added sunshine and tailscale

19 files changed, 198 insertions, 115 deletions

diff --git a/.sops.yaml b/.sops.yaml
index 6cfa6ce..7012728 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -1,5 +1,5 @@
 keys:
-  - &admin_age age1g9xlgzxxvgfgq6a05jxy2e7zf8t4qgw6wjpjmvyhvzlnu8fmye6s8qx702
+  - &admin_age age1l7tecyh25hydmqpmut00qtg59qmscxe7trcj4f8t5qyfqm04690qh44pc8
   - &host_szpont age1s39d4mdrjhkf8cy8eea02p836r7s875fj8f7w3z4ld2stmaac49qd075ww
   - &host_thinkpad age12htxy05mlkaqx7q6m5wufkqnnvhmhe4nfsr5ljlwkdk0u59f7ujq7537fw
   - &host_pendrive age1sx8ut0arwlrp7n7qvlaele8mq93pyvzc0ddetlk47cnyx935gcusdceq9q
diff --git a/flake.lock b/flake.lock
index d4aa93f..30529a3 100644
--- a/flake.lock
+++ b/flake.lock
@@ -212,11 +212,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772408722,
-        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
+        "lastModified": 1775087534,
+        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
+        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
         "type": "github"
       },
       "original": {
@@ -363,11 +363,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775711780,
-        "narHash": "sha256-7Bo5/DAh6DSA9N+P2dg+LvSL/ArQuvkObNPyyGBqDO0=",
+        "lastModified": 1776449631,
+        "narHash": "sha256-hexqfDecJo5/QCivkhPUjesBhuv28j3iLE/hOu9xb6g=",
         "owner": "Mjoyufull",
         "repo": "fsel",
-        "rev": "d7ce3cf6e74e165d333fc1ec0245ecfaca149af8",
+        "rev": "ef9e4e210f1206fe97126d74a0c109e9558a9ee0",
         "type": "github"
       },
       "original": {
@@ -383,11 +383,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776046499,
-        "narHash": "sha256-Wzc4nn07/0RL21ypPHRzNDQZcjhIC8LaYo7QJQjM5T4=",
+        "lastModified": 1776562531,
+        "narHash": "sha256-Lh5Ns9DI67E+lSMOCGK0S+mFPy0mz0yOGiJTUXiR9JI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "287f84846c1eb3b72c986f5f6bebcff0bd67440d",
+        "rev": "5b56ad02dc643808b8af6d5f3ff179e2ce9593f4",
         "type": "github"
       },
       "original": {
@@ -528,11 +528,11 @@
       },
       "locked": {
         "dir": "packages/nix",
-        "lastModified": 1774491538,
-        "narHash": "sha256-11rgTocaXAIFYVEcbb6ju/sDN6sZpxjneXj9FSbgwrA=",
+        "lastModified": 1776469299,
+        "narHash": "sha256-6KV0OgBCKrbVP4EM9hqcospkoPImbt6VZ18Mbgi9bqY=",
         "owner": "SteamClientHomebrew",
         "repo": "Millennium",
-        "rev": "bf8b0cd016fcc4168c4e348cbcbfd237de4c01c8",
+        "rev": "19741152e4237810141a0f18868a6993939e556a",
         "type": "github"
       },
       "original": {
@@ -647,11 +647,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1769799857,
-        "narHash": "sha256-88IFXZ7Sa1vxbz5pty0Io5qEaMQMMUPMonLa3Ls/ss4=",
+        "lastModified": 1776200608,
+        "narHash": "sha256-broZ6RFQr4Fv0wT73gGmzNX14A43TmTFF8g4wDKlNss=",
         "owner": "nix-community",
         "repo": "naersk",
-        "rev": "9d4ed44d8b8cecdceb1d6fd76e74123d90ae6339",
+        "rev": "8b23250ab45c2a38cd91031aee26478ca4d0a28e",
         "type": "github"
       },
       "original": {
@@ -691,11 +691,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775952282,
-        "narHash": "sha256-iJcGy0pW0wX7q6HAQuKx8sskTyu8an0l0gI3TBgzk3E=",
+        "lastModified": 1776557088,
+        "narHash": "sha256-DV2C1S+JYf2UB6S6CzmLl5dt6HwVh9FcC7q/+BLZZZg=",
         "owner": "nix-community",
         "repo": "neovim-nightly-overlay",
-        "rev": "f719e136a8e0cd91e70515e590385356abce1341",
