moved ssh and tailscale to srv, revamped netwroking modules

23 files changed, 373 insertions, 96 deletions

diff --git a/flake.lock b/flake.lock
index f696025..f78e2b0 100644
--- a/flake.lock
+++ b/flake.lock
@@ -547,22 +547,6 @@
         "type": "github"
       }
     },
-    "nixpkgs-master": {
-      "locked": {
-        "lastModified": 1778946508,
-        "narHash": "sha256-QOjQroWRrCnorHwFtiEuzArAqaaHmMqEjNZI7TZYXBc=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "cb3e9a1118b87aae593ce3c17c7918e1ce10efa2",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "master",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "nixpkgs-stable": {
       "locked": {
         "lastModified": 1778737229,
@@ -753,7 +737,6 @@
         "nix-gaming-edge": "nix-gaming-edge",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_2",
-        "nixpkgs-master": "nixpkgs-master",
         "nixpkgs-stable": "nixpkgs-stable_2",
         "nixvim": "nixvim",
         "nvf": "nvf",
diff --git a/flake.nix b/flake.nix
index 20b15bd..0f60dc0 100644
--- a/flake.nix
+++ b/flake.nix
@@ -4,7 +4,6 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
     nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-25.11";
-    nixpkgs-master.url = "github:nixos/nixpkgs/master";
 
     # Hardware and gaming
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
@@ -104,19 +103,11 @@
       self,
       nixpkgs,
       nixpkgs-stable,
-      nixpkgs-master,
       ...
     }@inputs:
     let
       unstablePkgs = import nixpkgs { };
-      stablePkgs = import nixpkgs-stable {
-        system = "x86_64-linux";
-        config.allowUnfree = true;
-      };
-      masterPkgs = import nixpkgs-master {
-        system = "x86_64-linux";
-        config.allowUnfree = true;
-      };
+      stablePkgs = import nixpkgs-stable { };
       mkHost =
         {
           hostname,
@@ -130,7 +121,7 @@
             username = user;
             pkgs-unstable = unstablePkgs;
             pkgs-stable = stablePkgs;
-            pkgs-master = masterPkgs;
+            masterDomain = "bibus.top";
           };
           modules = [
             path
@@ -149,6 +140,11 @@
           hostname = "pendrive";
           user = "user";
         };
+        bibus-lab = mkHost {
+          hostname = "bibus-lab";
+          user = "opc";
+          isStable = true;
+        };
       };
     };
 }
diff --git a/hm/env/fsel.nix b/hm/env/fsel.nix
index d942363..faa7f24 100644
--- a/hm/env/fsel.nix
+++ b/hm/env/fsel.nix
@@ -11,6 +11,6 @@ in
 {
   options.hm.env.fsel.enable = lib.mkEnableOption "enables fsel";
   config = lib.mkIf cfg.enable {
-    home.packages = [ inputs.fsel.packages.${pkgs.system}.default ];
+    home.packages = [ inputs.fsel.packages.${pkgs.stdenv.hostPlatform.system}.default ];
   };
 }
diff --git a/hm/soft/chat.nix b/hm/soft/chat.nix
index 57cd6f7..d7f0020 100644
--- a/hm/soft/chat.nix
+++ b/hm/soft/chat.nix
@@ -11,6 +11,7 @@ in
   options.hm.soft.chat.enable = lib.mkEnableOption "chatting apps";
   config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [
+      simplex-chat-desktop
       signal-desktop
       equibop
       gajim
diff --git a/hm/soft/spicetify.nix b/hm/soft/spicetify.nix
index 98aebe3..f9a4d0c 100644
--- a/hm/soft/spicetify.nix
+++ b/hm/soft/spicetify.nix
@@ -7,7 +7,7 @@
 }:
 let
   cfg = config.hm.soft.spicetify;
-  spicePkgs = inputs.spicetify-nix.legacyPackages.${pkgs.system};
+  spicePkgs = inputs.spicetify-nix.legacyPackages.${pkgs.stdenv.hostPlatform.system};
 in
 {
   imports = [ inputs.spicetify-nix.homeManagerModules.default ];
diff --git a/hosts/bibus-lab/configuration.nix b/hosts/bibus-lab/configuration.nix
new file mode 100644
index 0000000..13e1a3b
--- /dev/null
+++ b/hosts/bibus-lab/configuration.nix
@@ -0,0 +1,14 @@
+{ inputs, username, ... }:
+{
+  system.stateVersion = "26.05";
+
+  imports = [
+    inputs.disko.nixosModules.disko
+    ./disko.nix
+
+    ../../os/default.nix
+  ];
+
+  hardware.facter.reportPath = ./facter.json;
+
+}
diff --git a/hosts/bibus-lab/disko.nix b/hosts/bibus-lab/disko.nix
new file mode 100644
index 0000000..0691fc0
--- /dev/null
+++ b/hosts/bibus-lab/disko.nix
@@ -0,0 +1,4 @@
+{
+  disko.devices = {
+  };
+}
diff --git a/hosts/desktop/configuration.nix b/hosts/desktop/configuration.nix
index 9fbe3cb..c7fa49c 100644
--- a/hosts/desktop/configuration.nix
+++ b/hosts/desktop/configuration.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  username,
-  pkgs-master,
-  ...
-}:
+{ config, username, ... }:
 {
   system.stateVersion = "25.05";
 
