...

6 files changed, 127 insertions, 33 deletions

diff --git a/os/srv/i2p.nix b/os/srv/i2p.nix
new file mode 100644
index 0000000..8850795
--- /dev/null
+++ b/os/srv/i2p.nix
@@ -0,0 +1,32 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.os.srv.i2p;
+in
+{
+  options.os.srv.i2p.enable = lib.mkEnableOption "enables i2pd";
+
+  config = lib.mkIf cfg.enable {
+    services.i2pd = {
+      enable = true;
+      upnp.enable = true;
+      bandwidth = 1024;
+      ssu2 = {
+        enable = true;
+        # published = true;
+      };
+      reseed.verify = true;
+      # proto = {
+      #   socksProxy = {
+      #     enable = true;
+      #     port = 4445;
+      #   };
+      #   i2pControl.enable = true;
+      # };
+      yggdrasil.enable = true;
+    };
+  };
+}
diff --git a/os/srv/ollama.nix b/os/srv/ollama.nix
index 7a9bc78..3afc684 100644
--- a/os/srv/ollama.nix
+++ b/os/srv/ollama.nix
@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   cfg = config.os.srv.ollama;
 in
@@ -14,15 +19,9 @@ in
     services.ollama = {
       enable = true;
       package = pkgs.ollama-rocm;
-      
+      rocmOverrideGfx = "12.0.1";
       user = "ollama";
       models = "/models";
-      
-      syncModels = true;
-      loadModels = [
-        "deepseek-r1:14b"
-        "qwen3:14b"
-      ];
     };
   };
 }
diff --git a/os/srv/sops.nix b/os/srv/sops.nix
index 40f9c74..fecb9df 100644
--- a/os/srv/sops.nix
+++ b/os/srv/sops.nix
@@ -23,17 +23,18 @@ in
       age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 
       secrets = {
-        "syncthing/gui_password" = {
-          owner = username;
-          sopsFile = ../../secrets/oci.yaml;
+        "syncthing/gui_password".owner = username;
+        "syncthing/encryption/game-saves".owner = username;
+        "syncthing/encryption/keepass".owner = username;
+        "vpn/warp_private_key" = {
+          owner = "root";
+          group = "networkmanager";
+          mode = "0400";
+          restartUnits = [ "NetworkManager.service" ];
         };
         "obs/websocket_password".owner = username;
         root_password.neededForUsers = true;
         user_password.neededForUsers = true;
-        oracler_password = {
-          neededForUsers = true;
-          sopsFile = ../../secrets/oci.yaml;
-        };
       };
     };
 
diff --git a/os/srv/srv.nix b/os/srv/srv.nix
index 8ee895b..4edd742 100644
--- a/os/srv/srv.nix
+++ b/os/srv/srv.nix
@@ -12,5 +12,7 @@
     ./ollama.nix
     ./kdeconnect.nix
     ./monero.nix
+    ./vpn.nix
+    ./i2p.nix
   ];
 }
diff --git a/os/srv/syncthing.nix b/os/srv/syncthing.nix
index 332bb54..b350428 100644
--- a/os/srv/syncthing.nix
+++ b/os/srv/syncthing.nix
@@ -6,39 +6,34 @@
 }:
 let
   cfg = config.os.srv.syncthing;
+  syncDirs = lib.mapAttrsToList (_: folder: folder.path) config.services.syncthing.settings.folders;
 in
 {
   options.os.srv.syncthing.enable = lib.mkEnableOption "enables syncthing syncing";
   config = lib.mkIf cfg.enable {
+    systemd.tmpfiles.rules = map (path: "d ${path} 0755 ${username} users -") syncDirs;
+
     services.syncthing = {
       enable = true;
-      user = "${username}";
+      user = username;
       dataDir = "/home/${username}/.local/share/syncthing";
       configDir = "/home/${username}/.config/syncthing";
-      guiPasswordFile = "/run/secrets/syncthing/gui_password";
+      guiPasswordFile = config.sops.secrets."syncthing/gui_password".path;
 
       settings = {
-        devices = {
-          "desktop" = {
-            id = "YGMWGOB-LTJUDM7-CY25MAF-NPE7J4J-KYRNPB5-ZHD5DBI-VNRAXI6-LIP2DQP";
-          };
-          "laptop" = {
-            id = "";
-          };
-          "thinkpad" = {
-            id = "";
-          };
-        };
+        devices."oci".id = "DQXGVDC-KGPM6RK-5NDEBJJ-R7PEWYZ-N6Z3WFZ-TSVJG5X-235SHG4-4BEJNQJ";
+
         folders = {
           "game-saves" = {
             path = "/home/${username}/.saves";
-            id = "shared-saves-v1";
+            id = "game-saves";
             devices = [
-              "desktop"
-              "laptop"
-              "thinkpad"
+              {
+                name = "oci";
+                encryptionPasswordFile = config.sops.secrets."syncthing/encryption/game-saves".path;
+                compression = "always";
+              }
             ];
-
             versioning = {
               type = "staggered";
               params = {
@@ -47,6 +42,22 @@ in
               };
             };
           };
+
+          "keepass" = {
+            path = "/home/${username}/.keepass";
+            id = "keepass";
+            devices = [
+              {
+                name = "oci";
+                encryptionPasswordFile = config.sops.secrets."syncthing/encryption/keepass".path;
+                compression = "metadata";
+              }
+            ];
+            versioning = {
+              type = "simple";
+              params.keep = "10";
+            };
+          };
         };
       };
     };
diff --git a/os/srv/vpn.nix b/os/srv/vpn.nix
new file mode 100644
index 0000000..28c7a9e
--- /dev/null
+++ b/os/srv/vpn.nix
@@ -0,0 +1,49 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.os.srv.vpn;
+  netCfg = config.os.core.network;
+in
+{
+  options.os.srv.vpn.enable = lib.mkEnableOption "enables vpn stuff";
+
+  config = lib.mkIf (cfg.enable && netCfg.enable) {
+    networking.networkmanager.ensureProfiles = {
+      environmentFiles = [ config.sops.secrets."vpn/warp_private_key".path ];
+      profiles.cloudflare-warp = {
+        connection = {
+          id = "cloudflare-warp";
+          type = "wireguard";
+          interface-name = "wg0";
+          autoconnect = false;
+        };
+        wireguard = {
+          mtu = 1200;
+          private-key = "$WG_KEY";
+        };
+        "wireguard-peer.bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo=" = {
+          endpoint = "engage.cloudflareclient.com:2408";
+          allowed-ips = "0.0.0.0/0;::/0;";
+        };
+        ipv4 = {
+          method = "manual";
+          address1 = "172.16.0.2/32";
+          dns = "1.1.1.1;1.0.0.1;";
+        };
+        ipv6 = {
+          method = "manual";
+          address1 = "2606:4700:110:84c7:36c4:e444:5efb:b108/128";
+          dns = "2606:4700:4700::1111;2606:4700:4700::1001;";
+        };
+      };
+    };
+    environment.systemPackages = with pkgs; [
+      wgcf
+      wireguard-tools
+    ];
+  };
+}