4EgSKTT_wxR33L8t9OpFzD85KfY-b_Un1l99ufjCnfg-EYkcICTn_G4-8bcW3eFIvJ6setzu-l0jHMhLQdIweqncn9on9xBXBD-ANhZfP95P2BJt-APqCi8eqiAvn_vClovdg0PxzRwOVDvWREz66FDw-HTU7xDtGO9hACopT5tfZOXDoykgZw1mJsq9NEq9ZzvKG2hvyk1UXtExxrNtFo.5q1OfGU4Amo4Si-vpeI42g",
+        "claims": {
+          "enableSSHCA": true,
+          "disableRenewal": false,
+          "allowRenewalAfterExpiry": false,
+          "disableSmallstepExtensions": false
+        },
+        "options": {
+          "x509": {},
+          "ssh": {}
+        }
+      }
+    ],
+    "template": {},
+    "backdate": "1m0s"
+  },
+  "tls": {
+    "cipherSuites": [
+      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
+      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
+    ],
+    "minVersion": 1.2,
+    "maxVersion": 1.3,
+    "renegotiation": false
+  },
+  "templates": {
+    "ssh": {
+      "user": [
+        {
+          "name": "config.tpl",
+          "type": "snippet",
+          "template": "templates/ssh/config.tpl",
+          "path": "~/.ssh/config",
+          "comment": "#"
+        },
+        {
+          "name": "step_includes.tpl",
+          "type": "prepend-line",
+          "template": "templates/ssh/step_includes.tpl",
+          "path": "${STEPPATH}/ssh/includes",
+          "comment": "#"
+        },
+        {
+          "name": "step_config.tpl",
+          "type": "file",
+          "template": "templates/ssh/step_config.tpl",
+          "path": "ssh/config",
+          "comment": "#"
+        },
+        {
+          "name": "known_hosts.tpl",
+          "type": "file",
+          "template": "templates/ssh/known_hosts.tpl",
+          "path": "ssh/known_hosts",
+          "comment": "#"
+        }
+      ],
+      "host": [
+        {
+          "name": "sshd_config.tpl",
+          "type": "snippet",
+          "template": "templates/ssh/sshd_config.tpl",
+          "path": "/etc/ssh/sshd_config",
+          "comment": "#",
+          "requires": [
+            "Certificate",
+            "Key"
+          ]
+        },
+        {
+          "name": "ca.tpl",
+          "type": "snippet",
+          "template": "templates/ssh/ca.tpl",
+          "path": "/etc/ssh/ca.pub",
+          "comment": "#"
+        }
+      ]
+    }
+  },
+  "commonName": "Step Online CA"
+}

modules/services/step-ca/ssh-host.nix

@@ -0,0 +1,96 @@
+{ inputs, ... }: {
+  flake.modules.nixos.step-ssh-host = { config, pkgs, lib, ... }:
+  let
+    cfg = config.step-ssh-host;
+    provisionerPasswordPath = config.sops.secrets."janus/admin_jwk".path;
+    sshKeyPath = "/etc/ssh/ssh_host_ed25519_key";
+    sshCertPath = "${sshKeyPath}-cert.pub";
+  in
+  {
+    # NixOS Options
+    options.step-ssh-host = {
+      hostname = lib.mkOption {
+        description = "Networking host name to register with the CA";
+        type = lib.types.str;
+      };
+      provisioner = lib.mkOption {
+        description = "Provisioner inside Step CA to use for the SSH certificates";
+        type = lib.types.str;
+        default = "admin";
+      };
+    };
+
+    imports = with inputs.self.modules.nixos; [ ssh ];
+
+    # NixOS Config
+    config = {
+      ssh.certificates.enable = true;
+      sops.secrets."janus/admin_jwk" = {
+        owner = "root";
+        group = "root";
+        mode = "0400";
+      };
+      networking.nameservers = [ "192.168.1.150" ];
+      networking.dhcpcd.extraConfig = "nohook resolv.conf";
+      environment.systemPackages = with pkgs; [
+        # step-cli
+        (writeShellScriptBin "ssh-host-cert-renew" ''
+          ${lib.getExe pkgs.step-cli} ssh certificate \
+          --host --sign \
+          --provisioner "${cfg.provisioner}" \
+          --provisioner-password-file "${provisionerPasswordPath}" \
+          --principal "${cfg.hostname}" \
+          --principal "${cfg.hostname}.john-stream.com" \
+          "${cfg.hostname}" "${sshKeyPath}.pub"
+        '')
+        (writeShellScriptBin "ssh-host-cert-check" "${lib.getExe' pkgs.openssh "ssh-keygen"} -Lf ${sshCertPath}")
+      ];
+
+      systemd.services.step-ssh-host-renew = {
+        description = "Renew Step SSH host certificate if needed";
+        wantedBy = [ ];
+        after = [ "network-online.target" ];
+        wants = [ "network-online.target" ];
+        path = with pkgs; [ coreutils systemd step-cli openssh  ];
+        serviceConfig = {
+          Type = "oneshot";
+          User = "root";
+          Group = "root";
+        };
+        script = ''
+          set -euo pipefail
+          if ${lib.getExe pkgs.step-cli} ssh needs-renewal "${sshCertPath}" --expires-in "4h"; then
+            echo "Renewing SSH host certificate"
+          else
+            rc=$?
+            if [ "$rc" -eq 1 ]; then
+              echo "SSH host cert does not need renewal"
+              exit 0
+            fi
+
+            if [ "$rc" -eq 2 ]; then
+              echo "SSH host cert missing: ${sshCertPath}" >&2
+              exit 1
+            fi
+
+            echo "step ssh needs-renewal failed with rc=$rc" >&2
+            exit "$rc"
+          fi
+        '';
+      };
+
+      systemd.timers.step-ssh-host-renew = {
+        description = "Periodic Step SSH host certificate renewal";
+        wantedBy = [ "timers.target" ];
+
+        timerConfig = {
+          OnBootSec = "5m";
+          OnUnitActiveSec = "4h";
+          RandomizedDelaySec = "15m";
+          Persistent = true;
+          Unit = "step-ssh-host-renew.service";
+        };
+      };
+    };
+  };
+}