@@ -45,22 +40,22 @@
         zram.enable = true;
         swapfile = {
           enable = true;
-          size = 32;
+          size = 16;
         };
       };
       network.enable = true;
       security = {
         enable = true;
         sandboxing.enable = true;
-        # antivirus.enable = true;
       };
-      ssh.enable = true;
-      tailscale.enable = true;
       storage.enable = true;
       users.enable = true;
     };
     srv = {
       bluetooth.enable = true;
+      tailscale.enable = true;
+      ssh.enable = true;
+      firewall.enable = true;
       yggdrasil.enable = true;
       i2p = {
         enable = true;
@@ -87,7 +82,7 @@
       virtualization.kvm.enable = true;
       kdeconnect.enable = true;
       nix-helper.enable = true;
-      monero.enable = true;
+      monero.wallet.enable = true;
       sops.enable = true;
       syncthing.enable = true;
       omnisearch.enable = true;
@@ -110,8 +105,6 @@
     ];
   };
 
-  environment.systemPackages = [ pkgs-master.simplex-chat-desktop ];
-
   # services.netbox = {
   #   enable = true;
   #   package = pkgs-stable.netbox;
diff --git a/os/core/default.nix b/os/core/default.nix
index 1899553..1146f2d 100644
--- a/os/core/default.nix
+++ b/os/core/default.nix
@@ -15,9 +15,7 @@ in
     ./networking.nix
     ./power.nix
     ./security.nix
-    ./ssh.nix
     ./storage.nix
-    ./tailscale.nix
     ./users.nix
   ];
 