+        "rev": "17e9c821a0213ff7ed87968082213c9e017ee6a7",
         "type": "github"
       },
       "original": {
@@ -707,11 +707,11 @@
     "neovim-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1775949028,
-        "narHash": "sha256-JXrr9lxKfTIm/VW4jvaB1RU9r+7pAoaXeDsy24TGPiw=",
+        "lastModified": 1776541400,
+        "narHash": "sha256-BjYfNZF6g5PJc1KnskaaxxYOony4peFET7HRz04ABHk=",
         "owner": "neovim",
         "repo": "neovim",
-        "rev": "4a289bfce3e71bf00d1eced168a6a7bbb270b95b",
+        "rev": "b351afb1b1c564c5a4e6856764d4db21a873242c",
         "type": "github"
       },
       "original": {
@@ -732,11 +732,11 @@
         "xwayland-satellite-unstable": "xwayland-satellite-unstable"
       },
       "locked": {
-        "lastModified": 1775877135,
-        "narHash": "sha256-nAqtUMy22olwyiOJB0CASVrbu5XB5+43GjlbIJ1KuvQ=",
+        "lastModified": 1776595270,
+        "narHash": "sha256-U5iJHEVjXVPhD+cHUvzfbFNlgT6AxfUr+IZr9MUYa8w=",
         "owner": "sodiboo",
         "repo": "niri-flake",
-        "rev": "f943da038fd668d435c2d17916577f295faa8839",
+        "rev": "8cd64f0a42a9a3e03974d1d804ff00f66baa2a18",
         "type": "github"
       },
       "original": {
@@ -765,11 +765,11 @@
     "niri-unstable": {
       "flake": false,
       "locked": {
-        "lastModified": 1775561155,
-        "narHash": "sha256-TK2IrqQivRcwqJa0suZMbcsN17CtA8Uu0v7CDnLATb0=",
+        "lastModified": 1776588656,
+        "narHash": "sha256-luGdCDS6Mxsgyhuamup/0P85S6JKSHF4E6lzZ/AY4A4=",
         "owner": "YaLTeR",
         "repo": "niri",
-        "rev": "599db847f857b8a7ff78ce02f15acab5d5d9fee1",
+        "rev": "04c422e43f018cab681d52b199dc779c5fa90a52",
         "type": "github"
       },
       "original": {
@@ -786,11 +786,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775801806,
-        "narHash": "sha256-aTSAGoSF58PXhsC6DlFI6rZo8IlOOtzt+N4oFaMtEOA=",
+        "lastModified": 1776492892,
+        "narHash": "sha256-NG9w4LJ/oQC9bLZrKgKNpAoQ8Kj2jEPTyKFvJj6VO8s=",
         "owner": "powerofthe69",
         "repo": "nix-gaming-edge",
-        "rev": "78a955bd30cf9c960442703cf431ba7cfa12f316",
+        "rev": "17939baf4da51f8b6802f7431470a5a559ef18c4",
         "type": "github"
       },
       "original": {
@@ -848,11 +848,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1775811116,
-        "narHash": "sha256-t+HZK42pB6N+i5RGbuy7Xluez/VvWbembBdvzsc23Ss=",
+        "lastModified": 1776434932,
+        "narHash": "sha256-gyqXNMgk3sh+ogY5svd2eNLJ6oEwzbAeaoBrrxD0lKk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "54170c54449ea4d6725efd30d719c5e505f1c10e",
+        "rev": "c7f47036d3df2add644c46d712d14262b7d86c0c",
         "type": "github"
       },
       "original": {
@@ -864,11 +864,11 @@
     },
     "nixpkgs-stable_2": {
       "locked": {
-        "lastModified": 1775811116,
-        "narHash": "sha256-t+HZK42pB6N+i5RGbuy7Xluez/VvWbembBdvzsc23Ss=",
+        "lastModified": 1776434932,
+        "narHash": "sha256-gyqXNMgk3sh+ogY5svd2eNLJ6oEwzbAeaoBrrxD0lKk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "54170c54449ea4d6725efd30d719c5e505f1c10e",
+        "rev": "c7f47036d3df2add644c46d712d14262b7d86c0c",
         "type": "github"
       },
       "original": {
@@ -880,11 +880,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1775710090,
-        "narHash": "sha256-ar3rofg+awPB8QXDaFJhJ2jJhu+KqN/PRCXeyuXR76E=",
+        "lastModified": 1776169885,
+        "narHash": "sha256-l/iNYDZ4bGOAFQY2q8y5OAfBBtrDAaPuRQqWaFHVRXM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4c1018dae018162ec878d42fec712642d214fdfa",