modules/services/step-ca/step-ca.nix

@@ -0,0 +1,25 @@
+{ inputs, ... }:
+let
+  ipAddress = "0.0.0.0";
+in
+{
+  flake.modules.nixos.step-ca = { pkgs, ... }: {
+    # https://github.com/NixOS/nixpkgs/blob/nixos-23.05/nixos/modules/services/security/step-ca.nix
+    services.step-ca = {
+      enable = true;
+      openFirewall = true;
+      address = ipAddress;
+      port = 8443;
+
+      # https://smallstep.com/docs/step-ca/configuration/#configuration-options
+      settings = {
+        root = "";
+        crt = "";
+      };
+    };
+    environment.systemPackages = with pkgs; [
+      step-ca
+      step-cli
+    ];
+  };
+}

modules/users/john.nix

@@ -0,0 +1,48 @@
+{ self, inputs, lib, ... }:
+let
+  username = "john";
+in
+{
+  flake.meta.users."${username}" = {
+    email = "32917998+jsl12@users.noreply.github.com";
+    name = "John Lancaster";
+    inherit username;
+    key = "";
+    keygrip = [
+    ];
+    authorizedKeys = [
+      # "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIAUa4dcg1TWc4pW++uodyhX4eOqrX/QYIxFWtEP7HFJ john@john-pc-ubuntu"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMOkGLo4N/L3RYvaIZ1FmePlxa1HK0fMciZxKtRhN58F root@janus"
+    ];
+  };
+
+  flake.modules = lib.mkMerge [
+    (self.factory.user {
+      username = username;
+      isAdmin = true;
+    })
+    {
+      nixos."${username}" = {
+        imports = [
+          inputs.home-manager.nixosModules.home-manager
+        ];
+        users.users."${username}" = {
+          openssh.authorizedKeys.keys = inputs.self.meta.users."${username}".authorizedKeys;
+        };
+      };
+
+      # This module will be imported by the user factory
+      homeManager."${username}" = with inputs.self.meta.users."${username}"; {
+        home.stateVersion = "25.11";
+        xdg.enable = true;
+        programs.git.settings.user.name = name;
+        programs.git.settings.user.email = email;
+        imports = with inputs.self.modules.homeManager; [
+          ssh
+          shell-tools
+          git
+        ];
+      };
+    }
+  ];
+}

scripts/inspect.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env sh
+
+NIX_EVAL_CMD="nix eval --json --no-warn-dirty --apply builtins.attrNames"
+
+list_flake_attr() {
+    attr="$1"
+    flake="${2:-.}"
+    echo "${attr} [${flake}]:"
+    $NIX_EVAL_CMD "${flake}#${attr}" | jq -r '"  - " + .[]'
+    echo
+}
+
+list_home_modules() {
+    list_flake_attr "homeModules" "$1"
+}
+
+list_home_configurations() {
+    list_flake_attr "homeConfigurations" "$1"
+}
+
+list_nixos_configurations() {
+    list_flake_attr "nixosConfigurations" "$1"
+}
+
+current_dir=$(readlink -f .)
+flake="${1:-$current_dir}"
+list_home_modules "$flake"
+list_home_configurations "$flake"
+list_nixos_configurations "$flake"

scripts/switch.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+
+FLAKE_DIR="/home/john/.config/home-manager/jsl-dendritic"
+
+is_in_array() {
+    local needle="$1"
+    shift
+    local arr=("$@")
+    [[ " ${arr[*]} " == *" ${needle} "* ]] && echo true || echo false
+}
+
+hostname_exists() {
+    NIX_EVAL_CMD="nix eval --json --no-warn-dirty --apply builtins.attrNames"
+    mapfile -t HOME_CONFIGS < <(${NIX_EVAL_CMD} ${FLAKE_DIR}#homeConfigurations | jq -r '.[]')
+    is_in_array "$(hostname)" "${HOME_CONFIGS[@]}"
+}
+
+HOSTNAME=$(hostname)
+if [[ "$(hostname_exists)" == "true" ]]; then
+    home-manager switch --flake "${FLAKE_DIR}#${HOSTNAME}"
+else
+    echo "No homeConfiguration found for hostname '${HOSTNAME}'." >&2
+    exit 1
+fi