diff --git a/os/core/fonts.nix b/os/core/fonts.nix
index dac0ee7..ee61591 100644
--- a/os/core/fonts.nix
+++ b/os/core/fonts.nix
@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   cfg = config.os.core.fonts;
 in
@@ -18,6 +23,10 @@ in
       nerd-fonts.jetbrains-mono
       nerd-fonts.fira-mono
       nerd-fonts.fira-code
+      noto-fonts
+      noto-fonts-cjk-sans
+      noto-fonts-cjk-serif
+      noto-fonts-color-emoji
     ];
   };
 }
diff --git a/os/core/networking.nix b/os/core/networking.nix
index 0a93cb9..22fc206 100644
--- a/os/core/networking.nix
+++ b/os/core/networking.nix
@@ -8,26 +8,50 @@ let
   cfg = config.os.core.network;
 in
 {
-  options.os.core.network.enable = lib.mkEnableOption "system-wide networking setup";
-  config = lib.mkIf cfg.enable {
-    networking = {
-      networkmanager = {
-        enable = true;
-        wifi = {
-          macAddress = "random";
-          backend = "iwd";
-        };
-        ethernet.macAddress = "random";
-        dns = "systemd-resolved";
-      };
-      firewall = {
-        enable = true;
-        allowedTCPPorts = [ ];
-        allowedUDPPorts = [ ];
-      };
+  options.os.core.network = {
+    enable = lib.mkEnableOption "system-wide networking setup";
+
+    profile = lib.mkOption {
+      type = lib.types.enum [
+        "client"
+        "server"
+      ];
+      default = "client";
+      description = "Which networking profile configuration to apply";
     };
-    environment.systemPackages = [ pkgs.impala ];
-    services.resolved.enable = true;
-    systemd.services."NetworkManager-wait-online".enable = false;
   };
+
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        networking.networkmanager = {
+          enable = true;
+          dns = "systemd-resolved";
+        };
+
+        services.resolved.enable = true;
+      }
+
+      (lib.mkIf (cfg.profile == "client") {
+        networking.networkmanager = {
+          wifi.macAddress = "random";
+          wifi.backend = "iwd";
+          ethernet.macAddress = "random";
+        };
+
+        systemd.services."NetworkManager-wait-online".enable = false;
+
+        environment.systemPackages = [
+          pkgs.impala
+        ];
+      })
+
+      (lib.mkIf (cfg.profile == "server") {
+        networking.networkmanager = {
+          wifi.macAddress = "keep";
+          ethernet.macAddress = "keep";
+        };
+      })
+    ]
+  );
 }
diff --git a/os/srv/crowdsec.nix b/os/srv/crowdsec.nix
new file mode 100644
index 0000000..79c8718
--- /dev/null
+++ b/os/srv/crowdsec.nix
@@ -0,0 +1,78 @@
+{ config, lib, ... }:
+let
+  cfg = config.os.srv.security.crowdsec;
+in
+{
+  options.os.srv.security.crowdsec = {
+    enable = lib.mkEnableOption "enables CrowdSec collaborative intrusion prevention";
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.networking.nftables.enable;
+        message = "CrowdSec requires networking.nftables to be enabled for blocking.";
+      }
+    ];
+
+    services.crowdsec = {
+      enable = true;
+      autoUpdateService = true;
+
+      localConfig = {
+        acquisitions = [
+          {
+            source = "journalctl";
+            journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
+            labels.type = "syslog";
+          }
+          {
+            filenames = [
+              "/var/log/nginx/access.log"
+              "/var/log/nginx/error.log"
+            ];
+            labels.type = "nginx";
+          }
+        ];
+
+        parsers.s02Enrich = [
+          {
+            name = "myips/whitelist";
+            description = "Prevent local address ranges from triggering bans";
+            whitelist = {
+              reason = "Internal private subnets";