+        "rev": "4bd9165a9165d7b5e33ae57f3eecbcb28fb231c9",
         "type": "github"
       },
       "original": {
@@ -919,11 +919,11 @@
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1776028177,
-        "narHash": "sha256-RHohvwPl6AdO64pq+Pn60ypqFf0VWNYaXUDurqFQ1Xk=",
+        "lastModified": 1776452249,
+        "narHash": "sha256-tpCsY9kIEfcitiV3JwUqYTmxwewwZKQlZSNUBqb9kF0=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "3682e0dde624e8e37b93ad053e567703ac33fd36",
+        "rev": "698d17490e19e2e360a6ce49b1af9134d1c6eacd",
         "type": "github"
       },
       "original": {
@@ -944,11 +944,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1775892726,
-        "narHash": "sha256-1TK1pe33cEHNvGW41TP5xAzrbG1Gp7LfyFL6c3+xf+I=",
+        "lastModified": 1776592225,
+        "narHash": "sha256-zrkNoTGdKcDPdNsv8z3N+HvaMnWuzBd+qVfHNF8oh0k=",
         "owner": "NotAShelf",
         "repo": "nvf",
-        "rev": "5ab359ee7dfd3fa09a5c6f863efaf810bb9a9436",
+        "rev": "fc411253d73790d3577149a2477c98003ea2653f",
         "type": "github"
       },
       "original": {
@@ -965,11 +965,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775885017,
-        "narHash": "sha256-KYgoIClRFYJE7//xDoR8H9K3WEng5V6PZSFwsJVIGy4=",
+        "lastModified": 1776134667,
+        "narHash": "sha256-UKJfv7uG2BsQqRdTNVl4BkKjQs2tA17lmi4/uW/Yzk0=",
         "ref": "refs/heads/master",
-        "rev": "4368e163682e6ccb0b5b992cd31bd8feada8fd88",
-        "revCount": 117,
+        "rev": "3a99a37b0c1232cf7310f5a5314466839001fec9",
+        "revCount": 118,
         "type": "git",
         "url": "https://git.bwaaa.monster/omnisearch"
       },
@@ -1011,11 +1011,11 @@
         "systems": "systems_5"
       },
       "locked": {
-        "lastModified": 1775197069,
-        "narHash": "sha256-ip0O6l9H64WpZRdFDltTMyqOvFmtSSThciQChAQ8sAk=",
+        "lastModified": 1776532353,
+        "narHash": "sha256-sAkUjqPgg+zIX0eOmuMGMgtmq2w+uE2PLIacSzSCrjo=",
         "owner": "kuokuo123",
         "repo": "otter-launcher",
-        "rev": "58762fbde17243e9a2e88b4f3480514ac42d6f7b",
+        "rev": "1ff9f075eb885fc834a6e2c0644b0a7061baaebb",
         "type": "github"
       },
       "original": {
@@ -1146,11 +1146,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1775630794,
-        "narHash": "sha256-Njq83xACSD8HTP7slV6KGHJAXb4AHp1fyua8W8KKxJ8=",
+        "lastModified": 1776144554,
+        "narHash": "sha256-ILLBoK1jB4C5y418nC1X34vCspjnx0DwU04+D5cL68U=",
         "owner": "gabm",
         "repo": "Satty",
-        "rev": "c1a9d2125e19073059d144c15ed7713226016cea",
+        "rev": "f96a991f0bd623b64cefd3683bec514c39e1e37e",
         "type": "github"
       },
       "original": {
@@ -1189,11 +1189,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775971308,
-        "narHash": "sha256-VKp9bhVSm0bT6JWctFy06ocqxGGnWHi1NfoE90IgIcY=",
+        "lastModified": 1776119890,
+        "narHash": "sha256-Zm6bxLNnEOYuS/SzrAGsYuXSwk3cbkRQZY0fJnk8a5M=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "31ac5fe5d015f76b54058c69fcaebb66a55871a4",
+        "rev": "d4971dd58c6627bfee52a1ad4237637c0a2fb0cd",
         "type": "github"
       },
       "original": {
@@ -1210,11 +1210,11 @@
         "systems": "systems_6"
       },
       "locked": {
-        "lastModified": 1775421933,
-        "narHash": "sha256-JkEbzFDFTsUlVtHEzA8Y4r3O9LInhb96eOCbtGjGnbM=",
+        "lastModified": 1776578704,