+              cidr = [
+                "10.0.0.0/16"
+              ];
+            };
+          }
+        ];
+      };
+
+      hub = {
+        collections = [
+          "crowdsecurity/linux"
+          "crowdsecurity/nginx"
+          "crowdsecurity/sshd"
+        ];
+      };
+
+      settings = {
+        lapi.credentialsFile = "/var/lib/crowdsec/state/lapi.yaml";
+        capi.credentialsFile = "/var/lib/crowdsec/state/capi.yaml";
+      };
+    };
+
+    services.crowdsec-firewall-bouncer = {
+      enable = true;
+      settings = {
+        update_frequency = "10s";
+      };
+    };
+
+    users.users.crowdsec.extraGroups = [
+      "nginx"
+      "systemd-journal"
+    ];
+  };
+}
diff --git a/os/srv/default.nix b/os/srv/default.nix
index b83e892..76351e2 100644
--- a/os/srv/default.nix
+++ b/os/srv/default.nix
@@ -3,7 +3,10 @@
   imports = [
     ./bluetooth.nix
     ./compat.nix
+    ./crowdsec.nix
+    ./fail2ban.nix
     ./files.nix
+    ./firewall.nix
     ./gaming.nix
     ./i2p.nix
     ./kdeconnect.nix
@@ -15,8 +18,10 @@
     ./opnsense.nix
     ./simplex.nix
     ./sops.nix
+    ./ssh.nix
     ./sunshine.nix
     ./syncthing.nix
+    ./tailscale.nix
     ./tor.nix
     ./virtualization.nix
     ./vpn.nix
diff --git a/os/srv/fail2ban.nix b/os/srv/fail2ban.nix
new file mode 100644
index 0000000..9b51ceb
--- /dev/null
+++ b/os/srv/fail2ban.nix
@@ -0,0 +1,69 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.os.srv.fail2ban;
+in
+{
+  options.os.srv.fail2ban = {
+    enable = lib.mkEnableOption "the NGINX reverse proxy service";
+    nginxJails.enable = lib.mkEnableOption "enables Nginx basic-auth and botsearch jails" // {
+      default = true;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.networking.firewall.enable || config.networking.nftables.enable;
+        message = "Fail2ban requires the NixOS firewall or nftables to be enabled to block IPs.";
+      }
+      {
+        assertion = cfg.nginxJails.enable -> config.os.srv.nginx.enable;
+        message = "Fail2ban Nginx jails require your custom Nginx service to be enabled.";
+      }
+    ];
+
+    services.fail2ban = {
+      enable = true;
+
+      bantime = "24h";
+      # findtime = "10m";
+      maxretry = 5;
+
+      banaction = "nftables-multiport";
+
+      ignoreIP = [ "10.0.0.0/16" ];
+
+      jails = lib.mkMerge [
+        {
+          sshd = {
+            enabled = true;
+            settings = {
+              maxretry = 3;
+            };
+          };
+        }
+
+        (lib.mkIf cfg.nginxJails.enable {
+          nginx-http-auth = {
+            enabled = true;
+            settings = {
+              port = "http,https";
+              filter = "nginx-http-auth";
+              maxretry = 5;
+            };
+          };
+
+          nginx-botsearch = {
+            enabled = true;
+            settings = {
+              port = "http,https";
+              filter = "nginx-botsearch";
+              maxretry = 3;
+            };
+          };
+        })
+      ];
+    };
+  };
+}
diff --git a/os/srv/firewall.nix b/os/srv/firewall.nix
new file mode 100644
index 0000000..9242007
--- /dev/null
+++ b/os/srv/firewall.nix
@@ -0,0 +1,22 @@
+{ config, lib, ... }:
+let
+  cfg = config.os.srv.firewall;
+in
+{
+  options.os.srv.firewall = {
+    enable = lib.mkEnableOption "enables the firewall";
+  };
+
+  config = lib.mkIf cfg.enable {
+    networking = {
+      nftables.enable = true;
+
+      firewall = {
+        enable = true;
+
+        allowedTCPPorts = [ ];
+        allowedUDPPorts = [ ];
+      };
+    };
+  };
+}
diff --git a/os/srv/gaming.nix b/os/srv/gaming.nix
index afe6d1e..1e3e9cd 100644
--- a/os/srv/gaming.nix
+++ b/os/srv/gaming.nix
@@ -66,7 +66,7 @@ in
 
     # --- SPECIFIC GAMES ---
     (lib.mkIf cfg.games.enable {
-      environment.systemPackages = with inputs.openmw-nix.packages.${pkgs.system}; [
+      environment.systemPackages = with inputs.openmw-nix.packages.${pkgs.stdenv.hostPlatform.system}; [
         (pkgs.openttd-jgrpp)
 
         # OpenMW Specific
@@ -104,13 +104,15 @@ in
               DisableFamilyShareLock = true;
               SafeMode = false;
             };
-            home.packages = [ inputs.sls-steam.packages.${pkgs.system}.wrapped ];
+            home.packages = [ inputs.sls-steam.packages.${pkgs.stdenv.hostPlatform.system}.wrapped ];
 
             xdg.desktopEntries = {
               "SLSsteam" = {
                 name = "SLSsteam";
                 comment = "Library modification for Steam";
-                exec = "${lib.getExe' inputs.sls-steam.packages.${pkgs.system}.wrapped "SLSsteam"} %U";
+                exec = "${
+                  lib.getExe' inputs.sls-steam.packages.${pkgs.stdenv.hostPlatform.system}.wrapped "SLSsteam"
+                } %U";
                 icon = "steam";
                 terminal = false;
                 type = "Application";
diff --git a/os/srv/monero.nix b/os/srv/monero.nix
index 40675e0..c7db2d8 100644
--- a/os/srv/monero.nix
+++ b/os/srv/monero.nix
@@ -2,6 +2,7 @@
   config,
   lib,
   pkgs,
+  masterDomain,
   ...
 }:
 let
@@ -9,20 +10,66 @@ let
 in
 {
   options.os.srv.monero = {
-    enable = lib.mkEnableOption "enables the daemon and wallet";
+    wallet.enable = lib.mkEnableOption "enables the monero wallet";
     service.enable = lib.mkEnableOption "enables hosting a monero node";
   };
 
   config = lib.mkMerge [
-    (lib.mkIf cfg.enable {
+    (lib.mkIf cfg.wallet.enable {
       environment.systemPackages = [ pkgs.monero-cli ];
     })
     (lib.mkIf cfg.service.enable {
+      assertions = [
+        {
+          assertion = config.os.srv.nginx.enable;
+          message = "Hosting a Monero node requires nginx for proxying";
+        }
+        {
+          assertion = config.os.srv.sops.enable;
+          message = "Required for password secure password storing";
+        }
+      ];
+
+      sops.secrets."monero/rpc-password" = {
+        owner = "monero";
+        restartUnits = [ "monero.service" ];
+      };
+
       services.monero = {
         enable = true;
-        prune = true;
-        dataDir = "/home/monero";
+        environmentFile = config.sops.secrets."monero/rpc-password".path;
+        banlist = builtins.fetchurl {
+          url = "https://gui.xmr.pm/files/block.txt";
+          hash = "0ik4d66js6wvrvciza0li6bsajj8dvxsqlf09hcz7hg610szdxcw";
+        };
+        limits = {
+          upload = 1250;
+          download = 1250;
+          threads = 4;
+        };
+        rpc = {
+          restricted = true;
+          user = "admin";
+        };
+      };
+
+      services.nginx.virtualHosts."xmr.${masterDomain}" = {
+        enableACME = true;
+        forceSSL = true;
+
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:18081";
+          extraConfig = ''
+            proxy_read_timeout 600s;
+            proxy_send_timeout 600s;
+
+            client_max_body_size 50m;
+          '';
+        };
       };
+
+      # Left open for P2P syncing
+      networking.firewall.allowedTCPPorts = [ 18080 ];
     })
   ];
 }
diff --git a/os/srv/simplex.nix b/os/srv/simplex.nix
index 9ea54c3..51b9577 100644
--- a/os/srv/simplex.nix
+++ b/os/srv/simplex.nix
@@ -1,4 +1,9 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  masterDomain,
+  ...
+}:
 let
   cfg = config.os.srv.simplex;
   internalSmpPort = 5223;
@@ -22,24 +27,48 @@ in
             assertion = config.os.srv.nginx.enable;
             message = "SimpleX requires os.srv.nginx to be enabled for clearnet proxying.";
           }
+          {
+            assertion = config.os.srv.sops.enable;
+            message = "SimpleX requires sops for managing container passwords securely.";
+          }
         ];
 
+        sops.secrets."simplex/smp-env" = { };
+        sops.secrets."simplex/xftp-env" = { };
+
         virtualisation.oci-containers.containers = {
           simplex-smp = {
             image = "simplexchat/smp-server:latest";
             ports = [ "127.0.0.1:${toString internalSmpPort}:5223" ];
+
+            environment = {
+              ADDR = "smp.${masterDomain}";
+              CONFIG_DIR = "/etc/opt/simplex";
+            };
+
+            environmentFiles = [ config.sops.secrets."simplex/smp-env".path ];
+
             volumes = [
               "/var/lib/simplex/smp/config:/etc/opt/simplex:rw"
               "/var/lib/simplex/smp/logs:/var/opt/simplex:rw"
+              "/var/lib/simplex/certs:/certificates:ro"
             ];
           };
 