+        "narHash": "sha256-4+JHYCweZ/SSrMcu2nJ5gc7gop2scBk0JIIfaUKuTaQ=",
         "owner": "Gerg-L",
         "repo": "spicetify-nix",
-        "rev": "ec8d73085fdf807d55765335dc8126e14e7b2096",
+        "rev": "73f6d24b4f5bdacc3b41ddcf9965bef2781f97dd",
         "type": "github"
       },
       "original": {
@@ -1230,11 +1230,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774815343,
-        "narHash": "sha256-PPnyrnBWhGZQ6KdUoz68WJv3sqtj5mncBIHm2MMaC7A=",
+        "lastModified": 1776509741,
+        "narHash": "sha256-EckkZBhvVSd/nA+l6fIhtE7BEY0DTIeVLFaH+xmjGf8=",
         "owner": "MattiaPun",
         "repo": "SubTUI",
-        "rev": "ae09ba5351a35a10bafc602d433fbea9be0e2d26",
+        "rev": "7c40607663d6eb08b0d6d31f287d75eca3439c0c",
         "type": "github"
       },
       "original": {
@@ -1356,11 +1356,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775558724,
-        "narHash": "sha256-tjZmQ+H9osk0MA7LB/JBCO8K+dzqNmxdjU2mbVRUsQ8=",
+        "lastModified": 1776070970,
+        "narHash": "sha256-ArclxR9y505NG3VmjXyrw/i2o37BJcVBtNoWL5VO8nU=",
         "owner": "Alexays",
         "repo": "Waybar",
-        "rev": "202ae4bd5f2d8865704761211b3004d2fcd2d7d8",
+        "rev": "3a321d934dda790f8ce8dc76d8e545abe1ec3251",
         "type": "github"
       },
       "original": {
@@ -1428,11 +1428,11 @@
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1775870717,
-        "narHash": "sha256-8dyHQR5Ssy2lZplDErqDZ5ri33Okc16+TJUEp3Y5Rn4=",
+        "lastModified": 1776589137,
+        "narHash": "sha256-BFsxdfQLP8MQAWebFIQ/KkFhCLFTXEDmKRTkScMH+po=",
         "owner": "sxyazi",
         "repo": "yazi",
-        "rev": "80a54c3dd555ed3957c3dec53c79174351e85731",
+        "rev": "369c47539c3261972349ae57d1098c741bfbc5c4",
         "type": "github"
       },
       "original": {
diff --git a/hm/editors/nixvim/nixvim.nix b/hm/editors/nixvim/nixvim.nix
index ea6398b..6d4583b 100644
--- a/hm/editors/nixvim/nixvim.nix
+++ b/hm/editors/nixvim/nixvim.nix
@@ -17,7 +17,7 @@ in
     programs.nixvim = {
       diagnostics.virtual_text = false;
       enable = true;
-      package = inputs.neovim-nightly-overlay.packages.${pkgs.system}.default;
+      # package = inputs.neovim-nightly-overlay.packages.${pkgs.system}.default;
 
       viAlias = true;
       vimAlias = true;
diff --git a/hm/soft/chat.nix b/hm/soft/chat.nix
index 61c1f92..5d3d2fc 100644
--- a/hm/soft/chat.nix
+++ b/hm/soft/chat.nix
@@ -11,6 +11,7 @@ in
   options.hm.soft.chat.enable = lib.mkEnableOption "chatting apps";
   config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [
+      signal-desktop
       equibop
       gajim
     ];
diff --git a/hm/soft/media.nix b/hm/soft/media.nix
index 350517b..04bc670 100644
--- a/hm/soft/media.nix
+++ b/hm/soft/media.nix
@@ -12,6 +12,7 @@ in
   config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [
       stremio-linux-shell
+      krita
       czkawka
       nsxiv
       pinta
diff --git a/hm/soft/mpv.nix b/hm/soft/mpv.nix
index af1d941..b9ad274 100644
--- a/hm/soft/mpv.nix
+++ b/hm/soft/mpv.nix
@@ -45,7 +45,7 @@ in
         profile = "gpu-hq";
         gpu-api = "vulkan";
         vo = "gpu-next";
-        hwdec = "vaapi";
+        hwdec = "vaapi-copy";
 
         scale = "ewa_lanczossharp";
         cscale = "ewa_lanczos";
diff --git a/hosts/desktop/configuration.nix b/hosts/desktop/configuration.nix
index f6ecf55..28e417b 100644
--- a/hosts/desktop/configuration.nix
+++ b/hosts/desktop/configuration.nix
@@ -2,6 +2,7 @@
   config,
   username,
   inputs,
+  pkgs,
   ...
 }:
 {
@@ -28,10 +29,8 @@
       drivers = {
         enable = true;
         cpu = "amd";
-        kernel = "zen";
         graphics = {
           enable = true;
-          version = "git";
           amdgpu.enable = true;
         };
       };
@@ -56,6 +55,7 @@
         antivirus.enable = true;
       };
       ssh.enable = true;
+      tailscale.enable = true;
       storage.enable = true;
       users.enable = true;
     };
@@ -80,6 +80,7 @@
         steam.enable = true;
         vr.enable = true;
       };
+      sunshine.enable = true;
       virtualization.kvm.enable = true;
       kdeconnect.enable = true;
       nix-helper.enable = true;
@@ -96,10 +97,10 @@
     };
   };
 
-  virtualisation.waydroid.enable = true;
-
   environment.systemPackages = [
     inputs.subtui.packages.x86_64-linux.subtui
+    pkgs.gimp
+    pkgs.brave
   ];
 
   boot = {
diff --git a/hosts/thinkpad/boot.key b/hosts/thinkpad/boot.key
deleted file mode 100644
index 6675c92..0000000
--- a/hosts/thinkpad/boot.key
+++ /dev/null
diff --git a/hosts/thinkpad/configuration.nix b/hosts/thinkpad/configuration.nix
index b08d7ba..728f5a9 100644
--- a/hosts/thinkpad/configuration.nix
+++ b/hosts/thinkpad/configuration.nix
@@ -53,6 +53,7 @@
       };
       ssh.enable = true;
       storage.enable = true;
+      tailscale.enable = true;
       users.enable = true;
     };
     srv = {
@@ -76,6 +77,7 @@
         games.enable = true;
         steam.enable = true;
       };
+      moonlight.enable = true;
       virtualization.kvm.enable = true;
       kdeconnect.enable = true;
       nix-helper.enable = true;
diff --git a/os/core/default.nix b/os/core/default.nix
index 160e67b..1899553 100644
--- a/os/core/default.nix
+++ b/os/core/default.nix
@@ -17,6 +17,7 @@ in
     ./security.nix
     ./ssh.nix
     ./storage.nix
+    ./tailscale.nix
     ./users.nix
   ];
 
diff --git a/os/core/drivers.nix b/os/core/drivers.nix
index 3764937..ca5ecc4 100644
--- a/os/core/drivers.nix
+++ b/os/core/drivers.nix
@@ -86,7 +86,10 @@ in
             initrd.enable = true;
             overdrive.enable = true;
           };
-          graphics.extraPackages = [ pkgs.rocmPackages.clr.icd ];
+          graphics.extraPackages = with pkgs; [
+            rocmPackages.clr.icd
+            libva-utils
+          ];
         };
       })
       (lib.mkIf (cfg.graphics.enable && cfg.graphics.version == "git") {
diff --git a/os/core/tailscale.nix b/os/core/tailscale.nix
new file mode 100644
index 0000000..795fdbb
--- /dev/null
+++ b/os/core/tailscale.nix
@@ -0,0 +1,19 @@
+{ config, lib, ... }:
+let
+  cfg = config.os.core.tailscale;
+in
+{
+  options.os.core.tailscale.enable = lib.mkEnableOption "enables tailscale vpn";
+
+  config = lib.mkIf cfg.enable {
+    services.tailscale = {
+      enable = true;
+      openFirewall = true;
+      useRoutingFeatures = "client";
+    };
+    networking.firewall = {
+      trustedInterfaces = [ "tailscale0" ];
+      checkReversePath = "loose";
+    };
+  };
+}
diff --git a/os/srv/default.nix b/os/srv/default.nix
index 4b5a54a..4f520a5 100644
--- a/os/srv/default.nix
+++ b/os/srv/default.nix
@@ -12,6 +12,7 @@
     ./ollama.nix
     ./omnisearch.nix
     ./sops.nix
+    ./sunshine.nix
     ./syncthing.nix
     ./tor.nix
     ./virtualization.nix
diff --git a/os/srv/gaming.nix b/os/srv/gaming.nix
index 5de2e26..ca59782 100644
--- a/os/srv/gaming.nix
+++ b/os/srv/gaming.nix
@@ -35,6 +35,14 @@ in
       programs.gamemode = {
         enable = true;
         enableRenice = true;
+        settings = {
+          general.renice = 10;
+          # gpu = {
+          #   apply_gpu_optimisations = "accept-responsibility";
+          #   gpu_device = 0;
+          #   amd_performance_level = "high";
+          # };
+        };
       };
 
       home-manager.users.${username}.hm.soft.mangohud.enable = true;
diff --git a/os/srv/sops.nix b/os/srv/sops.nix
index 250b1c7..b5bf3af 100644
--- a/os/srv/sops.nix
+++ b/os/srv/sops.nix
@@ -26,6 +26,7 @@ in
         "syncthing/gui_password".owner = username;
         "syncthing/encryption/game-saves".owner = username;
         "syncthing/encryption/keepass".owner = username;
+        "syncthing/encryption/sync".owner = username;
         "vpn/warp_private_key".owner = "root";
         "obs/websocket_password".owner = username;
         "yggdrasil-private-key" = {
diff --git a/os/srv/sunshine.nix b/os/srv/sunshine.nix
new file mode 100644
index 0000000..f1d4300
--- /dev/null
+++ b/os/srv/sunshine.nix
@@ -0,0 +1,41 @@
+{
+  config,
+  lib,
+  pkgs,
+  username,
+  ...