           simplex-xftp = {
             image = "simplexchat/xftp-server:latest";
             ports = [ "127.0.0.1:${toString internalXftpPort}:443" ];
+
+            environment = {
+              ADDR = "xftp.${masterDomain}";
+              QUOTA = "10gb";
+            };
+
+            environemntFiles = [ config.sops.secrets."simplex/xftp-env".path ];
             volumes = [
               "/var/lib/simplex/xftp/config:/etc/opt/simplex-xftp:rw"
               "/var/lib/simplex/xftp/logs:/var/opt/simplex-xftp:rw"
+              "/var/lib/simplex/xftp/files:/srv/xftp:rw"
             ];
           };
         };
@@ -60,8 +89,16 @@ in
         systemd.tmpfiles.rules = [
           "d /var/lib/simplex/smp/config 0755 root root -"
           "d /var/lib/simplex/smp/logs 0755 root root -"
+          "d /var/lib/simplex/rsa_certs 0755 root root -"
+
           "d /var/lib/simplex/xftp/config 0755 root root -"
           "d /var/lib/simplex/xftp/logs 0755 root root -"
+          "d /var/lib/simplex/xftp/files 0755 root root -"
+        ];
+
+        networking.firewall.allowedTCPPorts = [
+          5223
+          5224
         ];
       }
 
diff --git a/os/core/ssh.nix b/os/srv/ssh.nix
index 52b7c32..089fb32 100644
--- a/os/core/ssh.nix
+++ b/os/srv/ssh.nix
@@ -5,14 +5,14 @@
   ...
 }:
 let
-  cfg = config.os.core.ssh;
+  cfg = config.os.srv.ssh;
   keys = {
     main = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC610CJfgc3yII7MpLVqzEzQGa8Tsm+dih+CTXHXTnv4";
     oci = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCgWmRbNTP/kcaZ8JNV1boVTZ/FQVV4qP/9eTKL9buzDvz9HJdgyWmbCiVZicNSert31IRdWOF/wm1sFjZ48nSkGDHbrnc//MPSdHULTx+kMES/NW9SZwwpaquFIJClrObysxrFYBAqweD+DJ3bp451WIymBs7lRBMNKPgoHBpJ5WN2CfIQjl60Jqnli7ML5seCsrquPEemcMPr1TFPmrFCbirzgDVkzCLL5kOowSD2uprtSA08fFm/pZ6nZh6KTQaEgPO4zR9tK+NQ46oCynWwBTI7JOPB4/LtIOiC5TjEUrkXZ/sJzpCBiNPYSRI8RWnAD0N/uVFJ4EYPUKLO2C/d";
   };
 in
 {
-  options.os.core.ssh.enable = lib.mkEnableOption "enables ssh server setup";
+  options.os.srv.ssh.enable = lib.mkEnableOption "enables ssh server setup";
 
   config = lib.mkIf cfg.enable {
     services.openssh = {
diff --git a/os/core/tailscale.nix b/os/srv/tailscale.nix
index 795fdbb..5c8d72e 100644
--- a/os/core/tailscale.nix
+++ b/os/srv/tailscale.nix
@@ -1,9 +1,9 @@
 { config, lib, ... }:
 let
-  cfg = config.os.core.tailscale;
+  cfg = config.os.srv.tailscale;
 in
 {
-  options.os.core.tailscale.enable = lib.mkEnableOption "enables tailscale vpn";
+  options.os.srv.tailscale.enable = lib.mkEnableOption "enables tailscale vpn";
 