+}:
+let
+  cfgSunshine = config.os.srv.sunshine;
+  cfgMoonlight = config.os.srv.moonlight;
+in
+{
+  options.os.srv = {
+    sunshine.enable = lib.mkEnableOption "enables sunshine streaming server";
+    moonlight.enable = lib.mkEnableOption "enables moonlight streaming client";
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf cfgSunshine.enable {
+      services.sunshine = {
+        enable = true;
+        capSysAdmin = true;
+        openFirewall = true;
+      };
+
+      hardware.uinput.enable = true;
+
+      users.users.${username}.extraGroups = [
+        "video"
+        "input"
+        "render"
+      ];
+    })
+
+    (lib.mkIf cfgMoonlight.enable {
+      environment.systemPackages = [
+        pkgs.moonlight-qt
+      ];
+    })
+  ];
+}
diff --git a/os/srv/syncthing.nix b/os/srv/syncthing.nix
index b350428..2234b88 100644
--- a/os/srv/syncthing.nix
+++ b/os/srv/syncthing.nix
@@ -58,6 +58,22 @@ in
               params.keep = "10";
             };
           };
+
+          "sync" = {
+            path = "/home/${username}/sync";
+            id = "sync";
+            devices = [
+              {
+                name = "oci";
+                encryptionPasswordFile = config.sops.secrets."syncthing/encryption/sync".path;
+                compression = "metadata";
+              }
+            ];
+            versioning = {
+              type = "simple";
+              params.keep = "3";
+            };
+          };
         };
       };
     };
diff --git a/os/srv/tor.nix b/os/srv/tor.nix
index 55c779d..8777fba 100644
--- a/os/srv/tor.nix
+++ b/os/srv/tor.nix
@@ -22,10 +22,6 @@ in
           dns.enable = true;
           transparentProxy.enable = true;
         };
-        settings = {
-          Sandbox = true;
-          DisableAllSwap = true;
-        };
       };
     })
     (lib.mkIf cfg.enableBrowser {
diff --git a/secrets.yaml b/secrets.yaml
index a934f23..55556f1 100644
--- a/secrets.yaml
+++ b/secrets.yaml
@@ -9,55 +9,47 @@ syncthing:
     encryption:
         game-saves: ENC[AES256_GCM,data:67kubvePq/KYxJKJkNR8gBEf3VGczFkJE469XSYvBg/a4HfAAmdJuL2kfv62zEXVVb5BXx7NK1Xr5s+81AEaZw==,iv:1ERuh9X8IX/+XM22rreNUzt+i4CcJhVhS+IM210Z6dU=,tag:iSkTHHUF/WosX94JqJAjiQ==,type:str]
         keepass: ENC[AES256_GCM,data:OLU0tYB9TTKZ5V1Mzj5FDE9YdCpj0ajJaoxzqd7HtTmaBqETjs7CjYriq7kCOgSEVBtwzek/NA1vetwuMQhI8Q==,iv:P9aBZCIbj23aOvuMBtAjAZ2L+0lUT5Xjk7XRikbc9u0=,tag:xnWUxctkKVTUOV0AtpnTug==,type:str]
+        sync: ENC[AES256_GCM,data:XaD+8knm2VLHGFE5AOc9V4GSJ4opGNcz7ujCH2rfMVTtQ270QzohMsQoKMjSM18a44AxZ/vtnZjLtTo+ZOWYcA==,iv:wchjwjuICqY6CQyQQmxS++9H5YECCVjURUlB2ebFSO8=,tag:v8CxGv7ZnV3WsTz5wEZFMQ==,type:str]
 yggdrasil-private-key: ENC[AES256_GCM,data:lyyOlWDvYa33Koc8DmhcRwgMI8KOsqmD9oc1gORb/RZiAXiKsmlXRFuiu3ba8CA1uAahJpK897ambZiFVi8qlgMrK7irfmqVyoF3r9luQJGyjrp9dvypSkRuQKLnp2Aj3FoIyXBM+mFwZpbAyGxTCTvylXhoqZo=,iv:2b4OwPNQt1WeF36oolSDIFwu3ux+f39/9+7brfgxqbg=,tag:rH8A5TYv+aG2sDKjJkZokw==,type:str]
 sops:
     age:
-        - recipient: age1g9xlgzxxvgfgq6a05jxy2e7zf8t4qgw6wjpjmvyhvzlnu8fmye6s8qx702
+        - recipient: age1l7tecyh25hydmqpmut00qtg59qmscxe7trcj4f8t5qyfqm04690qh44pc8
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHRVJVNW1qaVJvUEQ0UHV0
-            bE1zY0VyeDlpK0VhUWhCTnU2T0JZM01hOEdvCjBtNWRhNFNWa0s4aHRMUVgvNUM3
-            blpZZDdGb3NzeVgzampyRkVCRmdPZXMKLS0tIE8yRzN0TXl1enNVaFBTc3R1VXVI
-            eWZ2ak9zQ3ovclBGVWZVaitHZ0lQV2MKNESZYp4qoEFeMFo0cS7Nkzu3VVRa7WZJ
-            tDge83b812ikeK2YM10XmGZxpO+QbHLO+RxE7mA4YrU00Ar2AHR+Wg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvUVViQmx1UVNONFlQQW1t
+            a2FmUjJXM0pDOHJIanhGRzRQQUpjaEtpVURBCkhrbTh3aGh6K28vRisrdlQ5ZjF3
+            S3c3aGNKVFlTYTE3TzhXMjdUU0czRUkKLS0tIEM4MVNPNFYyTXF6NWxjZFhaZEhm
+            Y0lteEgzZVBYejBHeG8zeVFHM1RsSjAKOpQZ9fQbBlJOycnfV/36fjf3rXMpCGm+
+            YQSsCdwR07Y7onWCAG3fsHDusbUZvl1284l5m+ukJptaCe8DMB5Hbg==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1s39d4mdrjhkf8cy8eea02p836r7s875fj8f7w3z4ld2stmaac49qd075ww
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrdzl3MEd4cTloTXA1ZlFo
-            ODgrS09ZRVR3bStiL0pQeEtRV2hrYWRZemxBCjZjcXhoNlhqMlVLNytOYkErYnND
-            RERNQ0V0THpSMkJiMVZyOFp6SUQyNUEKLS0tIEF0ZVJjMlkzQTgraE1RekFJcGN6
-            MStHSVZWWDhOaVZZS2ptV05LUVQzcW8KLHINhvhr0xIFt4PaRJJLLBpmqgoxaKyw
-            pE6T4DTdUrvq12rDg2lnKg8alUDMY5lvhRDz7uZYnWyxUGELqLRiJg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0V1NhWnYxMFlVMWxMMkFj
+            YXlJUmRnN0RNN25yeUd5NE9PMzBiTlA0RlQwCllKcWl4VnJVbTBGamc1dVg0L3RS
+            ajFEbjVGcEpuRVBLRmY4dmp1YUR4WWcKLS0tIHI2UXE2Smc0em1XODNEY0x3dXd1
+            WlhEM2VteStwaGM1aGlqdXdzaVAreHMKUOgEGQf72AXGVyGp1vSeYVKLC7X68hKC
+            uZFW0JxGT964y7OAdGOC1SOl633a677yRBxMFYT1i9x1qklj+jgtNA==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age12htxy05mlkaqx7q6m5wufkqnnvhmhe4nfsr5ljlwkdk0u59f7ujq7537fw
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvdjJidkZOK2llQ1pyakNO
-            S0FsSU8wNlpqa0NqRXBqeTRMZkdJbkphN0NrCi91UmdhZ1daRTY2SXdaSFNsYTE3
-            WkVnTnAwaWp2SW1yS0FvNzFJNG1CRWsKLS0tIDRNK2xPN2RtRDFMMktRYS9ZOWY5
-            dEMwVWpnZDNvVGxQdElSSG00VURzTUEKAg/WNRSoYB9ArmM9nX6Alz7YPPqUdjkg