   config = lib.mkIf cfg.enable {
     services.tailscale = {
diff --git a/os/srv/virtualization.nix b/os/srv/virtualization.nix
index 143e9da..8ff9f3f 100644
--- a/os/srv/virtualization.nix
+++ b/os/srv/virtualization.nix
@@ -2,7 +2,6 @@
   config,
   lib,
   pkgs,
-  username,
   ...
 }:
 let
@@ -11,7 +10,6 @@ in
 {
   options.os.srv.virtualization = {
     kvm.enable = lib.mkEnableOption "KVM/QEMU virtualization with Virt-Manager";
-    docker.enable = lib.mkEnableOption "Docker Container Virtualization";
     waydroid.enable = lib.mkEnableOption "Waydroid Container Virtualization";
   };
   config = lib.mkMerge [
@@ -28,11 +26,6 @@ in
         (lib.optional (config.os.core.drivers.cpu == "amd") "kvm-amd")
         ++ (lib.optional (config.os.core.drivers.cpu == "intel") "kvm-intel");
     })
-    (lib.mkIf cfg.docker.enable {
-      virtualisation.docker.enable = true;
-      environment.systemPackages = [ pkgs.docker-compose ];
-      users.users.${username}.extraGroups = [ "docker" ];
-    })
     (lib.mkIf cfg.waydroid.enable {
       virtualisation.waydroid = {
         enable = true;
diff --git a/os/vms/default.nix b/os/vms/default.nix
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/os/vms/default.nix
diff --git a/secrets.yaml b/secrets.yaml
index 44fd8fa..9d77702 100644
--- a/secrets.yaml
+++ b/secrets.yaml
@@ -13,10 +13,11 @@ syncthing:
         keepass: ENC[AES256_GCM,data:OLU0tYB9TTKZ5V1Mzj5FDE9YdCpj0ajJaoxzqd7HtTmaBqETjs7CjYriq7kCOgSEVBtwzek/NA1vetwuMQhI8Q==,iv:P9aBZCIbj23aOvuMBtAjAZ2L+0lUT5Xjk7XRikbc9u0=,tag:xnWUxctkKVTUOV0AtpnTug==,type:str]
         sync: ENC[AES256_GCM,data:XaD+8knm2VLHGFE5AOc9V4GSJ4opGNcz7ujCH2rfMVTtQ270QzohMsQoKMjSM18a44AxZ/vtnZjLtTo+ZOWYcA==,iv:wchjwjuICqY6CQyQQmxS++9H5YECCVjURUlB2ebFSO8=,tag:v8CxGv7ZnV3WsTz5wEZFMQ==,type:str]
 yggdrasil-private-key: ENC[AES256_GCM,data:lyyOlWDvYa33Koc8DmhcRwgMI8KOsqmD9oc1gORb/RZiAXiKsmlXRFuiu3ba8CA1uAahJpK897ambZiFVi8qlgMrK7irfmqVyoF3r9luQJGyjrp9dvypSkRuQKLnp2Aj3FoIyXBM+mFwZpbAyGxTCTvylXhoqZo=,iv:2b4OwPNQt1WeF36oolSDIFwu3ux+f39/9+7brfgxqbg=,tag:rH8A5TYv+aG2sDKjJkZokw==,type:str]
+monero:
+    rpc-password: ENC[AES256_GCM,data:ape+Cp5BzpTxHKIjqTWM4571e6gXfx6TY16rArRGHbWHhSjteyCWiXGmsuwU+ApIVfr09NgqJ9IGmhfX3bmnCdIz5OHWgBiAQ1nr1zmDK7RsqJ9aJKt0wg2I0+kN8okBjfxP+VJfbwcUmx6yIcnoDouCgfg1JP/duziD1Qa7QqzOo399WpYG2noJ9W2lBrYv6twTfARisg==,iv:u+hrCy99SSAvw09tLcy5KN1+QcFXuMpDfbbspkdNm1Q=,tag:PbSeJ9XRNYEqPRwJmv8aDQ==,type:str]
 sops:
     age:
-        - recipient: age1y8hkdaq5yry0gnlwjtvp6npu028zpgf648wcr2sr3s6q4dyxj96sv5a56j
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVdGN2L2d0RFdUcEEvK1pp
             eFhTUWhNTHB6S0hKOUhpVTIzT29TbVdmelVFCjhZL01ZK3NEdWZhOTRVTmNiaURn