-            TRq3bwClQkLm/L8HquNwfFigqeTPvz2aXV9Ujlf5r3zZq4IXhEZRDA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5d3pRR1J3dEREamdGZWZK
+            Snc1RE05dUdENW5iamJnSHZxdEJibHdubmxJCkVjNVRLNXNwSHIvTHpRN3BIbDVF
+            QnEzWWJoQVUwNGhjNVNuZlAyZTR1VncKLS0tIHBKQ2pLd3dDdVltQkdXSUZVZFpS
+            cDVQWHJEdnNDeWVSa2dycWxhUDZKbmsKv2vWjtc5gPa3+TMEX9iSwKhyquGbXiOx
+            b6wOT+Op9bpoXv+bq2DzSRDgmTX2Vc2KlzTqCLBdfUGrcXdEjAKkJQ==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1sx8ut0arwlrp7n7qvlaele8mq93pyvzc0ddetlk47cnyx935gcusdceq9q
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNbnFIREc2U1ZITFZuYTR4
-            cE82TjBxVWpkc1VOQlp4a1pRaWU3NEZmZWw0CnI3cjEvRjJ1bWU0eW4rNXhVeGpJ
-            UXRhMUlxb0tLcUc0NWlDM1BEUzJtdVUKLS0tIGJhNjBWWmtGTUZYT2dxcGNEdHRO
-            VkkwbThtZUFsMFBoRmwxd1VtU1hkNkkKNMQ9jzxjCYqOUn6CRl9o2bjaE1CdwyxS
-            6e2vZ2CD/cj3u2iQfjohxWeDmDmmiJmxMM1VJbDEnjGjP6L+omFpug==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSNDNKTkFSdEZzeUN1T3J4
+            MFB2VEh6allkQkxBNjA5RmJDdk5yb1lzOFFNCm5NM3FleVNORUVrYVZESno1QXA5
+            d2hNbnBIendxMXU5TDVxZDM3VFFjYWcKLS0tIEZFVUdOQy95YjRZSlRpcng5WlVv
+            UTRzNTFzeDlQWXVWVjBTV3ZnVllkVUEKe3BeeKOsEJmwKxUBb98Bek/evn4ylhlz
+            uMTURAdoMWgnCo+l60NTcL2g01LK8m/HDjdk2Dmd/mjVuFpG9JuhXw==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1m4u7n6mt5d3jv39lf4aedr9gqu3khl4sahuqx5n5h7v48gkyc9zqkp9qs8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1bTVvaEVFQ2tjUVNUaWRH
-            S0VoRWNHTFZ6Rnhyb054cHJTZnV4TGlIYkFvCmhXVU5pd2orRlErV04yTFBlR0Fz
-            SGp4NkxNTG1XeTdzWXBPb1dzNFkwZUkKLS0tIE44bGZHb3RVTVVhaC9VVE1LWFVV
-            YlM4bDBaVGFWVlFVS2t2aGpqS2lLQ1kKGEAW2a7IQaQwxr3AyArhYPNU23skM94s
-            2fIPMKVgfYEA7lf2ViJ7kfbPxGSGrhOFcyc5U6lgB/hFa1HuGXSCow==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-03-19T21:33:05Z"
-    mac: ENC[AES256_GCM,data:pHgvw9hhX84Gz6Id0G9oyp0dRMHfUjDGO0SjxJDoyP5N5ZyQSpnkwzaIvwhvTT+jIhJlkrzbJc3Ebq0Y0pRFf94L+dBdtnibk0c6I/zJhZZLF3qSbsI892Erk19bbbzldewd7YO130gBQxhP0DWdSIJAWBJ8UEUxyQE+KH47Kzg=,iv:wVCCYDIz5Nczhbz7Mnp9tuobdCL284j8sv+3q7HnIjc=,tag:FrhUf4kCK6CrmvvNhNVuSw==,type:str]
+    lastmodified: "2026-04-17T13:02:30Z"
+    mac: ENC[AES256_GCM,data:dVqS5hgPvhj5a4tcVZpbuSPcTr4thkdDN84rk45kI0HaXiSIxFy2l7WwlJb4ZkTdLhNFw1THgXMr4nHXW00ne8QzEt90ITKjHb6hXAFqCTcOPuzYDkwe9wPtJiu0FnTUiVqKSFlH/ZKoMlyU1vSvGrX0GqeNBMEtRuST39NNrfI=,iv:hotanmPBRJ8bByxs//Dbd7K03N6rDj7zPMgRb+1xk50=,tag:S/zE35gJKcUpQhXVjK4Mcw==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.12.1
+    version: 3.12.2