@@ -24,8 +25,8 @@ sops:
             cjhrekxrN2IwOUZ5N25DdlM2LzBRWDQKSIbht68agXUCkBdo6GnBZ0hrNVlzA+6e
             3qd959nLvvWLT8mBxyt1TguNANoHF/TaCqXmTydhwFPgnVRRJQ4CQQ==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1s39d4mdrjhkf8cy8eea02p836r7s875fj8f7w3z4ld2stmaac49qd075ww
-          enc: |
+          recipient: age1y8hkdaq5yry0gnlwjtvp6npu028zpgf648wcr2sr3s6q4dyxj96sv5a56j
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRVmpkZmlsYzBIYU9LQVdp
             L3d5OUZ2ZEQwc3FMcmprSzY2TmlrTHRzdVhRCkwxNXdwQWpyK3phbktia3RNRGJJ
@@ -33,8 +34,8 @@ sops:
             Z2dWTUdBbUJpUVQ1RzJ2THdZVDVsK3MKF1UQpm5FRmPkH/SyQDfvWpzZZEAyzCFI
             qGZBeMTEfsRyxQvFI0yKWZKIHW0N2Gb1FnncoCW9hIo3NnBvBLVJpg==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age12htxy05mlkaqx7q6m5wufkqnnvhmhe4nfsr5ljlwkdk0u59f7ujq7537fw
-          enc: |
+          recipient: age1s39d4mdrjhkf8cy8eea02p836r7s875fj8f7w3z4ld2stmaac49qd075ww
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyV25rZmpSOEREcDZ5T1gx
             Uk9GM01jSnZqWjhyc0NsWnM4LzZabmE3TWtZCmxkS3llMEFlazZKKzVnd3VuQTFD
@@ -42,8 +43,8 @@ sops:
             VXU2MFlQTmM3TlpkTmlDYnZnb2o5eHMKD9rLtf3qD6d/2Dx1lI8NJXb+UKyu77OJ
             gfLtInLTry/C7hftlLUKs4R5jwEW0f+O/7SBIRP3qKkqs1UYTlPkcQ==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1sx8ut0arwlrp7n7qvlaele8mq93pyvzc0ddetlk47cnyx935gcusdceq9q
-          enc: |
+          recipient: age12htxy05mlkaqx7q6m5wufkqnnvhmhe4nfsr5ljlwkdk0u59f7ujq7537fw
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4c2VJSEQ5R09wOFlwMXBi
             Tkw3dW0zak5rOUFJVVVHVzY3Yk53QVJIQ0hVCjgybU11RHAzajBPQVlJZDNlQisv
@@ -51,7 +52,8 @@ sops:
             SHVLdytlK0RzSWVURTM2NldLVlR0eXMKvOEQCjWrr6lKQBuiTkRHV4SsCukflnKg
             CXZbLjjZ0Q5we+RTisnyT8pqVIJtD2oyCliBdpGoM+HuX6pc9YbwKg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-09T23:02:53Z"
-    mac: ENC[AES256_GCM,data:t3A70Nc2NTwKzD7YLjWzCWjUZ4dUygzF2mV6wHBvcvrWG/TtvF86jps9KIVXBRoZXvZem2Vmc6V94xmPzZrPz3rrUybJVEC2kouNEVV0Fds1efmidkVF1K1ButiiX1MjbjZS0cYeSSpaBssNyQbc6YVe9FdgjKEfu2j/Gf92eys=,iv:Dyn2mTsgAoMLZA0GdAZcewCi4t5KR8hwTy9/umHUcIc=,tag:PaaS5hAQw8QS9HarV3vlUw==,type:str]
+          recipient: age1sx8ut0arwlrp7n7qvlaele8mq93pyvzc0ddetlk47cnyx935gcusdceq9q
+    lastmodified: "2026-05-16T20:03:01Z"
+    mac: ENC[AES256_GCM,data:voxZK2H4SBDXUG4Yh21MfCpJfo+x2MXYTfiBbxieVOpik6Aq2HAP4yp2nFJTZD0AEaZSjX17Svx5wgezttf9ykkngv1KnXWYXwIKWKXloFvGfNHinBnsf1+Wuii1VT40eC/LWyqR5bczcZDqrY1sNhpsNDMMZwxLualCAN9APD8=,iv:aqgMow/guB+wRWr2FkGmasddLv+MVVpFIPsVUN+vLVA=,tag:QRVcGj8G4LMu+ENiq0/izg==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.12.2
+    version: 3.13.0